Mikrotik PDF

Download as pdf or txt
Download as pdf or txt
You are on page 1of 337

Mikrotik Full Package

MGS TRAINING

PDF generated using the open source mwlib toolkit. See http://code.pediapress.com/ for more information.
PDF generated at: Mon, 11 Jun 2012 16:17:15 UTC

Contents
Articles
Manual:First time startup

Manual:Console login process

Manual:Troubleshooting tools

10

Manual:Connection oriented communication (TCP/IP)

20

Manual:RouterOS features

26

Manual:Console

29

Manual:Winbox

37

Manual:Webfig

53

Manual:License

60

Manual:Purchasing a License for RouterOS

65

Manual:Entering a RouterOS License key

67

Manual:Default Configurations

70

Manual:System/Packages

74

Manual:Upgrading RouterOS

77

Manual:Netinstall

85

Manual:Configuration Management

92

Manual:Interface/Bonding

97

Manual:Interface/Bridge

105

Manual:Interface/VRRP

114

Manual:Bonding Examples

121

Manual:VRRP-examples

123

Manual:Wireless AP Client

127

Manual:Making a simple wireless AP

133

Manual:Interface/VLAN

136

Manual:IP/IPsec

143

Manual:Interface/Gre

156

Manual:Interface/PPPoE

158

Manual:Interface/PPTP

169

Manual:Interface/L2TP

175

Manual:IP/Address

182

Manual:IP/ARP

183

Manual:Load balancing multiple same subnet links

188

Manual:Simple Static Routing

191

Manual:Virtual Routing and Forwarding

192

Manual:IP/DHCP Server

200

Manual:IP/DHCP Client

208

Manual:IP/DHCP Relay

210

Manual:IP/Pools

213

Manual:OSPF Case Studies

214

Manual:OSPF-examples

231

Manual:OSPF and Point-to-Point interfaces

237

Manual:BGP Load Balancing with two interfaces

238

Manual:IP/Firewall/Filter

242

Manual:IP/Firewall/NAT

250

Manual:IP/Firewall/Mangle

256

Manual:IP/Firewall/Address list

263

Manual:IP/Firewall/Connection tracking

264

Manual:BGP Case Studies

266

Manual:HTB

273

Manual:Queue Size

282

Manual:Queues - Burst

285

Manual:Queues - PCQ

290

Manual:Queues - PCQ Examples

293

Manual:System/Log

295

Manual:IP/Traffic Flow

302

Manual:SNMP

305

Manual:Router AAA

310

Manual:RADIUS Client

316

Manual:Hotspot Introduction

326

References
Article Sources and Contributors

330

Image Sources, Licenses and Contributors

332

Manual:First time startup

Manual:First time startup


Applies to RouterOS: 2.9, v3, v4

Overview
After you have installed the RouterOS software, or turned on the Router for the first time, there are various ways
how to connect to it:
Accessing Command Line Interface (CLI) via Telnet, ssh, serial cable or even keyboard and monitor if router has
VGA card.
Accessing Web based GUI (WebFig)
Using WinBox configuration utility
Every router is factory pre-configured with IP address 192.168.88.1/24 on ether1 port. Default username is admin
with empty password.
Additional configuration may be set depending on RouterBoard model. For example, RB750 ether1 is configured as
WAN port and any communication with the router through that port is not possible. List of RouterBOARD models
and their default configurations can be found in this article.

Winbox
Winbox is configuration utility that can connect to the router via MAC or IP protocol. Latest winbox version can be
downloaded from our demo router [1].
Run Winbox utility, then click the [...] button and see if Winbox finds your Router and it's MAC address. Winbox
neighbor discovery will discover all routers on the broadcast network. If you see routers on the list, connect to it by
clicking
on
MAC
address
and
pressing
Connect
button.

Winbox will try download plugins from the router, if it is connecting for the first time to the router with current
version. Note that it may take about one minute to download all plugins if winbox is connected with MAC protocol.
This method works with any device that runs RouterOS. Your PC needs to have MTU 1500

Manual:First time startup


After winbox have successfully downloaded plugins and authenticated, main window will be displayed:

If winbox cannot find any routers, make sure that your Windows computer is directly connected to the router with an
Ethernet cable, or at least they both are connected to the same switch. As MAC connection works on Layer2, it is
possible to connect to the router even without IP address configuration. Due to the use of broadcasting MAC
connection is not stable enough to use continuously, therefore it is not wise to use it on a real production / live
network!. MAC connection should be used only for initial configuration.
Follow winbox manual for more information.

Manual:First time startup

WebFig
If you have router with default configuration, then IP address of the router can be used to connect to the Web
interface. WebFig has almost the same configuration functionality as Winbox.

Please see following articles to learn more about web interface configuration:
Initial Configuration with WebFig
General WebFig Manual

CLI
Command Line Interface (CLI) allows configuration of the router's settings using text commands. Since there is a lot
of available commands, they are split into groups organized in a way of hierarchical menu levels. Follow console
manual for CLI syntax and commands.
There are several ways how to access CLI:

winbox terminal
telnet
ssh
serial cable etc.

Manual:First time startup

Serial Cable
If your device has a Serial port, you can use a console cable (or Null modem cable)
Plug one end of the serial cable into the console port (also known as a serial port or DB9 RS232C asynchronous
serial port) of the RouterBOARD and the other end in your PC (which hopefully runs Windows or Linux). You can
also use a USB-Serial adapter. Run a terminal program (HyperTerminal, or Putty on Windows) with the following
parameters for All RouterBOARD models except 230:
115200bit/s, 8 data bits, 1 stop bit, no parity, flow control=none by default.
RouterBOARD 230 parameters are:
9600bit/s, 8 data bits, 1 stop bit, no parity, hardware (RTS/CTS) flow control by default.

If parameters are set correctly you should be able to see login prompt. Now you can access router by entering
username and password:
MikroTik 4.15
MikroTik Login:
MMM
MMM
MMMM
MMMM
MMM MMMM MMM
MMM MM MMM
MMM
MMM
MMM
MMM

III
III
III
III

KKK
KKK
KKK KKK
KKKKK
KKK KKK
KKK KKK

TTTTTTTTTTT
TTTTTTTTTTT
OOOOOO
TTT
OOO OOO
TTT
OOO OOO
TTT
OOOOOO
TTT

RRRRRR
RRR RRR
RRRRRR
RRR RRR

MikroTik RouterOS 4.15 (c) 1999-2010

III
III
III
III

KKK
KKK
KKK KKK
KKKKK
KKK KKK
KKK KKK

http://www.mikrotik.com/

[admin@MikroTik] >
Detailed description of CLI login is in login process section.

Monitor and Keyboard


If your device has a graphics card (ie. regular PC) simply attach a monitor to the video card connector of the
computer (note: RouterBOARD products don't have this, so use Method 1 or 2) and see what happens on the screen.
You should see a login promt like this:
MikroTik v3.16
Login:
Enter admin as the login name, and hit enter twice (because there is no password yet), you will see this screen:
MMM
MMM
MMMM
MMMM
MMM MMMM MMM
MMM MM MMM
MMM
MMM
MMM
MMM

III
III
III
III

KKK
KKK
KKK KKK
KKKKK
KKK KKK
KKK KKK

RRRRRR
RRR RRR
RRRRRR
RRR RRR

MikroTik RouterOS 3.16 (c) 2008

TTTTTTTTTTT
TTTTTTTTTTT
OOOOOO
TTT
OOO OOO
TTT
OOO OOO
TTT
OOOOOO
TTT

III
III
III
III

http:/ / www. mikrotik. com/

KKK
KKK
KKK KKK
KKKKK
KKK KKK
KKK KKK

Manual:First time startup

Terminal ansi detected, using single line input mode


[admin@router] >
Now you can start configuring the router, by issuing the setup command.
This method works with any device that has a video card and keyboard connector
[ Top | Back to Content ]

References
[1] http:/ / demo2. mt. lv/ winbox/ winbox. exe

Manual:Console login process


Applies to RouterOS: 2.9, v3, v4

Description
There are different ways to log into console:

serial port
console (screen and keyboard)
telnet
ssh
mac-telnet
winbox terminal

Input and validation of user name and password is done by login process. Login process can also show different
informative screens (license, demo version upgrade reminder, software key information, default configuration).
At the end of successful login sequence login process prints banner and hands over control to the console process.
Console process displays system note, last critical log entries, auto-detects terminal size and capabilities and then
displays command prompt]. After that you can start writing commands.
Use up arrow to recall previous commands from command history, TAB key to automatically complete words in the
command you are typing, ENTER key to execute command, and Control-C to interrupt currently running command
and return to prompt.
Easiest way to log out of console is to press Control-D at the command prompt while command line is empty (You
can cancel current command and get an empty line with Control-C, so Control-C followed by Control-D will log you
out in most cases).

Manual:Console login process

Console login options


Starting from v3.14 it is possible to specify console options during login process. These options enables or disables
various console features like color, terminal detection and many other.
Additional login parameters can be appended to login name after '+' sign.
login_name ::= user_name [ '+' parameters ]
parameters ::= parameter [ parameters ]
parameter ::= [ number ] 'a'..'z'
number ::= '0'..'9' [ number ]
If parameter is not present, then default value is used. If number is not present then implicit value of parameter is
used.
example: admin+c80w - will disable console colors and set terminal width to 80.
Param Default Implicit

Description

"w"

auto

auto

Set terminal width

"h"

auto

auto

Set terminal height

"c"

on

off

disable/enable console colors

"t"

on

off

Do auto detection of terminal capabilities

"e"

on

off

Enables "dumb" terminal mode

Different information shown by login process


Banner
Login process will display MikroTik banner after validating user name and password.
MMM
MMM
MMMM
MMMM
MMM MMMM MMM
MMM MM MMM
MMM
MMM
MMM
MMM

III
III
III
III

KKK
KKK
KKK KKK
KKKKK
KKK KKK
KKK KKK

RRRRRR
RRR RRR
RRRRRR
RRR RRR

MikroTik RouterOS 3.0rc (c) 1999-2007

TTTTTTTTTTT
TTTTTTTTTTT
OOOOOO
TTT
OOO OOO
TTT
OOO OOO
TTT
OOOOOO
TTT

III
III
III
III

KKK
KKK
KKK KKK
KKKKK
KKK KKK
KKK KKK

http://www.mikrotik.com/

Actual banner can be different from the one shown here if it is replaced by distributor. See also: branding.

Manual:Console login process

License
After logging in for the first time after installation you are asked to read software licenses.
Do you want to see the software license? [Y/n]:
Answer y to read licenses, n if you do not wish to read licenses (question will not be shown again). Pressing SPACE
will skip this step and the same question will be asked after next login.

Demo version upgrade reminder


After logging into router that has demo key, following remonder is shown:
UPGRADE NOW FOR FULL SUPPORT
---------------------------FULL SUPPORT benefits:
- receive technical support
- one year feature support
- one year online upgrades
(avoid re-installation and re-configuring your router)
To upgrade, register your license "software ID"
on our account server www.mikrotik.com
Current installation "software ID": ABCD-456
Please press "Enter" to continue!

Software key information


If router does not have software key, it is running in the time limited trial mode. After logging in following
information is shown:
ROUTER HAS NO SOFTWARE KEY
---------------------------You have 16h58m to configure the router to be remotely accessible,
and to enter the key by pasting it in a Telnet window or in Winbox.
See www.mikrotik.com/key for more details.
Current installation "software ID": ABCD-456
Please press "Enter" to continue!
After entering valid software key, following information is shown after login:
ROUTER HAS NEW SOFTWARE KEY
---------------------------Your router has a valid key, but it will become active
only after reboot. Router will automatically reboot in a day.

=== Automatic configuration ===

Usually after [[netinstall|installation]] or configuration [[reset]] RouterOS will apply [[default


settings]], such as an IP address.
First login into will show summary of these settings and offer to undo them.

Manual:Console login process


This is an example:
<pre>
The following default configuration has been installed on your router:
------------------------------------------------------------------------------IP address 192.168.88.1/24 is on ether1
ether1 is enabled

------------------------------------------------------------------------------You can type "v" to see the exact commands that are used to add and remove
this default configuration, or you can view them later with
'/system default-configuration print' command.
To remove this default configuration type "r" or hit any other key to continue.
If you are connected using the above IP and you remove it, you will be disconnected.

Applying and removing of the default configuration is done using console script (you can press 'v' to review it).

Different information shown by console process after logging in


System Note
It is possible to always display some fixed text message after logging into console.

Critical log messages


Console will display last critical error messages that this user has not seen yet. See log for more details on
configuration. During console session these messages are printed on screen.
dec/10/2007 10:40:06 system,error,critical login failure for user root from 10.0.0.1 via telnet
dec/10/2007 10:40:07 system,error,critical login failure for user root from 10.0.0.1 via telnet
dec/10/2007 10:40:09 system,error,critical login failure for user test from 10.0.0.1 via telnet

Prompt
[admin@MikroTik] /interface> - Default command prompt, shows user name, system identity, and
current command path.
[admin@MikroTik] /interface<SAFE> - Prompt indicates that console session is in Safe Mode.
[admin@MikroTik] >> - Prompt indicates that HotLock is turned on.
{(\... - While entering multiple line command continuation prompt shows open parentheses.
line 2 of 3> - While editing multiple line command prompt shows current line number and line count.
address: - Command requests additional input. Prompt shows name of requested value.
Console can show different prompts depending on enabled modes and data that is being edited. Default command
prompt looks like this:
[admin@MikroTik] /interface>
Default command prompt shows name of user, '@' sign and system name in brackets, followed by space, followed
by current command path (if it is not '/'), followed by '>' and space. When console is in safe mode, it shows word
SAFE in the command prompt.
[admin@MikroTik] /interface<SAFE>
Hotlock mode is indicated by an additional yellow '>' character at the end of the prompt.

Manual:Console login process


[admin@MikroTik] >>
It is possible to write commands that consist of multiple lines. When entered line is not a complete command and
more input is expected, console shows continuation prompt that lists all open parentheses, braces, brackets and
quotes, and also trailing backslash if previous line ended with backslash-whitespace.
[admin@MikroTik] > {
{... :put (\
{(\... 1+2)}
3
When you are editing such multiple line entry, prompt shows number of current line and total line count instead of
usual username and system name.
line 2 of 3> :put (\
Sometimes commands ask for additional input from user. For example, command '/password' asks for old and new
passwords. In such cases prompt shows name of requested value, followed by colon and space.
[admin@MikroTik] > /password
old password: ******
new password: **********
retype new password: **********

FAQ
Q: How do I turn off colors in console?
A: Add '+c' after login name.
Q: After logging in console prints rubbish on the screen, what to do?
Q: My expect script does not work with newer 3.0 releases, it receives some strange characters. What are those?
A: These sequences are used to automatically detect terminal size and capabilities. Add '+t' after login name to turn
them off.
Q: Thank you, now terminal width is not right. How do I set terminal width?
A: Add '+t80w' after login name, where 80 is your terminal width.
[ Top | Back to Content ]

Manual:Troubleshooting tools

Manual:Troubleshooting tools
Troubleshooting tools
Before, we look at the most significant commands for connectivity checking and troubleshooting, here is little
reminder on how to check host computer's network interface parameters on .
The Microsoft windows have a whole set of helpful command line tools that helps testing and configuring
LAN/WAN interfaces. We will look only at commonly used Windows networking tools and commands.
All of the tools are being ran from windows terminal. Go to Start/Run and enter "cmd" to open a Command window.
Some of commands on windows are:
ipconfig used to display the TCP/IP network configuration values. To open it, enter "ipconfig" in the command
prompt.
C:\>ipconfig
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : mshome.net
Link-local IPv6 Address . . . . . : fe80::58ad:cd3f:f3df:bf18%8
IPv4 Address. . . . . . . . . . . : 173.16.16.243
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 173.16.16.1
There are also a variety of additional functions for ipconfig. To obtain a list of additional options, enter
"ipconfig /?" or ipconfig -?.
netstat displays the active TCP connections and ports on which the computer is listening, Ethernet statistics, the IP
routing table, statistics for the IP, ICMP, TCP, and UDP protocols. It comes with a number of options for displaying
a variety of properties of the network and TCP connections netstat ?.
nslookup is a command-line administrative tool for testing and troubleshooting DNS servers. For example, if you
want to know what IP address is "www.google.com", enter "nslookup www.google.com" and you will find that there
are more addresses 74.125.77.99, 74.125.77.104, 74.125.77.147.
netsh is a tool an administrator can use to configure and monitor Windows-based computers at a command
prompt. It allows configure interfaces, routing protocols, routes, routing filters and display currently running
configuration.
Very similar commands are available also on unix-like machines. Today in most of Linux distributions network
settings can be managed via GUI, but it is always good to be familiar with the command-line tools. Here is the list of
basic networking commands and tools on Linux:
ifconfig it is similar like ipconfig commands on windows. It lets enable/disable network adapters, assigned IP
address and netmask details as well as show currently network interface configuration.
iwconfig - iwconfig tool is like ifconfig and ethtool for wireless cards. That also view and set the basic Wi-Fi
network details.
nslookup give a host name and the command will return IP address.
netstat print network connections, including port connections, routing tables, interface statistics, masquerade
connections, and more. (netstat r, netstat - a)
ip show/manipulate routing, devices, policy routing and tunnels on linux-machine.
For example, check IP address on interface using ip command:

10

Manual:Troubleshooting tools
$ip addr show
You can add static route using ip following command:
ip route add {NETWORK address} via {next hop address} dev {DEVICE}, for example:
$ip route add 192.168.55.0/24 via 192.168.1.254 dev eth1
mentioned tools are only small part of networking tools that is available on Linux. Remember if you want full details
on the tools and commands options use man command. For example, if you want to know all options on ifconfig
write command man ifconfig in terminal.

Check network connectivity


Using the ping command
Ping is one of the most commonly used and known commands. Administration utility used to test whether a
particular host is reachable across an Internet Protocol (IP) network and to measure the round-trip time for packets
sent from the local host to a destination host, including the local host's own interfaces.
Ping uses Internet Control Message Protocol (ICMP) protocol for echo response and echo request. Ping sends ICMP
echo request packets to the target host and waits for an ICMP response. Ping output displays the minimum, average
and maximum times used for a ping packet to find a specified system and return.
From PC:
Windows:
C:\>ping 10.255.255.4
Pinging 10.255.255.4 with 32 bytes of data:
Reply from 10.255.255.4: bytes=32 time=1ms TTL=61
Reply from 10.255.255.4: bytes=32 time<1ms TTL=61
Reply from 10.255.255.4: bytes=32 time<1ms TTL=61
Reply from 10.255.255.4: bytes=32 time<1ms TTL=61
Ping statistics for 10.255.255.4:
Packets: Sent = 4, Received = 4, Lost = 0 (0%
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
Unix-like:
andris@andris-desktop:/$ ping 10.255.255.6
PING 10.255.255.6 (10.255.255.6) 56(84) bytes of data.
64 bytes from 10.255.255.6: icmp_seq=1 ttl=61 time=1.23 ms
64 bytes from 10.255.255.6: icmp_seq=2 ttl=61 time=0.904 ms
64 bytes from 10.255.255.6: icmp_seq=3 ttl=61 time=0.780 ms
64 bytes from 10.255.255.6: icmp_seq=4 ttl=61 time=0.879 ms
^C
--- 10.255.255.6 ping statistics --4 packets transmitted, 4 received, 0% packet loss, time 2999ms
rtt min/avg/max/mdev = 0.780/0.948/1.232/0.174 ms
Press Ctrl-C to stop ping process.
From MikroTik:

11

Manual:Troubleshooting tools

12

[admin@MikroTik] > ping 10.255.255.4


10.255.255.4 64 byte ping: ttl=62 time=2 ms
10.255.255.4 64 byte ping: ttl=62 time=8 ms
10.255.255.4 64 byte ping: ttl=62 time=1 ms
10.255.255.4 64 byte ping: ttl=62 time=10 ms
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max = 1/5.2/10 ms
Press Ctrl-C to stop ping process.

Using the traceroute command


Traceroute displays the list of the routers that packet travels through to get to a remote host. The traceroute or
tracepath tool is available on practically all Unix-like operating systems and tracert on Microsoft Windows
operating systems.
Traceroute operation is based on TTL value and ICMP Time Exceeded massage. Remember that TTL value in IP
header is used to avoid routing loops. Each hop decrements TTL value by 1. If the TTL reaches zero, the packet is
discarded and ICMP Time Exceeded message is sent back to the sender when this occurs.
Initially by traceroute, the TTL value is set to 1 when next router finds a packet with TTL = 1 it sets TTL value to
zero, and responds with an ICMP "time exceeded" message to the source. This message lets the source know that the
packet traverses that particular router as a hop. Next time TTL value is incremented by 1 and so on. Typically, each
router in the path towards the destination decrements the TTL field by one unit TTL reaches zero.
Using this command you can see how packets travel through the network and where it may fail or slow down. Using
this information you can determine the computer, router, switch or other network device that possibly causing
network issues or failures.
From Personal computer:
Windows:
C:\>tracert 10.255.255.2
Tracing route to 10.255.255.2 over a maximum of 30 hops
1
<1 ms
<1 ms
<1 ms 10.13.13.1
2
1 ms
1 ms
1 ms 10.255.255.2
Trace complete.
Unix-like:
Traceroute and tracepath is similar, only tracepath does not not require superuser privileges.
andris@andris-desktop:~$ tracepath 10.255.255.6
1: andris-desktop.local (192.168.10.4)
1: 192.168.10.1 (192.168.10.1)
1: 192.168.10.1 (192.168.10.1)
2: 192.168.1.2 (192.168.1.2)
3: no reply
4: 10.255.255.6 (10.255.255.6)
Resume: pmtu 1500 hops 4 back 61
From MikroTik:
[admin@MikroTik] > tool traceroute 10.255.255.1
ADDRESS
STATUS

0.123ms pmtu 1500


0.542ms
0.557ms
1.213ms
2.301ms reached

Manual:Troubleshooting tools

13

1
10.0.1.17 2ms 1ms 1ms
2
10.255.255.1 5ms 1ms 1ms
[admin@MikroTik] >

Log Files
System event monitoring facility allows to debug different problems using Logs. Log file is a text file created in the
server/router/host capturing different kind of activity on the device. This file is the primary data analysis source.
RouterOS is capable of logging various system events and status information. Logs can be saved in routers memory
(RAM), disk, file, sent by email or even sent to remote syslog server.
All messages stored in routers local memory can be printed from /log menu. Each entry contains time and date
when event occurred, topics that this message belongs to and message itself.
[admin@MikroTik] /log> print
15:22:52 system,info device changed by admin
16:16:29 system,info,account user admin logged out from 10.13.13.14 via winbox
16:16:29 system,info,account user admin logged out from 10.13.13.14 via telnet
16:17:16 system,info filter rule added by admin
16:17:34 system,info mangle rule added by admin
16:17:52 system,info simple queue removed by admin
16:18:15 system,info OSPFv2 network added by admin
Read more about logging on RouterOS here>>

Torch (/tool torch)


Torch is realtime traffic monitoring tool that can be used to monitor the traffic flow through an interface.
You can monitor traffic classified by protocol name, source address, destination address, port. Torch shows the
protocols you have chosen and tx/rx data rate for each of them.
Example:
The following example monitor the traffic generated by the telnet protocol, which passes through the interface
ether1.
[admin@MikroTik] tool> torch ether1 port=telnet
SRC-PORT
DST-PORT
1439
23 (telnet)
[admin@MikroTik] tool>
To see what IP protocols are sent via ether1:
[admin@MikroTik]
PRO.. TX
tcp
1.06kbps
udp
896bps
icmp 480bps
ospf 0bps

tool> torch ether1 protocol=any-ip


RX
608bps
3.7kbps
480bps
192bps

[admin@MikroTik] tool>

TX
1.7kbps

RX
368bps

Manual:Troubleshooting tools

14

In order to see what protocols are linked to a host connected to interface 10.0.0.144/32 ether1:
[admin@MikroTik] tool> torch ether1 src-address=10.0.0.144/32 protocol=any
PRO.. SRC-ADDRESS
TX
tcp
10.0.0.144
1.01kbps
icmp 10.0.0.144
480bps
[admin@MikroTik] tool>

RX
608bps
480bps

IPv6
Starting from v5RC6 torch is capable of showing IPv6 traffic. Two new parameters are introduced src-address6 and
dst-address6. Example:
admin@RB1100test] > /tool torch interface=bypass-bridge src-address6=::/0 ip-protocol=any sr
c-address=0.0.0.0/0
MAC-PROTOCOL

IP-PROT... SRC-ADDRESS

TX

RX

ipv6

tcp

2001:111:2222:2::1

60.1kbps

1005.4kbps

ip

tcp

10.5.101.38

18.0kbps

3.5kbps

ip

vrrp

10.5.101.34

0bps

288bps

ip

udp

10.5.101.1

0bps

304bps

ip

tcp

10.0.0.176

0bps

416bps

ip

ospf

224.0.0.5

544bps

0bps

78.7kbps

1010.0kbps

To make /ping tool to work with domain name that resolves IPv6 address use the following:
/ping [:resolve ipv6.google.com]
By default ping tool will take IPv4 address.

Manual:Troubleshooting tools

Winbox
More attractive Torch interface is available from Winbox (Tool>Torch). In Winbox you can also trigger a Filter bar
by hitting the F key on the keyboard.

Packet Sniffer (/tool sniffer)


Packet sniffer is a tool that can capture and analyze packets sent and received by specific interface. packet sniffer
uses libpcap format.
Packet Sniffer Configuration
In the following example streaming-server will be added, streaming will be enabled, file-name will be set to test
and packet sniffer will be started and stopped after some time:
[admin@MikroTik] tool sniffer> set streaming-server=192.168.0.240 \
\... streaming-enabled=yes file-name=test
[admin@MikroTik] tool sniffer> print
interface: all
only-headers: no
memory-limit: 10
file-name: "test"
file-limit: 10
streaming-enabled: yes
streaming-server: 192.168.0.240
filter-stream: yes
filter-protocol: ip-only
filter-address1: 0.0.0.0/0:0-65535
filter-address2: 0.0.0.0/0:0-65535

15

Manual:Troubleshooting tools

16

running: no
[admin@MikroTik] tool sniffer> start
[admin@MikroTik] tool sniffer> stop
Here you can specify different packet sniffer parameters, like maximum amount of used memory, file size limit in
KBs.
Running Packet Sniffer Tool
There are three commands that are used to control runtime operation of the packet sniffer:
/tool sniffer start, /tool sniffer stop, /tool sniffer save.
The start command is used to start/reset sniffing, stop - stops sniffing. To save currently sniffed packets in a specific
file save command is used.
In the following example the packet sniffer will be started and after some time - stopped:

[admin@MikroTik] tool sniffer> start


[admin@MikroTik] tool sniffer> stop
Below the sniffed packets will be saved in the file named test:
[admin@MikroTik] tool sniffer> save file-name=test
View sniffed packets
There are also available different submenus for viewing sniffed packets.
/tool sniffer packet show the list of sniffed packets
/tool sniffer protocol show all kind of protocols that have been sniffed
/tool sniffer host shows the list of hosts that were participating in data exchange you've sniffed
For example:
[admin@MikroTik] tool sniffer packet> print
#
0
1
2
3
4
5
6
7
8
9
--

TIME
1.697
1.82
2.007
2.616
2.616
5.99
6.057
7.067
8.087
9.977
more

INTERFACE
ether1
ether1
ether1
ether1
ether1
ether1
ether1
ether1
ether1
ether1

SRC-ADDRESS
0.0.0.0:68 (bootpc)
10.0.1.17
10.0.1.18
0.0.0.0:68 (bootpc)
10.0.1.18:45630
10.0.1.18
159.148.42.138
10.0.1.5:1701 (l2tp)
10.0.1.18:1701 (l2tp)
10.0.1.18:1701 (l2tp)

Figure below shows sniffer GUI in Winbox, which is more user-friendly.

Manual:Troubleshooting tools

Detailed commands description can be found in the manual >>

Bandwidth test
The Bandwidth Tester can be used to measure the throughput (Mbps) to another MikroTik router (either wired or
wireless network) and thereby help to discover network "bottlenecks"- network point with lowest throughput.
BW test uses two protocols to test bandwidth:
TCP uses the standard TCP protocol operation principles with all main components like connection
initialization, packets acknowledgments, congestion window mechanism and all other features of TCP algorithm.
Please review the TCP protocol for details on its internal speed settings and how to analyze its behavior. Statistics
for throughput are calculated using the entire size of the TCP data stream. As acknowledgments are an internal
working of TCP, their size and usage of the link are not included in the throughput statistics. Therefore statistics
are not as reliable as the UDP statistics when estimating throughput.
UDP traffic sends 110% or more packets than currently reported as received on the other side of the link. To see
the maximum throughput of a link, the packet size should be set for the maximum MTU allowed by the links
which is usually 1500 bytes. There is no acknowledgment required by UDP; this implementation means that the
closest approximation of the throughput can be seen.
Remember that Bandwidth Test uses all available bandwidth (by default) and may impact network usability.
If you want to test real throughput of a router, you should run bandwidth test through the router not from or to it. To
do this you need at least 3 routers connected in chain:
Bandwidth Server router under test Bandwidth Client.

17

Manual:Troubleshooting tools

Note: If you use UDP protocol then Bandwidth Test counts IP header+UDP header+UDP data. In case if you
use TCP then Bandwidth Test counts only TCP data (TCP header and IP header are not included).

Configuration example:
Server
To enable bandwidth-test server with client authentication:
[admin@MikroTik] /tool bandwidth-server> set enabled=yes authenticate=yes
[admin@MikroTik] /tool bandwidth-server> print
enabled: yes
authenticate: yes
allocate-udp-ports-from: 2000
max-sessions: 100
[admin@MikroTik] /tool bandwidth-server>
Client
Run UDP bandwidth test in both directions, user name and password depends on remote Bandwidth Server. In this
case user name is admin without any password.
[admin@MikroTik] > tool bandwidth-test protocol=udp user=admin password="" direction=both \
address=10.0.1.5
status: running
duration: 22s
tx-current: 97.0Mbps
tx-10-second-average: 97.1Mbps
tx-total-average: 75.2Mbps
rx-current: 91.7Mbps
rx-10-second-average: 91.8Mbps
rx-total-average: 72.4Mbps
lost-packets: 294
random-data: no
direction: both
tx-size: 1500
rx-size: 1500

-- [Q quit|D dump|C-z pause]

More information and all commands description can be found in the manual>>

18

Manual:Troubleshooting tools

Profiler
Profiler is a tool that shows CPU usage for each process running on RouterOS. It helps to identify which process is
using most of the CPU resources.

Read more >>


[ Top | Back to Content ]

19

Manual:Connection oriented communication (TCP/IP)

Manual:Connection oriented communication


(TCP/IP)
Connection oriented communication (TCP/IP)
The connection-oriented communication is a data communication mode in which you must first establish a
connection with remote host or server before any data can be sent. It is similar with analog telephone network where
you had to establish connection before you are able to communicate with a recipient. Connection establishment
included operations such as dial number, receive dial tone, wait for calling signal etc.

TCP session establishment and termination


Process when transmitting device establishes a connection-oriented session with remote peer is called a three-way
handshake. As the result end-to-end virtual (logical) circuit is created where flow control and acknowledgment for
reliable delivery is used. TCP has several message types used in connection establishment and termination process
(see Figure 2.1.).

20

Manual:Connection oriented communication (TCP/IP)

Connection establishment process


1. The host A who needs to initialize a connection sends out a SYN (Synchronize) packet with proposed initial
sequence number to the destination host B.
2. When the host B receives SYN message, it returns a packet with both SYN and ACK fags set in the TCP header
(SYN-ACK).
3. When the host A receives the SYN-ACK, it sends back ACK (Acknowledgment) macket.
4. Host B receives ACK and at this stage the connection is ESTABLISHED.
Connection-oriented protocol services are often sending acknowledgments (ACKs) after successful delivery. After
packet with data is transmitted, sender waits acknowledgement from receiver. If time expires and sender did not
receive ACK, packet is retransmitted.

Connection termination
When the data transmission is complete and the host wants to terminate the connection, termination process is
initiated. Unlike TCP Connection establishment, which uses three-way handshake, connection termination uses
four-way massages. Connection is terminated when both sides have finished the shut down procedure by sending a
FIN and receiving an ACK.
1. The host A, who needs to terminate the connection, sends a special message with the FIN (finish) flag, indicating
that it has finished sending the data.
2. The host B, who receives the FIN segment, does not terminate the connection but enters into a "passive close"
(CLOSE_WAIT) state and sends the ACK for the FIN back to the host A. Now the host B enters into
LAST_ACK state. At this point host B will no longer accept data from host A, but can continue transmit data to
host A. If host B does not have any data to transmit to the host A it will also terminate the connection by sending
FIN segment.
3. When the host A receives the last ACK from the host B, it enters into a (TIME_WAIT) state, and sends an ACK
back to the host B.
4. Host B gets the ACK from the host A and closes the connection.

Segments transmission (windowing)


Now that we know how the TCP connection is established we need to understand how data transmission is managed
and maintained. In TCP/IP networks transmission between hosts is handled by TCP protocol.
Lets think about what happens when datagrams are sent out faster than receiving device can process. Receiver stores
them in memory called a buffer. But since buffer space are not unlimited, when its capacity is exceeded receiver
starts to drop the frames. All dropped frames must be retransmitted again which is the reason for low transmission
performance.
To address this problem, TCP uses flow control protocol. window mechanism is used to control the flow of the data.
When connection is established, receiver specifies window field (see, TCP header format, Figure 1.6.) in each TCP
frame. Window size represents the amount of received data that receiver is willing to store in the buffer. window size
(in bytes) is send together with acknowledgements to the sender. So the size of window controls how much
information can be transmitted from one host to another without receiving an acknowledgment. Sender will send
only amount of bites specified in window size and then will wait for acknowledgments with updated window size.
If the receiving application can process data as quickly as it arrives from the sender, then the receiver will send a
positive window advertisement (increase the windows size) with each acknowledgement. It works until sender
becomes faster than receiver and incoming data will eventually fill the receiver's buffer, causing the receiver to
advertise acknowledgment with a zero window. A sender that receives a zero window advertisement must stop
transmit until it receives a positive window. Windowing process is illustrated in Figure 2.2.

21

Manual:Connection oriented communication (TCP/IP)

The host A starts transmit with window size of 1000, one 1000byte frame is transmitted. Receiver (host B) returns
ACK with window size to increase to 2000. The host A receives ACK and transmits two frames (1000 bytes each).
After that receiver advertises an initial window size to 2500. Now sender transmits three frames (two containing
1,000 bytes and one containing 500 bytes) and waits for an acknowledgement. The first three segments fill the
receiver's buffer faster than the receiving application can process the data, so the advertised window size reaches
zero indicating that it is necessary to wait before further transmission is possible.
The size of the window and how fast to increase or decrease the window size is available in various TCP congestion
avoidance algorithms such as Reno, Vegas, Tahoe etc.

Ethernet networking
CSMA/CD
The Ethernet system consists of three basic elements:
the physical medium used to carry Ethernet signals between network devices,
medium access control system embedded in each Ethernet interface that allow multiple computers to fairly
control access to the shared Ethernet channel,
Ethernet frame that consists of a standardized set of bits used to carry data over the system.
Ethernet network uses Carrier Sense Multiple Access with Collision detection (CSMA/CD) protocol for data
transmission. That helps to control and manage access to shared bandwidth when two or more devices want to
transmit data at the same time. CSMA/CD is a modification of Carrier Sense Multiple Access. Carrier Sense
Multiple Access with Collision Detection is used to improve CSMA performance by terminating transmission as
soon as collision is detected, reducing the probability of a second collision on retry.
Before we discuss a little more about CSMA/CD we need to understand what is collision, collision domain and
network segment. A collision is the result of two devices on the same Ethernet network attempting to transmit data at
the same time. The network detects the "collision" of the two transmitted packets and discards both of them.

22

Manual:Connection oriented communication (TCP/IP)


If we have one large network solution is to break it up into smaller networks often called network segmentation. It
is done by using devices like routers and switches - each of switch ports create separate network segment which
result in separate collision domain. A collision domain is a physical network segment where data packets can
"collide" with each other when being sent on a shared medium. Therefore on a hub, only one computer can receive
data simultaneously otherwise collision can occur and data will be lost.

Hub (called also repeater) is specified in Physical layer of OSI model because it regenerates only electrical signal
and sends out input signal to each of ports. Today hubs do not dominate on the LAN networks and are replaced with
switches.
Carrier Sense means that a transmitter listens for a carrier (encoded information signal) from another station
before attempting to transmit.
Multiple Access means that multiple stations send and receive on the one medium.
Collision Detection - involves algorithms for checking for collision and advertises about collision with collision
response Jam signal.
When the sender is ready to send data, it checks continuously if the medium is busy. If the medium becomes idle the
sender transmits a frame.
Look at the Figure 2.4 bellow where simple example of CSMA/CD is explained.

23

Manual:Connection oriented communication (TCP/IP)

1. Any host on the segment that wants to send data listens what is happening on the physical medium(wire) an is
checking whether someone else is not sending data already.
2. Host A and host C on shared network segment sees that nobody else is sending and tries to send frames.
3. Host A and Host C are listening at the same time so both of them will transmit at the same time and collision will
occur. Collision results in what we refer to as "noise" - a change in the voltage of the signals in the line (wire).
4. Host A and Host B detect this collision and send out jam signal to tell other hosts not to send data at this time.
Both Host A and Host C need to retransmit this data, but we don't want them to send frames simultaneously once
again. To avoid this, host A and host B will start a random timer (ms) before attempting to start CSMA/CD
process again by listening to the wire.
Each computer on Ethernet network operates independently of all other stations on the network.

Half and Full duplex Ethernet


Ethernet standards such as Ethernet II and Ethernet 802.3 are passed through formal IEEE (Institute of Electrical and
Electronics Engineers) standardization process. The difference is that Ethernet II header includes Protocol type field
whereas in Ethernet 802.3 this field was changed to length field. Ethernet is the standard CSMA/CD access method.
Ethernet supports different data transfer rates Ethernet (10BaseT) 10 Mbps, Fast Ethernet (100Base-TX) 100
Mbps Gigabit Ethernet (1000Base-T) 1000 Mbps through different types of physical mediums (twisted pairs
(Copper), coaxial cable, optical fiber). Today Ethernet cables consist of four twisted pairs (8 wires). For example,
10Base-T uses only one of these wire pairs for running in both directions using half-duplex mode.
Half-duplex data transmission means that data can be transmitted in both directions between two nodes, but only one
direction at the same time. Also in the Gigabit Ethernet is defined (Half-duplex) specifications, but it isnt used in
practice.
Full-duplex data transmission means that data can be transmitted in both directions using different twisted pairs for
each of direction at the same time. Full Duplex Ethernet, collisions are not possible since data is transmitted and
received on different wires, and each segment is connected directly to a switch. Full-duplex Ethernet offers

24

Manual:Connection oriented communication (TCP/IP)


performance in both directions for example, if your computer supports Gigabit Ethernet (full duplex mode) and your
gateway (router) also support it then between your computer and gateway 2Gbps aggregated bandwidth is available.

Simple network communication example


ARP protocol operation
Address Resolution Protocol (ARP) is a protocol for mapping an Internet Protocol (IP) address of host in the local
network to the hardware address (MAC address). The physical/hardware address is also known as a Media Access
Control or MAC address. Each network device maintains ARP tables (cache) that contain list of MAC address and
its corresponding IP address. MAC addresses uniquely identify every network interface in the network. IP addresses
are used for path selection to destination (in the routing process), but frame forwarding process from one interface to
another occur using MAC addresses.
When host on local area network wants to send IP packet to another host in this network, it must looks for Ethernet
MAC address of destination host in its ARP cache. If the destination hosts MAC address is not in ARP table, then
ARP request is sent to find device with corresponding IP address. ARP sends broadcast request message to all
devices on the LAN by asking the devices with the specified IP address to reply with its MAC address. A device that
recognizes the IP address as its own returns ARP response with its own MAC address. Figure 2.5 shows how an
ARP looks for MAC address on the local network.

Commands that displays current ARP entries on a PC (linux, DOS) and a MikroTik router (commands might do the
same thing, but they syntax may be different):
For windows and Unix like machines: arp a displays the list of IP addresses with its corresponding MAC
addresses
ip arp print same command as arp a but display the ARP table on a MikroTik Router.
[ Top | Back to Content ]

25

Manual:RouterOS features

Manual:RouterOS features
RouterOS features
RouterOS is MikroTik's stand-alone operating system based on linux v2.6 kernel. The following list shows features
found in the latest RouterOS release:

Hardware Support

i386 compatible architecture


SMP multi-core and multi-CPU compatible
Minimum 32MB of RAM (maximum supported 2GB)
IDE, SATA, USB and flash storage medium with minimum of 64MB space
Network cards supported by linux v2.6 kernel (PCI, PCI-X)
Partial hardware compatibility list (user maintained)
Switch chip configuration support

Installation
M:Netinstall: Full network based installation from PXE or EtherBoot enabled network card
Netinstall: Installation to a secondary drive mounted in Windows
CD based installation

Configuration

MAC based access for initial configuration


WinBox standalone Windows GUI configuration tool
Webfig - advanced web based configuration interface
Basic web interface configuration tool
Powerful command-line configuration interface with integrated scripting capabilities, accessible via local
terminal, serial console, telnet and ssh
API - the way to create your own configuration and monitoring applications.

Backup/Restore
Binary configuration backup saving and loading
Configuration export and import in human readable text format

Firewall

Statefull filtering
Source and destination NAT
NAT helpers (h323, pptp, quake3, sip, ftp, irc, tftp)
Internal connection, routing and packet marks
Filtering by IP address and address range, port and port range, IP protocol, DSCP and many more
Address lists
Custom Layer7 matcher
IPv6 support

PCC - per connection classifier, used in load balancing configurations

26

Manual:RouterOS features

Routing

Static routing
Virtual Routing and Forwarding (VRF)
Policy based routing
Interface routing
ECMP routing
IPv4 dynamic routing protocols: RIP v1/v2, OSPFv2, BGP v4
IPv6 dynamic routing protocols: RIPng, OSPFv3, BGP
Bidirectional Forwarding Detection ( BFD)

MPLS

Static Label bindings for IPv4


Label Distribution protocol for IPv4
RSVP Traffic Engineering tunnels
VPLS MP-BGP based autodiscovery and signaling
MP-BGP based MPLS IP VPN
complete list of MPLS features

VPN
Ipsec tunnel and transport mode, certificate or PSK, AH and ESP security protocols. Hardware encryption
support on RouterBOARD 1000 [1].
Point to point tunneling (OpenVPN, PPTP, PPPoE, L2TP, SSTP)
Advanced PPP features (MLPPP, BCP)
Simple tunnels ( IPIP, EoIP) IPv4 andIPv6 support
6to4 tunnel support (IPv6 over IPv4 network)
VLAN IEEE802.1q Virtual LAN support, Q-in-Q support
MPLS based VPNs

Wireless

IEEE802.11a/b/g wireless client and access point


Full IEEE802.11n support
Nstreme and Nstreme2 proprietary protocols
NV2 protocol
Wireless Distribution System (WDS)
Virtual AP
WEP, WPA, WPA2
Access control list
Wireless client roaming
WMM
HWMP+ Wireless MESH protocol
MME wireless routing protocol

27

Manual:RouterOS features

DHCP

Per interface DHCP server


DHCP client and relay
Static and dynamic DHCP leases
RADIUS support
Custom DHCP options
DHCPv6 Prefix Delegation (DHCPv6-PD)
DHCPv6 Client

Hotspot

Plug-n-Play access to the Network


Authentication of local Network Clients
Users Accounting
RADIUS support for Authentication and Accounting

QoS
Hierarchical Token Bucket ( HTB) QoS system with CIR, MIR, burst and priority support
Simple and fast solution for basic QoS implementation - Simple queues
Dynamic client rate equalization ( PCQ)

Proxy

HTTP caching proxy server


Transparent HTTP proxy
SOCKS protocol support
DNS static entries
Support for caching on a separate drive
Parent proxy support
Access control list
Caching list

Tools

Ping, traceroute
Bandwidth test, ping flood
Packet sniffer, torch
Telnet, ssh
E-mail and SMS send tools
Automated script execution tools
CALEA
File Fetch tool
Advanced traffic generator

28

Manual:RouterOS features

Other features

Bridging spanning tree protocol (STP, RSTP), bridge firewall and MAC natting.
Dynamic DNS update tool
NTP client/server and synchronization with GPS system
VRRP v2 and v3 support
SNMP
M3P - MikroTik Packet packer protocol for wireless links and ethernet
MNDP - MikroTik neighbor discovery protocol, supports CDP (Cisco discovery protocol)
RADIUS authentication and accounting
TFTP server
Synchronous interface support (Farsync cards only) (Removed in v5.x)
Asynchronous serial PPP dial-in/dial-out, dial on demand
ISDN dial-in/dial-out, 128K bundle support, Cisco HDLC, x75i, x75ui, x75bui line protocols, dial on demand

[ Top | Back to Content ]

References
[1] http:/ / routerboard. com

Manual:Console
Applies to RouterOS: 2.9, v3, v4

Overview
The console is used for accessing the MikroTik Router's configuration and management features using text
terminals, either remotely using serial port, telnet, SSH or console screen within Winbox, or directly using monitor
and keyboard. The console is also used for writing scripts. This manual describes the general console operation
principles. Please consult the Scripting Manual on some advanced console commands and on how to write scripts.

Hierarchy
The console allows configuration of the router's settings using text commands. Since there is a lot of available
commands, they are split into groups organized in a way of hierarchical menu levels. The name of a menu level
reflects the configuration information accessible in the relevant section, eg. /ip hotspot.
Example
For example, you can issue the /ip route print command:
[admin@MikroTik] > ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#
DST-ADDRESS
PREF-SRC
G GATEWAY
DIS INTE...

29

Manual:Console
0 A S 0.0.0.0/0
1 ADC 1.0.1.0/24
2 ADC 1.0.2.0/24
3 ADC 10.0.3.0/24
4 ADC 10.10.10.0/24
[admin@MikroTik] >

30
r 10.0.3.1
1.0.1.1
1.0.2.1
10.0.3.144
10.10.10.1

1
0
0
0
0

bridge1
bridge1
ether3
bridge1
wlan1

Instead of typing ip route path before each command, the path can be typed only once to move into this particular
branch of menu hierarchy. Thus, the example above could also be executed like this:
[admin@MikroTik] > ip route
[admin@MikroTik] ip route> print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#
DST-ADDRESS
PREF-SRC
G GATEWAY
DIS INTE...
0 A S 0.0.0.0/0
r 10.0.3.1
1
bridge1
1 ADC 1.0.1.0/24
1.0.1.1
0
bridge1
2 ADC 1.0.2.0/24
1.0.2.1
0
ether3
3 ADC 10.0.3.0/24
10.0.3.144
0
bridge1
4 ADC 10.10.10.0/24
10.10.10.1
0
wlan1
[admin@MikroTik] ip route>
Notice that the prompt changes in order to reflect where you are located in the menu hierarchy at the moment. To
move to the top level again, type " / "
[admin@MikroTik] > ip route
[admin@MikroTik] ip route> /
[admin@MikroTik] >
To move up one command level, type " .. "
[admin@MikroTik] ip route> ..
[admin@MikroTik] ip>
You can also use / and .. to execute commands from other menu levels without changing the current level:
[admin@MikroTik] ip route> /ping 10.0.0.1
10.0.0.1 ping timeout
2 packets transmitted, 0 packets received, 100% packet loss
[admin@MikroTik] ip firewall nat> .. service-port print
Flags: X - disabled, I - invalid
#
NAME
0
ftp
1
tftp
2
irc
3
h323
4
sip
5
pptp
[admin@MikroTik] ip firewall nat>

PORTS
21
69
6667

Manual:Console

Item Names and Numbers


Many of the command levels operate with arrays of items: interfaces, routes, users etc. Such arrays are displayed in
similarly looking lists. All items in the list have an item number followed by flags and parameter values.
To change properties of an item, you have to use set command and specify name or number of the item.
Item Names
Some lists have items with specific names assigned to each of them. Examples are interface or user levels. There
you can use item names instead of item numbers.
You do not have to use the print command before accessing items by their names, which, as opposed to numbers,
are not assigned by the console internally, but are properties of the items. Thus, they would not change on their own.
However, there are all kinds of obscure situations possible when several users are changing router's configuration at
the same time. Generally, item names are more "stable" than the numbers, and also more informative, so you should
prefer them to numbers when writing console scripts.
Item Numbers
Item numbers are assigned by the print command and are not constant - it is possible that two successive print
commands will order items differently. But the results of last print commands are memorized and, thus, once
assigned, item numbers can be used even after add, remove and move operations (since version 3, move operation
does not renumber items). Item numbers are assigned on a per session basis, they will remain the same until you quit
the console or until the next print command is executed. Also, numbers are assigned separately for every item list, so
ip address print will not change numbering of the interface list.
Since version 3 it is possible to use item numbers without running print command. Numbers will be assigned just as
if the print command was executed.
You can specify multiple items as targets to some commands. Almost everywhere, where you can write the number
of item, you can also write a list of numbers.
[admin@MikroTik] > interface print
Flags: X - disabled, D - dynamic, R - running
#
NAME
TYPE
MTU
0 R ether1
ether
1500
1 R ether2
ether
1500
2 R ether3
ether
1500
3 R ether4
ether
1500
[admin@MikroTik] > interface set 0,1,2 mtu=1460
[admin@MikroTik] > interface print
Flags: X - disabled, D - dynamic, R - running
#
NAME
TYPE
MTU
0 R ether1
ether
1460
1 R ether2
ether
1460
2 R ether3
ether
1460
3 R ether4
ether
1500
[admin@MikroTik] >

31

Manual:Console

32

Quick Typing
There are two features in the console that help entering commands much quicker and easier - the [Tab] key
completions, and abbreviations of command names. Completions work similarly to the bash shell in UNIX. If you
press the [Tab] key after a part of a word, console tries to find the command within the current context that begins
with this word. If there is only one match, it is automatically appended, followed by a space:
/inte[Tab]_ becomes /interface _
If there is more than one match, but they all have a common beginning, which is longer than that what you have
typed, then the word is completed to this common part, and no space is appended:
/interface set e[Tab]_ becomes /interface set ether_
If you've typed just the common part, pressing the tab key once has no effect. However, pressing it for the second
time shows all possible completions in compact form:
[admin@MikroTik]
[admin@MikroTik]
[admin@MikroTik]
ether1 ether5
[admin@MikroTik]

> interface set e[Tab]_


> interface set ether[Tab]_
> interface set ether[Tab]_
> interface set ether_

The [Tab] key can be used almost in any context where the console might have a clue about possible values command names, argument names, arguments that have only several possible values (like names of items in some
lists or name of protocol in firewall and NAT rules). You cannot complete numbers, IP addresses and similar values.
Another way to press fewer keys while typing is to abbreviate command and argument names. You can type only
beginning of command name, and, if it is not ambiguous, console will accept it as a full name. So typing:
[admin@MikroTik] > pi 10.1 c 3 si 100
equals to:
[admin@MikroTik] > ping 10.0.0.1 count 3 size 100
It is possible to complete not only beginning, but also any distinctive substring of a name: if there is no exact match,
console starts looking for words that have string being completed as first letters of a multiple word name, or that
simply contain letters of this string in the same order. If single such word is found, it is completed at cursor position.
For example:
[admin@MikroTik] > interface x[TAB]_
[admin@MikroTik] > interface export _
[admin@MikroTik] > interface mt[TAB]_
[admin@MikroTik] > interface monitor-traffic _

General Commands
There are some commands that are common to nearly all menu levels, namely: print, set, remove, add, find, get,
export, enable, disable, comment, move. These commands have similar behavior throughout different menu levels.
add - this command usually has all the same arguments as set, except the item number argument. It adds a new
item with the values you have specified, usually at the end of the item list, in places where the order of items is
relevant. There are some required properties that you have to supply, such as the interface for a new address,
while other properties are set to defaults unless you explicitly specify them.

Manual:Console
Common Parameters
copy-from - Copies an existing item. It takes default values of new item's properties from another item. If
you do not want to make exact copy, you can specify new values for some properties. When copying items
that have names, you will usually have to give a new name to a copy
place-before - places a new item before an existing item with specified position. Thus, you do not need to
use the move command after adding an item to the list
disabled - controls disabled/enabled state of the newly added item(-s)
comment - holds the description of a newly created item
Return Values
add command returns internal number of item it has added
edit - this command is associated with the set command. It can be used to edit values of properties that contain
large amount of text, such as scripts, but it works with all editable properties. Depending on the capabilities of the
terminal, either a fullscreen editor, or a single line editor is launched to edit the value of the specified property.
find - The find command has the same arguments as set, plus the flag arguments like disabled or active that take
values yes or no depending on the value of respective flag. To see all flags and their names, look at the top of
print command's output. The find command returns internal numbers of all items that have the same values of
arguments as specified.
move - changes the order of items in list.
Parameters
first argument specifies the item(-s) being moved.
second argument specifies the item before which to place all items being moved (they are placed at the end
of the list if the second argument is omitted).
print - shows all information that's accessible from particular command level. Thus, /system clock print shows
system date and time, /ip route print shows all routes etc. If there's a list of items in current level and they are not
read-only, i.e. you can change/remove them (example of read-only item list is /system history, which shows
history of executed actions), then print command also assigns numbers that are used by all commands that operate
with items in this list.
Common Parameters
from - show only specified items, in the same order in which they are given.
where - show only items that match specified criteria. The syntax of where property is similar to the find
command.
brief - forces the print command to use tabular output form
detail - forces the print command to use property=value output form
count-only - shows the number of items
file - prints the contents of the specific submenu into a file on the router.
interval - updates the output from the print command for every interval seconds.
oid - prints the OID value for properties that are accessible from SNMP
without-paging - prints the output without stopping after each screenful.
remove - removes specified item(-s) from a list.
set - allows you to change values of general parameters or item parameters. The set command has arguments with
names corresponding to values you can change. Use ? or double [Tab] to see list of all arguments. If there is a list
of items in this command level, then set has one action argument that accepts the number of item (or list of
numbers) you wish to set up. This command does not return anything.

33

Manual:Console

Modes
Console line editor works either in multiline mode or in single line mode. In multiline mode line editor displays
complete input line, even if it is longer than single terminal line. It also uses full screen editor for editing large text
values, such as scripts. In single line mode only one terminal line is used for line editing, and long lines are shown
truncated around the cursor. Full screen editor is not used in this mode.
Choice of modes depends on detected terminal capabilities.

List of keys
Control-C
keyboard interrupt.
Control-D
log out (if input line is empty)
Control-K
clear from cursor to the end of line
Control-X
toggle safe mode
Control-V
toggle hotlock mode mode
F6
toggle cellar
F1 or ?
show context sensitive help. If the previous character is \, then inserts literal ?.
Tab
perform line completion. When pressed second time, show possible completions.
Delete
remove character at cursor
Control-H or Backspace
remove character before cursor and move cursor back one position.
Control-\
split line at cursor. Insert newline at cursor position. Display second of the two resulting lines.
Control-B or Left
move cursor backwards one character
Control-F or Right
move cursor forward one character
Control-P or Up
go to previous line. If this is the first line of input then recall previous input from history.
Control-N or Down
go to next line. If this is the last line of input then recall next input from history.
Control-A or Home

34

Manual:Console
move cursor to the beginning of the line. If cursor is already at the beginning of the line, then go to the
beginning of the first line of current input.
Control-E or End
move cursor to the end of line. If cursor is already at the end of line, then move it to the end of the last line of
current input.
Control-L or F5
reset terminal and repaint screen.
up, down and split keys leave cursor at the end of line.

Built-in Help
The console has a built-in help, which can be accessed by typing ?. General rule is that help shows what you can
type in position where the ? was pressed (similarly to pressing [Tab] key twice, but in verbose form and with
explanations).

Safe Mode
It is sometimes possible to change router configuration in a way that will make the router inaccessible (except from
local console). Usually this is done by accident, but there is no way to undo last change when connection to router is
already cut. Safe mode can be used to minimize such risk.
Safe mode is entered by pressing [CTRL]+[X]. To save changes and quit safe mode, press [CTRL]+[X] again. To
exit without saving the made changes, hit [CTRL]+[D]
[admin@MikroTik] ip route>[CTRL]+[X]
[Safe Mode taken]
[admin@MikroTik] ip route<SAFE>

35

Manual:Console

36

Message Safe Mode taken is displayed and prompt changes to reflect that session is now in safe mode. All
configuration changes that are made (also from other login sessions), while router is in safe mode, are automatically
undone if safe mode session terminates abnormally. You can see all such changes that will be automatically undone
tagged with an F flag in system history:
[admin@MikroTik] ip route>
[Safe Mode taken]
[admin@MikroTik] ip route<SAFE> add
[admin@MikroTik] ip route<SAFE> /system history print
Flags: U - undoable, R - redoable, F - floating-undo
ACTION
BY
F route added
admin

POLICY
write

Now, if telnet connection (or winbox terminal) is cut, then after a while (TCP timeout is 9 minutes) all changes that
were made while in safe mode will be undone. Exiting session by [Ctrl]+[D] also undoes all safe mode changes,
while /quit does not.
If another user tries to enter safe mode, he's given following message:
[admin@MikroTik] >
Hijacking Safe Mode from someone - unroll/release/don't take it [u/r/d]:
[u] - undoes all safe mode changes, and puts the current session in safe mode.
[r] - keeps all current safe mode changes, and puts current session in a safe mode. Previous owner of safe mode is
notified about this:
[admin@MikroTik] ip firewall rule input
[Safe mode released by another user]

Manual:Console
[d] - leaves everything as-is.
If too many changes are made while in safe mode, and there's no room in history to hold them all (currently history
keeps up to 100 most recent actions), then session is automatically put out of the safe mode, no changes are
automatically undone. Thus, it is best to change configuration in small steps, while in safe mode. Pressing [Ctrl]+[X]
twice is an easy way to empty safe mode action list.

HotLock Mode
When HotLock mode is enabled commands will be auto completed.
To enter/exit HotLock mode press [CTRL]+[V].
[admin@MikroTik] /ip address> [CTRL]+[V]
[admin@MikroTik] /ip address>>
Double >> is indication that HotLock mode is enabled. For example if you type /in e, it will be auto completed
to
[admin@MikroTik] /ip address>> /interface ethernet

Quick Help menu


F6 key enables menu at the bottom of the terminal which shows common key combinations and their usage.
[admin@RB493G] >
tab compl ? F1 help ^V hotlk ^X safe ^C brk ^D quit

Manual:Winbox
Summary
Winbox is a small utility that allows administration of Mikrotik RouterOS using a fast and simple GUI. It is a native
Win32 binary, but can be run on Linux and Mac OSX using Wine.
All Winbox interface functions are as close as possible to Console functions, that is why there are no Winbox
sections in the manual.
Some of advanced and system critical configurations are not possible from winbox, like MAC address change on an
interface.

37

Manual:Winbox

Starting the Winbox


Winbox loader can be downloaded directly from the router.
Open your browser and enter router's IP address, RouterOS welcome page will be displayed. Click on the link to
download winbox.exe

When winbox.exe is downloaded, double click on it and winbox loader window will pop up:

To connect to the router enter IP or MAC address of the router, specify username and password (if any) and click on
Connect button.

38

Manual:Winbox

39
Note: It is recommended to use IP address whenever possible. MAC session uses network broadcasts and is
not 100% reliable.

You can also use neighbor discovery, to list available routers by clicking on [...] button:

From list of discovered routers you can click on IP or MAC address column to connect to that router. If you click on
IP address then IP will be used to connect, but if you click on MAC Address then MAC address will be used to
connect to the router.
Note: Neighbor discovery will show also devices which are not compatible with Winbox, like Cisco routers
or any other device that uses CDP (Cisco Discovery Protocol)

Description of buttons and fields of loader screen


[...] - discovers and shows MNDP (MikroTik Neighbor Discovery Protocol) or CDP (Cisco
Discovery Protocol) devices.

Connect - Connect to the router


Save - Save address, login, password and note. Saved entries are listed at the bottom of loader window.
Remove - Remove selected entry from saved list
Tools... - Allows to run various tools: removes all items from the list, clears cache on the local disk, imports
addresses from wbx file or exports them to wbx file.

Connect To: - destination IP or MAC address of the router


Login - username used for authentication
Password - password used for authentication
Keep Password - if unchecked, password is not saved to the list
Secure Mode - if checked, winbox will use TLS encryption to secure session
Load Previous Session - if checked, winbox will try to restore all previously opened windows.
Note - description of the router that will be saved to the list.
Warning: Passwords are saved in plain text. Anyone with access to your file system will be able to retrieve
passwords.

It is possible to use command line to pass connect to user and password parameters automatically:

winbox.exe [<connect-to> [<login> [<password>]]]

Manual:Winbox
For example:
winbox.exe 10.5.101.1 admin
Will connect to router 10.5.101.1 with username "admin"without password.

IPv6 connectivity
Starting from v5RC6 Winbox supports IPv6 connectivity. To connect to the routers IPv6 address, it must be placed
in square braces the same as in web browsers when connecting to IPv6 server. Example:

Winbox neighbor discovery is now capable of discovering IPv6 enabled routers. As you can see from the image
below, there are two entries for each IPv6 enabled router, one entry is with IPv4 address and another one with IPv6
link-local address. You can easily choose to which one you want to connect:

40

Manual:Winbox

Interface Overview
Winbox interface has been designed to be intuitive for most of the users. Interface consists of:
Main toolbar at the top where users ca add various info fields, like CPU and memory usage.
Menu bar on the left - list of all available menus and sub-menus. This list changes depending on what packages
are installed. For example if IPv6 package is disabled, then IPv6 menu and all it's sub-menus will not be
displayed.
Work area - area where all menu windows are opened.

Title bar shows information to identify with which router Winbox session is opened. Information is displayed in
following format:
[username]@[Router's IP or MAC] ( [RouterID] ) - Winbox [ROS version] on [RB model] ([platform])

From screenshot above we can see that user admin is logged into router with IP address 10.1.101.18. Router's ID is
MikroTik, currently installed RouterOS version is v5.0beta1, RouterBoard is RB800 and platform is PowerPC.
On the Main toolbar's left side is located undo and redo buttons to quickly undo any changes made to configuration.
On the right side is located:
winbox traffic indicator displayed as a green bar,
indicator that shows whether winbox session uses TLS encryption
checkbox Hide password. This checkbox replaces all sensitive information (for example, ppp secret passwords)
with '*' asterisk symbols.

41

Manual:Winbox

Work Area and child windows


Winbox has MDI interface meaning that all menu configuration (child) widows are attached to main (parent)
Winbox window and are showed in work area.

Child windows can not be dragged out of working area. Notice in screenshot above that Interface window is
dragged out of visible working area and horizontal scroll bar appeared at the bottom. If any window is outside visible
work area boundaries the vertical or/and horizontal scrollbars will appear.

Child window menu bar


Each child window has its own toolbar. Most of the windows have the same set of toolbar buttons:

Add - add new item to the list

Remove - remove selected item from the list

Enable - enable selected item (the same as enable command from console)

Disable - disable selected item (the same as disable command from console)

Comment - add or edit comment

Sort - allows to sort out items depending on various parameters. Read more >>
Almost all windows have quick search input field at the right side of the toolbar. Any text entered in this field is
searched through all the items and highlighted as illustrated in screenshot below

42

Manual:Winbox

Notice that at the right side next to quick find input filed there is a dropdown box. For currently opened (IP Route)
window this dropdown box allows to quickly sort out items by routing tables. For example if main is selected, then
only routes from main routing table will be listed.
Similar dropdown box is also in all firewall windows to quickly sort out rules by chains.

43

Manual:Winbox

Sorting out displayed items


Almost every window has a Sort button. When clicking on this button several options appear as illustrated in
screenshot below

Example shows how to quickly filter out routes that are in 10.0.0.0/8 range
1. Press Sort button
2. Chose Dst.Address from the first dropdown box.
3. Chose in form the second dropdown box. "in" means that filter will check if dst address value is in range of
specified network.
4. Enter network against which values will be compared (in our example enter "10.0.0.0/8")
5. These buttons are to add or remove another filter to the stack.
6. Press Filter button to apply our filter.
As you can see from screenshot winbox sorted out only routes that are within 10.0.0.0/8 range.
Comparison operators (Number 3 in screenshot) may be different for each window. For example "Ip Route" window
has only two is and in. Other windows may have operators such as "is not", "contains", "contains not".
Winbox allows to build stack of filters. For example if there is a need to filter by destination address and gateway,
then

set first filter as described in example above,


press [+] button to add another filter bar in stack.
set up seconf filter to filter by gateway
press Filter button to apply filters.

You can also remove unnecessary filter from the stack by pressing [-] button.

44

Manual:Winbox

Customizing list of displayed columns


By default winbox shows most commonly used parameters. However sometimes it is needed to see another
parameters, for example "BGP AS Path" or other BGP attributes to monitor if routes are selected properly.
Winbox allows to customize displayed columns for each individual window. For example to add BGP AS path
column:
Click on little arrow button (1) on the right side of the column titles or right mouse click on the route list.
From popped up menu move to Show Columns (2) and from the sub-menu pick desired column, in our case click
on BGP AS Path (3)

Changes made to window layout are saved and next time when winbox is opened the same column order and size is
applied.

45

Manual:Winbox
Detail mode
It is also possible to enable Detail mode. In this mode all parameters are displayed in columns, first column is
parameter name, second column is parameter's value.
To enable detail mode right mouse click on the item list and from the popupmenu pick Detail mode

46

Manual:Winbox
Category view
It is possible to list items by categories. In tis mode all items will be grouped alphabetically or by other category. For
example items may be categorized alphabetically if sorted by name, items can also be categorized by type like in
screenshot below.
To enable Category view, right mouse click on the item list and from the popupmenu pick Show Categories

47

Manual:Winbox

48

Drag & Drop


It is possible to upload and download files to/from router using winbox drag & drop functionality.

Note: Drag & Drop does not work if winbox is running on Linux using wine. This is not a winbox problem,
wine does not support drag & drop.

Traffic monitoring
Winbox can be used as a tool to monitor traffic of every interface, queue or firewall rule in
real-time. Screenshot below shows ethernet traffic monitoring graphs.

Manual:Winbox

49

Manual:Winbox

Item copy
This shows how easy it is to copy an item in Winbox. In this example, we will use the COPY button to make a
Dynamic WDS interface into a Static interface.
This image shows us the initial state, as you see DRA indicates "D" which means Dynamic:

Double-Click on the interface and click on COPY:

50

Manual:Winbox

A new interface window will appear, a new name will be created automatically (in this case WDS2)

You can see that the new interface status has changed:

51

Manual:Winbox

52

Transferring Settings
On
Windows
Vista/7
Winbox
settings
%USERPROFILE%\AppData\Roaming\Mikrotik\Winbox\winbox.cfg
Simply copy this file to the same location on the new host.
[ Top | Back to Content ]

are

stored

in:

Manual:Webfig

Manual:Webfig
Summary
WebFig is a web based RouterOS utility which allows you to monitor, configure and troubleshoot the router. It is
designed as an alternative of WinBox, both have similar layouts and both have access to almost any feature of
RouterOS.
WebFig is accessible directly from the router which means that there is no need to install additional software (except
web browser with JavaScript support, of course).
As Webfig is platform independent, it can be used to configure router directly from various mobile devices without
need of a software developed for specific platform.
Some of the tasks that you can perform with WebFig:
Configuration - view and edit current configuration;
Monitoring - display the current status of the router, routing information, interface stats, logs and many more;
Troubleshooting - RouterOS has built in many troubleshooting tools (like ping, traceroute, packet sniffers, traffic
generators and many other) and all of them can be used with WebFig.

Connecting to Router
WebFig can be launched from the
routers home page which is accessible
by entering routers IP address in the
browser. When home page is
successfully loaded, choose webfig
from the list of available icons as
illustrated in screenshot.
After clicking on webfig icon, login
prompt will ask you to enter username
and password. Enter login information
and click connect.
Now you should be able to see webfig
in action.

IPv6 Connectivity
RouterOS http service now listens on ipv6 address, too. To connect to IPv6, in your browser enter ipv6 address in
square brackets, for example [2001:db8:1::4]. If it is required to connect to link local address, don't forget to specify
interface name or interface id on windows, for example [fe80::9f94:9396%ether1].

53

Manual:Webfig

54

Interface Overview
WebFig interface is designed to be very intuitive especially for WinBox users. It has very similar layout: menu bar
on the left side, undo/redo at the top and work are at the rest of available space.

When connected to router, browsers title bar (tab name on Chrome) displays currently opened menu, user name used
to authenticate, ip address, system identity, ROS version and RouterBOARD model in following format:
[menu] at [username]@[Router's IP] ( [RouterID] ) - Webfig [ROS version] on [RB model] ([platform])

Menu bar has almost the same design as WinBox menu bar. Little arrow on the right side of the menu item indicates
that this menu has several sub-menus.
When clicking on such menu item, sub-menus will be listed and the arrow will
be pointing down, indicating that sub-menus are listed.
At the top you can see three common buttons Undo/Redo buttons similar to
winbox and one additional button Log Out. In the top right corner, you can see
WebFig logo and RouterBOARDS model name.
Work area has tab design, where you can switch between several configuration
tabs, for example in screenshot there are listed all tabs available in Bridge
menu (Bridge, Ports, Filters, NAT, Rules).
Below the tabs are listed buttons for all menu specific commands, for example
Add New and Settings.
The last part is table of all menu items. First column of an item has item
specific command buttons:

- enable current item

- disable current item

- remove current item

Manual:Webfig

Item configuration
When clicking on one of the listed items, webfig will open new page showing all configurable parameters, item
specific commands and status.

At the top you can see item type and item name. In example screenshot you can see that item is an interface with
name bypass
There are also item specific command buttons (Ok, Cancel, Apply, Remove and Torch). These can vary between
different items. For example Torch is available only for interfaces.
Common Item buttons:

Ok - apply changes to parameters and exit;


Cancel - exit and do not apply changes;
Apply - apply changes and stay on current page;
Remove - remove current item.

Status bar similar to winbox shows current status of item specific flags (e.g running flag). Grey-ed out flag means
that it is not active. In example screenshot you can see that running is in solid black and slave is grey-ed, which
means that interface is running and is not a slave interface.
List of properties is divided in several sections, for example "General", "STP", "Status", "Traffic". In winbox these
sections are located in separate tabs, but webfig lists them all in one page specifying section name. In screenshotyou
can see "General" section. Grey-edout properties mean that they are read-only and configuration is not possible.

55

Manual:Webfig

Work with Files


Webfig allows to upload files directly to the router, without using FTP services. To upload files, open Files menu,
click on Choose File button, pick file and wait until file is uploaded.

Files also can be easily downloaded from the router, by clicking Download button at the right side of the file entry.

Traffic Monitoring
[ Top | Back to Content ]

Skins
Webfig skins is handy tool to make interface more user friendly. It is not a security tool. If user has sufficient rights
it is possible to access hidden features by other means.
Designing skins
If user has sufficient permissions (group has policy edit permissions) Design Skin button becomes available.
Pressing that toggle button will open interface editing options. Possible operations are:
Hide menu - this will hide all items from menu and its submenus;

56

Manual:Webfig

57

Hide submenu - only certain submenu will be hidden


Hide tabs - if submenu details have several tabs, it is possible to hide them this way;
Rename menus, items - make some certain features more obvious or translate them into your launguage;
Add note to to item (in detail view) - to add comments on filed;
Make item read-only (in detail view) - for user safety very sensitive fields can be made read only
Hide flags (in detail view) - while it is only possible to hide flag in detail view, this flag will not be visible in list
view and in detailed view;
Add limits for field - (in detail view) where it is list of times that are comma or newline separated list of allowed
values:
number interval '..' example: 1..10 will allow values from 1 to 10 for fiels with numbers, example, MTU size.
field prefix (Text fields, MAC address, set fields, combo-boxes). If it is required to limit prefix length $ should
be added to the end, for example, limiting wireless interface to "station" only will contain
Add Tab - will add grey ribbon with editable label that will separate the fields. Ribbon will be added before field
it is added to;
Add Separator - will add low height horizontal separator before the field it is added to.
Note: Number interval cannot be set to extend limitations set by RouterOS for that field

Note: Set fields are argument that consist of set of check-boxes, for example, setting up policies for user
groups, RADIUS "Service"

Note: Limitations set for combo-boxes will values selectable from dropdown

Configure wireless interface


To configure

Status page
Note: Starting RouterOS 5.7 webfig interface adds capability for users to create status page where fields from
anywhere can be added and arranged.

Satus page can be created by users (with sufficient permissions) and fields on the page can be
reordered.
When status page is created it is default page that opens when logging in the router through webfig
interface.

Manual:Webfig
Addition of fields
To add field to status page user has to enter "Design skin" mode and from drop-down menu at the field choose
option - "Add to status page"
As the result of this action desired field in read-only mode will be added to status page. If at the time Status page is
not present at the time, it will be created for the user automatically.

Two columns
Fields in Status page can be arranged in two columns. Columns are filled from top to bottom.
When you have only one column then first item intended for second should be dragged to the top of the first item
when black line appear on top of the first item, then drag mouse to the left until shorter black line is displayed as
showed in screenshot. Releasing mouse button will create second column. Rest of the fields afterwards can be
dragged and dropped same way as with one column design.

58

Manual:Webfig

59

Skin design examples


Set field
Setting

And

limits

for

the

set

field

result:

Using skins
To use skins you have to assign skin to group, when that is done users of that group will automatically use selected
skin as their default when logging into Webfig.
Note: Webfig is only configuration interface that can use skins

If it is required to use created skin on other router you can copy files to skins folder on the other
router. On new router it is required to add copied skin to user group to use it.
[ Top | Back to Content ]

Manual:License

60

Manual:License
Overview
RouterBOARD devices come preinstalled with a RouterOS license, if you have purchased a RouterBOARD device,
nothing must be done regarding the license.
For X86 systems (ie. PC devices), you need to obtain a license key.
The license key is a block of symbols that needs to be copied from your mikrotik.com account, or from the email you
received in, and then it can be pasted into the router. You can paste the key anywhere in the terminal, or by clicking
"Paste key" in Winbox License menu. A reboot is required for the key to take effect.
RouterOS licensing scheme is based on SoftwareID number that is bound to storage media (HDD, NAND).
Licensing information can be read from CLI system console:
[admin@RB1100] >
software-id:
upgradable-to:
nlevel:
features:
[admin@RB1100] >

/system license print


"43NU-NLT9"
v7.x
6

or from equivalent winbox, webfig menu.

License Levels
You can purchase a Level 3, 4, 5 and 6. Level 1 is the demo license.
The difference between license levels is shown in the table.
Level 3 is a wireless station (client) only license. Level 3 can only be
obtained in large quantities.
Level 2 was a transitional license from old legacy (pre 2.8) license
format. These licenses are not available anymore, if you have this kind
of license, it will work, but to upgrade it - you will have to purchase a
new license.
Note: current RouterOS version is 5 table modified according to that.
The Upgradable-to below applies only to Keys purchased after release
of v5

Manual:License

61

Level number

0 (Demo mode) 1 (Free)

Price

no key

Upgradable To

no upgrades

ROS v6.x

ROS v6.x ROS v7.x ROS v7.x

Initial Config Support

15 days

30 days

30 days

Wireless AP

24h trial

yes

yes

yes

Wireless Client and Bridge 24h trial

yes

yes

yes

yes

RIP, OSPF, BGP protocols 24h trial

yes(*)

yes

yes

yes

EoIP tunnels

24h trial

unlimited

unlimited unlimited unlimited

PPPoE tunnels

24h trial

200

200

500

unlimited

PPTP tunnels

24h trial

200

200

500

unlimited

L2TP tunnels

24h trial

200

200

500

unlimited

OVPN tunnels

24h trial

200

200

unlimited unlimited

VLAN interfaces

24h trial

unlimited

unlimited unlimited unlimited

HotSpot active users

24h trial

200

500

unlimited

RADIUS client

24h trial

yes

yes

yes

yes

Queues

24h trial

unlimited

unlimited unlimited unlimited

Web proxy

24h trial

yes

yes

yes

yes

User manager active


sessions

24h trial

10

20

50

Unlimited

Number of KVM guests

none

Unlimited

Unlimited Unlimited Unlimited

[1]

registration required

3 (WISP CPE) 4 (WISP) 5 (WISP) 6 (Controller)


[1]

volume only

[2] $45

$95

$250

(*) - BGP is included in License Level3 only for RouterBOARDs, for other devices you need Level4 or above to
have BGP.
All Licenses:

never expire
include 15-30 day free support over e-mail
can use unlimited number of interfaces
are for one installation each

Level3 is not available for purchase individually. For ordering more than 100 L3 licenses, contact
sales[at]mikrotik.com

Licenses and RouterOS upgrades


RouterOS can be upgraded only to certain versions. For example if you are running RouterOS v5, your license could
restrict the upgrade only to v6, and not to v7. The following examples describe how this is determined:
There are two types of keys, Level3/L4 and Level5/L6
The difference between these is that L3 and L4 only allow RouterOS upgrades until the last update of the next
version. L5 and L6 however, give you the ability to use one more major version
There are also differences between all License levels (L3-L6) that are unrelated to RouterOS upgrades, see
License levels
So the math is:
L3/4 = current version + 1 = can use
L5/6 = current version + 2 = can use

Manual:License
eg. L5/6 = v3 + 2 = v5.21 you can use
Examples:
If current version is ROS v3, L3 and L4 will work with v3.1, v3.20, v4,1, v4.20 but NOT v5.0 and beyond
If current version is ROS v3, L5 and L6 will work with v3.1, v3.20, v4.1, v4.20 and also v5beta1 but NOT v6.0
and beyond
If current version would be ROS v4, L5 and L6 will work with v4.1, v4.20, v5.1, v5.20 and also v6beta to v6.99
but NOT v7

New 8 symbol SoftID


Since RouterOS 3.25 and 4.0beta3 new
SoftID format is introduced. Your license
menu will show both the old and the new
SoftID. Even by upgrading to a new version,
RouterOS will still work as before, but to
use some of the new features, LICENSE
UPDATE will be necessary. To do this, just
click on "Update license key" button in
Winbox (currently only in Winbox).
New SoftID's are in the form of
XXXX-XXXX (Four symbols, dash, four
symbols).
The following actions will be taken:
1. Winbox will contact www.mikrotik.com
with your old SoftID
2. www.mikrotik.com will check the
database and see details about your key
3. the server will generate a new key as "upgrade" and put it into the same account as old one
4. Winbox will receive the new key and automatically License your router with the new key
5. Reboot will be required
6. New RouterOS features will be unlocked
Important Note!: If you see this button also in v3.24, don't use it, it will not work.
If you ever wish to downgrade RouterOS, you will have to apply the OLD key before doing so. When RouterOS
applies the NEW key, the OLD key is saved to a file, in the FILES folder, to make sure you have the old key handy.
Even more important: Don't downgrade v4.0b3 to v3.23 or older. Use only v3.24 for downgrading, or you might
lose your new format key.

Change license Level


1. There are no license level upgrades, if you wish to use a different license Level, please purchase the appropriate
level. Be very careful when purchasing for the first time, choose the correct option.
2. Why is it not possible to change license level (ie. upgrade license)? Just like you can't easily upgrade your car's
engine from 2L to 4L just by paying the difference, you can't switch license levels as easily. This is a policy used
by many software companies, choose wisely when making your purchase! Instead we have lowered the prices,
and removed the software update time limit.

62

Manual:License

Using the License


Can I Format or Re-Flash the drive?
Formatting, and Re-Imaging the drive with non-mikrotik tools (like DD and Fdisk) will destroy your license! Be
very careful and contact mikrotik support before doing this. It is not recommended, as mikrotik support might deny
your request for a replacement license.
How many computers can I use the License on?
At the same time, the RouterOS license can be used only in one system. The License is bound to the HDD it is
installed on, but you have the ability to move the HDD to another computer system. You cannot move the License to
another HDD, neither can you format or overwrite the HDD with the RouterOS license. It will be erased from the
drive, and you will have to get a new one. If you accidently removed your license, contact the support team for help.
Can I temporary use the HDD for something else, other than RouterOS?
As stated above, no.
What is a Replacement Key
It is a special key which is issued by the Support Team if you accidently lose the license, and the Mikrotik Support
decides that it is not directly your fault. It costs 10$ and has the same features as the key that you lose. Note that
before issuing such key, the Mikrotik Support can ask you to prove that the old drive is failed, in some cases this
means sending us the dead drive.
Must I type the whole key into the router?
No, simply copy it and paste into the Telnet window, or License menu in Winbox.
Copy license to Telnet Window (or Winbox New Terminal),

63

Manual:License
Another option to use Winbox License Window, click on System ---> License,

Can I install another OS on my drive and then install RouterOS again later?
No, because if you use formatting or partitioning utilities, or tools that do something to the MBR, you will lose the
license and you will have to make a new one. This process is not free (see Replacement Key above)
I lost my RouterBOARD, can you give me the license to use on another system?
The RouterBOARD comes with an embedded license. You cannot move this license to a new system in any way,
this includes upgrades applied to the RouterBOARD while it was still working.
Licenses Purchased from Resellers
The keys that you purchase from other vendors and resellers, are not in your account. Your mikrotik.com account
only contains licenses purchased from MikroTik directly. However, you can use the "Request key" link in your
account, to get the key into your account for reference, or for some upgrades (if available).

64

Manual:License

65

Obtaining Licenses and working with them


Where can I buy a RouterOS license key?
In the Account Server, which is located on www.mikrotik.com
If I have purchased my key elsewhere
You must contact the company who sold you the license, they will provide support
If I have a license and want to put it on another account?
You can give access to keys with the help of Virtual Folders

References
[1] http:/ / www. mikrotik. com/ download. html
[2] mailto:sales@mikrotik. com

Manual:Purchasing a License for RouterOS


First you have to make an account on the Account Server, this can be done on the mikrotik.com main page, and is a
free and easy process.
Important! Before purchasing a key, you have to install RouterOS. It will generate a SoftID that will be required
during the purchase. Before entering the SoftID in the purchase form, make sure it has not changed on your router.
After installation, you have 24 hours to enter a key. If you are close to running out of time - shut down the router.
The timer will stop.
After you have an account, start by logging in, here is an example process:

Log into your account

Click on Purchase a Key

Manual:Purchasing a License for RouterOS

Select your License Level and the number of


licenses you need

Enter your SoftIDs and select the system kind,


remember that SoftID will be given to you after
installation of RouterOS. The system kind is a
choice between RouterBOARD and X86.
Basically if you have a RouterBOARD(TM)
device, select RouterBOARD, if you have some
other kind of device - select X86. NOTE!: Older
RouterBOARD 230 model is an X86 device too.

Click on Pay By Credit Card and You will be


presented the bank payment page

In the Bank page you will be asked for your Credit Card Number, CVC/CVV code, expiry date of the card and the
name on the card. The CVC/CVV card can be found on the back of the card and is a three digit code. After you enter
all the details and submit the information, your credit card will be charged. Do not close the browser or push any
buttons until the process is complete. Then you will receive your new key in your email, and it will also appear in the
"work with keys" section of your account.
Instructions how to apply license on your router are here.

66

Manual:Entering a RouterOS License key

Manual:Entering a RouterOS License key


First method
If you have installed the Router OS onto a PC (i.e. it is not a RouterBoard), you will initially have no key, but for 24
hours the router will be fully operable and working. During this period configure the router to have an IP address, for
example 10.1.0.133, then purchase a key on the www.mikrotik.com account server. To enter this key follow this
short guide:
Telnet to the router:

find the email from mikrotik which contains your key

67

Manual:Entering a RouterOS License key

select this key and click copy

in the telnet window right-click the screen and choose paste

68

Manual:Entering a RouterOS License key

type y and hit enter to reboot the router

For fans of the serial console, you may enter the license information via the serial console on certain equipment.
Perform the same operation as in the telnet session above, i.e., at the console prompt, paste the license
information as if it were a command; the paste buffer or clipboard should contain the full text including the lines
containing "BEGIN" and "END" as mentioned above.

69

Manual:Default Configurations

70

Manual:Default Configurations
Applies to RouterOS: v5

List of Default Configs


Integrated Indoors
Wan port

Lan port

Wireless
ht
ht extension dhcp-server dhcp-client Firewall
mode
chain

RB750
RB750G

ether1

Switched
ether2-ether5

RB751-2n

ether1

Switched
AP b/g/n
ether2-ether5, 2412MHz
bridged wlan1
with switch

NAT

Default IP

Mac
Server

on lan port

on wan port blocked Masquerade 192.168.88.1/24 Disabled


access
wan port
on lan port
on wan
to wan
port
port

above-control

on lan port

on wan port blocked Masquerade 192.168.88.1/24 Disabled


access
wan port
on lan port
on wan
to wan
port
port

RB1100

192.168.88.1/24
on ether1

RB1200

192.168.88.1/24
on ether1

RB2011

sfp1,ether1

two switch
gropups
bridged
(ether2-ether10,
wlan1 if
present)

on lan port

on wan port blocked Masquerade 192.168.88.1/24 Disabled


access
wan port
on ether1
on wan
to wan
port
port

Integrated Outdoors
Wan
port

Lan port

Groove
5Hn

wlan1

ether1

station
a/n
5300MHz

above
control

on lan port

Groove
A-5Hn

bridged
wlan1,ether1

AP a/n
5300MHz

SXT 5D

wlan1

ether1

station
a/n
5300MHz

0,1

above
control

on lan port

on wan port blocked Masquerade 192.168.88.1/24 Disabled


access to wan port
on lan port
on wan
wan port
port

Switched
AP a/n
ether2-ether5, 5300MHz
bridged
wlan1 with
switch

0,1

on lan port

on wan port

OmniTik ether1

Wireless
ht
ht
dhcp-server dhcp-client Firewall
mode
chain extension

NAT

Default IP

Mac
Server

on wan port blocked Masquerade 192.168.88.1/24 Disabled


access to wan port
on lan port
on wan
wan port
port
-

192.168.88.1/24
on lan port

Masquerade 192.168.88.1/24
wan port
on lan port

Manual:Default Configurations

71

Engineered
Wan
port

Lan port

RB450
RB450G

ether1

Switched
ether2-ether5

on lan port

on wan port blocked Masquerade 192.168.88.1/24 Disabled


access
wan port
on lan port
on wan
to wan
port
port

RB711-5

wlan1

ether1

station
a/n
5300MHz

above
control

on lan port

on wan port blocked Masquerade 192.168.88.1/24 Disabled


access
wan port
on lan port
on wan
to wan
port
port

bridged
AP a/n
wlan1,ether1 5300MHz

above
control

on lan port

RB711A-5Hn

RB711-2

wlan1

ether1

Wireless
ht
ht
dhcp-server dhcp-client Firewall
mode
chain extension

station
b/g/n
2412MHz

NAT

Default IP

192.168.88.1/24
on lan port

Mac
Server

on wan port blocked Masquerade 192.168.88.1/24 Disabled


access
wan port
on lan port
on wan
to wan
port
port

Note: To see exact configuration script that will be applied after system reset use following command
/system default-configuration print

Wan Port
When applying configuration WAN port is renamed to "<wan port>-gateway", for example, if wan
port is ether1, it will be renamed to "ether1-gateway".

Local Port
Local port can be:
single interface
ethernets configured in switch group
bridged all interfaces that are not WAN and switch slaves.
If ports are switched then master port is renamed to "<ethernet name>-master-local" and slaves to "<ethernet
name>-slave-local".
Lets take RB751 as an example. Board has ether1 configured as WAN port, it has switch chip and one
pre-configured wireless interface. So in this case all ethernets except ether1 are grouped in switch group and bridged
with wireless interface.
Generated config will be:
/interface set ether2 name=ether2-master-local;
/interface set ether3 name=ether3-slave-local;
/interface set ether4 name=ether4-slave-local;
/interface set ether5 name=ether5-slave-local;
/interface ethernet set ether3-slave-local master-port=ether2-master-local;
/interface ethernet set ether4-slave-local master-port=ether2-master-local;
/interface ethernet set ether5-slave-local master-port=ether2-master-local;

Manual:Default Configurations
/interface bridge add name=bridge-local disabled=no auto-mac=no protocol-mode=rstp;

:local bMACIsSet 0;
:foreach k in=[/interface find] do={
:local tmpPort [/interface get $k name];
:if ($bMACIsSet = 0) do={
:if ([/interface get $k type] = "ether") do={
/interface bridge set "bridge-local" admin-mac=[/interface ethernet get $tmpPort mac-address];
:set bMACIsSet 1;
}
}
:if (!($tmpPort~"bridge" || $tmpPort~"ether1" || $tmpPort~"slave")) do={
/interface bridge port add bridge=bridge-local interface=$tmpPort;
}
}

Wireless Config
Wireless configuration depends on market segment for which board is designed. It can be configured as AP or
station in 2GHz and 5GHz frequencies. Default 2GHz frequency is 2412 and default 5GHz frequency is 5300. SSID
is "Mikrotik".
If board has two chains (letter D in the naming of the board), then both chains are enabled. HT Extension is enabled
on all CPEs.
For example generated config on RB751:
:if ( $wirelessEnabled = 1) do={
# wait for wireless
:while ([/interface wireless find] = "") do={ :delay 1s; };

/interface wireless set wlan1 mode=ap-bridge band=2ghz-b/g/n ht-txchains=0,1 ht-rxchains=0,1 \


disabled=no country=no_country_set wireless-protocol=any
/interface wireless set wlan1 channel-width=20/40mhz-ht-above ;
}

Default IP and DHCP Config


Default IP address on all boards is 192.168.88.1/24. Boards without specific configuration has IP address set on
ether1, other boards has IP address on LAN interface.
All boards that has WAN port configured, DHCP client is set on WAN port.
Typically on all CPEs DHCP server is set on LAN port, giving out addresses in range from
192.168.88.2-192.168.88.254
As an example RB751 applied DHCP config.
/ip dhcp-client add interface=ether1-gateway disabled=no

/ip pool add name="default-dhcp" ranges=192.168.88.10-192.168.88.254;


/ip dhcp-server
add name=default address-pool="default-dhcp" interface=bridge-local disabled=no;

72

Manual:Default Configurations

73

/ip dhcp-server network


add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1 comment="default configuration";

Firewall, NAT and MAC server


All boards with configured WAN port has configured protection on that port. Any traffic leaving WAN port is
masqueraded.
Config example:
/ip firewall {
filter add chain=input action=accept protocol=icmp comment="default configuration"
filter add chain=input action=accept connection-state=established in-interface=ether1-gateway comment="default configuration"
filter add chain=input action=accept connection-state=related in-interface=ether1-gateway comment="default configuration"
filter add chain=input action=drop in-interface=ether1-gateway comment="default configuration"
nat add chain=srcnat out-interface=ether1-gateway action=masquerade comment="default configuration"
}

/tool mac-server remove [find];


/tool mac-server mac-winbox disable [find];
:foreach k in=[/interface find] do={
:local tmpName [/interface get $k name];
:if (!($tmpName~"ether1")) do={
/tool mac-server add interface=$tmpName disabled=no;
/tool mac-server mac-winbox add interface=$tmpName disabled=no;
}
}
/ip neighbor discovery set [find name="ether1-gateway"] discover=no

DNS
Every board allows remote DNS requests and static DNS name is pre-configured.
/ip dns {
set allow-remote-requests=yes
static add name=router address=192.168.88.1
}
[ Top | Back to Content ]

Manual:System/Packages

74

Manual:System/Packages
Summary
RouterOS supports a lot of different features and since every installation requires specific set of features supprted it
is possible to add or remove certain groups of features using package system. As result user is able to control what
features are available and size of installation. Packages are provided only by MikroTik and no 3rd parties are
allowed to make them.

Acquiring packages
Packages can be downloaded from MikroTik download
download methods can be used.

[1]

page or mirrors listed on that page. Either of provided

RouterOS packages
for each architecture
Package

Features

advanced-tools (mipsle,
mipsbe, ppc, x86)

advanced ping tools. netwatch, ip-scan, sms tool, wake-on-LAN

calea (mipsle, mipsbe,


ppc, x86)

data gathering tool for specific use due to "Communications Assistance for Law Enforcement Act" in USA

dhcp (mipsle, mipsbe,


ppc, x86)

Dynamic Host Control Protocol client and server

gps (mipsle, mipsbe, ppc, Global Positioning System devices support


x86)
hotspot (mipsle, mipsbe,
ppc, x86)

HotSpot user management

ipv6 (mipsle, mipsbe,


ppc, x86)

IPv6 addressing support

mpls (mipsle, mipsbe,


ppc, x86)

Multi Protocol Labels Switching support

multicast (mipsle,
mipsbe, ppc, x86)

ProtocolIndependentMulticast-SparseMode; InternetGroupManagingProtocol-Proxy

ntp (mipsle, mipsbe, ppc, Network protocol client and service


x86)
ppp (mipsle, mipsbe,
ppc, x86)

MlPPP client, PPP, PPTP, L2TP, PPPoE, ISDN PPP clients and servers

routerboard (mipsle,
mipsbe, ppc, x86)

accessing and managing RouterBOOT. RouterBOARD specific imformation.

routing (mipsle, mipsbe,


ppc, x86)

dynamic routing protocols like RIP, BGP, OSPF and routing utilities like BFD, filters for routes.

security (mipsle, mipsbe, IPSEC, SSH, Secure WinBox


ppc, x86)
system (mipsle, mipsbe,
ppc, x86)

basic router features like static routing, ip addresses, sNTP, telnet, API, queues, firewall, web proxy, DNS cache, TFTP,
IP pool, SNMP, packet sniffer, e-mail send tool, graphing, bandwidth-test, torch, EoIP, IPIP, bridging, VLAN, VRRP
etc.). Also, for RouterBOARD platform - MetaROUTER | Virtualization

Manual:System/Packages

75

ups (mipsle, mipsbe, ppc, APC ups


x86)
user-manager (mipsle,
mipsbe, ppc, x86)

MikroTik User Manager

wireless (mipsle, mipsbe, wireless interface support


ppc, x86)
arlan (x86)

legacy Aironet Arlan support

isdn (x86)

ISDN support

lcd (x86)

LCD panel support

radiolan (x86)

RadioLan cards support

synchronous (x86)

FarSync support

xen ( discontinued x86)

XEN Virtualization

kvm (x86)

KVM Virtualization

routeros-mipsle (mipsle) combined package for mipsle (RB100, RB500) (includes system, hotspot, wireless, ppp, security, mpls, advanced-tools,
dhcp, routerboard, ipv6, routing)
routeros-mipsbe
(mipsbe)

combined package for mipsbe (RB400) (includes system, hotspot, wireless, ppp, security, mpls, advanced-tools, dhcp,
routerboard, ipv6, routing)

routeros-powerpc (ppc)

combined package for powerpc (RB300, RB600, RB1000) (includes system, hotspot, wireless, ppp, security, mpls,
advanced-tools, dhcp, routerboard, ipv6, routing)

routeros-x86 (x86)

combined package for x86 (Intel/AMD PC, RB230) (includes system, hotspot, wireless, ppp, security, mpls,
advanced-tools, dhcp, routerboard, ipv6, routing)

mpls-test (mipsle,
mipsbe, ppc, x86)

Multi Protocol Labels Switching support improvements

routing-test (mipsle,
mipsbe, ppc, x86)

routing protocols (RIP, OSPF, BGP) improvements

Working with packages


Menu: /system package
Commands executed in this menu will take place only on restart of the router. Until then, user can freely schedule or
revert set actions.
Command
disable

Desciption
schedule package to be disabled after next reboot. All features provided by package will not be accessible

downgrade will prompt for reboot. During reboot process will try to downgrade RouterOS to oldest version possible by checking packages that
are uploaded to the router.
print

outputs information about packages, like: version, package state, planned state changes etc.

enable

schedule package to be enabled after next reboot

uninstall

schedule package to be removed from router. That will take place during reboot.

unschedule remove scheduled task for package.

Manual:System/Packages

76

Examples
Upgrade process is described here.
List available packages
/system package print
Flags: X - disabled
#
NAME
0 X ipv6
1
system
2 X mpls
3 X hotspot
4
routing
5
wireless
6 X dhcp
7
routerboard
8
routeros-mipsle
9
security
10 X ppp
11
advanced-tools

VERSION
3.13
3.13
3.13
3.13
3.13
3.13
3.13
3.13
3.13
3.13
3.13
3.13

Uninstall package
Schedules package for uninstallation and reboots router.
/system package uninstall ppp; /system reboot;
Reboot, yes? [y/N]:
Disable package
/system package disable hotspot; /system reboot;
Reboot, yes? [y/N]:
Downgrade
/system package downgrade; /system reboot;
Reboot, yes? [y/N]:
Cancel uninstall or disable action
/system package unschedule ipv6

SCHEDULED

Manual:Upgrading RouterOS

Manual:Upgrading RouterOS
Requirements
In this article we assume that youre license allows upgrading.

Methods
You can upgrade RouterOS in the following ways:
Winbox drag and drop files to the Files menu
FTP - upload files to root directory
The Dude See manual here
Note: RouterOS cannot be upgraded through serial cable. Using this method only RouterBOOT can be
upgraded.

Upgrade process
First step - visit www.mikrotik.com [1] and head to the download page, there choose the type of
system you have the RouterOS installed on.
Download the Combined package, it will include all the functionality of RouterOS:
Using Winbox

Connect to your router with Winbox, Select the downloaded file with your mouse, and drag it to the Files menu.
If there are some files already present, make sure to put the package in the root menu, not inside the
hotspot folder!:

77

Manual:Upgrading RouterOS

The upload will start:

After it finishes - REBOOT and that's all! The New version number will be seen in the Winbox Title and in
the Packages menu

78

Manual:Upgrading RouterOS

79

Using FTP
Open your favourite FTP program (in this case it is Filezilla [2]), select the package and upload it to your router
(demo2.mt.lv is the address of my router in this example). note that in the image I'm uploading many packages,
but in your case - you will have one file that contains them all

if you wish, you can check if the file is successfully transferred onto the router (optional):
[normis@Demo_v2.9] > file
# NAME
0 supout.rif
1 dhcp-2.9.8.npk
2 ppp-2.9.8.npk
3 advanced-tools-2.9....
4 web-proxy-2.9.8.npk
5 wireless-2.9.8.npk
6 routerboard-2.9.8.npk
7 system-2.9.8.npk

print
TYPE
.rif file
package
package
package
package
package
package
package

SIZE
285942
138846
328636
142820
377837
534052
192628
5826498

and reboot your router for the upgrade process to begin:


[normis@Demo_v2.9] > system reboot
Reboot, yes? [y/N]: y
after the reboot, your router will be up to date, you can check it in this menu:
/system package print
if your router did not upgrade correctly, make sure you check the log
/log print without-paging

CREATION-TIME
nov/24/2005 15:21:54
nov/29/2005 09:55:42
nov/29/2005 09:55:43
nov/29/2005 09:55:42
nov/29/2005 09:55:43
nov/29/2005 09:55:43
nov/29/2005 09:55:45
nov/29/2005 09:55:54

Manual:Upgrading RouterOS

RouterOS massive auto-upgrade


You can upgrade multiple MikroTik routers within few clicks. Let's have a look on simple network with 3 routers
(the same method works on networks with infinite numbers of routers),

RouterOS auto-upgrade
RouterOS can download software packages from a remote MikroTik router.
Make one router as network upgrade central point, that will update MikroTik RouterOS on other routers.
Upload necessary RouterOS packages to this router (in the example, mipsbe for RB751U and powerpc for
RB1100AHx2).

80

Manual:Upgrading RouterOS
Add upgrade router (192.168.100.1) information to a router that you want to update (192.168.100.253), required
settings IP address/Username/Password

Click on Refresh to see available packages, download newest packages and reboot the router to finalize the
upgrade.

81

Manual:Upgrading RouterOS

82

Manual:Upgrading RouterOS
The Dude auto-upgrade
Dude application can help you to upgrade entire RouterOS network with one click per router.
Set type RouterOS and correct password for any device on your Dude map, that you want to upgrade
automatically,

Upload required RouterOS packages to Dude files,

Upgrade RouterOS version on devices from RouterOS list. Upgrade process is automatic, after click on upgrade
(or force upgrade), package will be uploaded and router will be rebooted by the Dude automatically.

83

Manual:Upgrading RouterOS

The Dude hierarchical upgrade


For complicated networks, when routers are connected sequentially, the simplest example is 1router-2router-3router
connection. You might get an issue, 2router will go to reboot before packages are uploaded to the 3router. The
solution is Dude groups, the feature allows to group routers and upgrade all of them by one click!

Select group and click Upgrade (or Force Upgrade),

84

Manual:Upgrading RouterOS

License issues
When upgrading from older versions, there could be issues with your license key. Possible scenarios:
When upgrading from RouterOS v2.8 or older, the system might complain about expired upgrade time. To
override this, use Netinstall to upgrade. Netinstall will ignore old license restriction and will upgrade
When upgrading to RouterOS v4 or newer, the system will ask you to update license to a new format. To do this,
ensure your Winbox PC (not the router) has a working internet connection without any restrictions to reach
www.mikrotik.com and click "update license" in the license menu.

References
[1] http:/ / www. mikrotik. com
[2] http:/ / filezilla. sourceforge. net/

Manual:Netinstall
Applies to RouterOS: 2.9, v3, v4

NetInstall Description
NetInstall is a program that runs on Windows computer that allows you to install MikroTiK RouterOS onto a PC or
onto a RouterBoard via an Ethernet network.
You can download Netinstall on our download page [1].
NetInstall is also used to re-install RouterOS in cases where the the previous install failed, became damaged or
access passwords were lost.
Your device must support booting from ethernet, and there must be a direct ethernet link from the Netinstall
computer to the target device. All RouterBOARDs support PXE network booting, it must be either enabled inside
RouterOS "routerboard" menu if RouterOS is operable, or in the bootloader settings. For this you will need a
serial cable.
Note: For RouterBOARD devices with no serial port, and no RouterOS access, the reset button can also start PXE
booting mode. See your RouterBOARD manual PDF for details. For example RB750 PDF [1]
Netinstall can also directly install RouterOS on a disk (USB/CF/IDE) that is connected to the Netinstall Windows
machine. After installation just move the disk to the Router machine and boot from it.

85

Manual:Netinstall

Interface
The following options are available in the Netinstall window:

Routers/Drives - list of PC drives, and in the routers that were detected near the Netinstall PC
Make floppy - used to create a bootable 1.44" floppy disk for PCs which don't have Etherboot support
Net booting - used to enable PXE booting over network (your default choice)
Install/Cancel - after selecting the router and selecting the RouterOS packages below, use this to start install
SoftID - the SoftID that was generated on the router. Use this to purchase your key
Key / Browse - apply the purchased key here, or leave blank to install a 24h trial
Get key - get the key from your mikrotik.com account directly
Flashfig - launch Flashfig - the mass config utility which works on brand new devices
Keep old configuration - keeps the configuration that was on the router, just reinstalls software (no reset)
IP address / "Netmask - enter IP address and netmask in CIDR notation to preconfigure in the router
Gateway - default gateway to preconfigure in the router
Baud rate - default serial port baud-rate to preconfigure in the router
Configure script File that contains RouterOS CLI commands that directly configure router (e.g. commands
produced by export command). Used to apply default configuration

Screenshot

for installation over network, don't forget to enable the PXE server, and make sure Netinstall is not blocked by
your firewall or antivirus. The connection should be directly from your Windows PC to the Router PC (or
RouterBOARD), or at least through a switch/hub.

86

Manual:Netinstall

NetInstall Example
This is a step by step example of how to install RouterOS on a RouterBoard 532 from a typical notebook computer.
Requirements
The Notebook computer must be equiped with the following ports and contain the following files:

Ethernet port.
Serial port.
Serial communications program (such as Hyper Terminal)
The .npk RouterOS file(s) (not .zip file) of the RouterOS version that you wish to install onto the Routerboard.
The NetInstall program available from the Downloads page at www.mikrotik.com

Connection process
1. Connect the routerboard to a switch, a hub or directly to the Notebook computer via Ethernet. The notebook
computer Ethernet port will need to be configured with a usable IP address and subnet. For example: 10.1.1.10/24
2. Connect the routerboard to the notebook computer via serial, and establish a serial communication session with
the RouterBoard. Serial configuration example in in the Serial console manual
3. Run the NetInstall program on your notebook computer.
4. Press the NetInstall "Net Booting" button, enable the Boot Server, and enter a valid, usable IP address (within
the same subnet of the IP address of the Notebook) that the NetInstall program will assign to the RouterBoard to
enable communication with the Notebook computer. For example: 10.1.1.5/24
5. Set the RouterBoard BIOS to boot from the Ethernet interface.
Configuring Bootloader
To access Routerboard BIOS configuration: reboot the Routerboard while observing the activity on the Serial
Console. You will see the following prompt on the Serial Console Press any key within 2 seconds to enter setup
indicating that you have a 1 or 2 second window of time when pressing any key will give you access to Routerboard
BIOS configuration options.
(press any key when prompted):
You will see the following list of available BIOS Configuration commands. To set up the boot device, press the 'o'
key:
What do you want to configure?
d - boot delay
k - boot key
s - serial console
l - debug level
o - boot device
b - beep on boot
v - vga to serial
t - ata translation
p - memory settings
m - memory test
u - cpu mode
f - pci back-off
r - reset configuration
g - bios upgrade through serial port
c - bios license information

87

Manual:Netinstall

88

x - exit setup
Next Selection: Press the 'e' key to make the RouterBoard to boot from Ethernet interface:
Select boot device:
* i - IDE
e - Etherboot
1 - Etherboot (timeout
2 - Etherboot (timeout
3 - Etherboot (timeout
4 - Etherboot (timeout
5 - IDE, try Etherboot
6 - IDE, try Etherboot
7 - IDE, try Etherboot
8 - IDE, try Etherboot

15s),
1m),
5m),
30m),
first
first
first
first

IDE
IDE
IDE
IDE
on next
on next
on next
on next

boot
boot
boot
boot

(15s)
(1m)
(5m)
(30m)

The RouterBoard BIOS will return to the first menu. Press the 'x' key to exit from BIOS. The router will reboot.
Make sure boot-protocol is bootp.
Installation
Watch the serial console as the RouterBoard reboots, it will indicate that the RouterBoard is attempting to boot to the
NetInstall program. The NetInstall program will give the RouterBoard the IP address you entered at Step 4 (above),
and the RouterBoard will be ready for software installation. Now you should see the MAC Address of the
RouterBoard appear in the Routers/Drives list of the NetInstall program.

Click on the desired Router/Drive entry and you will be able to configure various installation parameters associated
with that Router/Drive entry.

Manual:Netinstall

For most Re-Installations of RouterOS on RouterBoards you will only need to set the following parameter:
Press the "Browse" button on the NetInstall program screen. Browse to the folder containing the .npk RouterOS
file(s) of the RouterOS version that you wish to install onto the Routerboard.

When you have finalized the installation parameters, press the "Install" button to install RouterOS.

89

Manual:Netinstall

When the installation process has finished, press 'Enter' on the console or 'Reboot' button in the NetInstall program.

90

Manual:Netinstall
Cleanup
1. Reset the BIOS Configuration of the RouterBoard to boot from its own memory.

2. Reboot the RouterBoard.


Reset RouterOS Password
Netinstall can be used to reset password of RouterOS by erasing all configuration from the router. Uncheck 'Keep
Old Configuration' during Netinstall and proceed with standard procedure,

[ Top | Back to Content ]

References
[1] http:/ / www. routerboard. com/ pricelist/ download_file. php?file_id=118

91

Manual:Configuration Management

Manual:Configuration Management
Applies to RouterOS: 2.9, v3, v4

Summary
This manual introduces you with commands which are used to perform the following functions:

system backup;
system restore from a backup;
configuration export;
configuration import;
system configuration reset.

Description
The configuration backup can be used for backing up MikroTik RouterOS configuration to a binary file, which can
be stored on the router or downloaded from it using FTP for future use. The configuration restore can be used for
restoring the router's configuration, exactly as it was at the backup creation moment, from a backup file. The
restoration procedure assumes the cofiguration is restored on the same router, where the backup file was originally
created, so it will create partially broken configuration if the hardware has been changed.
The configuration export can be used for dumping out complete or partial MikroTik RouterOS configuration to the
console screen or to a text (script) file, which can be downloaded from the router using FTP protocol. The
configuration dumped is actually a batch of commands that add (without removing the existing configuration) the
selected configuration to a router. The configuration import facility executes a batch of console commands from a
script file.
System reset command is used to erase all configuration on the router. Before doing that, it might be useful to
backup the router's configuration.

System Backup
Submenu level: /system backup
Description
The backup save command is used to store the entire router configuration in a backup file. The file is shown in the
/file submenu. It can be downloaded via ftp to keep it as a backup for your configuration.
Important! The backup file contains sensitive information, do not store your backup files inside the router's Files
directory, instead, download them, and keep them in a secure location.
To restore the system configuration, for example, after a /system reset-configuration, it is possible to upload that file
via ftp and load that backup file using load command in /system backup submenu. Command Description
load name=[filename] - Load configuration backup from a file
save name=[filename] - Save configuration backup to a file
Warning: If TheDude and user-manager is installed on the router then backup will not take care of
configuration used by these tools. Therefore additional care should be taken to save configuration from these.
Use provided tool mechanisms to save/export configuration if you want to save it.

92

Manual:Configuration Management

93

Example
To save the router configuration to file test:
[admin@MikroTik] system backup> save name=test
Configuration backup saved
[admin@MikroTik] system backup>
To see the files stored on the router:
[admin@MikroTik] > file print
# NAME
0 test.backup
[admin@MikroTik] >

TYPE
backup

SIZE
12567

CREATION-TIME
sep/08/2004 21:07:50

To load the saved backup file test:


[admin@MikroTik] > system backup load name=test
Restore and reboot? [y/N]:
y
Restoring system configuration
System configuration restored, rebooting now

Exporting Configuration
Command name: /export
The export command prints a script that can be used to restore configuration. The command can be invoked at any
menu level, and it acts for that menu level and all menu levels below it. The output can be saved into a file, available
for download using FTP.
Command Description
file=[filename] - saves the export to a file
Example
[admin@MikroTik] > ip address print
Flags: X - disabled, I - invalid, D - dynamic
#
ADDRESS
NETWORK
BROADCAST
0
10.1.0.172/24
10.1.0.0
10.1.0.255
1
10.5.1.1/24
10.5.1.0
10.5.1.255
[admin@MikroTik] >

INTERFACE
bridge1
ether1

To make an export file:


[admin@MikroTik] ip address> export file=address
[admin@MikroTik] ip address>
To see the files stored on the router:
[admin@MikroTik] > file print
# NAME
0 address.rsc
[admin@MikroTik] >

TYPE
script

SIZE
315

CREATION-TIME
dec/23/2003 13:21:48

Manual:Configuration Management

94

Compact Export
Starting from v5.12 compact export was added. It allows to export only part of configuration that is not default
RouterOS config.
For example compact OSPF export:
[admin@SXT-ST] /routing ospf> export compact
# jan/02/1970 20:16:32 by RouterOS 5.12
# software id = JRB7-9UGC
#
/routing ospf instance
set [ find default=yes ] redistribute-connected=as-type-1
/routing ospf interface
add disabled=yes interface=wlan1 network-type=point-to-point
/routing ospf network
add area=backbone network=10.255.255.36/32
add area=backbone disabled=yes network=10.5.101.0/24
add area=backbone network=10.10.10.0/24
[admin@SXT-ST] /routing ospf>
Compact export introduces another feature that indicates which part of config is default on RouterOS and cannot be
deleted. As in example below '*' indicates that this OSPF instance is part of default configuration.
[admin@SXT-ST] /routing ospf instance> print
Flags: X - disabled, * - default
0 * name="default" router-id=0.0.0.0 distribute-default=never
redistribute-connected=as-type-1 redistribute-static=no
redistribute-rip=no redistribute-bgp=no redistribute-other-ospf=no
metric-default=1 metric-connected=20 metric-static=20 metric-rip=20
metric-bgp=auto metric-other-ospf=auto in-filter=ospf-in
out-filter=ospf-out
List of default config by menus that cannot be removed:
Menu

Entries

/interface wireless
security-profiles

default

/ppp profile

"default", "default-encryption"

/ip hotspot profile

"default"

/ip hotspot user profile

"default"

/ip ipsec proposal

"default"

/ip smb shares

"pub"

/ip smb users

"guest"

/ipv6 nd

"all"

/mpls interface

"all"

/routing bfd interface

"all"

/routing bgp instance

"default"

/routing ospf instance

"default"

Manual:Configuration Management

/routing ospf area

"backbone"

/routing ospf-v3 instance

"default"

/routing ospf-v3 area

"backbone"

/snmp community

"public"

/tool mac-server
mac-winbox

"all"

/tool mac-server

"all"

/system logging

"info", "error", "warning", "critical"

/system logging action

"memory", "disk", "echo", "remote"

/queue type

"default", "ethernet-default", "wireless-default", "synchronous-default", "hotspot-default", "only-hardware-queue",


"multi-queue-ethernet-default", "default-small"

Importing Configuration
Command name: /import
The root level command /import [file_name] executes a script, stored in the specified file adds the configuration
from the specified file to the existing setup. This file may contain any console comands, including scripts. is used to
restore configuration or part of it after a /system reset event or anything that causes configuration data loss.
Note that it is impossible to import the whole router configuration using this feature. It can only be used to import a
part of configuration (for example, firewall rules) in order to spare you some typing.
Command Description
file=[filename] - loads the exported configuration from a file to router
Automatic Import
Since RouterOS v3rc it is possible to automatically execute scripts - your script file has to be called
anything.auto.rsc - once this file is uploaded with FTP to the router, it will automatically be executed, just like with
the Import command.
Example
To load the saved export file use the following command:
[admin@MikroTik] > import address.rsc
Opening script file address.rsc
Script file loaded and executed successfully
[admin@MikroTik] >

95

Manual:Configuration Management

Configuration Reset
Command name: /system reset-configuration
Description
The command clears all configuration of the router and sets it to the default including the login name and password
('admin' and no password), IP addresses and other configuration is erased, interfaces will become disabled. After the
reset command router will reboot.
Command Description

keep-users: keeps router users and passwords


no-defaults: doesn't load any default cofigurations, just clears everything
skip-backup: automatic backup is not created before reset, when yes is specified
run-after-reset: specify export file name to run after reset
Warning: If the router has been installed using netinstall and had a script specified as the initial
configuration, the reset command executes this script after purging the configuration. To stop it doing so, you
will have to reinstall the router.

Example
[admin@MikroTik] > system reset-configuration
Dangerous! Reset anyway? [y/N]: n
action cancelled
[admin@MikroTik] >

96

Manual:Interface/Bonding

Manual:Interface/Bonding
Applies to RouterOS: v3, v4

Summary
Bonding is a technology that allows to aggregate multiple ethernet-like interfaces into a single virtual link, thus
getting higher data rates and providing failover.

Specifications
Packages required: system
License required: Level1
Submenu level: /interface bonding
Standards and Technologies: None
Hardware usage: Not significant

Quick Setup Guide


Let us assume that we have 2 NICs in each router (Router1 and Router2) and want to get maximum data rate
between 2 routers. To make this possible, follow these steps:
Make sure that you do not have IP addresses on interfaces which will be enslaved for bonding interface!
Add bonding interface on Router1:
[admin@Router1] interface bonding> add slaves=ether1,ether2
And on Router2:
[admin@Router2] interface bonding> add slaves=ether1,ether2
Add addresses to bonding interfaces:
[admin@Router1] ip address> add address=172.16.0.1/24 interface=bonding1
[admin@Router2] ip address> add address=172.16.0.2/24 interface=bonding1
Test the link from Router1:
[admin@Router1] interface bonding> /pi 172.16.0.2
172.16.0.2 ping timeout
172.16.0.2 ping timeout
172.16.0.2 ping timeout
172.16.0.2 64 byte ping: ttl=64 time=2 ms
172.16.0.2 64 byte ping: ttl=64 time=2 ms

97

Manual:Interface/Bonding

98

Note: bonding interface needs a couple of seconds to get connectivity with its peer.

Link monitoring
It is critical that one of available link monitoring options are enabled. In example above if one of
the bonded links fail, bonding driver will still continue to send packets over failed link which will
lead to network degradation. Currently bonding in RouterOS supports two schemes for monitoring a link state of
slave devices: MII and ARP monitoring. It is not possible to use both methods at a time due to restrictions in the
bonding driver.

ARP Monitoring
ARP monitoring sends ARP queries and uses the response as an indication that the link is operational. This also
gives assurance that traffic is actually flowing over the links. If balance-rr and balance-xor modes are set, then the
switch should be configured to evenly distribute packets across all links. Otherwise all replies from the ARP targets
will be received on the same link which could cause other links to fail. ARP monitoring is enabled by setting three
properties link-monitoring, arp-ip-targets and arp-interval. Meaning of each option is described
later in this article. It is possible to specify multiple ARP targets that can be useful in a High Availability setups. If
only one target is set, the target itself may go down. Having an additional targets increases the reliability of the ARP
monitoring.
Enable ARP monitoring
[admin@Router1] interface bonding> set 0 link-monitoring=arp arp-ip-targets=172.16.0.2
[admin@Router2] interface bonding> set 0 link-monitoring=arp arp-ip-targets=172.16.0.1

We will not change arp-interval value in our example, RouterOS sets arp-interval to 100ms by default.
Unplug one of the cables to test if link monitoring works correctly, you will notice some ping timeouts until arp
monitoring detects link failure.
[admin@Router1] interface bonding> /pi
172.16.0.2 ping timeout
172.16.0.2 64 byte ping: ttl=64 time=2
172.16.0.2 ping timeout
172.16.0.2 64 byte ping: ttl=64 time=2
172.16.0.2 ping timeout
172.16.0.2 64 byte ping: ttl=64 time=2
172.16.0.2 64 byte ping: ttl=64 time=2
172.16.0.2 64 byte ping: ttl=64 time=2

172.16.0.2
ms
ms
ms
ms
ms

MII monitoring
MII monitoring monitors only the state of the local interface. In RouterOS it is possible to configure MII monitoring
in two ways:
MII Type 1 - device driver determines whether link is up or down. If device driver does not support this option
then link will appear as always up.
MII Type 2 - deprecated calling sequences within the kernel are used to determine if link is up. This method is
less efficient but can be used on all devices. This mode should be set only if MII type 1 is not supported.
Main disadvantage is that MII monitoring can't tell if the link actually can pass the packets or not even if the link is
detected as up.

Manual:Interface/Bonding
MII monitoring is configured setting desired link-monitoring mode and mii-interval.
Enable MII Type2 monitoring:
[admin@Router1] interface bonding> set 0 link-monitoring=mii-type-2
[admin@Router2] interface bonding> set 0 link-monitoring=mii-type-2
We will leave mii-interval to it's default value (100ms)
When unplugging one of the cables, notice that failure was detected almost instantly compared to ARP link
monitoring.

Bonding modes
802.3ad
802.3ad mode is an IEEE standard also called LACP (Link Aggregation Control Protocol). It includes automatic
configuration of the aggregates, so minimal configuration of the switch is needed. This standard also mandates that
frames will be delivered in order and connections should not see mis-ordering of packets. Also standard mandates
that all devices in the aggregate must operate at the same speed and duplex and works only with MII link monitoring.
LACP balances outgoing traffic across the active ports based on hashed protocol header information and accepts
incoming traffic from any active port. The hash includes the Ethernet source and destination address, and, if
available, the VLAN tag, and the IPv4/IPv6 source and destination address. How has is calculated depends on
transmit-hash-policy parameter.
Note: layer-3-and-4 mode is not fully compatible with LACP.

Configuration example

Example connects two ethernet interfaces on a router to the Edimax switch as a single load balanced and fault
tolerant link. More interfaces can be added to increase throughput and fault tolerance. Since frame ordering is
mandatory on Ethernet links then any traffic between two devices always flows over the same physical link limiting
the maximum speed to that of one interface. The transmit algorithm attempts to use as much information as it can to
distinguish different traffic flows and balance across the available interfaces.
Router R1 configuration:
/inteface bonding add slaves=ether1,ether2 mode=802.3ad lacp-rate=30secs link-monitoring=mii-type1 \
transmit-hash-policy=layer-2-and-3

Configuration on a switch:

99

Manual:Interface/Bonding

100

01 02 03 04 05
- v - v - - - - - - - - - - - - - - - - - - - - - - - - -

Intelligent Switch : Trunk Configuration


==================
06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 M1 M2
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1
2
3
4
5
6
7

TRK1
TRK2
TRK3
TRK4
TRK5
TRK6
TRK7

LACP
Disable
Disable
Disable
Disable
Disable
Disable

Notice that LACP is enabled on first trunk group (TRK1) and switch ports on first trunk group are bound with 'v'
flag. In our case port 2 and port4 will run LACP.
Verify if LACP is working: On the switch at first we should verify if LACP protocol is enabled and running:
Intelligent Switch : LACP Port State Active Configuration
==================

Port
State Activity
--------------------------2
Active
4
Active

Port
State Activity
---------------------------

After that we can ensure that LACP negotiated with our router. If you don't see both ports on the list then something
is wrong and LACP is not going to work.
Intelligent Switch : LACP Group Status
==================

Group
[Actor]

[Partner]

Priority:

65535

MAC

000E2E2206A9

000C42409426

Port_No
2
4

:
Key
513
513

Priority
1
1

Active
selected
selected

Port_No
1
2

Key
9
9

Priority
255
255

Manual:Interface/Bonding
After we verified that switch successfully negotiated LACP with our router, we can start traffic from Client1 and
Client2 to the Server and check how traffic is evenly forwarded through both bonding slaves:
[admin@test-host] /interface> monitor-traffic ether1,ether2,bonding1
rx-packets-per-second: 8158
8120
16278
rx-drops-per-second: 0
0
0
rx-errors-per-second: 0
0
0
rx-bits-per-second: 98.8Mbps 98.2Mbps 197.0Mbps
tx-packets-per-second: 4833
4560
9394
tx-drops-per-second: 0
0
0
tx-errors-per-second: 0
0
0
tx-bits-per-second: 2.7Mbps 3.0Mbps 5.8Mbps

balance-rr
If this mode is set, packets are transmitted in sequential order from the first available slave to the last.
Balance-rr is the only mode that will send packets across multiple interfaces that belong to the same TCP/IP
connection.
When utilizing multiple sending and multiple receiving links, packets often are received out of order, which result in
segment retransmission, for other protocols such as UDP it is not a problem if client software can tolerate
out-of-order packets.
If switch is used to aggregate links together, then appropriate switch port configuration is required, however many
switches do not support balance-rr.
Quick setup guide demonstrates use of the balance-rr bonding mode. As you can see, it is quite simple to set up.
Balance-rr is also useful for bonding several wireless links, however it requires equal bandwidth for all bonded links.
If bandwidth of one bonded link drops, then total bandwidth of bond will be equal to bandwidth of the slowest
bonded link.

active-backup
This mode uses only one active slave to transmit packets. Different slave becomes active only if primary slave fails.
Mac address of the bonding interface is visible only on active port to avoid confusing of the switch. Active-backup is
best choice in high availability setups with multiple switches that are interconnected.
ARP monitoring in this mode will not work correctly if both routers are directly connected. In such setups
mii-type1 or mii-type2 monitoring must be used or switch should be put between routers.

balance-xor
This mode balances outgoing traffic across the active ports based on hashed protocol header information and accepts
incoming traffic from any active port. Mode is very similar to LACP except that it is not standardized and works
with layer-3-and-4 hash policy.

broadcast
When ports configured with broadcast mode, all slave ports transmits the same packets to the destination that way
providing fault tolerance. This mode does not provide load balancing.

101

Manual:Interface/Bonding

balance-tlb
This mode balances outgoing traffic by peer. Each link can be a different speed and duplex and no specific switch
configuration is required as in other modes. Downside of this mode is that only MII link monitoring is supported and
incoming traffic is not balanced. Incoming traffic will use the link that is configured as "primary".
Configuration example
Lets assume than router has two links - ether1 max bandwidth is 10Mbps and ether2 max bandwidth is 5Mbps.
First link has more bandwidth so we set it as primary link
/interface bonding add mode=balance-tlb slaves=ether1,ether2 primary=ether1
No additional configuration is required for the switch.

Image above illustrates how balance-tlb mode works. As you can see router can communicate to all the clients
connected to switch with total bandwidth of both links (15Mbps). But as you already know, balance-tlb is not
balancing incoming traffic. In our example clients can communicate to router with total bandwidth of primary link
which is 10Mbps in our configuration.

balance-alb
Mode is basically the same as balance-tlb but incoming traffic is also balanced. Only additional downside of
this mode is that it requires device driver capability to change mac address. Most of the cheap cards do not support
this mode.

102

Manual:Interface/Bonding

103

Image above illustrates how balance-alb mode works. Compared to balance-tlb traffic from clients also can use
secondary link to communicate with router.

Property Description
Property

Description

arp (disabled | enabled | proxy-arp |


reply-only; Default: enabled)

Address Resolution Protocol for the interface.

arp-interval (time; Default:


00:00:00.100)

time in milliseconds which defines how often to monitor ARP requests

arp-ip-targets (IP addres;


Default: )

IP target address which will be monitored if link-monitoring is set to arp. You can specify
multiple IP addresses, separated by comma

disabled - the interface will not use ARP


enabled - the interface will use ARP
proxy-arp - the interface will use the ARP proxy feature
reply-only - the interface will only reply to the requests originated to its own IP addresses.
Neighbour MAC addresses will be resolved using /ip arp statically set table only

down-delay (time; Default: 00:00:00) if a link failure has been detected, bonding interface is disabled for down-delay time. Value should be a
multiple of mii-interval
lacp-rate (1sec | 30secs; Default:
30secs)

Link Aggregation Control Protocol rate specifies how often to exchange with LACPDUs between
bonding peer. Used to determine whether link is up or other changes have occurred in the network.
LACP tries to adapt to these changes providing failover.

link-monitoring (arp | mii-type1 | method to use for monitoring the link (whether it is up or down)
mii-type2 | none; Default: none)
arp - uses Address Resolution Protocol to determine whether the remote interface is reachable
mii-type1 - uses Media Independent Interface type1 to determine link status. Link status
determenation relies on the device driver
mii-type2 - similar as mii-type1, but status determination does not rely on the device driver
none - no method for link monitoring is used.
Note: some bonding modes require specific link monitoring to work properly.
mii-interval (time; Default:
00:00:00.100)

how often to monitor the link for failures (parameter used only if link-monitoring is mii-type1 or
mii-type2)

Manual:Interface/Bonding

mode (802.3ad | active-backup |


balance-alb | balance-rr | balance-tlb |
balance-xor | broadcast; Default:
balance-rr)

104
Specifies one of the bonding policies

802.3ad - IEEE 802.3ad dynamic link aggregation. In this mode, the interfaces are aggregated in a
group where each slave shares the same speed. Provides fault tolerance and load balancing. Slave
selection for outgoing traffic is done according to the transmit-hash-policy more>
active-backup - provides link backup. Only one slave can be active at a time. Another slave
becomes active only, if first one fails. more>
balance-alb - adaptive load balancing. The same as balance-tlb but received traffic is also
balanced. Device driver should have support for changing the mac address. more>
balance-rr - round-robin load balancing. Slaves in bonding interface will transmit and receive
data in sequential order. Provides load balancing and fault tolerance. more>
balance-tlb - Outgoing traffic is distributed according to the current load on each slave.
Incoming traffic is not balanced and is received by the current slave. If receiving slave fails, then
another slave takes the MAC address of the failed slave. more>
balance-xor - Transmit based on the selected transmit-hash-policy. This mode provides
load balancing and fault tolerance. more>
broadcast - Broadcasts the same data on all interfaces at once. This provides fault tolerance but
slows down traffic throughput on some slow machines. more>

mtu (integer; Default: 1500)

Maximum Transmit Unit in bytes

name (string; Default: )

descriptive name of bonding interface

primary (string; Default: )

Interface is used as primary output interface. If primary interface fails, only then others slaves will be
used. This value works only with active-backup mode

slaves (string; Default: none)

at least two ethernet-like interfaces separated by a comma, which will be used for bonding

up-delay (time; Default: 00:00:00)

if a link has been brought up, bonding interface is disabled for up-delay time and after this time it is
enabled. Value should be a multiple of mii-interval

transmit-hash-policy (layer-2 | Selects the transmit hash policy to use for slave selection in balance-xor and 802.3ad modes
layer-2-and-3 | layer-3-and-4; Default:
layer-2)

layer-2 - Uses XOR of hardware MAC addresses to generate the hash. This algorithm will place
all traffic to a particular network peer on the same slave. This algorithm is 802.3ad compliant.
layer-2-and-3 - This policy uses a combination of layer2 and layer3 protocol information to
generate the hash. Uses XOR of hardware MAC addresses and IP addresses to generate the hash.
This algorithm will place all traffic to a particular network peer on the same slave. For non-IP traffic,
the formula is the same as for the layer2 transmit hash policy. This policy is intended to provide a
more balanced distribution of traffic than layer2 alone, especially in environments where a layer3
gateway device is required to reach most destinations. This algorithm is 802.3ad compliant.
layer-3-and-4 - This policy uses upper layer protocol information, when available, to generate
the hash. This allows for traffic to a particular network peer to span multiple slaves, although a single
connection will not span multiple slaves. For fragmented TCP or UDP packets and all other IP
protocol traffic, the source and destination port information is omitted. For non-IP traffic, the formula
is the same as for the layer2 transmit hash policy. This algorithm is not fully 802.3ad compliant.

Notes
Link failure detection and failover is working significantly better with expensive network cards, for example, made
by Intel, then with more cheap ones. For example, on Intel cards failover is taking place in less than a second after
link loss, while on some other cards, it may require up to 20 seconds. Also, the Active load balancing
(mode=balance-alb) does not work on some cheap cards.

Manual:Interface/Bridge

105

Manual:Interface/Bridge
Applies to RouterOS: v3, v4+

Summary
Sub-menu: /interface bridge
Standards: IEEE802.1D [1]
Ethernet-like networks (Ethernet, Ethernet over IP, IEEE802.11 in ap-bridge or bridge mode, WDS, VLAN) can be
connected together using MAC bridges. The bridge feature allows the interconnection of hosts connected to separate
LANs (using EoIP, geographically distributed networks can be bridged as well if any kind of IP network
interconnection exists between them) as if they were attached to a single LAN. As bridges are transparent, they do
not appear in traceroute list, and no utility can make a distinction between a host working in one LAN and a host
working in another LAN if these LANs are bridged (depending on the way the LANs are interconnected, latency and
data rate between hosts may vary).
Network loops may emerge (intentionally or not) in complex topologies. Without any special treatment, loops would
prevent network from functioning normally, as they would lead to avalanche-like packet multiplication. Each bridge
runs an algorithm which calculates how the loop can be prevented. STP and RSTP allows bridges to communicate
with each other, so they can negotiate a loop free topology. All other alternative connections that would otherwise
form loops, are put to standby, so that should the main connection fail, another connection could take its place. This
algorithm exchange configuration messages (BPDU - Bridge Protocol Data Unit) periodically, so that all bridges
would be updated with the newest information about changes in network topology. (R)STP selects root bridge which
is responosible for network reconfiguration, such as blocking and opening ports of the other bridges. The root bridge
is the bridge with lowest bridge ID.

Bridge Interface Setup


Sub-menu: /interface bridge
To combine a number of networks into one bridge, a bridge interface should be created (later, all the desired
interfaces should be set up as its ports). One MAC address will be assigned to all the bridged interfaces (the smallest
MAC address will be chosen automatically).
Property

Description

admin-mac (MAC address; Default: ) Static MAC address of the bridge (takes effect if auto-mac=no)
ageing-time (time; Default:
00:05:00)

How long a host information will be kept in the bridge database

arp (disabled | enabled | proxy-arp |


reply-only; Default: enabled)

Address Resolution Protocol setting

auto-mac (yes | no; Default: yes)

Automatically select the smallest MAC address of bridge ports as a bridge MAC address

forward-delay (time; Default:


00:00:15)

Time which is spent during the initialization phase of the bridge interface (i.e., after router startup or
enabling the interface) in listening/learning state before the bridge will start functioning normally

l2mtu (integer; read-only)

Layer2 Maximum transmission unit. read more

Manual:Interface/Bridge

106

max-message-age (time; Default:


00:00:20)

How long to remember Hello messages received from other bridges

mtu (integer; Default: 1500)

Maximum Transmission Unit

name (text; Default: bridgeN)

Name of the bridge interface

priority (integer: 0..65535;


Default: 32768)

Spanning tree protocol priority for bridge interface. Bridge with the smallest (lowest) bridge ID becomes a
Root-Bridge. Bridge ID consists of two numbers - priority and MAC address of the bridge. To compare
two bridge IDs, the priority is compared first. If two bridges have equal priority, then the MAC addresses
are compared.

protocol-mode (none | rstp | stp;


Default: none)

Select Spanning tree protocol (STP) or Rapid spanning tree protocol (RSTP) to ensure a loop-free
topology for any bridged LAN. RSTP provides provides for faster spanning tree convergence after a
topology change.

transmit-hold-count (integer:
1..10; Default: 6)

The Transmit Hold Count used by the Port Transmit state machine to limit transmission rate

http://en.wikipedia.org/wiki/Spanning_Tree_Protocol [2]
To add and enable a bridge interface that will forward all the protocols:
[admin@MikroTik] /interface bridge> add
[admin@MikroTik] /interface bridge> print
Flags: X - disabled, R - running
0 R name="bridge1" mtu=1500 l2mtu=65535 arp=enabled
mac-address=00:00:00:00:00:00 protocol-mode=none priority=0x8000
auto-mac=yes admin-mac=00:00:00:00:00:00 max-message-age=20s
forward-delay=15s transmit-hold-count=6 ageing-time=5m
[admin@MikroTik] /interface bridge>

Bridge Settings
Sub-menu: /interface bridge settings
Property

Description

use-ip-firewall (yes | no; Default: no)

Makes bridged traffic to be processed through IP firewall

use-ip-firewall-for-pppoe (yes | no;


Default: no)

Makes bridged unencrypted PPPoE traffic to be processed through IP firewall (requires


use-ip-firewall=yes to work)

use-ip-firewall-for-vlan (yes | no;


Default: no)

Makes bridged VLAN traffic to be processed through IP firewall (requires


use-ip-firewall=yes to work)

Port Settings
Sub-menu: /interface bridge port
Port submenu is used to enslave interfaces in a particular bridge interface.

Manual:Interface/Bridge

107

Property

Description

bridge (name; Default: none)

The bridge interface the respective interface is grouped in

edge (auto | no | no-discover | yes | yes-discover; Default: auto) Set port as edge port or non-edge port, or enable automatic detection
external-fdb (auto | no | yes; Default: auto)

Whether to use wireless registration table to speed up bridge host learning

horizon (none | integer 0..429496729; Default: none)

Use split horizon bridging to prevent bridging loops. read more

interface (name; Default: none)

Name of the interface

path-cost (integer: 0..65535; Default: 10)

Path cost to the interface, used by STP to determine the "best" path

priority (integer: 0..255; Default: 128)

The priority of the interface in comparison with other going to the same subnet

To group ether1 and ether2 in the already created bridge1 bridge


[admin@MikroTik] /interface bridge port> add bridge=bridge1 interface=ether1
[admin@MikroTik] /interface bridge port> add bridge=bridge1 interface=ether2
[admin@MikroTik] /interface bridge port> print
Flags: X - disabled, I - inactive, D - dynamic
#
INTERFACE
BRIDGE
PRIORITY PATH-COST HORIZON
0
ether1
bridge1
0x80
10
none
1
ether2
bridge1
0x80
10
none
[admin@MikroTik] /interface bridge port>

Bridge Monitoring
Sub-menu: /interface bridge monitor
Used to monitor the current status of a bridge.
Property

Description

current-mac-address (MAC address) Current MAC address of the bridge


designated-port-count (integer)

Number of designated bridge ports

port-count (integer)

Number of the bridge ports

root-bridge (yes | no)

Shows whether bridge is the root bridge of the spanning tree

root-bridge-id (text)

The root bridge ID, which is in form of bridge-priority.bridge-MAC-address

root-path-cost (integer)

The total cost of the path to the root-bridge

root-port (name)

Port to which the root bridge is connected to

state (enabled | disabled)

State of the bridge

To monitor a bridge:
[admin@MikroTik] /interface bridge> monitor bridge1
state: enabled
current-mac-address: 00:0C:42:52:2E:CE
root-bridge: yes
root-bridge-id: 0x8000.00:00:00:00:00:00
root-path-cost: 0
root-port: none
port-count: 2
designated-port-count: 0

Manual:Interface/Bridge

108

[admin@MikroTik] /interface bridge>

Bridge Port Monitoring


Sub-menu: /interface bridge port monitor
Statistics of an interface that belongs to a bridge.
Property

Description

edge-port-discovery (yes | no)

Whether port to automatically detects edge ports

external-fdb (yes | no)

Shows whether registration table is used instead of forwarding data base

forwarding (yes | no)

Port state

learning (yes | no)

Port state

port-number (integer 1..4095)

Port identifier

role (designated | root port | alternate | backup |


disabled)

(R)STP algorithm assigned role of the port:

Disabled port - not strictly part of STP, a network administrator can manually disable
a port
Root port a forwarding port that is the best port from Nonroot-bridge to Rootbridge
Alternative port an alternate path to the root bridge. This path is different than using
the root port
Designated port a forwarding port for every LAN segment
Backup port a backup/redundant path to a segment where another bridge port
already connects.

sending-rstp (yes | no)

Whether the port is sending BPDU messages

status (in-bridge | inactive)

Port status

To monitor a bridge port:


[admin@MikroTik] /interface bridge port> monitor 0
status: in-bridge
port-number: 1
role: designated-port
edge-port: no
edge-port-discovery: yes
point-to-point-port: no
external-fdb: no
sending-rstp: no
learning: yes
forwarding: yes
[admin@MikroTik] /interface bridge port>

Manual:Interface/Bridge

109

Bridge Host Monitoring


Sub-menu: /interface bridge host
Property

Description

age (read-only: time)

The time since the last packet was received from the host

bridge (read-only: name)

The bridge the entry belongs to

external-fdb (read-only: flag)

Whether the host was learned using wireless registration table

local (read-only: flag)

Whether the host entry is of the bridge itself (that way all local interfaces are shown)

mac-address (read-only: MAC address) Host's MAC address


on-interface (read-only: name)

Which of the bridged interfaces the host is connected to

To get the active host table:


[admin@MikroTik] /interface bridge host> print
Flags: L - local, E - external-fdb
BRIDGE
MAC-ADDRESS
ON-INTERFACE
bridge1
00:00:00:00:00:01 ether2
bridge1
00:01:29:FF:1D:CC ether2
L bridge1
00:0C:42:52:2E:CF ether2
bridge1
00:0C:42:52:2E:D0 ether2
bridge1
00:0C:42:5C:A5:AE ether2
[admin@MikroTik] /interface bridge host>

AGE
3s
0s
0s
3s
0s

Bridge Firewall
Sub-menu: /interface bridge filter, /interface bridge nat
The bridge firewall implements packet filtering and thereby provides security functions that are used to manage data
flow to, from and through bridge.
Packet flow diagram shows how packets are processed through router. It is possible to force bridge traffic to go
through /ip firewall filter rules (see: Bridge Settings)
There are two bridge firewall tables:
filter - bridge firewall with three predefined chains:
input - filters packets, which destination is the bridge (including those packets that will be routed, as they are
anyway destined to the bridge MAC address)
output - filters packets, which come from the bridge (including those packets that has been routed normally)
forward - filters packets, which are to be bridged (note: this chain is not applied to the packets that should be
routed through the router, just to those that are traversing between the ports of the same bridge)
nat - bridge network address translation provides ways for changing source/destination MAC addresses of the
packets traversing a bridge. Has two built-in chains:
srcnat - used for "hiding" a host or a network behind a different MAC address. This chain is applied to the
packets leaving the router through a bridged interface
dstnat - used for redirecting some pakets to another destinations
You can put packet marks in bridge firewall (filter and NAT), which are the same as the packet marks in IP firewall
put by mangle. So packet marks put by bridge firewall can be used in IP firewall, and vice versa.
General bridge firewall properties are described in this section. Some parameters that differ between nat and filter
rules are described in further sections.

Manual:Interface/Bridge
Property802.3-sap
(integer)802.3-type
(integer)arp-dst-address
(IP
address;
default:
)arp-dst-mac-address
(MAC address; default: )arp-gratuitous
(yes | no; default:
)arp-hardware-type (integer; default: 1)arp-opcode (arp-nak | drarp-error | drarp-reply | drarp-request |
inarp-reply | inarp-request | reply | reply-reverse | request | request-reverse)arp-src-address (IP address;
default: )arp-src-mac-address (MAC address; default: )chain (text)dst-address (IP address;
default: )dst-mac-address (MAC address; default: )dst-port (integer 0..65535)in-bridge
(name)in-interface (name)ingress-priority (integer 0..63)ip-protocol (ddp | ggp | icmp | igmp |
ipsec-ah | ospf | rdp | tcp | vrrp | egp | gre | icmpv6 | ipencap | ipsec-esp | pim | rspf | udp | xns-idp | encap | hmp |
idpr-cmtp | ipip | iso-tp4 | pup | st | vmtp | xtp)jump-target
(name)limit
(integer/time,integer)log-prefix (text)mac-protocol (arp | ip | ipv6 | ipx | length | pppoe | pppoe-discovery |
rarp | vlan)out-bridge (name)out-interface (name)packet-mark (name)packet-type (broadcast
| host | multicast | other-host)src-address (IP address; default: )src-mac-address (MAC address;
default:
)src-port
(integer
0..65535)stp-flags
(topology-change
|
topology-change-ack)stp-forward-delay
(time
0..65535)stp-hello-time
(time
0..65535)stp-max-age
(time
0..65535)stp-msg-age
(time
0..65535)stp-port
(integer
0..65535)stp-root-address (MAC address)stp-root-cost (integer 0..65535)stp-root-priority
(integer
0..65535)stp-sender-address
(MAC
address)stp-sender-priority
(integer
0..65535)stp-type (config | tcn)vlan-encap (arp | ip | ipv6 | ipx | length | pppoe | pppoe-discovery | rarp |
vlan )vlan-id (integer 0..4095)vlan-priority (integer 0..7)DescriptionDSAP (Destination Service Access
Point) and SSAP (Source Service Access Point) are 2 one byte fields, which identify the network protocol entities
which use the link layer service. These bytes are always equal. Two hexadecimal digits may be specified here to
match an SAP byteEthernet protocol type, placed after the IEEE 802.2 frame header. Works only if 802.3-sap is
0xAA (SNAP - Sub-Network Attachment Point header). For example, AppleTalk can be indicated by SAP code of
0xAA followed by a SNAP type code of 0x809BARP destination addressARP destination MAC addressMatches
ARP gratuitous packetsARP hardware type. This normally Ethernet (Type 1) ARP opcode (packet type)
arp-nak - negative ARP reply (rarely used, mostly in ATM networks)
drarp-error - Dynamic RARP error code, saying that an IP address for the given MAC address can not be
allocated
drarp-reply - Dynamic RARP reply, with a temporaty IP address assignment for a host
drarp-request - Dynamic RARP request to assign a temporary IP address for the given MAC address
inarp-reply inarp-request reply - standard ARP reply with a MAC address
reply-reverse - reverse ARP (RARP) reply with an IP address assigned
request - standard ARP request to a known IP address to find out unknown MAC address
request-reverse - reverse ARP (RARP) request to a known MAC address to find out unknown IP address
(intended to be used by hosts to find out their own IP address, similarly to DHCP service)
ARP source addressARP source MAC addressBridge firewall chain, which the filter is functioning in (either a
built-in one, or a user defined)Destination IP address (only if MAC protocol is set to IPv4)Destination MAC
addressDestination port number or range (only for TCP or UDP protocols)Bridge interface through which the packet
is coming inPhysical interface (i.e., bridge port) through which the packet is coming inMatches ingress priority of
the packet. Priority may be derived from VLAN, WMM or MPLS EXP bit. read more IP protocol (only if MAC
protocol is set to IPv4)
ipsec-ah - IPsec AH protocol
ipsec-esp - IPsec ESP protocol
ddp - datagram delivery protocol
egp - exterior gateway protocol

110

Manual:Interface/Bridge

ggp - gateway-gateway protocol


gre - general routing encapsulation
hmp - host monitoring protocol
idpr-cmtp - idpr control message transport
icmp - internet control message protocol
icmpv6 igmp - internet group management protocol
ipencap - ip encapsulated in ip
encap - ip encapsulation
ipip - ip encapsulation
iso-tp4 - iso transport protocol class 4
ospf - open shortest path first
pim - protocol independent multicast
pup - parc universal packet protocol
rspf - radio shortest path first
rdp - reliable datagram protocol
st - st datagram mode

tcp - transmission control protocol


udp - user datagram protocol
vmtp - versatile message transport
vrrp xns-idp - xerox ns idp
xtp xpress transfer protocol

If action=jump specified, then specifies the user-defined firewall chain to process the packet Restricts packet
match rate to a given limit.
count - maximum average packet rate, measured in packets per second (pps), unless followed by Time option
time - specifies the time interval over which the packet rate is measured
burst - number of packets to match in a burst
Defines the prefix to be printed before the logging informationEthernet payload type (MAC-level protocol)Outgoing
bridge interfaceInterface via packet is leaving the bridgeMatch packets with certain packet mark MAC frame type:

broadcast - broadcast MAC packet


host - packet is destined to the bridge itself
multicast - multicast MAC packet
other-host - packet is destined to some other unicast address, not to the bridge itself

Source IP address (only if MAC protocol is set to IPv4)Source MAC addressSource port number or range (only for
TCP or UDP protocols) The BPDU (Bridge Protocol Data Unit) flags. Bridge exchange configuration messages
named BPDU peridiocally for preventing from loop
topology-change - topology change flag is set when a bridge detects port state change, to force all other bridges
to drop their host tables and recalculate network topology
topology-change-ack - topology change acknowledgement flag is sen in replies to the notification packets
Forward delay timerSTP hello packets timeMaximal STP message ageSTP message ageSTP port identifierRoot
bridge MAC addressRoot bridge costRoot bridge prioritySTP message sender MAC addressSTP sender priority The
BPDU type:
config - configuration BPDU
tcn - topology change notification

111

Manual:Interface/Bridge

112

the MAC protocol type encapsulated in the VLAN frameVLAN identifier fieldThe user priority field
STP matchers are only valid if destination MAC address is 01:80:C2:00:00:00/FF:FF:FF:FF:FF:FF (Bridge Group
address), also stp should be enabled.
ARP matchers are only valid if mac-protocol is arp or rarp
VLAN matchers are only valid for vlan ethernet protocol
IP-related matchers are only valid if mac-protocol is set as ipv4
802.3 matchers are only consulted if the actual frame is compliant with IEEE 802.2 and IEEE 802.3 standards
(note: it is not the industry-standard Ethernet frame format used in most networks worldwide!). These matchers
are ignored for other packets.

Bridge Packet Filter


Sub-menu: /interface bridge filter
This section describes bridge packet filter specific filtering options, which were omitted in the general firewall
description.
Property

Description

action (accept | drop | jump | log | mark-packet


| passthrough | return | set-priority)

accept - accept the packet. No action, i.e., the packet is passed through without undertaking
any action, and no more rules are processed in the relevant list/chain
drop - silently drop the packet (without sending the ICMP reject message)
jump - jump to the chain specified by the value of the jump-target argument
log - log the packet
mark - mark the packet to use the mark later
passthrough - ignore this rule and go on to the next one. Acts the same way as a disabled
rule, except for ability to count packets
return - return to the previous chain, from where the jump took place
set-priority

Bridge NAT
Sub-menu: /interface bridge nat
This section describes bridge NAT options, which were omitted in the general firewall description.
Property

Description

Manual:Interface/Bridge

113

action (accept | drop | jump | mark-packet | redirect | set-priority


| arp-reply | dst-nat | log | passthrough | return | src-nat)

accept - accept the packet. No action, i.e., the packet is passed through
without undertaking any action, and no more rules are processed in the
relevant list/chain
arp-reply - send a reply to an ARP request (any other packets will be
ignored by this rule) with the specified MAC address (only valid in
dstnat chain)
drop - silently drop the packet (without sending the ICMP reject
message)
dst-nat - change destination MAC address of a packet (only valid in
dstnat chain)
jump - jump to the chain specified by the value of the jump-target
argument
log - log the packet
mark - mark the packet to use the mark later
passthrough - ignore this rule and go on to the next one. Acts the same
way as a disabled rule, except for ability to count packets
redirect - redirect the packet to the bridge itself (only valid in dstnat
chain)
return - return to the previous chain, from where the jump took place
set-priority
src-nat - change source MAC address of a packet (only valid in srcnat
chain)

to-arp-reply-mac-address (MAC address)

Source MAC address to put in Ethernet frame and ARP payload, when
action=arp-reply is selected

to-dst-mac-address (MAC address)

Destination MAC address to put in Ethernet frames, when


action=dst-nat is selected

to-src-mac-address (MAC address)

Source MAC address to put in Ethernet frames, when action=src-nat


is selected

[ Top | Back to Content ]

References
[1] http:/ / standards. ieee. org/ getieee802/ download/ 802. 1D-2004. pdf
[2] http:/ / en. wikipedia. org/ wiki/ Spanning_Tree_Protocol

Manual:Interface/VRRP

Manual:Interface/VRRP
Applies to RouterOS: v3, v4, v5

Summary
Sub-menu level: /interface vrrp
Standards: RFC 5798, RFC 3768
This chapter describes the Virtual Router Redundancy Protocol (VRRP) support in RouterOS.
Mostly on larger LANs dynamic routing protocols ( OSPF or RIP) are used, however there are number of factors that
may make undesirable to use dynamic routing protocols. One alternative is to use static routing, but if statically
configured first hop fails, then host will not be able to communicate with other hosts.
In IPv6 networks, hosts learn about routers by receiving Router Advertisements used by Neighbor Discovery (ND)
protocol. ND already has built in mechanism to determine unreachable routers. However it can take up to 38seconds
to detect unreachable router. It is possible to change parameters and make detection faster, but it will increase
overhead of ND traffic especially if there are a lot of hosts. VRRP allows to detect unreachable router within
3seconds without additional traffic overhead.
Virtual Router Redundancy Protocol (VRRP) provides a solution by combining number of routers into logical group
called Virtual Router (VR). VRRP implementation in RouterOS is compliant to VRRPv2 RFC 3768 and VRRPv3
RFC 5798.

114

Manual:Interface/VRRP

115

Protocol Overview
The purpose of the VRRP is to
communicate to all VRRP routers
associated with the Virtual Router ID
and support router redundancy through
a prioritized election process among
them.
All messaging is done by IPv4 or IPv6
multicast packets. Destination address
of IPv4 packet is 224.0.0.12 and for
IPv6 it is FF02:0:0:0:0:0:0:12. Source
address of the packet is always the
primary IP address of an interface from
which the packet is being sent. In IPv6
networks source address is link-local
address of an interface.
These packets are always sent with
TTL=255 and are not forwarded by the
router. If for any reason router receives
a packet with lower TTL, packet is
discarded.

Simple VRRP example

Each VR node has a single assigned


MAC address. This MAC address is used as a source for all periodic messages sent by Master.
Virtual Router is defined by VRID and mapped set of IPv4 or IPv6 addresses. Master router is said to be the owner
of mapped IPv4/IPv6 addresses. There are no limits to use the same VRID for IPv4 and IPv6, however these will be
two different Virtual Routers.
Only Master router is sending periodic Advertisement messages to minimize the traffic. Backup will try to preempt
the Master only if it has the higher priority and preemption is not prohibited.
All VRRP routers belonging to the same VR must be configured with the same advertisement interval. If
interval does not match router will discard received advertisement packet.

Virtual Router (VR)


A Virtual Router (VR) consists of one Owner router and one or more backup routers belonging to the same network.
VR includes:
VRID configured on each VRRP router
the same virtual IP on each router
Owner and Backup configured on each router. On a given VR there can be only one Owner.

Manual:Interface/VRRP

116

Virtual MAC address


VRRP automatically assigns MAC address to VRRP interface based on standard MAC prefix for VRRP packets and
VRID number. First five octets are 00:00:5E:00:01 and last octet is configured VRID. For example, Virtual Routers
VRID is 49, then virtual MAC address will be 00:00:5E:00:01:31.
Note: Virtual mac address can not be manually set or edited.

Owner
An Owner router for a VR is default
Master router and operates as the
Owner for all subnets included in the
VR. As mentioned before priority on
an owner router must be the highest
value (255). In example network R1 is
an Owner. It's priority is set to 255 and
virtual IP is the same as real IP (owns
the virtual IP address).
All Virtual Router members can be
configured so that virtual IP is not the
same as physical IP. Such Virtual
address can be called floating or pure virtual IP address.

VRRP without Owner

Advantage of this setup is flexibility given to the administrator. Since the virtual IP address is not the real address of
any one of the participant routers, the administrator can change these physical routers or their addresses without any
need to reconfigure the virtual router itself.
Note: RouterOS can not be configured as Owner. Pure virtual IP configuration is the only valid configuration
unless non-RouterOS device is set as owner.

Master
Master router in a VR operates as the physical gateway for the network for which it is configured.
Selection of the Master is controlled by priority value. Master state describes behavior of Master router. In example
network R1 is the Master router. When R1 is no longer available R2 becomes master.

Manual:Interface/VRRP

Backup
VR must contain at least one Backup router. Backup router must be configured with the same virtual IP as Master for
that VR. Default priority for Backup routers is 100. When current master router is no longer available, backup router
with highest priority will become current master. Every time when router with higher priority becomes available it is
switched to master. Sometimes this behavior is not necessary. To override it preemption mode should be disabled.

Virtual Address
Virtual IP associated with VR must be identical and set on all VR nodes. On Owner router Virtual IP must be the
same as real IP. For example on Owner router real IP and virtual IP is 192.168.1.1, on Backup router virtual IP is
192.168.1.1, but real IP is 192.168.1.2. All virtual and real addresses should be from the same network.
If the Master of VR is associated with multiple IP addresses, then Backup routers belonging to the same VR must
also be associated with the same set of virtual IP addresses. If virtual address on the Master is not also on Backup a
misconfiguration exists and VRRP advertisement packets will be discarded.
Note: It is not recommended to set up Mikrotik router as an Owner router. VRRP address and real IP address
should not be the same.

In IPv6 networks first address is always link-local address associated to VR. If multiple IPv6
addresses are configured, then they are added in advertisement packet after the link-local address.

IPv4 ARP
The Master for a given VR responds to ARP requests with the VR's assigned MAC address. Virtual MAC address is
also used as the source MAC address for advertisement packets sent by the Master. To ARP requests for non-virtual
IP addresses router responds with the system MAC address. Backup routers are not responding to ARP requests for
Virtual IPs.

IPv6 ND
As you already know there are no ARP in IPv6 networks, routers are discovered by Neighbor Discovery protocol.
When router becomes the Master, unsolicited ND Neighbor Advertisement with the Router Flag is sent for each IPv6
address associated with the virtual router.

117

Manual:Interface/VRRP

VRRP state machine


As you can see from diagram, each
VRRP node can be in one of three
states:
Init state
Backup state
Master state

Init state
The purpose of this state is to wait for
a Startup event. When this event is
received, then following actions are
taken:
if priority is 255,
* for IPv4 send advertisement
VRRP state transition flow
packet and broadcast ARP requests
* for IPv6 send an unsolicited ND Neighbor Advertisement for each IPv6 address associated with the virtual
router and set target address to link-local address associated with VR.
* transit to MASTER state;
else transit to BACKUP state.

Backup state
When in backup state,
in IPv4 networks, node is not responding to ARP requests and is not forwarding traffic for the IP associated with
the VR.
in IPv6 networks, node is not responding to ND Neighbor Solicitation messages and is not sending ND Router
Advertisement messages for VR associated IPv6 addresses.
Routers main task is to receive advertisement packets and check if master node is available.
Backup router will transit itself to master state in two cases:
If priority in advertisement packet is 0;
When Preemption_Mode is set to no, or Priority in the ADVERTISEMENT is greater than or equal to the local
Priority
After transition to Master state node is:
in IPv4 broadcasts gratuitous ARP request;
in IPv6 sends an unsolicited ND Neighbor Advertisement for every associated IPv6 address.
In other cases advertisement packets will be discarded. When shutdown event is received, transit to Init state.
Note: Preemption mode is ignored if Owner router becomes available.

Master state
When MASTER state is set, node functions as a forwarding router for IPv4/IPv6 addresses
associated with the VR.
In IPv4 networks Master node responds to ARP requests for the IPv4 address associated with the VR. In IPv6
networks Master node:

118

Manual:Interface/VRRP
responds to ND Neighbor Solicitation message for the associated IPv6 address;
sends ND Router Advertisements for the associated IPv6 addresses.
If advertisement packet is received by master node:
If priority is 0, send advertisement immediately;
If priority in advertisement packet is greater than nodes priority then transit to backup state
If priority in advertisement packet is equal to nodes priority and primary IP Address of the sender is greater than
the local primary IP Address, then transit to backup state
Ignore advertisement in other cases
When shutdown event is received, send advertisement packet with priority=0 and transit to Init state.

Configuring VRRP
IPv4
Setting up Virtual Router is quite easy, only two actions are required - create vrrp interface and set Virtual Routers
IP address.
For example, add vrrp to ether1 and set VRs address to 192.168.1.1
/interface vrrp add name=vrrp1 interface=ether1
/ip address add address=192.168.1.1/32 interface=vrrp1
Notice that only 'interface' parameter was specified when adding vrrp. It is the only parameter required to be set
manually, other parameters if not specified will be set to their defaults: vrid=1, priority=100 and
authentication=none.
Note: address on VRRP interface must have /32 netmask.

Before VRRP can operate correctly correct IP address is required on ether1. In this example it is
192.168.1.2/24
VRRP Examples section contains several configuration examples.

IPv6
To make VRRP work in IPv6 networks, several additional options must be enabled - v3 support is required and
protocol type should be set to IPv6:
/interface vrrp add name=vrrp1 interface=ether1 version=3 v3-protocol=ipv6
Now when VRRP interface is set, we can add global address and enable ND advertisement:
/ipv6 address add address=FEC0:0:0:FFFF::1/64 advertise=yes interface=vrrp1
No additional address configuration is required as it is in IPv4 case. IPv6 uses link-local addresses to communicate
between nodes.

119

Manual:Interface/VRRP

120

Property reference
Sub-menu: /interface vrrp
Property

Description

arp (disabled | enabled | proxy-arp | ARP resolution protocol mode


reply-only; Default: enabled)
authentication (ah | none |
simple; Default: none)

Authentication method to use for VRRP advertisement packets.

none - should be used only in low security networks (e.g., two VRRP nodes on LAN).
ah - IP Authentication Header. This algorithm provides strong protection against configuration errors,
replay attacks and packet corruption/modification. Recommended when there is limited control over the
administration of nodes on a LAN.
simple - uses clear text password. Protects against accidental misconfiguration of routers on local
network.

interface (string; Default: )

Interface name on which VRRP instance will be running

interval (time [10ms..4m15s];


Default: 1s)

VRRP update interval in seconds. Defines how often master sends advertisement packets.

mtu (integer; Default: 1500)

Layer3 MTU size

name (string; Default: )

VRRP interface name

on-backup (string; Default: )

Script to execute when the node is switched to backup state

on-master (string; Default: )

Script to execute when the node is switched to master state

password (string; Default: )

Password required for authentication. Can be ignored if authentication is not used.

preemption-mode (yes | no;


Default: yes)

Whether master node always has the priority. When set to 'no' backup node will not be elected to be a master
until the current master fails, even if the backup node has higher priority than the current master. This
setting is ignored if Owner router becomes available

priority (integer: 1..254; Default: Priority of VRRP node used in Master election algorithm. Higher number means higher priority. '255' is
100)
reserved to Router that owns VR IP and '0' is reserved for Master router to indicate that it is releasing
responsibility.
v3-protocol (ipv4 | ipv6;
Default: ipv4)

Protocol that will be used by VRRPv3. Valid only if version is 3

version (integer [2, 3]; Default: 3) Which VRRP version to use.


vrid (integer: 1..255; Default: 1)

Virtual Router identifier. Each Virtual router must have unique id number

There are two ways to add scripts to on-backup and on-master


specify scripts name added to script repository
write script directly by putting it in scopes '{ }'.

See more
VRRP-examples
[ Top | Back to Content ]

Manual:Bonding Examples

Manual:Bonding Examples
ARP Link Monitoring HowTo
About
This is an example of aggregating multiple network interfaces into a single pipe. In particular, it is shown how to
aggregate multiple virtual (EoIP) interfaces to get maximum throughput (MT) with emphasis on availability.

Objective
You will learn how to connect remote locations via multiple physical links. The combined pipe will deliver higher
throughput and availability then the individual links.

Network Diagram
Two routers R1 and R2 are interconnected via multihop wireless links. Wireless interfaces on both sides have
assigned IP addresses.

Getting started
Bonding could be used only on OSI layer 2 (Ethernet level) connections. Thus we need to create EoIP interfaces on
each of the wireless links. This is done as follows:
on router R1:
[admin@MikroTik] > /interface eoip add remote-address=10.0.1.1/24 tunnel-id=1
[admin@MikroTik] > /interface eoip add remote-address=10.0.2.1/24 tunnel-id=2
and on router R2
[admin@MikroTik] > /interface eoip add remote-address=10.1.1.1/24 tunnel-id=1
[admin@MikroTik] > /interface eoip add remote-address=10.2.2.1/24 tunnel-id=2
The second step is to add bonding interface and specify EoIP interfaces as slaves:
on router R1:
[admin@MikroTik] > / interface bonding add slaves=eoip-tunnel1,eoip-tunnel2 mode=balance-rr

Refer to the following page regarding bonding mode selection.


and on router R2
[admin@MikroTik] > / interface bonding add slaves=eoip-tunnel1,eoip-tunnel2 mode=balance-rr

121

Manual:Bonding Examples
The last step is to add IP addresses to the bonding interfaces:
on router R1:
[admin@MikroTik] > / ip address add address 192.168.0.1/24 interface=bonding1
Tip: Refer to the following page regarding bonding mode selection.
and on router R2
[admin@MikroTik] > / ip address add address 192.168.0.2/24 interface=bonding1

Test the configuration


Now two routers are able to reach each other using addresses from the 192.168.0.0/24 network. To verify bonding
interface functionality, do the following:
on router R1:
[admin@MikroTik] > /interface monitor-traffic eoip-tunnel1,eoip-tunnel2
and on router R2
[admin@MikroTik] > /tool bandwidth-test 192.168.0.1 direction=transmit
You should see that traffic is distributed equally across both EoIP interfaces:
[admin@MikroTik] > /int monitor-traffic eoip-tunnel1,eoip-tunnel2
received-packets-per-second: 685
685
received-bits-per-second: 8.0Mbps 8.0Mbps
sent-packets-per-second: 21
20
sent-bits-per-second: 11.9kbps 11.0kbps
received-packets-per-second: 898
899
received-bits-per-second: 10.6Mbps 10.6Mbps
sent-packets-per-second: 20
21
sent-bits-per-second: 11.0kbps 11.9kbps
received-packets-per-second: 975
975
received-bits-per-second: 11.5Mbps 11.5Mbps
sent-packets-per-second: 22
22
sent-bits-per-second: 12.4kbps 12.3kbps
received-packets-per-second: 980
980
received-bits-per-second: 11.6Mbps 11.6Mbps
sent-packets-per-second: 21
21
sent-bits-per-second: 11.9kbps 11.8kbps
received-packets-per-second: 977
977
received-bits-per-second: 11.6Mbps 11.5Mbps
sent-packets-per-second: 21
21
sent-bits-per-second: 11.9kbps 11.8kbps
-- [Q quit|D dump|C-z pause]
[admin@MikroTik] >

122

Manual:Bonding Examples

Link Monitoring
It is easy to notice that with the configuration above as soon as any of individual link fails, the bonding interface
throughput collapses. That's because no link monitoring is performed, consequently, the bonding driver is unaware
of problems with the underlying links. Enabling link monitoring is a must in most bonding configurations. To enable
ARP link monitoring (recommended), do the following:
on router R1:
[admin@MikroTik] > / interface bonding set bonding1 link-monitoring=arp arp-ip-targets=192.168.0.2

Refer to the following page regarding bonding mode selection.


and on router R2
[admin@MikroTik] > / interface bonding set bonding1 link-monitoring=arp arp-ip-targets=192.168.0.1

Tip: Refer to the following page for information about different link monitoring types.

Manual:VRRP-examples
Applies to RouterOS: v3, v4

VRRP Configuration Examples


This section contains several useful VRRP configuration examples

123

Manual:VRRP-examples

Basic Setup
This is the basic VRRP configuration example.

According to this configuration, as long as the master, R1, is functional, all traffic destined to the external network
gets directed to R1. But as soon as R1 fails, R2 takes over as the master and starts handling packets forwarded to the
interface associated with IP(R1). In this setup Router R2 is completely idle during Backup period.
Configuration
R1 configuration:
/ip address add address=192.168.1.1/24 interface=ether1
/interface vrrp add interface=ether1 vrid=49 priority=254
/ip address add address=192.168.1.254/32 interface=vrrp1
R2 configuration:
/ip address add address=192.168.1.2/24 interface=ether1
/interface vrrp add interface=ether1 vrid=49
/ip address add address=192.168.1.254/32 interface=vrrp1
Testing
First of all check if both routers have correct flags at vrrp interfaces. On router R1 it should look like this
/interface vrrp print
0

RM name="vrrp1" mtu=1500 mac-address=00:00:5E:00:01:31 arp=enabled interface=ether1 vrid=49


priority=254 interval=1 preemption-mode=yes authentication=none password="" on-backup=""
on-master=""

and on router R2:

124

Manual:VRRP-examples
/interface vrrp print
0

B name="vrrp1" mtu=1500 mac-address=00:00:5E:00:01:31 arp=enabled interface=ether1 vrid=49


priority=100 interval=1 preemption-mode=yes authentication=none password=""
on-backup="" on-master="

As you can see vrrp interface mac addresses are identical on both routers. Now to check if vrrp is working correctly,
try to ping virtual address from client and check arp entries:
[admin@client] > /ping 192.168.1.254
192.168.1.254 64 byte ping: ttl=64 time=10 ms
192.168.1.254 64 byte ping: ttl=64 time=8 ms
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 8/9.0/10 ms
[admin@client] /ip arp> print
Flags: X - disabled, I - invalid, H - DHCP, D - dynamic
#
ADDRESS
MAC-ADDRESS
INTERFACE
...
1 D 192.168.1.254
00:00:5E:00:01:31 bridge1
Now unplug ether1 cable on router R1. R2 will become VRRP master, ARP table on client will not change but
traffic will start to flow over R2 router.

Load sharing
In basic configuration example R2 is completely idle during Backup state. This behavior may be considered as waste
of valuable resources. In such circumstances R2 router can be set as gateway for some clients.
The obvious advantage of this configuration is the establishment of a load-sharing scheme. But by doing so R2
router is not protected by current VRRP setup.
To make this setup work we need two virtual routers.

125

Manual:VRRP-examples

126

Configuration for V1 virtual router will be identical to configuration in basic example - R1 is the Master and R2 is
Backup router. In V2 Master is R2 and Backup is R1.
With this configuration, we establish a load-sharing between R1 and R2; moreover, we create protection setup by
having two routers acting as backups for each other.
Configuration
R1 configuration:
/ip address add
/interface vrrp
/interface vrrp
/ip address add
/ip address add

address=192.168.1.1/24 interface=ether1
add interface=ether1 vrid=49 priority=254
add interface=ether1 vrid=77
address=192.168.1.253/32 interface=vrrp1
address=192.168.1.254/32 interface=vrrp2

R2 configuration:
/ip address add
/interface vrrp
/interface vrrp
/ip address add
/ip address add

address=192.168.1.2/24 interface=ether1
add interface=ether1 vrid=49
add interface=ether1 vrid=77 priority=254
address=192.168.1.253/32 interface=vrrp1
address=192.168.1.254/32 interface=vrrp2

Manual:VRRP-examples

VRRP without Preemption


Each time when router with higher priority becomes available it becomes Master router. Sometimes it is not desired
behavior which can be turned off by setting preemption-mode=no in vrrp configuration.
Configuraton
We will be using the same setup as in basic example. Only difference is during configuration set
preemption-mode=no. It can be done easily modifying existing configuration:
/interface vrrp set [find] preemption-mode=no
Testing
Try turning off R1 router, R2 will become Master router because it has highest priority among available routers.
Now turn R1 router on and you will see that R2 router continues to be Master even if R1 has higher priority.

VRRP and scripts

See Also
VRRP
Scripting
[ Top | Back to Content ]

Manual:Wireless AP Client
Applies to RouterOS: v3, v4

Summary
Configuration example shows how to establish simple wireless network by using MikroTik RouterOS. MikroTik
RouterOS is fully compliant with IEEE802.11a/b/g/n standards, MikroTik RouterOS device [1] can be used as
wireless access-point and wireless station (other modes [2] are supported too).

127

Manual:Wireless AP Client

Configuration setup
Our basic configuration setup is

128

Manual:Wireless AP Client

Access Point Configuration


Connect to the router via Winbox [3]
Setup Wireless interface, necessary configuration options are mode=ap-bridge band=ap_operated_band
frequency=ap_operated_frequency ssid=network_identification

These settings are enough to establish wireless connection, additionally you need to add IP address for the
wireless interface for IP routing, optionally add security and other settings.

129

Manual:Wireless AP Client

Station Configuration
Wireless client configuration example is for MikroTik RouterOS, other vendor OS configuration should be
looked in the appropriate documentation/forum/mailing list etc.
Connect to the client router via the same way and proceed to the Wireless interface configuration.
Necessary configuration options are mode=station band=band_ap_operates_on ssid=ap_network_ssid

These settings are enough to establish wireless connection, additionally you need to set IP address for the wireless
interface to establish IP routing communication with access point, optionally use security and other settings.

130

Manual:Wireless AP Client

Additional Configuration
IP Configuration
Add IP address to Access Point router, like 192.168.0.1/24

Add IP address to Client router, address should be from the same subnet like 192.168.0.2/24

Check IP communication by ping from station (for example),

131

Manual:Wireless AP Client

Additional Access Point Configuration


All the necessary settings for the simple Access Point are showed here [4].
Security profiles are used for WPA/WPA2 protection, configuration options are explained here [5]. Usually all
wireless clients share the same security configuration as access point.
mode=ap-bridge allows 2007 clients, max-station-count is used to limit the number of wireless client per Access
Point. Wireless mode=bridge is used for point-to-point wireless links and allows connection for one station only.
MikroTik RouterOS license level4 is minimum for mode=ap-bridge
Other wireless settings are (http://wiki.mikrotik.com/wiki/Category:Wireless explained here)

Additional Station Configuration


Station adapts to wireless access point frequency, despite of the frequency configuration in Wireless menu.
Station uses scan-list to select available Access Point, when superchannel mode is used on wireless Access Point,
set custom Access Point frequency to mode=station scan-list.

References
[1]
[2]
[3]
[4]
[5]

http:/ / routerboard. com/


http:/ / wiki. mikrotik. com/ wiki/ Manual:Interface/ Wireless#Wireless_interface_configuration
http:/ / wiki. mikrotik. com/ wiki/ First_time_startup
http:/ / wiki. mikrotik. com/ wiki/ Manual:Making_a_simple_wireless_AP
http:/ / wiki. mikrotik. com/ wiki/ Manual:Interface/ Wireless#Security_profiles

132

Manual:Making a simple wireless AP

Manual:Making a simple wireless AP


This article will show a very quick overview for beginners on setting up a Wireless Access Point in RouterOS
Winbox graphical configuration tool.

Requirements
a router running RouterOS loaded with supported miniPCI wireless cards
a connection to the router via the Winbox utility

Instructions
Start by opening the Wireless Interface window in Winbox. You will see some wireless cards listed here, they might
be disabled - to turn them on, click on the blue Enable button. Make sure that the interface is configured and the
antennas are connected before you enable an interface.

To configure an interface, double-click it's name, and the config window will appear. To set the device as an AP,
choose "ap bridge" mode. You can also set other things, like the desired band, frequency, SSID (the AP identifier)
and the security profile.

133

Manual:Making a simple wireless AP

You probably want your AP to be secure, so you need to configure WPA2 security. Close the wireless setting
window with OK if you are done, and move to the Security Profiles tab of the Wireless interface window. There,
make a new profile with the Add button and set desired WPA2 settings. You can choose this new security profile
back in the Interface configuration.

134

Manual:Making a simple wireless AP


To see if any stations are connected to your AP, go to the Registration Table tab in the Wireless Interface window.

Just connecting is probaly not enough, as your AP needs an IP address. This can be configured in the IP menu. Make
sure that your stations also have IP addresses from the same subnet, or set up a DHCP server in this Router (not
covered in this tutorial).

If your ISP doesn't know about your new local network and hasn't set up proper routes to it, you need to configure
SRC-NAT so that your stations have access to the internet via their private IP addresses. They will be masqueraded
by the router's NAT functionality (not covered in this tutorial)

135

Manual:Making a simple wireless AP

Manual:Interface/VLAN
Applies to RouterOS: v3, v4+

Summary
Sub-menu: /interface vlan
Standards: IEEE 802.1Q [1]
Virtual Local Area Network (VLAN) is layer 2 method that allows you to have multiple Virtual LANs on a single
physical interface (ethernet, wireless, etc.), giving the ability to segregate LANs efficiently.
You can use MikroTik RouterOS (as well as Cisco IOS, Linux and other router systems) to mark these packets as
well as to accept and route marked ones.
As VLAN works on OSI Layer 2, it can be used just as any other network interface without any restrictions. VLAN
successfully passes through regular Ethernet bridges.
You can also transport VLANs over wireless links and put multiple VLAN interfaces on a single wireless interface.
Note that as VLAN is not a full tunnel protocol (i.e., it does not have additional fields to transport MAC addresses of
sender and recipient), the same limitation applies to bridging over VLAN as to bridging plain wireless interfaces. In
other words, while wireless clients may participate in VLANs put on wireless interfaces, it is not possible to have
VLAN put on a wireless interface in station mode bridged with any other interface.

136

Manual:Interface/VLAN

802.1Q
The most commonly used protocol for Virtual LANs (VLANs) is IEEE 802.1Q. It is standardized encapsulation
protocol that defines how to insert a four-byte VLAN identifier into Ethernet header. (see Figure 12.1.)

Each VLAN is treated as separate subnet. It means that, by default, host in specific VLAN cannot communicate with
host that is member of another VLAN, although they are connected in the same switch. So if you want inter-VLAN
communication you need a router. RouterOS supports up to 4095 VLAN interfaces, each with a unique VLAN ID,
per interface. VLAN priorites may also be used and manipulated.
When the VLAN extends over more than one switch, the inter-switch link have to become trunk, where packets are
tagged to indicate which VLAN they belong to. A trunk carries the traffic of multiple VLANs, it is like a
point-to-point link that carries tagged packets between switches or between a switch and router.

137

Manual:Interface/VLAN

138

Q-in-Q
Original 802.1Q allows only one vlan header, Q-in-Q in the other hand allows two or more vlan headers. In
RouterOS Q-in-Q can be configured by adding one vlan interface over another. Example:
/interface vlan
add name=vlan1 vlan-id=11 interface=ether1
add name=vlan2 vlan-id=12 interface=vlan1
If any packet is sent over "vlan2" interface, two vlan tags will be added to ethernet header - "11" and "12".

Properties
Property

Description

arp (disabled | enabled | proxy-arp | reply-only;


Default: enabled)

Address Resolution Protocol mode

interface (name; Default: )

Name of physical interface on top of which VLAN will work

l2mtu (integer; Default: )

Layer2 MTU. For VLANS this value is not configurable. Read more>>

mtu (integer; Default: 1500)

Layer3 Maximum transmission unit

name (string; Default: )

Interface name

use-service-tag (yes | no; Default: )

802.1ad compatible Service Tag

vlan-id (integer: 4095; Default: 1)

Virtual LAN identifier or tag that is used to distinguish VLANs. Must be equal for all
computers that belong to the same VLAN.

Note: MTU should be set to 1500 bytes as on Ethernet interfaces. But this may not work with some Ethernet
cards that do not support receiving/transmitting of full size Ethernet packets with VLAN header added (1500
bytes data + 4 bytes VLAN header + 14 bytes Ethernet header). In this situation MTU 1496 can be used, but
note that this will cause packet fragmentation if larger packets have to be sent over interface. At the same
time remember that MTU 1496 may cause problems if path MTU discovery is not working properly between
source and destination.

Setup examples
Simple Example
Lets assume that we have several MikroTik routers connected to a hub. Remember that hub is OSI physical layer
device (if there is a hub between routers, then from L3 point of view it is the same as Ethernet cable connection
between them). For simplification assume that all routers are connected to the hub using ether1 interface and has
assigned IP addresses as illustrated in figure below. Then on each of them the VLAN interface should be created.

Manual:Interface/VLAN

139

Configuration for R2 and R4 is shown below:


R2:
[admin@MikroTik] /interface vlan> add name=VLAN2 vlan-id=2 interface=ether1 disabled=no
[admin@MikroTik] /interface vlan> print
Flags: X - disabled, R - running, S - slave
#
0 R

NAME

MTU

VLAN2

1500

ARP
enabled

VLAN-ID INTERFACE
2

ether1

R4:
[admin@MikroTik] /interface vlan> add name=VLAN2 vlan-id=2 interface=ether1 disabled=no
[admin@MikroTik] /interface vlan> print
Flags: X - disabled, R - running, S - slave
#
0 R

NAME

MTU

VLAN2

1500

ARP
enabled

VLAN-ID INTERFACE
2

ether1

The next step is to assign IP addresses to the VLAN interfaces.


R2:
[admin@MikroTik] ip address> add address=10.10.10.3/24 interface=VLAN2
[admin@MikroTik] ip address> print
Flags: X - disabled, I - invalid, D - dynamic
#
ADDRESS
NETWORK
BROADCAST
INTERFACE
0
10.0.1.4/24
10.0.1.0
10.0.1.255
ether1
1
10.20.0.1/24
10.20.0.0
10.20.0.255
pc1
2
10.10.10.3/24
10.10.10.0
10.10.10.255
vlan2
[admin@MikroTik] ip address>
R4:

Manual:Interface/VLAN
[admin@MikroTik] ip address> add address=10.10.10.5/24 interface=VLAN2
[admin@MikroTik] ip address> print
Flags: X - disabled, I - invalid, D - dynamic
#
ADDRESS
NETWORK
BROADCAST
INTERFACE
0
10.0.1.5/24
10.0.1.0
10.0.1.255
ether1
1
10.30.0.1/24
10.30.0.0
10.30.0.255
pc2
2
10.10.10.5/24
10.10.10.0
10.10.10.255
vlan2
[admin@MikroTik] ip address>
At this point it should be possible to ping router R4 from router R2 and vice versa:
'''Ping from R2 to R4:'''
[admin@MikroTik] ip address> /ping 10.10.10.5
10.10.10.5 64 byte ping: ttl=255 time=4 ms
10.10.10.5 64 byte ping: ttl=255 time=1 ms
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 1/2.5/4 ms

'''From R4 to R2:'''
[admin@MikroTik] ip address> /ping 10.10.10.3
10.10.10.3 64 byte ping: ttl=255 time=6 ms
10.10.10.3 64 byte ping: ttl=255 time=1 ms
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 1/3.5/6 ms
To make sure if VLAN setup is working properly, try to ping R1 from R2. If pings are timing out then VLANs are
successfully isolated.
'''From R2 to R1:'''
[admin@MikroTik] ip address> /ping 10.10.10.2
10.10.10.2 ping timeout
10.10.10.2 ping timeout
3 packets transmitted, 0 packets received, 100% packet loss

140

Manual:Interface/VLAN

Create trunks and implement routing between VLANs


If separate VLANs are implemented on a switch, then router is required to provide communication between VLANs.
Switch works at OSI layer 2 so it uses only Ethernet header to forward and does not check IP header. For this reason
we must use the router that is working as a gateway for each VLAN. Without a router host is unable to communicate
outside its own VLAN. Routing process between VLANs described above is called inter-VLAN communication.
To illustrate inter-VLAN communication, we will create a trunk that will carry traffic from three VLANs (VLAN2
and VLAN3, VLAN4) across a single link between Mikrotik router and a manageable switch that supports VLAN
trunking.

Each VLAN has its own separate subnet (broadcast domain) as we see in figure above:
VLAN 2 10.10.20.0/24;
VLAN 3 10.10.30.0/24;
VLAN 4 10.10.40.0./24.
VLAN configuration on most of switches is straightforward, basically we need to define which ports are members of
VLAN and define "trunk" port that can carry tagged frames between switch and router.
Configuration example on MikroTik router:
Create VLAN interfaces:
/interface vlan
add name=VLAN2 vlan-id=2 interface=ether1 disabled=no
add name=VLAN3 vlan-id=3 interface=ether1 disabled=no
add name=VLAN4 vlan-id=4 interface=ether1 disabled=no
Add IP addresses to VLANs:
/ip
add
add
add

address
address=10.10.20.1/24 interface=VLAN2
address=10.10.30.1/24 interface=VLAN3
address=10.10.40.1/24 interface=VLAN4

141

Manual:Interface/VLAN

RouterOS /32 and IP unnumbered addresses


In RouterOS to create point-to-point tunnel with addresses you have to use address with network mask /32 that
effectively brings you same features as some vendors unnumbered IP address.
There are 2 routers RouterA and RouterB that each is part of networks 10.22.0.0/24 and 10.23.0.0/24 respectively, to
connect these router using VLAN as carrier with the following configuration:

RouterA:
/ip address add address=10.22.0.1/24 interface=ether1
/interface vlan add interface=ether2 vlan-id=1 name=vlan1
/ip address add address=10.22.0.1/32 interface=vlan1 network=10.23.0.1
/ip route add gateway=10.23.0.1 dst-address=10.23.0.0/24
RouterB:
/ip address add address=10.23.0.1/24 interface=ether1
/interface vlan add interface=ether2 vlan-id=1 name=vlan1
/ip address add address=10.23.0.1/32 interface=vlan1 network=10.22.0.1
/ip route add gateway=10.22.0.1 dst-address=10.22.0.0/24
[ Top | Back to Content ]

References
[1] http:/ / standards. ieee. org/ getieee802/ download/ 802. 1Q-1998. pdf

142

Manual:IP/IPsec

Manual:IP/IPsec
Applies to RouterOS: v5.0 +

Summary
Sub-menu: /ip ipsec
Package required: security
Standards: RFC 4301
Internet Protocol Security (IPsec) is a set of protocols defined by the Internet Engineering Task Force (IETF) to
secure packet exchange over unprotected IP/IPv6 networks such as Internet.
IpSec protocol suite can be divided in following groups:
Authentication Header (AH) RFC 4302
Encapsulating Security Payload (ESP) RFC 4303
Internet Key Exchange (IKE) protocols. Dynamically generates and distributes cryptographic keys for AH and
ESP.

Authentication Header (AH)


AH is a protocol that provides authentication of either all or part of the contents of a datagram through the addition
of a header that is calculated based on the values in the datagram. What parts of the datagram are used for the
calculation, and the placement of the header, depends whether tunnel or transport mode is used.
The presence of the AH header allows to verify the integrity of the message, but doesn't encrypt it. Thus, AH
provides authentication but not privacy (Another protocol ESP is used to provide encryption).
RouterOS supports the following authentication algorithms for AH:
SHA1
MD5

Transport mode
In transport mode AH header is inserted after IP header. IP data and header is used to calculate authentication value.
IP fields that might change during transit, like TTL and hop count, are set to zero values before authentication.

Tunnel mode
In tunnel mode original IP packet is encapsulated within a new IP packet. All of the original IP packet is
authenticated.

Encapsulating Security Payload


Encapsulating Security Payload (ESP) uses shared key encryption to provide data privacy. ESP also supports its own
authentication scheme like that used in AH, or can be used in conjunction with AH.
ESP packages its fields in a very different way than AH. Instead of having just a header, it divides its fields into
three components:

143

Manual:IP/IPsec
ESP Header - Comes before the encrypted data and its placement depends on whether ESP is used in transport
mode or tunnel mode.
ESP Trailer - This section is placed after the encrypted data. It contains padding that is used to align the
encrypted data.
ESP Authentication Data - This field contains an Integrity Check Value (ICV), computed in a manner similar to
how the AH protocol works, for when ESP's optional authentication feature is used.

Transport mode
In transport mode ESP header is inserted after original IP header. ESP trailer and authentication value is added to the
end of the packet. In this mode only IP payload is encrypted and authenticated, IP header is not secured.

Tunnel mode
In tunnel mode original IP packet is encapsulated within a new IP packet thus securing IP payload and IP header.

Encryption algorithms
RouterOS ESP supports various encryption and authentication algorithms.
Authentication:
SHA1
MD5
Encryption:

DES - 56-bit DES-CBC encryption algorithm;


3DES - 168-bit DES encryption algorithm;
AES - 128, 192 and 256-bit key AES-CBC encryption algorithm;
Blowfish - added since v4.5
Twofish - added since v4.5
Camellia - 128, 192 and 256-bit key Camellia encryption algorithm added since v4.5

Hardware encryption
Hardware encryption allows to do faster encryption process by using built-in encryption engine inside CPU. AES is
the only algorithm that will be accelerated in hardware.
List of RouterBoards with enabled hardware support:
RB1000
RB1100AHx2
For comparison RB1000 with enabled HW support can forward up to 550Mbps encrypted traffic. When HW support
is disabled it can forward only 150Mbps encrypted traffic in AES-128 mode.
Some configuration advices on how to get maximum ipsec throughput on multicore RB1100AHx2:
Avoid using ether12 and ethet13. Since these prots are pci-x they will be slowest ones.
Fastest forwarding is from switch chip ports (ether1-ether10) to ether11 (directly connected to CPU) and vice
versa.
Set hardware queue on all interfaces
/queue interface set [find] set queue=only-hardware-queue
Disable RPS:
/system resource irq rps disable [find]

144

Manual:IP/IPsec
Assign one CPU core to ether11 and other CPU core to everything else. Forwarding over ether11 requires more
CPU that is why we are giving one core only for that interface (in IRQ setting ether11 is listed as ether12 tx,rx
and error).
/system resource irq
set [find] cpu=1
set [find users="eth12 tx"] cpu=0
set [find users="eth12 rx"] cpu=0
set [find users="eth12 error"] cpu=0
disable connection tracking
With all above recommendations it is possible to forward 820Mbps (1470byte packets two streams).
With enabled connection tracking 700Mbps (1470 byte packets two streams).

Internet Key Exchange Protocol


The Internet Key Exchange (IKE) is a protocol that provides authenticated keying material for Internet Security
Association and Key Management Protocol (ISAKMP) framework. There are other key exchange schemes that work
with ISAKMP, but IKE is the most widely used one. Together they provide means for authentication of hosts and
automatic management of security associations (SA).
Most of the time IKE daemon is doing nothing. There are two possible situations when it is activated:
There is some traffic caught by a policy rule which needs to become encrypted or authenticated, but the policy
doesn't have any SAs. The policy notifies IKE daemon about that, and IKE daemon initiates connection to remote
host. IKE daemon responds to remote connection. In both cases, peers establish connection and execute 2 phases:
Phase 1 - The peers agree upon algorithms they will use in the following IKE messages and authenticate. The
keying material used to derive keys for all SAs and to protect following ISAKMP exchanges between hosts is
generated also. This phase should match following settings:

authentication method
DH group
encryption algorithm
exchange mode
hash alorithm
NAT-T
DPD and lifetime (optional)

Phase 2 - The peers establish one or more SAs that will be used by IPsec to encrypt data. All SAs established by
IKE daemon will have lifetime values (either limiting time, after which SA will become invalid, or amount of
data that can be encrypted by this SA, or both). This phase should match following settings:

Ipsec protocol
mode (tunnel or transport)
authentication method
PFS (DH) group
lifetime

145

Manual:IP/IPsec

146
Note: There are two lifetime values - soft and hard. When SA reaches it's soft lifetime treshold, the IKE
daemon receives a notice and starts another phase 2 exchange to replace this SA with fresh one. If SA reaches
hard lifetime, it is discarded.

IKE can optionally provide a Perfect Forward Secrecy (PFS), which is a property of key
exchanges, that, in turn, means for IKE that compromising the long term phase 1 key will not
allow to easily gain access to all IPsec data that is protected by SAs established through this phase 1. It means an
additional keying material is generated for each phase 2.
Generation of keying material is computationally very expensive. Exempli gratia, the use of modp8192 group can
take several seconds even on very fast computer. It usually takes place once per phase 1 exchange, which happens
only once between any host pair and then is kept for long time. PFS adds this expensive operation also to each phase
2 exchange.

Diffie-Hellman Groups
Diffie-Hellman (DH) key exchange protocol allows two parties without any initial shared secret to create one
securely. The following Modular Exponential (MODP) and Elliptic Curve (EC2N) Diffie-Hellman (also known as
"Oakley") Groups are supported:
Diffie-Hellman Group Name

Reference

Group 1

768 bit MODP group

RFC 2409

Group 2

1024 bits MODP group

RFC 2409

Group 3

EC2N group on GP(2^155) RFC 2409

Group 4

EC2N group on GP(2^185) RFC 2409

Group 5

1536 bits MODP group

RFC 3526

IKE Traffic
To avoid problems with IKE packets hit some SPD rule and require to encrypt it with not yet established SA (that
this packet perhaps is trying to establish), locally originated packets with UDP source port 500 are not processed
with SPD. The same way packets with UDP destination port 500 that are to be delivered locally are not processed in
incoming policy check.

Setup Procedure
To get IPsec to work with automatic keying using IKE-ISAKMP you will have to configure policy, peer and
proposal (optional) entries.
Warning: Ipsec is very sensitive to time changes. If both ends of the IpSec tunnel are not synchronizing time
equally(for example, different NTP servers not updating time with the same timestamp), tunnels will break
and will have to be established again.

Manual:IP/IPsec

147

Peer configuration
Sub-menu: /ip ipsec peer
Peer configuration settings are used to establish connections between IKE daemons ( phase 1 configuration). This
connection then will be used to negotiate keys and algorithms for SAs.
Property

Description

address (IP/IPv6 Prefix; Default: 0.0.0.0/0)

If remote peer's address matches this prefix, then the peer configuration is used in authentication
and establishment of Phase 1. If several peer's addresses match several configuration entries, the
most specific one (i.e. the one with largest netmask) will be used.

auth-method (pre-shared-key |
rsa-signature; Default: pre-shared-key)

Authentication method:

certificate (string; Default: )

Name of a certificate listed in certificate table (signing packets; the certificate must have private
key). Applicable if RSA signature authentication method (auth-method=rsa-signature) is used.

comment (string; Default: )

Short description of the peer.

dh-group (ec2n155 | ec2n185 | modp1024 |


modp1536 | modp2048 | modp3072 | modp4096
| modp6144 | modp768; Default: modp1024)

Diffie-Hellman group (cipher strength)

disabled (yes | no; Default: no)

Whether peer is used to match remote peer's prefix.

dpd-interval (time | disable-dpd; Default:


2m)

Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.

dpd-maximum-failures (integer: 1..100;


Default: 5)

Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.

pre-shared-key - authenticate by a password (secret) string shared between the peers


rsa-signature - authenticate using a pair of RSA certificates
rsa-key - authenticate using a RSA key imported in Ipsec key menu.

enc-algorithm (3des | aes-128 | aes-192 | Encryption algorithm.


aes-256 | blowfish | camellia-128 | camellia-192
| camellia-256 | des; Default: 3des)
exchange-mode (aggressive | base | main |
main-l2tp; Default: main)

Different ISAKMP phase 1 exchange modes according to RFC 2408. Do not use other modes
then main unless you know what you are doing. main-l2tp mode relaxes rfc2409 section 5.4, to
allow pre-shared-key authentication in main mode.

generate-policy (yes | no; Default: no)

Allow this peer to establish SA for non-existing policies. Such policies are created dynamically
for the lifetime of SA. Automatic policies allows, for example, to create IPsec secured L2TP
tunnels, or any other setup where remote peer's IP address is not known at the configuration time.

hash-algorithm (md5 | sha1; Default:


md5)

Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower.

key (string; Default: )

Name of the key from key menu. Applicable if auth-method=rsa-key.

lifebytes (Integer: 0..4294967295; Default: Phase 1 lifetime: specifies how much bytes can be transferred before SA is discarded. If set to 0,
0)
SA will not be discarded due to byte count excess.
lifetime (time; Default: 1d)

Phase 1 lifetime: specifies how long the SA will be valid.

my-id-user-fqdn (string; Default: )

By default IP address is used as ID. This parameter replaces ID with specified value. Can be
used, for example, in cases if DNS name as ID is required.

nat-traversal (yes | no; Default: no)

Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers inbetween IPsec
peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the
complete packet, including IP header, which is changed by NAT, rendering AH signature
invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some
minor issues that made ESP incompatible with NAT.

port (integer:0..65535; Default: 500)

Communication port used for ipsec traffic.

Manual:IP/IPsec

148

proposal-check (claim | exact | obey |


strict; Default: obey)

Phase 2 lifetime check logic:

remote-certificate (string; Default: )

Name of a certificate (listed in certificate table) for authenticating the remote side (validating
packets; no private key required). Applicable if RSA signature authentication method is used

secret (string; Default: )

Secret string (in case pre-shared key authentication is used). If it starts with '0x', it is parsed as a
hexadecimal value

claim - take shortest of proposed and configured lifetimes and notify initiator about it
exact - require lifetimes to be the same
obey - accept whatever is sent by an initiator
strict - if proposed lifetime is longer than the default then reject proposal otherwise accept
proposed lifetime

send-initial-contact (yes | no; Default: Specifies whether to send initial IKE information or wait for remote side.
yes)

Note: IPSec phases information is erased, when /ip ipsec peer configuration is modified on the fly, however
packets are being encrypted/decrypted because of installed-sa (for example remote-peers information is
erased, when peer configuration is modified.

Keys
Sub-menu: /ip ipsec key
This submenu list all imported public/private keys, that can be used for peer authentication. Submenu also has
several commands to work with keys.
For example print below shows two imported 1024-bit keys, one public and one private.
[admin@PoETik] /ip ipsec key> print
Flags: P - private-key, R - rsa
#

NAME

KEY-SIZE

0 PR priv

1024-bit

1024-bit

R pub

Commands
Property

Description

export-pub-key (file-name;
key)

Export public key to file from one of existing private keys.

generate-key (key-size; name)

Generate private key. Takes two parameters, name of newly generated key and key size 1024,2048 and
4096.

import (file-name; name)

Import key from file.

Manual:IP/IPsec

149

Policy
Sub-menu: /ip ipsec policy
Policy table is used to determine whether security settings should be applied to a packet.
Property

Description

action (discard | encrypt | none; Default:


encrypt)

Specifies what to do with packet matched by the policy.

comment (string; Default: )

Short description of the policy

disabled (yes | no; Default: no)

Whether policy is used to match packets.

dst-address (IP/IPv6 prefix; Default:


0.0.0.0/32)

Destination address to be matched in packets.

none - pass the packet unchanged


discard - drop the packet
encrypt - apply transformations specified in this policy and it's SA

dst-port (integer:0..65535 | any; Default: any) Destination port to be matched in packets. If set to any all ports will be matched
ipsec-protocols (ah | esp; Default: esp)

Specifies what combination of Authentication Header and Encapsulating Security Payload


protocols you want to apply to matched traffic

level (require | unique | use; Default: require)

Specifies what to do if some of the SAs for this policy cannot be found:

use - skip this transform, do not drop packet and do not acquire SA from IKE daemon
require - drop packet and acquire SA
unique - drop packet and acquire a unique SA that is only used with this particular
policy

manual-sa (string | none; Default: none)

Name of the manual SA template

priority (integer:-2147483646..2147483647;
Default: 0)

Policy ordering classificator (signed integer). Larger number means higher priority.

proposal (string; Default: default)

Name of the proposal template that will be sent by IKE daemon to establish SAs for this
policy.

protocol (all | egp | ggp| icmp | igmp | ...;


Default: all)

IP packet protocol to match.

sa-dst-address (ip/ipv6 address; Default: ::)

SA destination IP/IPv6 address (remote peer).

sa-src-address (ip/ipv6 address; Default: ::)

SA source IP/IPv6 address (local peer).

src-address (ip/ipv6 prefix; Default:


0.0.0.0/32)

Source IP prefix

src-port (any | integer:0..65535; Default: any) Source Port of the packet


tunnel (yes | no; Default: no)

Specifies whether to use tunnel mode

Note: All packets are IPIP encapsulated in tunnel mode, and their new IP header's src-address and dst-address
are set to sa-src-address and sa-dst-address values of this policy. If you do not use tunnel mode (id est you use
transport mode), then only packets whose source and destination addresses are the same as sa-src-address and
sa-dst-address can be processed by this policy. Transport mode can only work with packets that originate at
and are destined for IPsec peers (hosts that established security associations). To encrypt traffic between
networks (or a network and a host) you have to use tunnel mode.

Manual:IP/IPsec

150

Policy Stats
Command /ip ipsec policy print stats will show current status of the policy. Additional read-only
parameters will be printed.
Property

Description

in-accepted (integer)

How many incoming packets were passed by the policy without an attempt to decrypt.

in-dropped (integer)

How many incoming packets were dropped by the policy without an attempt to decrypt

in-transformed (integer)

How many incoming packets were decrypted (ESP) and/or verified (AH) by the policy

out-accepted (integer)

How many outgoing packets were passed by the policy without an attempt to encrypt.

out-dropped (integer)

How many outgoing packets were dropped by the policy without an attempt to encrypt.

out-transformed (integer)

How many outgoing packets were encrypted (ESP) and/or verified (AH) by the policy.

ph2-state (expired | no-phase2 | established) Indication of the progress of key establishing.

Dumping Policies
It is possible to dump policies installed into the kernel for debugging purposes with command:
/ip ipsec policy

dump-kernel-policies

After executing this command check the logs to see the result, there should be three policies in the kernel: forward,
in and out.
[admin@test-host] >/log print
07:28:34 ipsec,debug,packet policy ipsec fwd: 10.5.101.9[0] - 10.5.101.13[0]
07:28:34 ipsec,debug,packet policy ipsec in: 10.5.101.9[0] - 10.5.101.13[0]
07:28:34 ipsec,debug,packet policy ipsec out: 10.5.101.13[0] - 10.5.101.9[0]

Proposal settings
Sub-menu: /ip ipsec proposal
Proposal information that will be sent by IKE daemon to establish SAs for this policy ( Phase 2). Configured
proposals are set in policy configuration.
Property

Description

auth-algorithms (md5|sha1|null; Default: sha1)

Allowed algorithms for


authorization. sha1 is stronger, but
slower algorithm.

comment (string; Default: )

Short description of an item.

disabled (yes | no; Default: no)

Whether item is disabled.

enc-algorithms
(null|des|3des|aes-128|aes-192|aes-256|blowfish|camellia-128|camellia-192|camellia-256|twofish; Default:
3des)

Allowed algorithms and key


lengths to use for SAs.

lifetime (time; Default: 30m)

How long to use SA before


throwing it out.

name (string; Default: )

Name of the proposal template,


that will be identified in other
parts of ipsec configuration.

pfs-group (ec2n155 | ec2n185 | modp1024 | modp1536 | modp2048 | modp3072 | modp4096 | modp6144 |


modp768 | none; Default: modp1024)

Diffie-Helman group used for


Perfect Forward Secrecy.

Manual:IP/IPsec

151

Manual SA
Sub-menu: /ip ipsec manual-sa
Menu is used to configure SAs manually. Created SA template then can be used in policy configuration.
Property

Description

ah-algorithm (in/out
in,out = md5|null|sha1; Default: null)

Authentication Header encryption algorithm.

ah-key (string/string; Default: )

Incoming-authentication-key/outgoing-authentication-key

ah-spi (0x100..FFFFFFFF/0x100..FFFFFFFF; Default: 0x100)

Incoming-SA-SPI/outgoing-SA-SPI

disabled (yes | no; Default: no)

Defines whether item is ignored or used

esp-auth-algorithm (in/out
in,out = md5|null|sha1; Default: null)

Encapsulating Security Payload authentication encryption algorithm

esp-auth-key (string/string; Default: )

Incoming-authentication-key/outgoing -authentication-key

esp-enc-algorithm (in/out
in,out = 3des | aes-128 | aes-192 | aes-256 | des | ...; Default: null)

Incoming-encryption-algorithm

esp-enc-key (string/string; Default: )

Incoming-encryption-key/outgoing-encryption-key

esp-spi (0x100..FFFFFFFF/0x100..FFFFFFFF; Default: 0x100) Incoming-SA-SPI/outgoing-SA-SPI


lifetime (time; Default: 0s)

Lifetime of this SA

name (string; Default: )

Name of the item for reference from policies

Installed SA
Sub-menu: /ip ipsec installed-sa
This facility provides information about installed security associations including the keys.
Property

Description

AH (yes | no)
ESP (yes | no)
add-lifetime (time/time)

Added lifetime for the SA in format soft/hard

soft - time period after which ike will try to establish new SA
hard - time period after which SA is deleted

addtime (time)

Date and time when this SA was added.

auth-algorithm (sha1 | md5)

Shows currently used authentication algorithm

auth-key (string)

Shows used authentication key

current-bytes (integer)

Shows number of bytes seen by this SA.

dst-address (IP)
enc-algorithm (des | 3des | aes ...) Shows currently used encryption algorithm
pfs (yes | no)
replay (integer)
spi (string)
src-address (IP)

Manual:IP/IPsec

152
state (string)

Shows the current state of the SA ("mature", "dying" etc)

Flushing SAs
Sometimes after incorrect/incomplete negotiations took place, it is required to flush manually the installed SA table
so that SA could be renegotiated. This option is provided by the /ip ipsec installed-sa flush
command.
This command accepts only one property:
Property

Description

sa-type (ah | all | esp; Default: all) Specifies SA types to flush:

ah - delete AH protocol SAs only


esp - delete ESP protocol SAs only
all - delete both ESP and AH protocols SAs

Remote Peers
Sub-menu: /ip ipsec remote-peers
This submenu provides you with various statistics about remote peers that currently have established phase 1
connections with this router. Note that if peer doesn't show up here, it doesn't mean that no IPsec traffic is being
exchanged with it.
Read only properties:
Property

Description

local-address (ip/ipv6
address)

Local ISAKMP SA address on the router used by the peer

remote-address (ip/ipv6
address)

Remote peer's ip/ipv6 address

side (initiator | responder)

Shows which side initiated the Phase1 negotiation.

state (string)

State of phase 1 negotiation with the peer. For example when phase1 and phase 2 are negotiated it will show
state "established".

established (time)

How long peers are in established state.

Closing all IPsec connections


Menu has a command to quickly close all established ipsec connections. This command will clear all installed SAs
(Phase2) and remove all entries from remote-peers menu (Phase1).
Usage:
/ip ipsec remote-peers kill-connections

Statistics
Sub-menu: /ip ipsec statistics
This menu shows various ipsec statistics

Manual:IP/IPsec

153

Property

Description

in-errors (integer)

All inbound errors that are not matched by other counters.

in-buffer-errors (integer)

No free buffer.

in-header-errors (integer)

Header error

in-no-states (integer)

No state is found i.e. Either inbound SPI, address, or IPsec protocol at SA is wrong

in-state-protocol-errors
(integer)

Transformation protocol specific error, for example SA key is wrong or hardware accelerator is
unable to handle amount of packets.

in-state-mode-errors (integer)

Transformation mode specific error

in-state-sequence-errors
(integer)

Sequence number is out of window

in-state-expired (integer)

State is expired

in-state-mismatches (integer)

State has mismatched option, for example UDP encapsulation type is mismatched.

in-state-invalid (integer)

State is invalid

in-template-mismatches (integer)

No matching template for states, e.g. Inbound SAs are correct but SP rule is wrong

in-no-policies (integer)

No policy is found for states, e.g. Inbound SAs are correct but no SP is found

in-policy-blocked (integer)

Policy discards

in-policy-errors (integer)

Policy errors

out-errors (integer)

All outbound errors that are not matched by other counters

out-bundle-errors (integer)

Bundle generation error

out-bundle-check-errors (integer) Bundle check error


out-no-states (integer)

No state is found

out-state-protocol-errors
(integer)

Transformation protocol specific error

out-state-mode-errors (integer)

Transformation mode specific error

out-state-sequence-errors
(integer)

Sequence errors, for example Sequence number overflow

out-state-expired (integer)

State is expired

out-policy-blocked (integer)

Policy discards

out-policy-dead (integer)

Policy is dead

out-policy-errors (integer)

Policy error

Manual:IP/IPsec

Application Examples
Site to Site IpSec Tunnel
Consider setup as illustrated below

Two remote office routers are connected to internet and office workstations behind routers are NATed. Each office
has its own local subnet, 10.1.202.0/24 for Office1 and 10.1.101.0/24 for Office2. Both remote offices needs secure
tunnel to local networks behind routers.
IP Connectivity
On both routers ether1 is used as wan port and ether2 is used to connect workstations. Also NAT rules are set tu
masquerade local networks.
Office1 router:
/ip address
add address=192.168.90.1/24 interface=ether1
add address=10.1.202.1/24 interface=ether2
/ip route
add gateway=192.168.90.254
/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade
Office2 router:
/ip address
add address=192.168.80.1/24 interface=ether1
add address=10.1.101.1/24 interface=ether2
/ip route
add gateway=192.168.80.254

154

Manual:IP/IPsec

/ip firewall nat


add chain=srcnat out-interface=ether1 action=masquerade
IpSec Peer's config
Next step is to add peer's configuration. We need to specify peers address and port and pre-shared-key. Other
parameters are left to default values.
Office1 router:
/ip ipsec peer
add address=192.168.80.1/32 port=500 auth-method=pre-shared-key secret="test"
Office2 router:
/ip ipsec peer
add address=192.168.90.1/32 port=500 auth-method=pre-shared-key secret="test"
Policy and proposal
It is important that proposed authentication and encryption algorithms match on both routers. In this example we can
use predefined "default" proposal
[admin@MikroTik] /ip ipsec proposal> print
Flags: X - disabled
0
name="default" auth-algorithms=sha1 enc-algorithms=3des lifetime=30m
pfs-group=modp1024
As we already have proposal as a next step we need correct IpSec policy. We want to encrypt traffic coming form
10.1.202.0/24 to 10.1.101.0/24 and vice versa.
Office1 router:
/ip ipsec policy
add src-address=10.1.202.0/24 src-port=any dst-address=10.1.101.0/24 dst-port=any \
sa-src-address=192.168.90.1 sa-dst-address=192.168.80.1 \
tunnel=yes action=encrypt proposal=default

Office2 router:
/ip ipsec policy
add src-address=10.1.101.0/24 src-port=any dst-address=10.1.202.0/24 dst-port=any \
sa-src-address=192.168.80.1 sa-dst-address=192.168.90.1 \
tunnel=yes action=encrypt proposal=default

Note that we configured tunnel mode instead of transport, as this is site to site encryption.

155

Manual:IP/IPsec

156

NAT Bypass
At this point if you will try to establish IpSec tunnel it will not work, packets will be rejected. This is because both
routers have NAT rules that is changing source address after packet is encrypted. Remote router reiceves encrypted
packet but is unable to decrypt it because source address do not match address specified in policy configuration. For
more information see packet flow ipsec example.
To fix this we need to set up NAT bypass rule.
Office1 router:
/ip firewall nat
add chain=srcnat action=accept place-before=0 \
src-address=10.1.202.0/24 dst-address=10.1.101.0/24
Office2 router:
/ip firewall nat
add chain=srcnat action=accept place-before=0 \
src-address=10.1.101.0/24 dst-address=10.1.202.0/24
It is very important that bypass rule is placed at the top of all other NAT rules.
Note: If you previously tried to establish tunnel before NAT bypass rule was added, you have to clear
connection table from existing connection or restart the routers

[ Top | Back to Content ]

Manual:Interface/Gre
Applies to RouterOS: v5+

Summary
Sub-menu: /interface gre
Standards: GRE RFC 1701
GRE (generic routing encapsulation) is a tunneling protocol that was originally developed by Cisco. It can
encapsulate wide variety of protocols creating virtual point-to-point link.
GRE the same as IPIP and EoIP were originally developed as stateless tunnels. Meaning that if remote end of the
tunnels goes down all traffic that was routed over the tunnels gets blackholed. To solve this problem RouterOS have
added keepalive feature for GRE tunnels.
GRE tunnel adds 24 byte overhead (4-byte gre header + 20-byte IP header).

Manual:Interface/Gre

157

Properties
Property

Description

arp (disabled | enabled | proxy-arp | reply-only;


Default: )

Address Resolution Protocol mode

comment (string; Default: )

Short description of the tunnel.

disabled (yes | no; Default: no)

Whether tunnel is enabled.

keepalive (integer [1..4294967295]; Default: )

Tunnel keepalive timeout in seconds. By default keepalive is disabled.

l2mtu (integer [0..65536]; Default: 65535)

Layer2 Maximum transmission unit.

local-address (IP; Default: 0.0.0.0)

Ip addres that will be used as local tunnel end. If set to 0.0.0.0 then ip address of outgoing
interface will be taken.

mtu (integer [0..65536]; Default: 1476)

Layer3 Maximum transmission unit.

name (string; Default: )

Name of the tunnel.

remote-address (IP; Default: )

IP address of remote tunnel end.

Setup examples
The goal of example is to get Layer 3 connectivity between two remote sites over the internet.

We two sites Site1 with local network range 10.1.101.0/24 and Site2 with local network range 10.1.202.0/24.
First step is to create GRE tunnels. Router on site 1:
/interface gre add name=myGre remote-address=192.168.90.1 local-address=192.168.80.1

Router on site 2:
/interface gre add name=myGre remote-address=192.168.80.1 local-address=192.168.90.1

As you can see tunnel configuration is quite simple.

Manual:Interface/Gre

158
Note: In this example keepalive is not configured, so tunnel interface will have running flag even if remote
tunnel end is not reachable

Now we just need to set up tunnel addresses and proper routing. Router on site 1:

/ip address
add address=172.16.1.1/30 interface=myGre
/ip route
add dst-address=10.1.202.0/24 gateway=172.16.1.2
Router on site 2:
/ip address
add address=172.16.1.2/30 interface=myGre
/ip route
add dst-address=10.1.101.0/24 gateway=172.16.1.1
At this point sites have Layer 3 connectivity over GRE tunnel.
[ Top | Back to Content ]

Manual:Interface/PPPoE
Applies to RouterOS: v3, v4

Summary
The PPPoE (Point to Point Protocol over Ethernet) protocol provides extensive user management, network
management and accounting benefits to ISPs and network administrators. Currently PPPoE is used mainly by ISPs to
control client connections for xDSL and cable modems as well as plain Ethernet networks. PPPoE is an extension of
the standard Point to Point Protocol (PPP). The difference between them is expressed in transport method: PPPoE
employs Ethernet instead of serial modem connection.
Generally speaking, PPPoE is used to hand out IP addresses to clients based on the username (and workstation, if
desired) authentication as opposed to workstation only authentication, when static IP addresses or DHCP are used. It
is adviced not to use static IP addresses or DHCP on the same interfaces as PPPoE for obvious security reasons.
The PPPoE client and server work over any Ethernet level interface on the router - wireless 802.11 (Aironet, Cisco,
WaveLan, Prism, Atheros), 10/100/1000 Mbit/s Ethernet, RadioLan and EoIP (Ethernet over IP tunnel).

Manual:Interface/PPPoE

Feature list

PPPoE server and client support;


Multilink PPP (MLPPP);
MLPPP over single link (ability to transmit full-sized frames);
BCP (Bridge Control Protocol) support - allows to send raw Ethernet frames over PPP links;
MPPE 40bit and MPPE 128bit RSA encryption;
pap, chap, mschap v1/v2 authentication;
RADIUS support for client authentication and accounting.

Note that when RADIUS server is authenticating a user with CHAP, MS-CHAPv1 or MS-CHAPv2, the RADIUS
protocol does not use shared secret, it is used only in authentication reply. So if you have a wrong shared secret,
RADIUS server will accept the request. You can use /radius monitor command to see bad-replies parameter. This
value should increase whenever a client tries to connect.
Supported connections:
MikroTik RouterOS PPPoE client to any PPPoE server (access concentrator)
MikroTik RouterOS server (access concentrator) to multiple PPPoE clients (clients are avaliable for almost all
operating systems and most routers)

Specifications
Packages required: ppp
License required: Level1 (limited to 1 interface) , Level3 (limited to 200 interfaces) , Level4 (limited to 200
interfaces) , Level5 (limited to 500 interfaces) , Level6 (unlimited)
Submenu level: /interface pppoe-server, /interface pppoe-client
Standards and Technologies: PPPoE (RFC 2516)
Hardware usage: PPPoE server may require additional RAM (uses approx. 9KiB (plus extra 10KiB for packet
queue, if data rate limitation is used) for each connection) and CPU power. Maximum of 65535 connections is
supported.

Quick Setup Guide


To configure MikroTik RouterOS to be a PPPoE client, just add a pppoe-client:
/interface pppoe-client
add name=pppoe-user-mike user=user password=passwd interface=wlan1 \
service-name=internet disabled=no
To configure MikroTik RouterOS to be an Access Concentrator (PPPoE Server):

add an address pool for the clients from 10.1.1.62 to 10.1.1.72;


add ppp profile;
add ppp secret (username/password);
add pppoe server itself.

/ip pool
add name="pppoe-pool" ranges=10.1.1.62-10.1.1.72
/ppp profile
add name="pppoe-profile" local-address=10.1.1.1 remote-address=pppoe-pool
/ppp secret

159

Manual:Interface/PPPoE
add name=user password=passwd service=pppoe profile=pppoe-profile
/interface pppoe-server server
add service-name=internet interface=wlan1 default-profile=pppoe-profile

PPPoE Operation
Stages
PPPoE has two stages:
Discovery stage - a client discovers all available access concentrators and selects one of them to establish PPPoE
session.This stage has four steps: initialization, offer, request and session confirmation . PPPoE Discovery uses
special Ethernet frames with their own Ethernet frame type 0x8863.

To initiate discovery, PPPoE client sends PADI frame to the broadcast Ethernet address (FF:FF:FF:FF:FF:FF) and
may specify particular service name.
When server receives PADI frame, it responds with PADO frame to Client's unicast Ethernet address. There can be
more than one server in broadcast range of the client. In such case client collects PADO frames and picks one (in
most cases it picks the server which responded first) to start session.
Client sends PADR frame to unicast Ethernet address of the server it chose. If server agrees to set up a session with
this particular client, it allocates resources to set up PPP session and assigns Session ID number. This number is sent
back to client in PADS frame. When client receives PADS frame, it knows servers mac address and Session ID, it
allocates resources and session can begin.
Session - When discovery stage is completed, both peers know PPPoE Session ID and other peer's Etehrnet
(MAC) address which together defines PPPoE session. PPP frames are encapsulated in PPPoE session frames,
which have Ethernet frame type 0x8864.
When server sends confirmation and client receives it, PPP Session stage is started that consists of following
steps:

160

Manual:Interface/PPPoE

161

LCP negotiation
Authentication
IPCP negotiation - client is assigned with an IP address.
PPPoE server sends Echo-Request packets to the client to determine the state of the session, otherwise server will not
be able to determine that session is terminated in cases when client terminates session without sending
Terminate-Request packet.
More detailed description of PPPoE protocol can be found in RFC 2516

Used Packet Types


Packet

Description

PADI

PPPoE Active Discovery Initialization


The PPPoE client sends out a PADI packet to the broadcast address. This packet can also populate the "service-name" field if a service
name has been entered on the dial-up networking properties of the PPPoE broadband connectoid. If a service name has not been entered,
this field is not populated

PADO

PPPoE Active Discovery Offer


The PPPoE server, or Access Concentrator, should respond to the PADI with a PADO if the Access Concentrator is able to service the
"service-name" field that had been listed in the PADI packet. If no "service-name" field had been listed, the Access Concentrator will
respond with a PADO packet that has the "service-name" field populated with the service names that the Access Concentrator can service.
The PADO packet is sent to the unicast address of the PPPoE client

PADR

PPPoE Active Discovery Request


When a PADO packet is received, the PPPoE client responds with a PADR packet. This packet is sent to the unicast address of the Access
Concentrator. The client may receive multiple PADO packets, but the client responds to the first valid PADO that the client received. If the
initial PADI packet had a blank "service-name" field filed, the client populates the "service-name" field of the PADR packet with the first
service name that had been returned in the PADO packet.

PADS

PPPoE Active Discovery Session confirmation


When the PADR is received, the Access Concentrator generates a unique session identification (ID) for the Point-to-Point Protocol (PPP)
session and returns this ID to the PPPoE client in the PADS packet. This packet is sent to the unicast address of the client.

PADT

PPPoE Active Discovery Terminate


might be sent anytime after a session is established to indicate that a PPPoE session terminated. It can be sent by either server or client.

MTU
Typically largest Ethernet frame that can be transmitted without fragmentation is 1500 bytes. PPPoE adds another 6
bytes of overhead and PPP field adds two more bytes, leaving 1492 bytes for IP datagram. Therefore max PPPoE
MRU and MTU values must not be larger than 1492.
TCP stacks try to avoid fragmentation, os they use an MSS (Maximum Segment Size). By default MSS is chosen as
MTU of the outgoing interface minus the usual size of the TCP and IP headers (40 bytes), which results in 1460
bytes for an Eternet interface. Unfortunately there may be intermediate links with lower MTU which will cause
fragmentation. In such case TCP stack performs path MTU discovery. Routers which cannot forward the datagram
without fragmentation are supposed to drop packet and send ICMP-Fragmentation-Required to originating host.
When host receives such ICMP, it tries lower MTU. This should work in ideal world, however in real world many
routers do not generate fragmentation-required datagrams, also many firewalls drop all ICMP datagrams.
Workaround for this problem is to adjust MSS if it is too big. By default RouterOS adds mangle rules to intercept
TCP SYN packets and silently adjust any advertised MSS option so they will be appropriate for the PPPoE link.
Additional information on maximum supported MTUs for routerboards are listed here.

Manual:Interface/PPPoE

162

PPPoE Client
Sub-menu: /interface pppoe-client

Properties
Property

Description

ac-name (string; Default: "")

Access Concentrator name, this may ne left blank and the client will connect to any access
concentrator on the broadcast domain

add-default-route (yes|no; Default: no)

Enable/Disable whether to add default route automatically

allow (mschap2|mschap1|chap|pap; Default:


mschap2,mschap1,chap,pap)

allowed authentication methods, by default all methods are allowed

dial-on-demand (yes|no; Default: no)

connects to AC only when outbound traffic is generated

interface (string; Default: )

interface name on which client will run

max-mru (integer; Default: 1460)

Maximum Receive Unit

max-mtu (integer; Default: 1460)

Maximum Transmission Unit

mrru (integer: 512..65535|disabled; Default:


disabled)

maximum packet size that can be received on the link. If a packet is bigger than tunnel MTU, it
will be split into multiple packets, allowing full size IP or Ethernet packets to be sent over the
tunnel. Read more >>

name (string; Default: pppoe-out[i])

name of the PPPoE interface, generated by ROuterOS if not specified

password (string; Default: )

password used to authenticate

profile (string; Default: default)

default profile for the connection defined in /ppp profiles

service-name (string; Default: "")

specifies the service name set on the access concentrator, can be left blank to connect to any
PPPoE server

use-peer-dns (yes|no; Default: no)

enable/disable getting DNS settings from the peer

user (string; Default: "")

username used for authentication

Status
Command /interface pppoe-client monitor will display current PPPoE status.
Available read only properties:
Property

Description

ac-mac (MAC address) MAC address of the access concentrator (AC) the client is connected to
ac-name (string)

name of the Access Concentrator

encoding (string)

encryption and encoding (if asymmetric, separated with '/') being used in this connection

mru (integer)

effective MRU of the link

mtu (integer)

effective MTU of the link

service-name (string) used service name


status (string)

current link status. Available values are:

uptime (time)

dialing,
verifying password...,
connected,
disconnected.

connection time displayed in days, hours, minutes and seconds

Manual:Interface/PPPoE

163

Scanner
Starting from v3.21 RouterOS has new tool - PPPoE Scanner. It allows you to scan all active PPPoE servers in
broadcast domain. Command to run scanner is as follows/interface pppoe-client scan
<interface>
Available read only properties:
Property
service (string)

Description
Service name configured on server

mac-address (MAC) Mac address of detected server


ac-name (string)

name of the Access Concentrator

Notes
Note for Windows. Some connection instructions may use the form where the "phone number", such as
"MikroTik_AC\mt1", is specified to indicate that "MikroTik_AC" is the access concentrator name and "mt1" is the
service name.
Specifying MRRU means enabling MP (Multilink PPP) over single link. This protocol is used to split big packets
into smaller ones. Under Windows it can be enabled in Networking tag, Settings button, "Negotiate multi-link for
single link connections". Their MRRU is hardcoded to 1614. This setting is usefull to overcome PathMTU discovery
failures. The MP should be enabled on both peers.

Example
To add and enable PPPoE client on the ether1 interface connecting to the AC that provides testSN service using user
name user with the password passwd:
[admin@RemoteOffice] interface pppoe-client> add interface=ether1 service-name=testSN user=user
password=passwd disabled=no
[admin@RemoteOffice] interface pppoe-client> print
Flags: X - disabled, R - running
0

R name="pppoe-out1" max-mtu=1480 max-mru=1480 mrru=disabled interface=ether1


user="user" password="passwd" profile=default service-name="testSN"
ac-name="" add-default-route=no dial-on-demand=no use-peer-dns=no
allow=pap,chap,mschap1,mschap2

[admin@MikroTik] interface pppoe-client> monitor pppoe-out1


status: "connected"
uptime: 6s
idle-time: 6s
encoding: "MPPE128 stateless"
service-name: "testSN"
ac-name: "MikroTik"
ac-mac: 00:0C:42:04:00:73
mtu: 1480
mru: 1480

Manual:Interface/PPPoE

164

Additional Resources
PPPoE Clients:
RASPPPoE [1]for Windows 95, 98, 98SE, ME, NT4, 2000, XP, .NET

PPPoE Server Setup (Access Concentrator)


Sub-menu: /interface pppoe-server server
The PPPoE server (access concentrator) supports multiple servers for each interface - with differing service names.
Currently the throughput of the PPPoE server has been tested to 160 Mb/s on a Celeron 600 CPU. Using higher
speed CPUs, throughput should increase proportionately.
The access concentrator name and PPPoE service name are used by clients to identity the access concentrator to
register with. The access concentrator name is the same as the identity of the router displayed before the command
prompt. The identity may be set within the /system identity submenu.
Note that if no service name is specified in WindowsXP, it will use only service with no name. So if you want to
serve WindowsXP clients, leave your service name empty.

Properties
Property

Description

authentication ( mschap2 | mschap1 | chap | Authentication algorithm


pap; Default: "mschap2, mschap1, chap, pap")
default-profile (string; Default: "default") Default user profile to use
interface (string; Default: "")

Interface, which the clients are connected to

keepalive-timeout (time; Default: "10")

Defines the time period (in seconds) after which the router is starting to send keepalive
packets every second. If no traffic and no keepalive responses came for that period of time
(i.e. 2 * keepalive-timeout), not responding client is proclaimed disconnected.

max-mru (integer; Default: "1480")

Maximum Receive Unit. The optimal value is the MTU of the interface the tunnel is working
over decreased by 20 (so, for 1500-byte Ethernet link, set the MTU to 1480 to avoid
fragmentation of packets)

max-mtu (integer; Default: "1480")

Maximum Transmission Unit. The optimal value is the MTU of the interface the tunnel is
working over decreased by 20 (so, for 1500-byte Ethernet link, set the MTU to 1480 to avoid
fragmentation of packets)

max-sessions (integer; Default: "0")

Maximum number of clients that the AC can serve. '0'- no limitations.

mrru (integer: 512..65535 | disabled; Default:


"disabled")

Maximum packet size that can be received on the link. If a packet is bigger than tunnel MTU,
it will be split into multiple packets, allowing full size IP or Ethernet packets to be sent over
the tunnel. Read more >>

one-session-per-host (yes | no; Default:


"no")

Allow only one session per host (determined by MAC address). If a host will try to establish a
new session, the old one will be closed

service-name (string; Default: "")

The PPPoE service name. Server will accept clients which sends PADI message with
service-names that matches this setting or if service-name field in PADI message is not set.

Manual:Interface/PPPoE
Notes
The default keepalive-timeout value of 10 is OK in most cases. If you set it to 0, the router will not disconnect clients
until they explicitly log out or the router is restarted. To resolve this problem, the one-session-per-host property can
be used.
Security issue: do not assign an IP address to the interface you will be receiving the PPPoE requests on.
Specifying MRRU means enabling MP (Multilink PPP) over single link. This protocol is used to split big packets
into smaller ones. Under Windows it can be enabled in Networking tag, Settings button, "Negotiate multi-link for
single link connections". Their MRRU is hardcoded to 1614. This setting is usefull to overcome PathMTU discovery
failures. The MP should be enabled on both peers.
Example
To add PPPoE server on ether1 interface providing ex service and allowing only one connection per host:
[admin@MikroTik] interface pppoe-server server> add interface=ether1 service-name=ex
one-session-per-host=yes
[admin@MikroTik] interface pppoe-server server> print
Flags: X - disabled
0 X service-name="ex" interface=ether1 mtu=1480 mru=1480 mrru=disabled
authentication=mschap2,mschap,chap,pap keepalive-timeout=10
one-session-per-host=yes max-sessions=0 default-profile=default
[admin@MikroTik] interface pppoe-server server>

PPPoE Server
Sub-menu: /interface pppoe-server
There are two types of interface (tunnel) items in PPTP server configuration - static users and dynamic connections.
An interface is created for each tunnel established to the given server. Static interfaces are added administratively if
there is a need to reference the particular interface name (in firewall rules or elsewhere) created for the particular
user. Dynamic interfaces are added to this list automatically whenever a user is connected and its username does not
match any existing static entry (or in case the entry is active already, as there can not be two separate tunnel
interfaces referenced by the same name). Dynamic interfaces appear when a user connects and disappear once the
user disconnects, so it is impossible to reference the tunnel created for that use in router configuration (for example,
in firewall), so if you need a persistent rules for that user, create a static entry for him/her. Otherwise it is safe to use
dynamic configuration. Note that in both cases PPP users must be configured properly - static entries do not replace
PPP configuration.
Property Description
encoding (read-only: text) - encryption and encoding (if asymmetric, separated with '/') being used in this
connection
mru (read-only: integer) - client's MRU
mtu (read-only: integer) - client's MTU
name (name) - interface name
remote-address (read-only: MAC address) - MAC address of the connected client
service (name) - name of the service the user is connected to
uptime (read-only: time) - shows how long the client is connected
user (name) - the name of the connected user (must be present in the user darabase anyway)

165

Manual:Interface/PPPoE
Example
To view the currently connected users:
[admin@MikroTik] interface pppoe-server> print
Flags: X - disabled, D - dynamic, R - running
#
NAME
USER
SERVICE
REMOTE... ENCODING UPTIME
0 DR <pppoe-ex> user
ex
00:0C:... MPPE12... 40m45s
[admin@MikroTik] interface pppoe-server>
To disconnect the user ex:
[admin@MikroTik] interface pppoe-server> remove [find user=ex]
[admin@MikroTik] interface pppoe-server> print
[admin@MikroTik] interface pppoe-server>

Application Examples
PPPoE in a multipoint wireless 802.11g network
In a wireless network, the PPPoE server may be attached to an Access Point (as well as to a regular station of
wireless infrastructure). Either our RouterOS client or Windows PPPoE clients may connect to the Access Point for
PPPoE authentication. Further, for RouterOS clients, the radio interface may be set to MTU 1600 so that the PPPoE
interface may be set to MTU 1500. This optimizes the transmission of 1500 byte packets and avoids any problems
associated with MTUs lower than 1500. It has not been determined how to change the MTU of the Windows
wireless interface at this moment.
Let us consider the following setup where the MikroTik Wireless AP offers wireless clients transparent access to the
local network with authentication:

First of all, the wireless interface should be configured:

166

Manual:Interface/PPPoE
[admin@PPPoE-Server] interface wireless> set 0 mode=ap-bridge \
frequency=2442 band=2.4ghz-b/g ssid=mt disabled=no
[admin@PPPoE-Server] interface wireless> print
Flags: X - disabled, R - running
0 X name="wlan1" mtu=1500 mac-address=00:0C:42:18:5C:3D arp=enabled
interface-type=Atheros AR5413 mode=ap-bridge ssid="mt" frequency=2442
band=2.4ghz-b/g scan-list=default antenna-mode=ant-a wds-mode=disabled
wds-default-bridge=none wds-ignore-ssid=no default-authentication=yes
default-forwarding=yes default-ap-tx-limit=0 default-client-tx-limit=0
hide-ssid=no security-profile=default compression=no
[admin@PPPoE-Server] interface wireless>
Now, configure the Ethernet interface, add the IP address and set the default route:
[admin@PPPoE-Server] ip address> add address=10.1.0.3/24 interface=Local
[admin@PPPoE-Server] ip address> print
Flags: X - disabled, I - invalid, D - dynamic
#
ADDRESS
NETWORK
BROADCAST
INTERFACE
0
10.1.0.3/24
10.1.0.0
10.1.0.255
Local
[admin@PPPoE-Server] ip address> /ip route
[admin@PPPoE-Server] ip route> add gateway=10.1.0.1
[admin@PPPoE-Server] ip route> print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#
DST-ADDRESS
PREF-SRC
G GATEWAY
DISTANCE INTER...
0 ADC 10.1.0.0/24
10.1.0.3
0
Local
1 A S 0.0.0.0/0
r 10.1.0.1
1
Local
[admin@PPPoE-Server] ip route> /interface ethernet
[admin@PPPoE-Server] interface ethernet> set Local arp=proxy-arp
[admin@PPPoE-Server] interface ethernet> print
Flags: X - disabled, R - running
#
NAME
MTU
MAC-ADDRESS
ARP
0 R Local
1500 00:0C:42:03:25:53 proxy-arp
[admin@PPPoE-Server] interface ethernet>
We should add PPPoE server to the wireless interface:
[admin@PPPoE-Server] interface pppoe-server server> add interface=wlan1 \
service-name=mt one-session-per-host=yes disabled=no
[admin@PPPoE-Server] interface pppoe-server server> print
Flags: X - disabled
0
service-name="mt" interface=wlan1 max-mtu=1480 max-mru=1480 mrru=disabled
authentication=pap,chap,mschap1,mschap2 keepalive-timeout=10
one-session-per-host=yes max-sessions=0 default-profile=default
[admin@PPPoE-Server] interface pppoe-server server>
Finally, we can set up PPPoE clients:

167

Manual:Interface/PPPoE
[admin@PPPoE-Server] ip pool> add name=pppoe ranges=10.1.0.100-10.1.0.200
[admin@PPPoE-Server] ip pool> print
# NAME
RANGES
0 pppoe
10.1.0.100-10.1.0.200
[admin@PPPoE-Server] ip pool> /ppp profile
[admin@PPPoE-Server] ppp profile> set default use-encryption=yes \
local-address=10.1.0.3 remote-address=pppoe
[admin@PPPoE-Server] ppp profile> print
Flags: * - default
0 * name="default" local-address=10.1.0.3 remote-address=pppoe
use-compression=no use-vj-compression=no use-encryption=yes only-one=no
change-tcp-mss=yes
1 * name="default-encryption" use-compression=default
use-vj-compression=default use-encryption=yes only-one=default
change-tcp-mss=default
[admin@PPPoE-Server] ppp profile> .. secret
[admin@PPPoE-Server] ppp secret> add name=w password=wkst service=pppoe
[admin@PPPoE-Server] ppp secret> add name=l password=ltp service=pppoe
[admin@PPPoE-Server] ppp secret> print
Flags: X - disabled
#
NAME
SERVICE CALLER-ID PASSWORD PROFILE
REMOTE-ADDRESS
0
w
pppoe
wkst
default
0.0.0.0
1
l
pppoe
ltp
default
0.0.0.0
[admin@PPPoE-Server] ppp secret>
Thus we have completed the configuration and added two users: w and l who are able to connect to Internet, using
PPPoE client software.
Note that Windows XP built-in client supports encryption, but RASPPPOE does not. So, if it is planned not to
support Windows clients older than Windows XP, it is recommended not to require encryption. In other case, the
server will accept clients that do not encrypt data.

Troubleshooting
I can connect to my PPPoE server. The ping goes even through it, but I still cannot open web pages
Make sure that you have specified a valid DNS server in the router (in /ip dns or in /ppp profile the dns-server
parameter).
The PPPoE server shows more than one active user entry for one client, when the clients disconnect, they
are still shown and active
Set the keepalive-timeout parameter (in the PPPoE server configuration) to 10 if You want clients to be
considered logged off if they do not respond for 10 seconds.
Note that if the keepalive-timeout parameter is set to 0 and the only-one parameter (in PPP profile
settings) is set to yes then the clients might be able to connect only once. To resolve this problem
one-session-per-host parameter in PPPoE server configuration should be set to yes
My Windows XP client cannot connect to the PPPoE server
You have to specify the "Service Name" in the properties of the XP PPPoE client. If the service name is not set, or it
does not match the service name of the MikroTik PPPoE server, you get the "line is busy" errors, or the system

168

Manual:Interface/PPPoE
shows "verifying password - unknown error"
I want to have logs for PPPoE connection establishment
Configure the logging feature under the /system logging facility and enable the PPP type logs. Read more >>
[ Top | Back to Content ]

References
[1] http:/ / www. raspppoe. com/

Manual:Interface/PPTP
Applies to RouterOS: v3, v4, v5+

Summary
Standards: RFC 2637
PPTP is a secure tunnel for transporting IP traffic using PPP. PPTP encapsulates PPP in virtual lines that run over IP.
PPTP incorporates PPP and MPPE (Microsoft Point to Point Encryption) to make encrypted links. The purpose of
this protocol is to make well-managed secure connections between routers as well as between routers and PPTP
clients (clients are available for and/or included in almost all OSs including Windows).
Multilink PPP (MP) is supported in order to provide MRRU (the ability to transmit full-sized 1500 and larger
packets) and bridging over PPP links (using Bridge Control Protocol (BCP) that allows to send raw Ethernet frames
over PPP links). This way it is possible to setup bridging without EoIP. The bridge should either have an
administratively set MAC address or an Ethernet-like interface in it, as PPP links do not have MAC addresses.
PPTP includes PPP authentication and accounting for each PPTP connection. Full authentication and accounting of
each connection may be done through a RADIUS client or locally.
MPPE 40bit RC4 and MPPE 128bit RC4 encryption are supported.
PPTP traffic uses TCP port 1723 and IP protocol GRE (Generic Routing Encapsulation, IP protocol ID 47), as
assigned by the Internet Assigned Numbers Authority (IANA). PPTP can be used with most firewalls and routers by
enabling traffic destined for TCP port 1723 and protocol 47 traffic to be routed through the firewall or router.
PPTP connections may be limited or impossible to setup though a masqueraded/NAT IP connection. Please see the
Microsoft and RFC links listed below for more information.

PPTP Client
Sub-menu: /interface pptp-client

Properties

169

Manual:Interface/PPTP

170

Property

Description

add-default-route (yes | no; Default: no) Whether to add PPTP remote address as a default route.
allow (mschap2 | mschap1 | chap | pap;
Default: mschap2, mschap1, chap, pap)

Allowed authentication methods.

connect-to (IP; Default: )

Remote address of PPTP server

dial-on-demand (yes | no; Default: no)


disabled (yes | no; Default: yes)

Whether interface is disabled or not. By default it is disabled

max-mru (integer; Default: 1460)

Maximum Receive Unit. Max packet size that PPTP interface will be able to receive without
packet fragmentation.

max-mtu (integer; Default: 1460)

Maximum Transmission Unit. Max packet size that PPTP interface will be able to send without
packet fragmentation.

mrru (disabled | integer; Default: disabled)

Maximum packet size that can be received on the link. If a packet is bigger than tunnel MTU, it
will be split into multiple packets, allowing full size IP or Ethernet packets to be sent over the
tunnel. Read more >>

name (string; Default: )

Descriptive name of the interface.

password (string; Default: "")

Password used for authentication.

profile (name; Default: default-encryption) Used PPP profile.


user (string; Default: )

User name used for authentication.

Quick example
This example demonstrates how to set up PPTP client with username "pptp-hm", password "123" and server
10.1.101.100
[admin@dzeltenais_burkaans] /interface pptp-client>add name=pptp-hm user=pptp-hm password=123 \
\... connect-to=10.1.101.100 disabled=no
[admin@dzeltenais_burkaans] /interface pptp-client> print detail
Flags: X - disabled, R - running
0

name="pptp-hm" max-mtu=1460 max-mru=1460 mrru=disabled


connect-to=10.1.101.100 user="pptp-hm" password="123"
profile=default-encryption add-default-route=no dial-on-demand=no
allow=pap,chap,mschap1,mschap2

PPTP Server
Sub-menu: /interface pptp-server
This sub-menu shows interfaces for each connected PPTP clients.
An interface is created for each tunnel established to the given server. There are two types of interfaces in PPTP
server's configuration
Static interfaces are added administratively if there is a need to reference the particular interface name (in firewall
rules or elsewhere) created for the particular user.
Dynamic interfaces are added to this list automatically whenever a user is connected and its username does not
match any existing static entry (or in case the entry is active already, as there can not be two separate tunnel
interfaces referenced by the same name).
Dynamic interfaces appear when a user connects and disappear once the user disconnects, so it is impossible to
reference the tunnel created for that use in router configuration (for example, in firewall), so if you need a persistent

Manual:Interface/PPTP

171

rules for that user, create a static entry for him/her. Otherwise it is safe to use dynamic configuration.
Note: in both cases PPP users must be configured properly - static entries do not replace PPP configuration.

Server configuration
Sub-menu: /interface pptp-server server
Properties:
Property

Description

authentication (pap | chap | mschap1 | Authentication methods that server will accept.
mschap2; Default: mschap1,mschap2)
default-profile (name; Default:
default-encryption)
enabled (yes | no; Default: no)

Defines whether PPTP server is enabled or not.

keepalive-timeout (time; Default: 30) Defines the time period (in seconds) after which the router is starting to send keepalive packets
every second. If no traffic and no keepalive responses has came for that period of time (i.e. 2 *
keepalive-timeout), not responding client is proclaimed disconnected
max-mru (integer; Default: 1460)

Maximum Receive Unit. Max packet size that PPTP interface will be able to receive without packet
fragmentation.

max-mtu (integer; Default: 1460)

Maximum Transmission Unit. Max packet size that PPTP interface will be able to send without
packet fragmentation.

mrru (disabled | integer; Default: disabled) Maximum packet size that can be received on the link. If a packet is bigger than tunnel MTU, it will
be split into multiple packets, allowing full size IP or Ethernet packets to be sent over the tunnel.
Read more >>

To enable PPTP server:


[admin@MikroTik] interface pptp-server server> set enabled=yes
[admin@MikroTik] interface pptp-server server> print
enabled: yes
max-mtu: 1460
max-mru: 1460
mrru: disabled
authentication: mschap2,mschap1
keepalive-timeout: 30
default-profile: default
[admin@MikroTik] interface pptp-server server>

Monitoring
Monitor command can be used to monitor status of the tunnel on both client and server.
[admin@dzeltenais_burkaans] /interface pptp-client> monitor 0
status: "connected"
uptime: 7h24m18s
idle-time: 6h21m4s
encoding: "MPPE128 stateless"
mtu: 1460
mru: 1460

Manual:Interface/PPTP

172

Read-only properties
Property

Description

status ()

Current PPTP status. Value other than "connected" indicates that there are some problems estabising tunnel.

uptime (time)

Elapsed time since tunnel was established.

idle-time (time) Elapsed time since last activity on the tunnel.


encoding ()

Used encryption method

mtu (integer)

Negotiated and used MTU

mru (integer)

Negotiated and used MRU

Application Examples
Connecting Remote Client
The following example shows how to connect a computer to a remote office network over PPTP encrypted tunnel
giving that computer an IP address from the same network as the remote office has (without need of bridging over
EoIP tunnels)
Consider following setup

Office router is connected to internet through ether1. Workstations are connected to ether2. Laptop is connected to
the internet and can reach Office router's public IP (in our example it is 192.168.80.1).
First step is to create a user
[admin@RemoteOffice] /ppp secret> add name=Laptop service=pptp password=123
local-address=10.1.101.1 remote-address=10.1.101.100
[admin@RemoteOffice] /ppp secret> print detail
Flags: X - disabled
0
name="Laptop" service=pptp caller-id="" password="123" profile=default
local-address=10.1.101.1 remote-address=10.1.101.100 routes==""
[admin@RemoteOffice] /ppp secret>

Manual:Interface/PPTP

173

Notice that pptp local address is the same as routers address on local interface and remote address is form the same
range as local network (10.1.101.0/24).
Next step is to enable pptp server and pptp client on the laptop.
[admin@RemoteOffice]
[admin@RemoteOffice]
enabled:
max-mtu:
max-mru:
mrru:
authentication:
keepalive-timeout:
default-profile:
[admin@RemoteOffice]

/interface pptp-server server> set enabled=yes


/interface pptp-server server> print
yes
1460
1460
disabled
mschap2
30
default
/interface pptp-server server>

PPTP client from the laptop should connect to routers public IP which in our example is 192.168.80.1.
Please, consult the respective manual on how to set up a PPTP client with the software You are using.
At this point (when pptp client is successfully connected) if you will try to ping any workstation form the laptop,
ping will time out, because Laptop is unable to get ARPs from workstations. Solution is to set up proxy-arp on
local interface
[admin@RemoteOffice]
[admin@RemoteOffice]
Flags: X - disabled,
#
NAME
0 R ether1
1 R ether2
[admin@RemoteOffice]

/interface ethernet> set Office arp=proxy-arp


/interface ethernet> print
R - running
MTU
MAC-ADDRESS
ARP
1500 00:30:4F:0B:7B:C1 enabled
1500 00:30:4F:06:62:12 proxy-arp
interface ethernet>

After proxy-arp is enabled client can successfully reach all workstations in local network behind the router.

Manual:Interface/PPTP

174

Site-to-Site PPTP
The following is an example of connecting two Intranets using PPTP tunnel over the Internet.
Consider following setup

Office and Home routers are connected to internet through ether1, workstations and laptops are connected to ether2.
Both local networks are routed through pptp client, thus they are not in the same broadcast domain. If both networks
should be in the same broadcast domain then you need to use BCP and bridge pptp tunnel with local interface.
First step is to create a user
[admin@RemoteOffice] /ppp secret> add name=Home service=pptp password=123
local-address=172.16.1.1 remote-address=172.16.1.2 routes="10.1.202.0/24 172.16.1.2 1"
[admin@RemoteOffice] /ppp secret> print detail
Flags: X - disabled
0

name="Home" service=pptp caller-id="" password="123" profile=default


local-address=172.16.1.1 remote-address=172.16.1.2 routes=="10.1.201.0/24 172.16.1.1 1"

[admin@RemoteOffice] /ppp secret>

Notice that we set up pptp to add route whenever client connects. If this option is not set, then you will need static
routing configuration on the server to route traffic between sites through pptp tunnel.
Next step is to enable pptp server on the office router and configure pptp client on the Home router.
[admin@RemoteOffice]
[admin@RemoteOffice]
enabled:
max-mtu:
max-mru:
mrru:
authentication:
keepalive-timeout:
default-profile:
[admin@RemoteOffice]

/interface pptp-server server> set enabled=yes


/interface pptp-server server> print
yes
1460
1460
disabled
mschap2
30
default
/interface pptp-server server>

Manual:Interface/PPTP

175

[admin@Home] /interface pptp-client> add user=Home password=123 connect-to=192.168.80.1 disabled=no


[admin@Home] /interface pptp-client> print
Flags: X - disabled, R - running
0

name="pptp-out1" max-mtu=1460 max-mru=1460 mrru=disabled connect-to=192.168.80.1 user="Home"


password="123" profile=default-encryption add-default-route=no dial-on-demand=no
allow=pap,chap,mschap1,mschap2

[admin@Home] /interface pptp-client>

Now we need to add route to reach local network behind Home router
[admin@RemoteOffice] /ip route> add dst-address=10.1.202.0/24 gateway=172.16.1.2
Now after tunnel is established and routes are set, you should be able to ping remote network.

Read More
BCP (Bridge Control Protocol)
http://msdn.microsoft.com/library/backgrnd/html/understanding_pptp.htm
http://support.microsoft.com/support/kb/articles/q162/8/47.asp
http://www.ietf.org/rfc/rfc2637.txt?number=2637
http://www.ietf.org/rfc/rfc3078.txt?number=3078
http://www.ietf.org/rfc/rfc3079.txt?number=3079
[ Top | Back to Content ]

Manual:Interface/L2TP
Applies to RouterOS: v3, v4, v5+

Summary
Standards: RFC 2661
L2TP is a secure tunnel protocol for transporting IP traffic using PPP. L2TP encapsulates PPP in virtual lines that
run over IP, Frame Relay and other protocols (that are not currently supported by MikroTik RouterOS). L2TP
incorporates PPP and MPPE (Microsoft Point to Point Encryption) to make encrypted links. The purpose of this
protocol is to allow the Layer 2 and PPP endpoints to reside on different devices interconnected by a
packet-switched network. With L2TP, a user has a Layer 2 connection to an access concentrator - LAC (e.g., modem
bank, ADSL DSLAM, etc.), and the concentrator then tunnels individual PPP frames to the Network Access Server NAS. This allows the actual processing of PPP packets to be separated from the termination of the Layer 2 circuit.
From the user's perspective, there is no functional difference between having the L2 circuit terminate in a NAS
directly or using L2TP.
It may also be useful to use L2TP just as any other tunneling protocol with or without encryption. The L2TP
standard says that the most secure way to encrypt data is using L2TP over IPsec (Note that it is default mode for
Microsoft L2TP client) as all L2TP control and data packets for a particular tunnel appear as homogeneous UDP/IP
data packets to the IPsec system.

Manual:Interface/L2TP

176

Multilink PPP (MP) is supported in order to provide MRRU (the ability to transmit full-sized 1500 and larger
packets) and bridging over PPP links (using Bridge Control Protocol (BCP) that allows to send raw Ethernet frames
over PPP links). This way it is possible to setup bridging without EoIP. The bridge should either have an
administratively set MAC address or an Ethernet-like interface in it, as PPP links do not have MAC addresses.
L2TP includes PPP authentication and accounting for each L2TP connection. Full authentication and accounting of
each connection may be done through a RADIUS client or locally.
MPPE 40bit RC4 and MPPE 128bit RC4 encryption are supported.
L2TP traffic uses UDP protocol for both control and data packets. UDP port 1701 is used only for link
establishment, further traffic is using any available UDP port (which may or may not be 1701). This means that
L2TP can be used with most firewalls and routers (even with NAT) by enabling UDP traffic to be routed through the
firewall or router.

L2TP Client
Sub-menu: /interface l2tp-client
Property

Description

add-default-route (yes | no; Default: no) Whether to add L2TP remote address as a default route.
allow (mschap2 | mschap1 | chap | pap;
Default: mschap2, mschap1, chap, pap)

Allowed authentication methods.

connect-to (IP; Default: )

Remote address of L2TP server

dial-on-demand (yes | no; Default: no)


disabled (yes | no; Default: yes)

Whether interface is disabled or not. By default it is disabled

max-mru (integer; Default: 1460)

Maximum Receive Unit. Max packet size that PPTP interface will be able to receive without
packet fragmentation.

max-mtu (integer; Default: 1460)

Maximum Transmission Unit. Max packet size that PPTP interface will be able to send without
packet fragmentation.

mrru (disabled | integer; Default: disabled)

Maximum packet size that can be received on the link. If a packet is bigger than tunnel MTU, it
will be split into multiple packets, allowing full size IP or Ethernet packets to be sent over the
tunnel. Read more >>

name (string; Default: )

Descriptive name of the interface.

password (string; Default: "")

Password used for authentication.

profile (name; Default: default-encryption) Used PPP profile.


user (string; Default: )

User name used for authentication.

This example demonstrates how to set up L2TP client with username "l2tp-hm", password "123" and server
10.1.101.100
[admin@dzeltenais_burkaans] /interface l2tp-client>add name=l2tp-hm user=l2tp-hm password=123 \
\... connect-to=10.1.101.100 disabled=no
[admin@dzeltenais_burkaans] /interface l2tp-client> print detail
Flags: X - disabled, R - running
0

name="l2tp-hm" max-mtu=1460 max-mru=1460 mrru=disabled


connect-to=10.1.101.100 user="l2tp-hm" password="123"
profile=default-encryption add-default-route=no dial-on-demand=no
allow=pap,chap,mschap1,mschap2

Manual:Interface/L2TP

177

L2TP Server
Sub-menu: /interface l2tp-server
This sub-menu shows interfaces for each connected L2TP clients.
An interface is created for each tunnel established to the given server. There are two types of interfaces in L2TP
server's configuration
Static interfaces are added administratively if there is a need to reference the particular interface name (in firewall
rules or elsewhere) created for the particular user.
Dynamic interfaces are added to this list automatically whenever a user is connected and its username does not
match any existing static entry (or in case the entry is active already, as there can not be two separate tunnel
interfaces referenced by the same name).
Dynamic interfaces appear when a user connects and disappear once the user disconnects, so it is impossible to
reference the tunnel created for that use in router configuration (for example, in firewall), so if you need a persistent
rules for that user, create a static entry for him/her. Otherwise it is safe to use dynamic configuration.
Note: in both cases PPP users must be configured properly - static entries do not replace PPP configuration.

Sub-menu: /interface l2tp-server server


Properties:

Property
authentication (pap | chap | mschap1 |
mschap2; Default: mschap1,mschap2)

Description
Authentication methods that server will accept.

default-profile (name; Default:


default-encryption)
enabled (yes | no; Default: no)

Defines whether PPTP server is enabled or not.

max-mru (integer; Default: 1460)

Maximum Receive Unit. Max packet size that PPTP interface will be able to receive without
packet fragmentation.

max-mtu (integer; Default: 1460)

Maximum Transmission Unit. Max packet size that PPTP interface will be able to send without
packet fragmentation.

mrru (disabled | integer; Default: disabled)

Maximum packet size that can be received on the link. If a packet is bigger than tunnel MTU, it
will be split into multiple packets, allowing full size IP or Ethernet packets to be sent over the
tunnel. Read more >>

To enable L2TP server:


[admin@MikroTik] interface l2tp-server server> set enabled=yes
[admin@MikroTik] interface l2tp-server server> print
enabled: yes
max-mtu: 1460
max-mru: 1460
mrru: disabled
authentication: pap,chap,mschap1,mschap2
default-profile: default-encryption
[admin@MikroTik] interface l2tp-server server>

Manual:Interface/L2TP

178

Monitoring
Monitor command can be used to monitor status of the tunnel on both client and server.
[admin@dzeltenais_burkaans] /interface l2tp-client> monitor 0
status: "connected"
uptime: 7h24m18s
idle-time: 6h21m4s
encoding: "MPPE128 stateless"
mtu: 1460
mru: 1460
Read-only properties
Property
status ()

Description
Current L2TP status. Value other than "connected" indicates that there are some problems estabising tunnel.

uptime (time)

dialing - attempting to make a connection


verifying password - connection has been established to the server, password verification in progress
connected - tunnel is successfully established
terminated - interface is not enabled or the other side will not establish a connection

Elapsed time since tunnel was established.

idle-time (time) Elapsed time since last activity on the tunnel.


encoding ()

Used encryption method

mtu (integer)

Negotiated and used MTU

mru (integer)

Negotiated and used MRU

Manual:Interface/L2TP

179

Application Examples
Connecting Remote Client
The following example shows how to connect a computer to a remote office network over L2TP encrypted tunnel
giving that computer an IP address from the same network as the remote office has (without need of bridging over
EoIP tunnels)
Consider following setup

Office router is connected to internet through ether1. Workstations are connected to ether2. Laptop is connected to
the internet and can reach Office router's public IP (in our example it is 192.168.80.1).
First step is to create a user
[admin@RemoteOffice] /ppp secret> add name=Laptop service=l2tp password=123
local-address=10.1.101.1 remote-address=10.1.101.100
[admin@RemoteOffice] /ppp secret> print detail
Flags: X - disabled
0
name="Laptop" service=l2tp caller-id="" password="123" profile=default
local-address=10.1.101.1 remote-address=10.1.101.100 routes==""
[admin@RemoteOffice] /ppp secret>
Notice that L2TP local address is the same as routers address on local interface and remote address is form the same
range as local network (10.1.101.0/24).
Next step is to enable L2TP server and L2TP client on the laptop.
[admin@RemoteOffice]
[admin@RemoteOffice]
enabled:
max-mtu:
max-mru:
mrru:
authentication:

/interface l2tp-server server> set enabled=yes


/interface l2tp-server server> print
yes
1460
1460
disabled
mschap2

Manual:Interface/L2TP

180

default-profile: default-encryption
[admin@RemoteOffice] /interface l2tp-server server>
L2TP client from the laptop should connect to routers public IP which in our example is 192.168.80.1.
Please, consult the respective manual on how to set up a L2TP client with the software You are using.
Note: By default Windows sets up L2TP with IPsec. To disable IpSec registry modifications are required.
Read more >>

At this point (when L2TP client is successfully connected) if you will try to ping any workstation
form the laptop, ping will time out, because Laptop is unable to get ARPs from workstations.
Solution is to set up proxy-arp on local interface
[admin@RemoteOffice]
[admin@RemoteOffice]
Flags: X - disabled,
#
NAME
0 R ether1
1 R ether2
[admin@RemoteOffice]

interface ethernet> set ether2 arp=proxy-arp


interface ethernet> print
R - running
MTU
MAC-ADDRESS
ARP
1500 00:30:4F:0B:7B:C1 enabled
1500 00:30:4F:06:62:12 proxy-arp
interface ethernet>

After proxy-arp is enabled client can successfully reach all workstations in local network behind the router.

Site-to-Site L2TP
The following is an example of connecting two Intranets using L2TP tunnel over the Internet.
Consider following setup

Office and Home routers are connected to internet through ether1, workstations and laptops are connected to ether2.
Both local networks are routed through L2TP client, thus they are not in the same broadcast domain. If both
networks should be in the same broadcast domain then you need to use BCP and bridge L2TP tunnel with local
interface.
First step is to create a user

Manual:Interface/L2TP

181

[admin@RemoteOffice] /ppp secret> add name=Home service=l2tp password=123


local-address=172.16.1.1 remote-address=172.16.1.2 routes="10.1.101.0/24 172.16.1.1 1"
[admin@RemoteOffice] ppp secret> print detail
Flags: X - disabled
0

name="Home" service=l2tp caller-id="" password="123" profile=default


local-address=172.16.1.1 remote-address=172.16.1.2 routes=="10.1.101.0/24 172.16.1.1 1"

[admin@RemoteOffice] /ppp secret>

Notice that we set up L2TP to add route whenever client connects. If this option is not set, then you will need static
routing configuration on the server to route traffic between sites through L2TP tunnel.
Next step is to enable L2TP server on the office router and configure pptp client on the Home router.
[admin@RemoteOffice]
[admin@RemoteOffice]
enabled:
max-mtu:
max-mru:
mrru:
authentication:
default-profile:
[admin@RemoteOffice]

/interface l2tp-server server> set enabled=yes


/interface l2tp-server server> print
yes
1460
1460
disabled
mschap2
default-encryption
/interface l2tp-server server>

[admin@Home] /interface l2tp-client> add user=Home password=123 connect-to=192.168.80.1 disabled=no


[admin@Home] /interface l2tp-client> print
Flags: X - disabled, R - running
0 R

name="pptp-out1" max-mtu=1460 max-mru=1460 mrru=disabled connect-to=192.168.80.1 user="Home"


password="123" profile=default-encryption add-default-route=no dial-on-demand=no
allow=pap,chap,mschap1,mschap2

[admin@Home] /interface l2tp-client>

Now we need to add route to reach local network behind Home router
[admin@RemoteOffice] /ip route> add dst-address=10.1.202.0/24 gateway=172.16.1.2
After tunnel is established and routes are set, you should be able to ping remote network.

Read More
BCP (Bridge Control Protocol)
Disable IpSec used with L2TP on Windows [1]
MikroTik RouterOS and Windows XP IPSec/L2TP
[ Top | Back to Content ]

References
[1] http:/ / support. microsoft. com/ default. aspx?scid=kb%3Ben-us%3B258261. php

Manual:IP/Address

182

Manual:IP/Address
Applies to RouterOS: 2.9, v3, v4 +

Summary
Sub-menu: /ip address
Standards: IPv4 RFC 791
IP addresses serve for a general host identification purposes in IP networks. Typical (IPv4) address consists of four
octets. For proper addressing the router also needs the network mask value, id est which bits of the complete IP
address refer to the address of the host, and which - to the address of the network. The network address value is
calculated by binary AND operation from network mask and IP address values. It's also possible to specify IP
address followed by slash "/" and the amount of bits that form the network address.
In most cases, it is enough to specify the address, the netmask, and the interface arguments. The network prefix and
the broadcast address are calculated automatically.
It is possible to add multiple IP addresses to an interface or to leave the interface without any addresses assigned to
it. In case of bridging or PPPoE connection, the physical interface may bot have any address assigned, yet be
perfectly usable. Putting an IP address to a physical interface included in a bridge would mean actually putting it on
the bridge interface itself. You can use /ip address print detail to see to which interface the address belongs to.
MikroTik RouterOS has following types of addresses:
Static - manually assigned to the interface by a user
Dynamic - automatically assigned to the interface by DHCP or an estabilished PPP connections

Properties
Property

Description

address (IP/Mask; Default: ) IP address


broadcast (IP; Default:
255.255.255.255)

roadcasting IP address, calculated by default from an IP address and a network mask. Starting from v5RC6 this
parameter is removed

interface (name; Default: ) Interface name the IP address is assigned to


netmask (IP; Default: 0.0.0.0) Delimits network address part of the IP address from the host part
network (IP; Default: 0.0.0.0) IP address for the network. For point-to-point links it should be the address of the remote end. Starting from
v5RC6 this parameter is configurable only for addresses with /32 netmask (point to point links)

Read only properties


Property
actual-interface
(name)

Description
Name of the actual interface the logical one is bound to. For example, if the physical interface you assigned the
address to, is included in a bridge, the actual interface will show that bridge

Two IP addresses from the same network assigned to routers different interfaces are not valid unless VRF is used.
For example, the combination of IP address 10.0.0.1/24 on the ether1 interface and IP address 10.0.0.132/24 on the
ether2 interface is invalid, because both addresses belong to the same network 10.0.0.0/24. Use addresses from

Manual:IP/Address

183

different networks on different interfaces, or enable proxy-arp on ether1 or ether2.

Example
[admin@MikroTik] ip address> add address=10.10.10.1/24 interface=ether2
[admin@MikroTik] ip address> print
Flags: X - disabled, I - invalid, D - dynamic
#
ADDRESS
NETWORK
BROADCAST
INTERFACE
0
2.2.2.1/24
2.2.2.0
2.2.2.255
ether2
1
10.5.7.244/24
10.5.7.0
10.5.7.255
ether1
2
10.10.10.1/24
10.10.10.0
10.10.10.255
ether2
[admin@MikroTik] ip address>
[ Top | Back to Content ]

Manual:IP/ARP
Applies to RouterOS: 2.9, v3, v4 +

Summary
Sub-menu: /ip arp
Standards: ARP RFC 826
Even though IP packets are addressed using IP addresses, hardware addresses must be used to actually transport data
from one host to another. Address Resolution Protocol is used to map OSI level 3 IP addresses to OSI level 2 MAC
addreses. Router has a table of currently used ARP entries. Normally the table is built dynamically, but to increase
network security, it can be partialy or completely built statically by means of adding static entries.

Properties
Property

Description

address (IP; Default: )

IP address to be mapped

interface (string; Default: )

Interface name the IP address is assigned to

mac-address (MAC; Default: 00:00:00:00:00:00) MAC address to be mapped to

Read only properties:

Manual:IP/ARP

184

Property
dhcp (yes | no)

Description
Whether ARP entry is added by DHCP server

dynamic (yes | no) Whether entry is dynamically created


invalid (yes | no) Whether entry is not valid

Note: Maximal number of ARP entries is 8192.

ARP Modes
It is possible to set several ARP modes in interface configuration .....

Disabled
If ARP feature is turned off on the interface, i.e., arp=disabled is used, ARP requests from clients are not answered
by the router. Therefore, static arp entry should be added to the clients as well. For example, the router's IP and MAC
addresses should be added to the Windows workstations using the arp command:
C:\> arp -s 10.5.8.254

00-aa-00-62-c6-09

Enabled
This mode is enabled by default on all interfaces. ARPs will be discovered automatically and new dynamic entries
will be added to ARP table.

Manual:IP/ARP

185

Proxy ARP
A router with properly configured proxy ARP feature acts like a transparent ARP proxy between directly connected
networks.
This behaviour can be usefull, for example, if you want to assign dial-in (ppp, pppoe, pptp) clients IP addresses from
the same address space as used on the connected LAN.

Lets look at example setup from image above. Host A (172.16.1.2) on Subnet A wants to send packets to Host D
(172.16.2.3) on Subnet B. Host A has a /16 subnet mask which means that Host A believes that it is directly
connected to all 172.16.0.0/16 network (the same LAN). Since the Host A believes that is directly connected it sends
an ARP request to the destination to clarify MAC address of Host D. (in case when Host A finds that destination IP
address is not from the same subnet it send packet to default gateway.)
Host A broadcasts an ARP request on Subnet A:
Info from packet analyzer software:
No.

12

Time

5.133205

Source

Destination

00:1b:38:24:fc:13

ff:ff:ff:ff:ff:ff

Protocol

ARP

Packet details:

Ethernet II, Src: (00:1b:38:24:fc:13), Dst: (ff:ff:ff:ff:ff:ff)


Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Source: (00:1b:38:24:fc:13)
Type: ARP (0x0806)
Address Resolution Protocol (request)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6

Info

Who has 173.16.2.3?

Tell 173.16.1.2

Manual:IP/ARP

186

Protocol size: 4
Opcode: request (0x0001)
[Is gratuitous: False]
Sender MAC address: 00:1b:38:24:fc:13
Sender IP address: 173.16.1.2
Target MAC address: 00:00:00:00:00:00
Target IP address: 173.16.2.3

With this ARP request, Host A (172.16.1.2) isasking Host D (172.16.2.3) to send its MAC address. The ARP request
packet is then encapsulated in an Ethernet frame with the MAC address of Host A as the source address and a
broadcast (FF:FF:FF:FF:FF:FF) as the destination address. Layer 2 broadcast means that frame will be sent to all
hosts in the same layer 2 broadcast domain which includes the ether0 interface of the router, but does not reach Host
D, because router by default does not forward layer 2 broadcast.
Since the router knows that the target address (172.16.2.3) is on another subnet but it can reach Host D, it replies
with its own MAC address to Host A.
No.

13

Time

5.133378

Source

Destination

00:0c:42:52:2e:cf

00:1b:38:24:fc:13

Protocol

Info

ARP

172.16.2.3 is at 00:0c:42:52:2e:cf

Packet details:

Ethernet II, Src: 00:0c:42:52:2e:cf, Dst: 00:1b:38:24:fc:13


Destination: 00:1b:38:24:fc:13
Source: 00:0c:42:52:2e:cf
Type: ARP (0x0806)
Address Resolution Protocol (reply)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (0x0002)
[Is gratuitous: False]
Sender MAC address: 00:0c:42:52:2e:cf
Sender IP address: 172.16.1.254
Target MAC address: 00:1b:38:24:fc:13
Target IP address: 172.16.1.2

This is the Proxy ARP reply that the router sends to Host A. Router sends back unicast proxy ARP reply with its own
MAC address as the source address and the MAC address of Host A as the destination address, by saying "send these
packets to me, and I'll get it to where it needs to go."
When Host A receives ARP response it updates its ARP table, as shown:
C:\Users\And>arp -a
Interface: 173.16.2.1 --- 0x8
Internet Address
Physical Address
173.16.1.254
00-0c-42-52-2e-cf
173.16.2.3
00-0c-42-52-2e-cf

Type
dynamic
dynamic

Manual:IP/ARP
173.16.2.2

187
00-0c-42-52-2e-cf

dynamic

After MAC table update, Host A forwards all the packets intended for Host D (172.16.2.3) directly to router
interface ether0 (00:0c:42:52:2e:cf) and the router forwards packets to Host D. The ARP cache on the hosts in
Subnet A is populated with the MAC address of the router for all the hosts on Subnet B. Hence, all packets destined
to Subnet B are sent to the router. The router forwards those packets to the hosts in Subnet B.
Multiple IP addresses by host are mapped to a single MAC address (the MAC address of this router) when proxy
ARP is used.
Proxy ARP can be enabled on each interface individually with command arp=proxy-arp:
Setup proxy ARP:
[admin@MikroTik] /interface ethernet> set 1 arp=proxy-arp
[admin@MikroTik] /interface ethernet> print
Flags: X - disabled, R - running
#
NAME
MTU
MAC-ADDRESS
ARP
0 R ether1
1500 00:30:4F:0B:7B:C1 enabled
1 R ether2
1500 00:30:4F:06:62:12 proxy-arp
[admin@MikroTik] interface ethernet>

Reply Only
If arp property is set to reply-only on the interface, then router only replies to ARP requests. Neighbour MAC
addresses will be resolved using /ip arp statically, but there will be no need to add the router's MAC address to other
hosts' ARP tables like in case if arp is disabled.

Manual:Load balancing multiple same subnet links

Manual:Load balancing multiple same subnet


links
Applies to RouterOS: v4,v5

This example demonstrates how to set up load balancing if provider is giving IP addresses from the
same subnet for all links.

Provider is giving us two links with IP addresses from the same network range (10.1.101.10/24 and 10.1.101.18/24).
Gateway for both of these links is the same 10.1.101.1
Here is the whole configuration for those who want to copy&paste
/ip address
add address=10.1.101.18/24 interface=ether1
add address=10.1.101.10/24 interface=ether2
add address=192.168.1.1/24 interface=Local
add address=192.168.2.1/24 interface=Local

/ip route
add gateway=10.1.101.1
add gateway=10.1.101.1%ether1 routing-mark=first
add gateway=10.1.101.1%ether2 routing-mark=other

/ip firewall nat


add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=ether2

188

Manual:Load balancing multiple same subnet links

/ip firewall mangle


add action=mark-routing chain=prerouting src-address=192.168.1.0/24 new-routing-mark=first
add action=mark-routing chain=prerouting src-address=192.168.2.0/24 new-routing-mark=other

In previous RouterOS version multiple IP addresses from the same subnet on different interfaces were not allowed.
Fortunately v4 allows such configurations.
In this example our provider assigned two upstream links, one connected to ether1 and other to ether2. Our local
network has two subnets 192.168.1.0/24 and 192.168.2.0/24
/ip
add
add
add
add

address
address=10.1.101.18/24
address=10.1.101.10/24
address=192.168.1.1/24
address=192.168.2.1/24

interface=ether1
interface=ether2
interface=Local
interface=Local

After IP address is set up, connected route will be installed as ECMP route
[admin@MikroTik] /ip route> print detail
0 ADC dst-address=10.1.101.0/24 pref-src=10.1.101.18 gateway=ether1,ether2
gateway-status=ether1 reachable,ether2 reachable distance=0 scope=10
Note: Routing filters can be used to adjust preferred source if needed

In our example very simple policy routing is used. Clients from 192.168.1.0/24 subnet is marked
to use "first" routing table and 192.168.2.0/24 to use "other" subnet.

Note: The same can be achieved by setting up route rules instead of mangle.

/ip firewall mangle


add action=mark-routing chain=prerouting src-address=192.168.1.0/24 new-routing-mark=first
add action=mark-routing chain=prerouting src-address=192.168.2.0/24 new-routing-mark=other

And masquerade our local networks


/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=ether2
Warning: You will also have to deal with traffic coming to and from the router itself. For explanations look
at PCC configuration example.

We are adding two gateways, one to resolve in "first" routing table and another to "other"
routing table.

189

Manual:Load balancing multiple same subnet links


/ip route
add gateway=10.1.101.1%ether1 routing-mark=first
add gateway=10.1.101.1%ether2 routing-mark=other
Interesting part of these routes is how we set gateway. gateway=10.1.101.1%ether1 means that gateway
10.1.101.1 will be explicitly reachable over ether1
[admin@MikroTik] /ip route> print detail
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
0 A S dst-address=0.0.0.0/0 gateway=10.1.101.1%ether2
gateway-status=10.1.101.1 reachable ether2 distance=1 scope=30
target-scope=10 routing-mark=other
1 A S

dst-address=0.0.0.0/0 gateway=10.1.101.1%ether1
gateway-status=10.1.101.1 reachable ether1 distance=1 scope=30
target-scope=10 routing-mark=first

Finally, we have one additional entry specifying that traffic from the router itself (the traffic without any routing
marks) will be resolved in main routing table.
/ip route
add gateway=10.1.101.1

190

Manual:Simple Static Routing

Manual:Simple Static Routing


Introduction
Lets make a simple routing setup illustrated in image below

Ether1 of Router1 is connected to ISP and will be the gateway of our networks. Router2 is connected to ether2 of
Router1 and will act as a gateway for clients connected to it from LAN2. Router1 also connects one client to ether3.
Our goal is to create setup so that clients from LAN1 can reach clients from LAN2 and all of them can connect to
internet.

Configuration
Lets consider that ISP gave us an address 10.1.1.2/30 and gateway is 10.1.1.1 Router1:
/ip
add
add
add

address
address=10.1.1.2 interface=ether1
address=172.16.1.1/30 interface=ether2
address=192.168.1.1/24 interface=ether3

/ip route
add gateway=10.1.1.1
add dst-address=192.168.2.0/24 gateway=172.16.1.2
Router2:
/ip address
add address=172.16.1.2/30 interface=ether1

191

Manual:Simple Static Routing


add address=192.168.2.1/24 interface=ether2
/ip route
add gateway=172.16.1.1
If you look at configuration then you will see that on Router1 we added route to destination 182.168.2.0/24. It is
required for clients from LAN1 to be able to reach clients on LAN2. On Router2 such route is not required since
LAN1 can be reached by default route.
[ Top | Back to Content ]

Manual:Virtual Routing and Forwarding


Applies to RouterOS: 3, v4

Packages required: routing-test, mpls-test for RouterOS v3; routing, mpls for RouterOS v4+

Description
RouterOS 3.x allows to create multiple Virtual Routing and Forwarding instances on a single router. This is useful
for BGP based MPLS VPNs. Unlike BGP VPLS, which is OSI Layer 2 technology, BGP VRF VPNs work in Layer
3 and as such exchange IP prefixes between routers. VRFs solve the problem of overlapping IP prefixes, and provide
the required privacy (via separated routing for different VPNs).
To create a VRF, configure it under /ip route vrf. You can now add routes to that VRF - simply specify
routing-mark attribute. Connected routes from interfaces belonging to a VRF will be installed in the right routing
table automatically.
Technically VRFs are based on policy routing. There is exactly one policy route table for each active VRF. The
existing policy routing support in MT RouterOS is not changed; but on the other hand, it is not possible to have
policy routing within a VRF. The main differences between VRF tables and simple policy routing are:
Routes in VRF tables resolve next-hops in their own route table by default, while policy routes always use the
main route table. Read-only route attribute gateway-table displays information about which table is used for a
particular route (default is main).
Route lookup is different. For policy routing: after route lookup has been done in policy-route table, and no route
was found, route lookup proceeds to the main route table. For VRFs: if lookup is done, and no route is found in
VRF route table, the lookup fails with "network unreachable" error. (You can still override this behavior with
custom route lookup rules, as they have precedence.)
You can use multi-protocol BGP with VPNv4 address family to distribute routes from VRF route tables - not only to
other routers, but also to different routing tables in the router itself. First configure the route distinguisher for a VRF.
It can be done under /ip route vrf. Usually there will be one-to-one correspondence between route distinguishers and
VRFs, but that's not a mandatory requirement. Route installation in VRF tables is controlled by BGP extended
communities attribute. Configure import and export lists under /ip route vrf, import-route-targets and
export-route-targets. Export route target list for a VRF should contained at least the route distinguisher for that
VRF. Then configure a list of VRFs for each BGP instance that will participate in VRF routing.
Once list of VRFs for BGP instance, route distinguisher and export route targets has been configured, some active
VPNv4 address family routes may be created, depending on BGP redistribution settings. They are installed in a

192

Manual:Virtual Routing and Forwarding


separate route table and, if present, visible under /routing bgp vpnv4-route. These so called VPNv4 routes have
prefix that consists of a route distinguisher and an IPv4 network prefix. This way you can have overlapping IPv4
prefixes distributed in BGP.
Please note that a VPNv4 route will be distributed only if it has a valid MPLS label. You need to install mpls-test
package and configure valid label range for this to work. (Default configuration has valid label range.)

Examples
The simplest MPLS VPN setup

In this example rudimentary MPLS backbone (consisting of two Provider Edge (PE) routers PE1 and PE2) is created
and configured to forward traffic between Customer Edge (CE) routers CE1 and CE2 routers that belong to cust-one
VPN.

CE1 Router
/ip address add address=10.1.1.1/24 interface=ether1
# use static routing
/ip route add dst-address=10.3.3.0/24 gateway=10.1.1.2

CE2 Router
/ip address add address=10.3.3.4/24 interface=ether1
/ip route add dst-address=10.1.1.0/24 gateway=10.3.3.3

PE1 Router
/interface bridge add name=lobridge
/ip address add address=10.1.1.2/24 interface=ether1
/ip address add address=10.2.2.2/24 interface=ether2
/ip address add address=10.5.5.2/32 interface=lobridge
/ip route vrf add disabled=no routing-mark=cust-one route-distinguisher=1.1.1.1:111 \
export-route-targets=1.1.1.1:111 import-route-targets=1.1.1.1:111 interfaces=ether1
/mpls ldp set enabled=yes transport-address=10.5.5.2
/mpls ldp interface add interface=ether2
/routing bgp instance set default as=65000
/routing bgp instance vrf add instance=default routing-mark=cust-one redistribute-connected=yes
/routing bgp peer add remote-address=10.5.5.3 remote-as=65000 address-families=vpnv4 \
update-source=lobridge

193

Manual:Virtual Routing and Forwarding


# add route to the remote BGP peer's loopback address
/ip route add dst-address=10.5.5.3/32 gateway=10.2.2.3

PE2 Router (Cisco)


ip vrf cust-one
rd 1.1.1.1:111
route-target export 1.1.1.1:111
route-target import 1.1.1.1:111
exit
interface Loopback0
ip address 10.5.5.3 255.255.255.255
mpls ldp router-id Loopback0 force
mpls label protocol ldp
interface FastEthernet0/0
ip address 10.2.2.3 255.255.255.0
mpls ip
interface FastEthernet1/0
ip vrf forwarding cust-one
ip address 10.3.3.3 255.255.255.0
router bgp 65000
neighbor 10.5.5.2 remote-as 65000
neighbor 10.5.5.2 update-source Loopback0
address-family vpnv4
neighbor 10.5.5.2 activate
neighbor 10.5.5.2 send-community both
exit-address-family
address-family ipv4 vrf cust-one
redistribute connected
exit-address-family
ip route 10.5.5.2 255.255.255.255 10.2.2.2

Results
Check that VPNv4 route redistribution is working:
[admin@PE1] > /routing bgp vpnv4-route print detail
Flags: L - label present
0 L route-distinguisher=1.1.1.1:111 dst-address=10.3.3.0/24 gateway=10.5.5.3
interface=ether2 in-label=17 out-label=17 bgp-local-pref=100 bgp-med=0
bgp-origin=incomplete bgp-ext-communities="RT:1.1.1.1:111"
1 L route-distinguisher=1.1.1.1:111 dst-address=10.1.1.0/24 interface=ether1

194

Manual:Virtual Routing and Forwarding

195

in-label=16 bgp-ext-communities="RT:1.1.1.1:111"
Check that the 10.3.3.0 is installed in IP routes, in cust-one route table:
[admin@PE1] > /ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#
DST-ADDRESS
PREF-SRC
GATEWAY
DISTANCE
0 ADC 10.1.1.0/24
10.1.1.2
ether1
0
1 ADb 10.3.3.0/24
10.5.5.3 recursi... 20
2 ADC 10.2.2.0/24
10.2.2.2
ether2
0
3 ADC 10.5.5.2/32
10.5.5.2
lobridge
0
4 A S 10.5.5.3/32
10.2.2.3 reachab... 1
Let's take closer look at IP routes in cust-one VRF. The 10.1.1.0/24 IP prefix is a connected route that belongs to an
interface that was configured to belong to cust-one VRF. The 10.3.3.0/24 IP prefix was advertised via BGP as
VPNv4 route from PE2 and is imported in this VRF routing table, because our configured import-route-targets
matched the BGP extended communities attribute it was advertised with.
[admin@PE1] /ip route> print detail where routing-mark=cust-one
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
0 ADC

dst-address=10.1.1.0/24 pref-src=10.1.1.2 gateway=ether1 distance=0 scope=10


routing-mark=cust-one

1 ADb

dst-address=10.3.3.0/24 gateway=10.5.5.3 recursive via 10.2.2.3 ether2


distance=20 scope=40 target-scope=30 routing-mark=cust-one
bgp-local-pref=100 bgp-origin=incomplete
bgp-ext-communities="RT:1.1.1.1:111"

The same for Cisco:


PE2#show ip bgp vpnv4 all
BGP table version is 5, local router ID is 10.5.5.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network
Next Hop
Metric LocPrf Weight Path
Route Distinguisher: 1.1.1.1:111 (default for vrf cust-one)
*>i10.1.1.0/24
10.5.5.2
100
0 ?
*> 10.3.3.0/24
0.0.0.0
0
32768 ?
PE2#show ip route vrf cust-one
Routing Table: cust-one
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

Manual:Virtual Routing and Forwarding


N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set

B
C

10.0.0.0/24
10.1.1.0
10.0.0.0/24
10.3.3.0

is subnetted, 1 subnets
[200/0] via 10.5.5.2, 00:05:33
is subnetted, 1 subnets
is directly connected, FastEthernet1/0

You should be able to ping from CE1 to CE2 and vice versa.
[admin@CE1] > /ping 10.3.3.4
10.3.3.4 64 byte ping: ttl=62 time=18 ms
10.3.3.4 64 byte ping: ttl=62 time=13 ms
10.3.3.4 64 byte ping: ttl=62 time=13 ms
10.3.3.4 64 byte ping: ttl=62 time=14 ms
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max = 13/14.5/18 ms

A more complicated setup (changes only)

As opposed to the simplest setup, in this example we have two customers: cust-one and cust-two.
We configure two VPNs for then, cust-one and cust-two respectively, and exchange all routes between them. (This is
also called "route leaking").
Note that this could be not the most typical setup, because routes are usually not exchanged between different
customers. In contrast, by default it should not be possible to gain access from one VRF site to a different VRF site
in another VPN. (This is the "Private" aspect of VPNs.) Separate routing is a way to provide privacy; and it is also
required to solve the problem of overlapping IP network prefixes. Route exchange is in direct conflict with these two
requirement but may sometimes be needed (e.g. temp. solution when two customers are migrating to single network
infrastructure).

196

Manual:Virtual Routing and Forwarding

197

CE1 Router, cust-one


/ip route add dst-address=10.4.4.0/24 gateway=10.1.1.2

CE2 Router, cust-one


/ip route add dst-address=10.4.4.0/24 gateway=10.3.3.3

CE1 Router, cust-two


/ip address add address=10.4.4.5 interface=ether1
/ip route add dst-address=10.1.1.0/24 gateway=10.3.3.3
/ip route add dst-address=10.3.3.0/24 gateway=10.3.3.3

PE1 Router
# replace the old VRF with this:
/ip route vrf add disabled=no routing-mark=cust-one route-distinguisher=1.1.1.1:111 \
export-route-targets=1.1.1.1:111 import-route-targets=1.1.1.1:111,2.2.2.2:222 interfaces=ether1

PE2 Router (Cisco)


ip vrf cust-one
rd 1.1.1.1:111
route-target export 1.1.1.1:111
route-target import 1.1.1.1:111
route-target import 2.2.2.2:222
exit
ip vrf cust-two
rd 2.2.2.2:222
route-target export 2.2.2.2:222
route-target import 1.1.1.1:111
route-target import 2.2.2.2:222
exit
interface FastEthernet2/0
ip vrf forwarding cust-two
ip address 10.4.4.3 255.255.255.0
router bgp 65000
address-family ipv4 vrf cust-two
redistribute connected
exit-address-family

Manual:Virtual Routing and Forwarding

198

Variation: replace the Cisco with another MT


PE2 Mikrotik config
/interface bridge add name=lobridge
/ip address
add address=10.2.2.3/24 interface=ether1
add address=10.3.3.3/24 interface=ether2
add address=10.4.4.3/24 interface=ether3
add address=10.5.5.3/32 interface=lobridge
/ip route vrf
add disabled=no routing-mark=cust-one route-distinguisher=1.1.1.1:111 \
export-route-targets=1.1.1.1:111 import-route-targets=1.1.1.1:111,2.2.2.2:222 \
interfaces=ether2
add disabled=no routing-mark=cust-two route-distinguisher=2.2.2.2:222 \
export-route-targets=2.2.2.2:222 import-route-targets=1.1.1.1:111,2.2.2.2:222 \
interfaces=ether3
/mpls ldp set enabled=yes transport-address=10.5.5.3
/mpls ldp interface add interface=ether1
/routing bgp instance set default as=65000
/routing bgp instance vrf add instance=default routing-mark=cust-one redistribute-connected=yes
/routing bgp instance vrf add instance=default routing-mark=cust-two redistribute-connected=yes
/routing bgp peer add remote-address=10.5.5.2 remote-as=65000 address-families=vpnv4 \
update-source=lobridge
# add route to the remote BGP peer's loopback address
/ip route add dst-address=10.5.5.2/32 gateway=10.2.2.2

Results
The output of /ip route print now is interesting enough to deserve detailed observation.
[admin@PE2] /ip route> print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#
DST-ADDRESS
PREF-SRC
GATEWAY
0 ADb 10.1.1.0/24
10.5.5.2 recurs...
1 ADC 10.3.3.0/24
10.3.3.3
ether2
2 ADb 10.4.4.0/24
3 ADb 10.1.1.0/24
10.5.5.2 recurs...
4 ADb 10.3.3.0/24
5 ADC 10.4.4.0/24
10.4.4.3
ether3
6 ADC 10.2.2.0/24
10.2.2.3
ether1
7 A S 10.5.5.2/32
10.2.2.2 reacha...
8 ADC 10.5.5.3/32
10.5.5.3
lobridge

DISTANCE
20
0
20
20
20
0
0
1
0

The route 10.1.1.0/24 was received from remote BGP peer and is installed in both VRF routing tables.
The routes 10.3.3.0/24 and 10.4.4.0/24 are also installed in both VRF routing tables. Each is as connected route in
one table and as BGP route in another table. This has nothing to do with their being advertised via BGP. They are

Manual:Virtual Routing and Forwarding

199

simply being "advertised" to local VPNv4 route table and locally reimported after that. Import and export
route-targets determine in which tables they will end up.
This can be deduced from its attributes - they don't have the usual BGP properties. (Route 10.4.4.0/24.)
[admin@PE2] /ip route> print detail where routing-mark=cust-one
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
0 ADb

dst-address=10.1.1.0/24 gateway=10.5.5.2 recursive via 10.2.2.2 ether1


distance=20 scope=40 target-scope=30 routing-mark=cust-one
bgp-local-pref=100 bgp-origin=incomplete
bgp-ext-communities="RT:1.1.1.1:111"

1 ADC

dst-address=10.3.3.0/24 pref-src=10.3.3.3 gateway=ether2 distance=0 scope=10


routing-mark=cust-one

2 ADb

dst-address=10.4.4.0/24 distance=20 scope=40 target-scope=10


routing-mark=cust-one bgp-ext-communities="RT:2.2.2.2:222"

Static inter-VRF routes


In general it is recommended that all routes between VRF should be exchanged using BGP local import and export
functionality. If that is not enough, static routes can be used to achieve this so-called route leaking.
There are two ways to install a route that has gateway in different routing table than the route itself.
The first way is to explicitly specify routing table in gateway field when adding route. This is only possible for the
"main" routing table. Example:
# add route to 5.5.5.0/24 in 'vrf1' routing table with gateway in the main routing table
add dst-address=5.5.5.0/24 gateway=10.3.0.1@main routing-mark=vrf1

The second way is to explicitly specify interface in gateway field. The interface specified can belong to a VRF
instance. Example:
# add route to 5.5.5.0/24 in the main routing table with gateway at 'ether2' VRF interface
add dst-address=5.5.5.0/24 gateway=10.3.0.1%ether2 routing-mark=main

# add route to 5.5.5.0/24 in the main routing table with 'ptp-link-1' VRF interface as gateway
add dst-address=5.5.5.0/24 gateway=ptp-link-1 routing-mark=main

As can be observed, there are two variations possible - to specify gateway as ip_address%interface or to simply
specify interface. The first should be used for broadcast interfaces in most cases. The second should be used for
point-to-point interfaces, and also for broadcast interfaces, if the route is a connected route in some VRF. For
example, if you have address 1.2.3.4/24 on interface ether2 that is put in a VRF, there will be connected route
to 1.2.3.0/24 in that VRF's routing table. It is acceptable to add static route 1.2.3.0/24 in a different
routing table with interface-only gateway, even though ether2 is a broadcast interface:
add dst-address=1.2.3.0/24 gateway=ether2 routing-mark=main

Manual:Virtual Routing and Forwarding

References
RFC 4364: BGP/MPLS IP Virtual Private Networks (VPNs) [1]
MPLS Fundamentals, chapter 7, Luc De Ghein, Cisco Press 2006

References
[1] http:/ / www. ietf. org/ rfc/ rfc4364. txt

Manual:IP/DHCP Server
Applies to RouterOS: v3, v4, v5+

Summary
Standards: RFC 2131, RFC 3315, RFC 3633
Package: dhcp
The DHCP (Dynamic Host Configuration Protocol) is needed for easy distribution of IP addresses in a network. The
MikroTik RouterOS implementation includes both server and client parts and is compliant with RFC 2131.
The router supports an individual server for each Ethernet-like interface. The MikroTik RouterOS DHCP server
supports the basic functions of giving each requesting client an IP address/netmask lease, default gateway, domain
name, DNS-server(s) and WINS-server(s) (for Windows clients) information (set up in the DHCP networks
submenu)
In order DHCP server to work, you must set up also IP pools (do not include the DHCP server's own IP address into
the pool range) and DHCP networks.
It is also possible to hand out leases for DHCP clients using the RADIUS server, here are listed the parameters for
used in RADIUS server.
Access-Request:

NAS-Identifier - router identity


NAS-IP-Address - IP address of the router itself
NAS-Port - unique session ID
NAS-Port-Type - Ethernet
Calling-Station-Id - client identifier (active-client-id)
Framed-IP-Address - IP address of the client (active-address)
Called-Station-Id - name of DHCP server
User-Name - MAC address of the client (active-mac-address)
Password - ""

Access-Accept:
Framed-IP-Address - IP address that will be assigned to client
Framed-Pool - ip pool from which to assign ip address to client
Rate-Limit - Datarate limitation for DHCP clients. Format is: rx-rate[/tx-rate] [rx-burst-rate[/tx-burst-rate]
[rx-burst-threshold[/tx-burst-threshold] [rx-burst-time[/tx-burst-time][priority] [rx-rate-min[/tx-rate-min]]]]. All

200

Manual:IP/DHCP Server

201

rates should be numbers with optional 'k' (1,000s) or 'M' (1,000,000s). If tx-rate is not specified, rx-rate is as
tx-rate too. Same goes for tx-burst-rate and tx-burst-threshold and tx-burst-time. If both rx-burst-threshold and
tx-burst-threshold are not specified (but burst-rate is specified), rx-rate and tx-rate are used as burst thresholds. If
both rx-burst-time and tx-burst-time are not specified, 1s is used as default. Priority takes values 1..8, where 1
implies the highest priority, but 8 - the lowest. If rx-rate-min and tx-rate-min are not specified rx-rate and tx-rate
values are used. The rx-rate-min and tx-rate-min values can not exceed rx-rate and tx-rate values.
Ascend-Data-Rate - tx/rx data rate limitation if multiple attributes are provided, first limits tx data rate, second rx data rate. If used together with Ascend-Xmit-Rate, specifies rx rate. 0 if unlimited
Ascend-Xmit-Rate - tx data rate limitation. It may be used to specify tx limit only instead of sending two
sequential Ascend-Data-Rate attributes (in that case Ascend-Data-Rate will specify the receive rate). 0 if
unlimited
Session-Timeout - max lease time (lease-time)

Quick Setup Guide


RouterOS has built in command that lets you easily set up DHCP server. Lets say we want to configure DHCP server
on ether1 interface to lend addresses from 192.168.0.2 to 192.168.0.254 which belong to the 192.168.0.0/24
network. The gateway and DNS server is 192.168.0.1.
From /ip dhcp-server menu run setup command and follow instructions:
[admin@MikroTik] ip dhcp-server> setup
Select interface to run DHCP server on
dhcp server interface: ether1
Select network for DHCP addresses
dhcp address space: 192.168.0.0/24
Select gateway for given network
gateway for dhcp network: 192.168.0.1
Select pool of ip addresses given out by DHCP server
addresses to give out: 192.168.0.2-192.168.0254
Select DNS servers
dns servers: 192.168.0.1
Select lease time
lease time: 3d
[admin@MikroTik] ip dhcp-server>
The wizard has made the following configuration based on the answers above:
[admin@MikroTik] ip dhcp-server> print
Flags: X - disabled, I - invalid
#
NAME
INTERFACE RELAY
0
dhcp1
ether1
0.0.0.0
[admin@MikroTik] ip dhcp-server> network print

ADDRESS-POOL LEASE-TIME ADD-ARP


dhcp_pool1
3d
no

Manual:IP/DHCP Server

202

# ADDRESS
0 192.168.0.0/24

GATEWAY
192.168.0.1

DNS-SERVER
WINS-SERVER
192.168.0.1

DOMAIN

[admin@MikroTik] ip dhcp-server> /ip pool print


# NAME
RANGES
0 dhcp_pool1
192.168.0.2-192.168.0.254
[admin@MikroTik] ip dhcp-server>

IPv6
Starting from v5.8 RouterOS supports IPv6 prefix delegation according to RFC 3315 and RFC 3633.
Starting from v5.9, DHCPv6 server configuration was moved to /ipv6 sub-menu. Read-more >>

General
Sub-menu: /ip dhcp-server
Property

Description

add-arp (yes | no; Default: no)

Whether to add dynamic ARP entry. If set to no either ARP mode should be enabled on that interface or
static ARP entries should be administratively defined in /ip arp submenu.

address-pool (string | static-only;


Default: static-only)

IP pool, from which to take IP addresses for the clients. If set to static-only, then only the clients that
have a static lease (added in lease submenu) will be allowed.

always-broadcast (yes | no;


Default: no)

Always send replies as broadcasts.

authoritative (after-10sec-delay | Whether the DHCP server is the only one DHCP server for the network:
after-2sec-delay | yes | no; Default:
after-10sec-delay - to clients request for an address, dhcp server will wait 10 seconds and if
after-2sec-delay)
there is another request from the client after this period of time, then dhcp server will offer the address
to the client or will send DHCPNAK, if the requested address is not available from this server
after-2sec-delay - to clients request for an address, dhcp server will wait 2 seconds and if there
is another request from the client after this period of time, then dhcp server will offer the address to
the client or will send DHCPNAK, if the requested address is not available from this server
yes - to clients request for an address that is not available from this server, dhcp server will send
negative acknowledgment (DHCPNAK)
no - dhcp server ignores clients requests for addresses that are not available from this server
boot-support (none | static |
dynamic; Default: static)

Support for BOOTP clients:

delay-threshold (time | none;


Default: none)

If secs field in DHCP packet is smaller than delay-threshold, then this packet is ignored. If set to none there is no threshold (all DHCP packets are processed)

interface (string; Default: )

Interface on which server will be running.

lease-time (time; Default: 72h)

The time that a client may use the assigned address. The client will try to renew this address after a half of
this time and will request a new address after time limit expires.

name (string; Default: )

Reference name

none - do not respond to BOOTP requests


static - offer only static leases to BOOTP clients
dynamic - offer static and dynamic leases for BOOTP clients

Manual:IP/DHCP Server

203

relay (IP; Default: 0.0.0.0)

The IP address of the relay this DHCP server should process requests from:

0.0.0.0 - the DHCP server will be used only for direct requests from clients (no DHCP really
allowed)
255.255.255.255 - the DHCP server should be used for any incomming request from a DHCP
relay except for those, which are processed by another DHCP server that exists in the /ip
dhcp-server submenu.

src-address (IP; Default: 0.0.0.0)

The address which the DHCP client must send requests to in order to renew an IP address lease. If there is
only one static address on the DHCP server interface and the source-address is left as 0.0.0.0, then the
static address will be used. If there are multiple addresses on the interface, an address in the same subnet
as the range of given addresses should be used.

use-radius (yes | no; Default: no)

Whether to use RADIUS server for dynamic leases

Menu specific commands


Property

Description

setup () Start DHCP server setup wizard, which guides you through the steps to easily create all necessary configuration. Read more>>

Lease Store Configuration


Sub-menu: /ip dhcp-server config
This sub-menu allows to configure how often DHCP leases will be stored on disk. If they would be saved on disk on
every lease change, a lot of disk writes would happen which is very bad for Compact Flash (especially, if lease times
are very short). To minimize writes on disk, all changes are saved on disk every store-leases-disk seconds.
Additionally leases are always stored on disk on graceful shutdown and reboot.
This sub-menu has only one configurable property:
Property

Description

store-leases-disk (time | immediately | never; Default: 5m) How frequently lease changes should be stored on disk

Networks
Sub-menu: /ip dhcp-server network
Property

Description

address (IP/netmask;
Default: )

the network DHCP server(s) will lend addresses from

boot-file-name (string;
Default: )

Boot file name

dhcp-option (string;
Default: )

Add additional DHCP options from option list.

dns-server (string;
Default: )

the DHCP client will use these as the default DNS servers. Two comma-separated DNS servers can be specified to
be used by DHCP client as primary and secondary DNS servers

domain (string; Default: )

The DHCP client will use this as the 'DNS domain' setting for the network adapter.

gateway (IP; Default:


0.0.0.0)

The default gateway to be used by DHCP Client.

netmask (integer: 0..32;


Default: 0)

The actual network mask to be used by DHCP client. If set to '0' - netmask from network address will be used.

Manual:IP/DHCP Server

204

next-server (IP; Default: IP address of next server to use in bootstrap.


)
ntp-server (IP; Default: ) the DHCP client will use these as the default NTP servers. Two comma-separated NTP servers can be specified to
be used by DHCP client as primary and secondary NTP servers
wins-server (IP; Default: The Windows DHCP client will use these as the default WINS servers. Two comma-separated WINS servers can
)
be specified to be used by DHCP client as primary and secondary WINS servers

Leases
Sub-menu: /ip dhcp-server lease
DHCP server lease submenu is used to monitor and manage server's leases. The issued leases are showed here as
dynamic entries. You can also add static leases to issue a particular client (identified by MAC address) the desired IP
address.
Generally, the DHCP lease it allocated as follows:
an unused lease is in waiting state
if a client asks for an IP address, the server chooses one
if the client will receive statically assigned address, the lease becomes offered, and then bound with the respective
lease time
if the client will receive a dynamic address (taken from an IP address pool), the router sends a ping packet and
waits for answer for 0.5 seconds. During this time, the lease is marked testing
in case, the address does not respond, the lease becomes offered, and then bound with the respective lease time
in other case, the lease becomes busy for the lease time (there is a command to retest all busy addresses), and the
client's request remains unanswered (the client will try again shortly)
A client may free the leased address. The dynamic lease is removed, and the allocated address is returned to the
address pool. But the static lease becomes busy until the client will reacquire the address.
Note: that the IP addresses assigned statically are not probed.

Properties
Property

Description

address (IP; Default: )

Specify ip address (or ip pool) for static lease. If set to 0.0.0.0 - pool from server will be used

address-list (string; Default: )

Address list to which address will be added if lease is bound.

always-broadcast (yes | no; Default: )

Send all repies as broadcasts

block-access (yes | no; Default: no)

Block access for this client

client-id (string; Default: )

If specified, must match DHCP 'client identifier' option of the request

lease-time (time; Default: 0s)

Time that the client may use the address. If set to 0s lease will never expire.

mac-address (MAC; Default: 00:00:00:00:00:00) If specified, must match the MAC address of the client
src-mac-address (MAC; Default: )

Source MAC address

use-src-mac (MAC; Default: )

Use this source MAC address instead

Manual:IP/DHCP Server

205

Read only properties


Property

Description

active-address (IP)

Actual IP address for this lease

active-client-id (string) Actual client-id of the client


active-mac-address
(MAC)

Actual MAC address of the client

active-server (list)

Actual dhcp server, which serves this client

agent-circuit-id (string) Circuit ID of DHCP relay agent


agent-remote-id (string)

Remote ID, set by DHCP relay agent

blocked ( flag )

Whether the lease is blocked

expires-after (time)

Time until lease expires

host-name (text)

Shows host name option from last received DHCP request

radius (yes | no)

Shows, whether this dynamic lease is authenticated by RADIUS or not

rate-limit (string)

Sets rate limit for active lease. Format is: rx-rate[/tx-rate] [rx-burst-rate[/tx-burst-rate]
[rx-burst-threshold[/tx-burst-threshold] [rx-burst-time[/tx-burst-time]]]]. All rates should be numbers with
optional 'k' (1,000s) or 'M' (1,000,000s). If tx-rate is not specified, rx-rate is as tx-rate too. Same goes for
tx-burst-rate and tx-burst-threshold and tx-burst-time. If both rx-burst-threshold and tx-burst-threshold are not
specified (but burst-rate is specified), rx-rate and tx-rate is used as burst thresholds. If both rx-burst-time and
tx-burst-time are not specified, 1s is used as default

server (string)

Server name which serves this client

status (waiting | testing |


authorizing | busy | offered |
bound)

Lease status:

waiting - not used static lease


testing - testing whether this address is used or not (only for dynamic leases) by pinging it with timeout of
0.5s
authorizing - waiting for response from radius server
busy - this address is assigned statically to a client or already exists in the network, so it can not be leased
offered - server has offered this lease to a client, but did not receive confirmation from the client
bound - server has received client's confirmation that it accepts offered address, it is using it now and will free
the address not later, than the lease time will be over

Menu specific commands


Property

Description

check-status (id) Check status of a given busy dynamic lease, and free it in case of no response
make-static (id)

Convert a dynamic lease to a static one

Alerts
Sub-menu: /ip dhcp-server alert
To find any rogue DHCP servers as soon as they appear in your network, DHCP Alert tool can be used. It will
monitor ethernet for all DHCP replies and check, whether this reply comes from a valid DHCP server. If reply from
unknown DHCP server is detected, alert gets triggered:
[admin@MikroTik] ip dhcp-server alert>/log print
00:34:23 dhcp,critical,error,warning,info,debug dhcp alert on Public:
discovered unknown dhcp server, mac 00:02:29:60:36:E7, ip 10.5.8.236

Manual:IP/DHCP Server

206

[admin@MikroTik] ip dhcp-server alert>


When the system alerts about a rogue DHCP server, it can execute a custom script.
As DHCP replies can be unicast, rogue dhcp detector may not receive any offer to other dhcp clients at all. To deal
with this, rogue dhcp detector acts as a dhcp client as well - it sends out dhcp discover requests once a minute

Properties
Property

Description

alert-timeout (none | time;


Default: none)

Time, after which alert will be forgotten. If after that time the same server will be detected, new alert will be
generated. If set to none timeout will never expire.

interface (string; Default: )

Interface, on which to run rogue DHCP server finder.

on-alert (string; Default: )

Script to run, when an unknown DHCP server is detected.

valid-server (string; Default: )

List of MAC addresses of valid DHCP servers.

Read only properties


Property

Description

unknown-server (string) List of MAC addresses of detected unknown DHCP servers. Server is removed from this list after alert-timeout

Menu specific commands


Property

Description

reset-alert (id) Clear all alerts on an interface

DHCP Options
Sub-menu: /ip dhcp-server option
With help of DHCP Option list, it is possible to define additional custom options for DHCP Server to advertise.
According to the DHCP protocol, a parameter is returned to the DHCP client only if it requests this parameter,
specifying the respective code in DHCP request Parameter-List (code 55) attribute. If the code is not included in
Parameter-List attribute, DHCP server will not send it to the DHCP client.

Properties

Manual:IP/DHCP Server

207

Property

Description

code (integer:1..254; Default: ) dhcp option code. All codes are available at [1]
name (string; Default: )

Descriptive name of the option

value (string; Default: )

Parameter's value in form of a string. If the string begins with "0x", it is assumed as a hexadecimal value

Example
Classless route adds specified route in clients routing table. In our example it will add dst-address=160.0.0.0/24
gateway=10.1.101.1
/ip
add
/ip
set

dhcp-server option
code=121 name=classless value=0x18A000000A016501000A016501
dhcp-server network
0 dhcp-option=classless

Result:
[admin@MikroTik] /ip route> print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf,
m - mme, B - blackhole, U - unreachable, P - prohibit
#

DST-ADDRESS

GATEWAY

DISTANCE

0 ADS

0.0.0.0/0

PREF-SRC

10.1.101.1

1 ADS

160.0.0.0/24

10.1.101.1

Configuration Examples
[ Top | Back to Content ]

References
[1] http:/ / www. iana. org/ assignments/ bootp-dhcp-parameters

Manual:IP/DHCP Client

Manual:IP/DHCP Client
Applies to RouterOS: v3, v4 +

Summary
The MikroTik RouterOS DHCP client may be enabled on any Ethernet-like interface at a time. The client will accept
an address, netmask, default gateway, and two dns server addresses. The received IP address will be added to the
interface with the respective netmask. The default gateway will be added to the routing table as a dynamic entry.
Should the DHCP client be disabled or not renew an address, the dynamic default route will be removed. If there is
already a default route installed prior the DHCP client obtains one, the route obtained by the DHCP client would be
shown as invalid.
RouterOS DHCP cilent asks for following options:

option 1 - SUBNET_MASK,
option 3 - GATEWAY_LIST,
option 6 - TAG_DNS_LIST,
option 33 - STATIC_ROUTE,
option 42 - NTP_LIST,
option 122 - CLASSLESS_ROUTE,

IPv6
Starting from v5.8 DHCP Client can receive delegated prefixes from DHCPv6 server. Currently received prefix is
added to IPv6 pool, which later can be used for example in pppoe server configuration. Starting from v5.9, DHCPv6
client configuration was moved to /ipv6 sub-menu. Read-more >>

Quick setup example


Add a DHCP client on ether1 interface:
/ip dhcp-client add interface=ether1 disabled=no
After interface is added, you can use rint" or "print detail" command to see what parameters DHCP client acquired:
[admin@MikroTik] ip dhcp-client> print detail
Flags: X - disabled, I - invalid
0
interface=ether1 add-default-route=yes use-peer-dns=yes use-peer-ntp=yes
status=bound address=192.168.0.65/24 gateway=192.168.0.1
dhcp-server=192.168.0.1 primary-dns=192.168.0.1 primary-ntp=192.168.0.1
expires-after=9m44s
[admin@MikroTik] ip dhcp-client>

208

Manual:IP/DHCP Client

209

Note: If interface used by DHCP client is part of VRF configuration, then default route and other received
routes from DHCP server will be added to VRF routing table.

Properties
Sub-menu: /ip dhcp-client
Property

Description

add-default-route (yes | no; Default: yes) Whether to install default route in routing table received from dhcp server.
client-id (string; Default: )

Corresponds to the settings suggested by the network administrator or ISP. If not specified,
client's MAC address will be sent

comment (string; Default: )

Short description of the client

default-route-distance (integer:0..255; Distance of default route. Applicable if add-default-route is set to yes.


Default: )
disabled (yes | no; Default: yes)
host-name (string; Default: )

Host name of the client sent to a DHCP server. If not specified, client's system identity will be
used.

interface (string; Default: )

Interface on which DHCP client will be running.

use-peer-dns (yes | no; Default: yes)

Whether to accept the DNS settings advertised by DHCP Server. (Will override the settings put
in the /ip dns submenu.

use-peer-ntp (yes | no; Default: yes)

Whether to accept the NTP settings advertised by DHCP Server. (Will override the settings put
in the /system ntp client submenu)

Status
Command /ip dhcp-client print detail will show current status of dhcp client and read-only
properties listed in table below:
Property

Description

address (IP/Netmask)

IP address and netmask, which is assigned to DHCP Client from the


Server

dhcp-server (IP)

IP address of the DHCP server.

expires-after (time)

Time when the lease expires (specified by the DHCP server).

gateway (IP)

IP address of the gateway which is assigned by DHCP server

invalid (yes | no)

Shows whether configuration is invalid.

netmask (IP)
primary-dns (IP)

IP address of the primary DNS server, assigned by the DHCP server

primary-ntp (IP)

IP address of the primary NTP server, assigned by the DHCP server

secondary-dns (IP)

IP address of the secondary DNS server, assigned by the DHCP server

secondary-ntp (IP)

IP address of the secondary NTP server, assigned by the DHCP server

status (bound | error | rebinding... | requesting... | searching... |


stopped)

Shows the status of DHCP Client

Manual:IP/DHCP Client

210

Menu specific commands


Property

Description

release
(numbers)

Release current binding and restart DHCP client

renew
(numbers)

Renew current leases. If the renew operation was not successful, client tries to reinitialize lease (i.e. it starts lease request
procedure (rebind) as if it had not received an IP address yet)

[ Top | Back to Content ]

Manual:IP/DHCP Relay
Applies to RouterOS: v3, v4 +

Summary
DHCP Relay is just a proxy that is able to receive a DHCP request and resend it to the real DHCP server.

Properties
Sub-menu: /ip dhcp-client
Property

Description

delay-threshold (time;
Default: none)

If secs field in DHCP packet is smaller than delay-threshold, then this packet is ignored

dhcp-server (string; Default: )

List of DHCP servers' IP addresses which should the DHCP requests be forwarded to

interface (string; Default: )

Interface name the DHCP relay will be working on.

local-address (IP; Default:


0.0.0.0)

The unique IP address of this DHCP relay needed for DHCP server to distinguish relays. If set to 0.0.0.0 the IP address will be chosen automatically

name (string; Default: )

Descriptive name for relay

DHCP relay does not choose the particular DHCP server in the dhcp-server list, it just send the incoming request to
all the listed servers.

Example setup
Let us consider that you have several IP networks 'behind' other routers, but you want to keep all DHCP servers on a
single router. To do this, you need a DHCP relay on your network which relies DHCP requests from clients to
DHCP server.
This example will show you how to configure a DHCP server and a DHCP relay which serve 2 IP networks 192.168.1.0/24 and 192.168.2.0/24 that are behind a router DHCP-Relay.

Manual:IP/DHCP Relay

211

IP Address Configuration
IP addresses of DHCP-Server:
[admin@DHCP-Server] ip address> print
Flags: X - disabled, I - invalid, D - dynamic
#
ADDRESS
NETWORK
BROADCAST
INTERFACE
0
192.168.0.1/24
192.168.0.0
192.168.0.255
To-DHCP-Relay
1
10.1.0.2/24
10.1.0.0
10.1.0.255
Public
[admin@DHCP-Server] ip address>
IP addresses of DHCP-Relay:
[admin@DHCP-Relay] ip address> print
Flags: X - disabled, I - invalid, D - dynamic
#
ADDRESS
NETWORK
BROADCAST
0
192.168.0.2/24
192.168.0.0
192.168.0.255
1
192.168.1.1/24
192.168.1.0
192.168.1.255
2
192.168.2.1/24
192.168.2.0
192.168.2.255
[admin@DHCP-Relay] ip address>

INTERFACE
To-DHCP-Server
Local1
Local2

DHCP Server Setup


To setup 2 DHCP Servers on DHCP-Server router add 2 pools. For networks 192.168.1.0/24 and 192.168.2.0:
/ip pool add name=Local1-Pool ranges=192.168.1.11-192.168.1.100
/ip pool add name=Local1-Pool ranges=192.168.2.11-192.168.2.100
[admin@DHCP-Server] ip pool> print

Manual:IP/DHCP Relay
# NAME
0 Local1-Pool
1 Local2-Pool
[admin@DHCP-Server] ip pool>

212
RANGES
192.168.1.11-192.168.1.100
192.168.2.11-192.168.2.100

Create DHCP Servers:


/ip dhcp-server add interface=To-DHCP-Relay relay=192.168.1.1 \
address-pool=Local1-Pool name=DHCP-1 disabled=no
/ip dhcp-server add interface=To-DHCP-Relay relay=192.168.2.1 \
address-pool=Local2-Pool name=DHCP-2 disabled=no
[admin@DHCP-Server] ip dhcp-server> print
Flags: X - disabled, I - invalid
#
NAME
INTERFACE
RELAY
ADDRESS-POOL LEASE-TIME ADD-ARP
0
DHCP-1
To-DHCP-Relay 192.168.1.1
Local1-Pool 3d00:00:00
1
DHCP-2
To-DHCP-Relay 192.168.2.1
Local2-Pool 3d00:00:00
[admin@DHCP-Server] ip dhcp-server>
Configure respective networks:
/ip dhcp-server network add address=192.168.1.0/24 gateway=192.168.1.1 \
dns-server=159.148.60.20
/ip dhcp-server network add address=192.168.2.0/24 gateway=192.168.2.1 \
dns-server 159.148.60.20
[admin@DHCP-Server] ip dhcp-server network> print
# ADDRESS
GATEWAY
DNS-SERVER
WINS-SERVER
DOMAIN
0 192.168.1.0/24
192.168.1.1
159.148.60.20
1 192.168.2.0/24
192.168.2.1
159.148.60.20
[admin@DHCP-Server] ip dhcp-server network>
DHCP Relay Config
Configuration of DHCP-Server is done. Now let's configure DHCP-Relay:
/ip dhcp-relay add name=Local1-Relay interface=Local1 \
dhcp-server=192.168.0.1 local-address=192.168.1.1 disabled=no
/ip dhcp-relay add name=Local2-Relay interface=Local2 \
dhcp-server=192.168.0.1 local-address=192.168.2.1 disabled=no
[admin@DHCP-Relay] ip dhcp-relay> print
Flags: X - disabled, I - invalid
#
NAME
INTERFACE
DHCP-SERVER
LOCAL-ADDRESS
0
Local1-Relay
Local1
192.168.0.1
192.168.1.1
1
Local2-Relay
Local2
192.168.0.1
192.168.2.1
[admin@DHCP-Relay] ip dhcp-relay>
[ Top | Back to Content ]

Manual:IP/Pools

213

Manual:IP/Pools
Applies to RouterOS: 2.9, v3, v4 +

IP pools are used to define range of IP addresses that is used for DHCP server and Point-to-Point
servers

Specifications

Packages required: system


License required: Level1
Submenu level: /ip pool
Standards and Technologies: none
Hardware usage: Not significant

Description
IP pools simply group IP addresses for further usage. It is a single configuration point for all features that assign IP
addresses to clients.
Note: Whenever possible, the same ip address is given out to each client (OWNER/INFO pair).

Setup
Sub-menu: /ip pool

Property Description
name (name) - the name of the pool
next-pool (name) - when address is acquired from pool that has no free addresses, and next-pool property is set to
another pool, then next IP address will be acquired from next-pool
ranges (IP address) - IP address list of non-overlapping IP address ranges in form of:
from1-to1,from2-to2,...,fromN-toN. For example, 10.0.0.1-10.0.0.27,10.0.0.32-10.0.0.47

Example
To define a pool named ip-pool with the 10.0.0.1-10.0.0.125 address range excluding gateway's address 10.0.0.1 and
server's address 10.0.0.100, and the other pool dhcp-pool, with the 10.0.0.200-10.0.0.250 address range:
[admin@MikroTik] ip pool> add name=ip-pool ranges=10.0.0.2-10.0.0.99,10.0.0.101
10.0.0.126
[admin@MikroTik] ip pool> add name=dhcp-pool ranges=10.0.0.200-10.0.0.250
[admin@MikroTik] ip pool> print
# NAME
RANGES
0 ip-pool
10.0.0.2-10.0.0.99
10.0.0.101-10.0.0.126
1 dhcp-pool
10.0.0.200-10.0.0.250
[admin@MikroTik] ip pool>

Manual:IP/Pools

214

Used Addresses from Pool


Submenu level: /ip pool used

Description
Here you can see all used IP addresses from IP pools.

Property Description

address (read-only: IP address) - IP address that is assigned to client form the pool
info (read-only: name) - name of the interface to which the client is connected to
owner (read-only: MAC address) - MAC address of the client
pool (read-only: name) - name of the IP pool

Example
See used addresses from pool:
[admin@MikroTik] ip pool used> print
POOL ADDRESS
OWNER
local 192.168.0.100
00:0C:42:03:1F:60
local 192.168.0.99
00:0C:42:03:21:0F

INFO
test
test

[ Top | Back to Content ]

Manual:OSPF Case Studies


Applies to RouterOS: v3, v4

Summary
This chapter describes the Open Shortest Path First (OSPF) routing protocol support in RouterOS.
OSPF is Interior Gateway Protocol (IGP) and distributes routing information only between routers belonging to the
same Autonomous System (AS).
OSPF is based on link-state technology that has several advantages over distance-vector protocols such as RIP:

no hop count limitations;


multicast addressing is used to send routing information updates;
updates are sent only when network topology changes occur;
logical definition of networks where routers are divided into areas
transfers and tags external routes injected into AS.

However there are few disadvantages:


OSPF is quite CPU and memory intensive due to SPF algorithm and maintenance of multiple copies of routing
information;
more complex protocol to implement compared to RIP;

Manual:OSPF Case Studies


MikroTik RouterOS implements OSPF version 2 (RFC 2328) and version 3 (RFC 5340, OSPF for IPv6).

OSPF Terminology
Term definitions related to OSPF operations.
Neighbor - connected (adjacent) router that is running OSPF with the adjacent interface assigned to the same
area. Neighbors are found by Hello packets.
Adjacency - logical connection between router and its corresponding DR and BDR. No routing information is
exchanged unless adjacencies are formed.
Link - link refers to a network or router interface assigned to any given network.
Interface - physical interface on the router. Interface is considered as link, when it is added to OSPF. Used to
build link database.
LSA - Link State Advertisement, data packet contains link-state and routing information, that is shared among
OSPF neighbors.
DR - Designated Router, chosen router to minimize the number of adjacencies formed. Option is used in broadcast
networks.
BDR -Backup Designated Router, hot standby for the DR. BDR receives all routing updates from adjacent routers,
but it does not flood LSA updates.
Area - areas are used to establish a hierarchical network.
ABR - Area Border Router, router connected to multiple areas.
ASBR - Autonomous System Boundary Router, router connected to an external network (in a different AS).
NBMA - Non-broadcast multi-access, networks allow multi-access but have no broadcast capability (for example
X.25, Frame Relay). Additional OSPF neighbor configuration is required for those networks.
Broadcast - Network that allows broadcasting, for example Ethernet.
Point-to-point - Network type eliminates the need for DRs and BDRs
Router-ID - IP address used to identify OSPF router. If the OSPF Router-ID is not configured manually, router
uses one of the IP addresses assigned to the router as its Router-ID.
Link State - The term link state refers to the status of a link between two routers. It defines the relationship
between a router's interface and its neighboring routers.
Cost - Link-state protocols assign a value to each link called cost. the cost value is depend to speed of media. A
cost is associated with the outside of each router interface. This is referred to as interface output cost.
Autonomous System - An autonomous system is a group of routers that use a common routing protocol to
exchange routing information.
All of these terms are important for understanding the operation of the OSPF and they are used throughout the
article.

OSPF Operation
OSPF is a link-state protocol. Interface of the router is considered an OSPF link and state of all the links are stored in
link-state database.
Link-state routing protocols are distributing, replicating database that describes the routing topology. Each router in
routing domain collects local routing topology and sends this information via link-state advertisements (LSAs).
LSAs are flooded to all other routers in routing domain and each router generates link-state database from received
LSAs. The link-state protocol's flooding algorithm ensures that each router has identical link-state database. Each
router is calculating routing table based on this link-state database.
OSPF defines several LSA types:

215

Manual:OSPF Case Studies


type 1 - (Router LSA) Sent by routers within the Area, including the list of directly attached links. Does not
cross the ABR or ASBR.
type 2 - (Network LSA) Generated for every transit network within an area. A transit network has at least two
directly attached OSPF routers. Ethernet is an example of a Transit Network. A Type 2 LSA lists each of the
attached routers that make up the transit network and is generated by the DR.
type 3 - (Summary LSA) The ABR sends Type 3 Summary LSAs. A Type 3 LSA advertises any networks
owned by an area to the rest of the areas in the OSPF AS. By default, OSPF advertises Type 3 LSAs for every
subnet defined in the originating area, which can cause flooding problems, so its a good idea to use a manual
summarization at the ABR.
type 4 - (ASBR-Summary LSA) It announces the ASBR address, it shows where the ASBR is located,
announcing its address instead of its routing table.
type 5 - (External LSA) Announces the Routes learned through the ASBR. External LSAs are flooded to all
areas except Stub areas. These LSAs divides in two types: external type 1 and external type2.
type 6 - (Group Membership LSA) This was defined for Multicast extensions to OSPF and is not used by
ROuterOS.
type 7 - type 7 LSAs are used to tell the ABRs about these external routes imorted in NSSA area. Area Border
Router then translates these LSAs to type 5 external LSAs and floods as normal to the rest of the OSPF
network
type 8 - (Link-local only LSA for OSPFv3)
type 9 type 10 type 11 Note: If we do not have any ASBR, theres no LSA Types 4 and 5 in the network.

Looking at the link-state database each routing domain router knows how many other routers are
in the network, how many interfaces routers have, what networks link between router connects,
cost of each link and so on.
There are several steps before OSPF network becomes fully functional:
Neighbor discovery
Database Synchronization
Routing calculation

216

Manual:OSPF Case Studies

217

Communication between OSPF routers


OSPF runs directly over the IP network layer using protocol number 89.
Destination IP address is set to neighbor's IP address or to one of the OSPF multicast addresses AllSPFRouters
(224.0.0.5) or AllDRRouters (224.0.0.6). Use of these addresses are described later in this article.
Every OSPF packet begins with standard 24-byte header.

Field

Description

Packet type

There are several types of OSPF packets: Hello packet, Database Description (DD) packet, Link state request packet,
link State Update packet and Link State Acknowledgment packet. All of these packets except Hello packet are used in
link-state database synchronization

Router ID

one of router's IP addresses unless configured manually

Area ID

Allows OSPF router to associate the packet to the proper OSPF area.

Checksum

Allows receiving router to determine if packet was damaged in transit.

Authentication
fields

These fields allow the receiving router to verify that the packet's contents was not modified and that packet really came
from OSPF router which Router ID appears in the packet.

There are five different OSPF packet types used to ensure proper LSA flooding over the OSPF network.
Hello packet - used to discover OSPF neighbors and build adjacencies.
Database Description (DD) - check for Database synchronization between routers. Exchanged after adjacencies
are built.
Link-State Request (LSR) - used to request up to date pieces of the neighbors database. Out of date parts of
routes database are determined after DD exchange.
Link-State Update (LSU) - carries a collection of specifically requested link-state records.
Link-State Acknowledgment (LSack) - is used to acknowledge other packet types that way introducing reliable
communication.

Neighbor discovery
Neighbors are discovered by periodically sending OSPF Hello packets out of configured interfaces. By default Hello
packets are sent out with 10 second interval. This interval can be changed by setting hello interval. Router learns the
existence of a neighboring router when it receives the neighbor's Hello in return.
The transmission and reception of Hello packets also allows router to detect failure of the neighbor. If Hello packets
are not received within Dead interval (which by default is 40s) router starts to route packets around the failure. Hello
protocol ensures that the neighboring routers agree on the Hello interval and Dead interval parameters, preventing
situations when not in time received Hello packets mistakenly bring the link down.

Manual:OSPF Case Studies

218

Field

Description

network mask

The IP mask of the originating router's interface IP address.

hello interval

period between Hello packets (default 10s)

options

OSPF options for neighbor information

router priority

an 8-bit value used to aid in the election of the DR and BDR. (Not set in p2p links)

router dead
interval

time interval has to be received before consider the neighbor is down. ( By default four times bigger than Hello
interval)

DR

the router-id of the current DR

BDR

the router-id of the current BDR

Neighbor router IDs

a list of router-ids for all the originating router's neighbors

On each type of network segment Hello protocol works a little different. It is clear that on point-to-point segments
only one neighbor is possible and no additional actions are required. However if more than one neighbor can be on
the segment additional actions are taken to make OSPF functionality even more efficient.
Note: Network mask, Priority, DR and BDR fields are used only when the neighbors are connected by a
broadcast or NBMA network segment.

Two routers do not become neighbors unless the following conditions are met.
Two way communication between routers is possible. Determined by flooding Hello packets.
Interface should belong to the same area;
Interface should belong to the same subnet and have the same network mask, unless it has network-type
configured as point-to-point;
Routers should have the same authentication options, and have to exchange same password (if any);
Hello and Dead intervals should be the same in Hello packets;
External routing and NSSA flags should be the same in Hello packets.

Manual:OSPF Case Studies

Discovery on Broadcast Subnets


Attached node to the broadcast subnet can send single packet and that packet is received by all other attached nodes.
This is very useful for auto-configuration and information replication. Another useful capability in broadcast subnets
is multicast. This capability allows to send single packet which will be received by nodes configured to receive
multicast packet. OSPF is using this capability to find OSPF neighbors and detect bidirectional connectivity.
Consider Ethernet network illustrated in image below.
Each OSPF router joins the IP multicast group AllSPFRouters (224.0.0.5), then router periodically multicasts its
Hello packets to the IP address 224.0.0.5. All other routers that joined the same group will receive multicasted Hello
packet. In that way OSPF routers maintain relationships with all other OSPF routers by sending single packet instead
of sending separate packet to each neighbor on the segment.
This approach has several advantages:
Automatic neighbor discovery by multicasting or broadcasting Hello packets.
Less bandwidth usage compared to other subnet types. On broadcast segment there are n*(n-1)/2 neighbor
relations, but those relations are maintained by sending only n Hellos.
If broadcast has multicast capability, then OSPF operates without disturbing non-OSPF nodes on the
broadcast segment. If multicast capability is not supported all routers will receive broadcasted Hello packet
even if node is not OSPF router.

Discovery on NBMA Subnets


Nonbroadcast multiaccess (NBMA) segments similar to broadcast supports more than two routers, only difference is
that NBMA do not support data-link broadcast capability. Due to this limitation OSPF neighbors must be discovered
initially through configuration. On RouterOS NBMA configuration is possible in/routig ospf
nbma-neighbor menu. To reduce the amount of Hello traffic, most routers attached to NBMA subnet should be
assigned Router Priority of 0 (set by default in RouterOS). Routers that are eligible to become Designated Routers
should have priority values other than 0. It ensures that during election of DR and BDR Hellos are sent only to
eligible routers.

Discovery on PTMP Subnets


Point-to-MultiPoint treats the network as a collection of point-to-point links.
On PTMP subnets Hello protocol is used only to detect active OSPF neighbors and to detect bidirectional
communication between neighbors. Routers on PTMP subnets send Hello packets to all other routers that are directly
connected to them. Designated Routers and Backup Designated routers are not elected on Point-to-multipoint
subnets.

Database Synchronization
Link-state Database synchronization between OSPF routers are very important.
There are two types of database synchronizations:
initial database synchronization
reliable flooding.
When the connection between two neighbors first come up, initial database synchronization will happen.
Unsynchronized databases may lead to calculation of incorrect routing table, resulting in routing loops or black
holes.
OSPF is using explicit database download when neighbor connections first come up. This procedure is called

219

Manual:OSPF Case Studies


Database exchange. Instead of sending the entire database, OSPF router sends only its LSA headers in a sequence
of OSPF Database Description (DD) packets. Router will send next DD packet only when previous packet is
acknowledged. When entire sequence of DD packets has been received, router knows which LSAs it does not have
and which LSAs are more recent. The router then sends Link-State Request (LSR) packets requesting desired
LSAs, and the neighbor responds by flooding LSAs in Link-State Update (LSU) packets. After all updates are
received neighbors are said to be fully adjacent.
Reliable flooding is another database synchronization method. It is used when adjacencies are already established
and OSPF router wants to inform other routers about LSA changes. When OSPF router receives such Link State
Update, it installs new LSA in link-state database, sends an acknowledgement packet back to sender, repackages
LSA in new LSU and sends it out all interfaces except the one that received the LSA in the first place.
OSPF determines if LSAs are up to date by comparing sequence numbers. Sequence numbers start with
080000001, the larger the number, the more recent the LSA is. Sequence number is incremented each time the
record is flooded and neighbor receiving update resets Maximum age timer. LSAs are refreshed every 30 minutes,
but without a refresh LSA remains in the database for maximum age of 60 minutes.
Databases are not always synchronized between all OSPF neighbors, OSPF decides whether databases needs to be
synchronized depending on network segment, for example, on point-to-point links databases are always
synchronized between routers, but on ethernet networks databases are synchronized between certain neighbor pairs.

Synchronization on Broadcast Subnets


On broadcast segment there are
n*(n-1)/2 neighbor relations, it will be
huge amount of Link State Updates
and Acknowledgements sent over the
subnet if OSPF router will try to
synchronize with each OSPF router on
the subnet.
This problem is solved by electing one
Designated Router and one Backup
Designated Router for each broadcast
subnet. All other routers are
synchronizing and forming adjacencies
only with those two elected routers.
This approach reduces amount of adjacencies from n*(n-1)/2 to only 2n-1.
Image on the right illustrates adjacency formations on broadcast subnets. Routers R1 and R2 are Designated Router
and Backup Designated router respectively. For example, R3 wants to flood Link State Update (LSU) to both R1 and
R2, router sends LSU to IP multicast address AllDRouters (224.0.0.6) and only DR and BDR listens to this
multicast address. Then Designated Router sends LSU addressed to AllSPFRouters, updating the rest of the routers.

220

Manual:OSPF Case Studies


DR election
DR and BDR routers are elected from data received in Hello packet. The first OSPF router on a subnet is always
elected as Designated Router, when second router is added it becomes Backup Designated Router. When existing
DR or BDR fails new DR or BDR is elected taking into account configured router priority. Router with the highest
priority becomes the new DR or BDR.
Being Designated Router or Backup Designated Router consumes additional resources. If Router Priority is set to 0,
then router is not participating in the election process. This is very useful if certain slower routers are not capable of
being DR or BDR.

Synchronization on NBMA Subnets


Database synchronization on NBMA networks are similar as on broadcast networks. DR and BDR are elected,
databases initially are exchanged only with DR and BDR routers and flooding always goes through the DR. The only
difference is that Link State Updates must be replicated and sent to each adjacent router separately.

Synchronization on PTMP Subnets


On PTMP subnets OSPF router becomes adjacent to all other routes with which it can communicate directly.

Routing table calculation


When link-state databases are synchronized OSPF routers are able to calculate routing table.
Link state database describes the routers and links that interconnect them and are appropriate for forwarding. It also
contains the cost (metric) of each link. This metric is used to calculate shortest path to destination network.
Each router can advertise a different cost for the router's own link direction, making it possible to have asymmetric
links (packets to destination travels over one path, but response travels different path). Asymmetric paths are not
very popular, because it makes harder to find routing problems.
The Cost in RouterOS is set to 10 on all interfaces by default. Value can be changed in ospf interface configuration
menu, for example to add ether2 interface with cost of 100:
/routing ospf interface add interface=ether2 cost=100
The cost of an interface on Cisco routers is inversely proportional to the bandwidth of that interface. Higher
bandwidth indicates lower cost. If similar costs are necessary on RouterOS, then use following formula:
Cost = 100000000/bw in bps.
OSPF router is using Dijkstra's Shortest Path First (SPF) algorithm to calculate shortest path. The algorithm places
router at the root of a tree and calculates shortest path to each destination based on the cumulative cost required to
reach the destination. Each router calculates own tree even though all routers are using the same link-state database.

SPT calculation
Assume we have the following network. Network consists of 4(four) routers. OSPF costs for outgoing interfaces are
shown near the line that represents the link. In order to build shortest path tree for router R1, we need to make R1 the
root and calculate the smallest cost for each destination.

221

Manual:OSPF Case Studies

As you can see from image above multiple shortest paths have been found to 172.16.1.0 network, allowing load
balancing of the traffic to that destination called equal-cost multipath (ECMP). After the shortest path tree is built,
router starts to build the routing table accordingly. Networks are reached consequently to the cost calculated in the
tree.
Routing table calculation looks quite simple, however when some of the OSPF extensions are used or OSPF areas
are calculated, routing calculation gets more complicated.

Configuring OSPF
Let's look how to configure single-area OSPF network.
One command is required to start OSPF on MikroTik RouterOS - add network in ospf network menu.
Let's assume we have the following network.

It has only one area with three routers connected to the same network 172.16.0.0/24. Backbone area is created during
RouterOS installation and additional configuration is not required for area settings.
R1 configuration:
/ip address add address=172.16.0.1/24 interface=ether1
/routing ospf network add network=172.16.0.0/24 area=backbone
R2 configuration:
/ip address add address=172.16.0.2/24 interface=ether1
/routing ospf network add network=172.16.0.0/24 area=backbone
R3 configuration:

222

Manual:OSPF Case Studies

223

/ip address add address=172.16.0.3/24 interface=ether1


/routing ospf network add network=172.16.0.0/24 area=backbone
To verify if OSPF instance is running on router:
[admin@MikroTik] /routing ospf> monitor once
state: running
router-id: 172.16.0.1
dijkstras: 6
db-exchanges: 0
db-remote-inits: 0
db-local-inits: 0
external-imports: 0
As you can see OSPF is up and running, notice that router-id is set the same as IP address of the router. It was done
automatically, because router-id was not specified during OSPF configuration.
Add a network to assign interface to the certain area. Look at the OSPF interface menu to verify that dynamic entry
was created and correct network type was detected.
[admin@MikroTik] /routing ospf interface> print
Flags: X - disabled, I - inactive, D - dynamic, P - passive
#

INTERFACE

COST

PRIORITY NETWORK-TYPE

AUTHENTICATION AUTHENTICATION-KEY

0 D

ether1

10

none

broadcast

Next step is to verify, that both neighbors are found, DR and BDR is elected and adjacencies are established:
[admin@MikroTik] /routing ospf neighbor> print
0 router-id=172.16.0.2 address=172.16.0.2 interface=ether1 priority=1
dr-address=172.16.0.3 backup-dr-address=172.16.0.2 state="Full" state-changes=5
ls-retransmits=0 ls-requests=0 db-summaries=0 adjacency=9m2s
1 router-id=172.16.0.3 address=172.16.0.3 interface=ether1 priority=1
dr-address=172.16.0.3 backup-dr-address=172.16.0.2 state="Full" state-changes=5
ls-retransmits=0 ls-requests=0 db-summaries=0 adjacency=6m42s

Most of the properties are self explanatory, but if something is unclear, description can be found in neighbor
reference manual
Last thing to check whether LSA table is generated properly.
[admin@MikroTik] /routing ospf lsa> print
AREA
TYPE
ID
backbone
router
172.16.0.1
backbone
router
172.16.0.2
backbone
router
172.16.0.3
backbone
network
172.16.0.3

ORIGINATOR
172.16.0.1
172.16.0.2
172.16.0.3
172.16.0.3

SEQUENCE-NUMBER
0x80000003
0x80000003
0x80000002
0x80000002

We have three router links and one network link. All properties are explained in LSA reference manual.
Congratulations, we have fully working OSPF network at this point.

AGE
587
588
592
587

Manual:OSPF Case Studies

Authentication
It is possible to secure OSPF packets exchange, MikroTik RouterOS provides two authentication methods, simple
and MD5. OSPF authentication is disabled by default.
Authentication is configured per interface. Add static ospf interface entry and specify authentication properties to
secure OSPF information exchange. md5 authentication configuration on ether1 is shown below:
/routing ospf interface
add interface=ether1 authentication=md5 authentication-key=mySampleKey authentication-key-id=2

Simple authentication is plain text authentication method. Method is vulnerable to passive attacks, anybody with
packet sniffer can easily get password. Method should be used only to protect OSPF from mis-configurations.
MD5 is a cryptographic authentication and is more preferred. Authentication-key, key-id and OSPF packet content is
used to generate message digest that is added to the packet. Unlike the simple authentication method, key is not
exchanged over the network.
Authentication-key-id value is 1, when authentication is not set (even for router that do not allow to set key
id at all).

Multi-area networks
Large single area network can produce serious issues:
Each router recalculates database every time whenever network topology change occurs, the process takes
CPU resources.
Each router holds entire link-state database, which shows the topology of the entire network, it takes
memory resources.
Complete copy of the routing table and number of routing table entries may be significantly greater than the
number of networks, that can take even more memory resources.
Updating large databases require more bandwidth.
To keep routing table size, memory and CPU demands to a manageable levels. OSPF uses a two-layer area
hierarchy:
backbone (transit) area - Primary function of this area is the fast and efficient movement of IP packets.
Backbone area interconnects other areas and generally, end users are not found within a backbone area.
regular area - Primary function of this area is to connect users and resources. To travel from one are to another,
traffic must travel over the backbone, meaning that two regular areas cannot be directly connected. Regular areas
have several Subtypes:

Standard Area
Stub Area
Totally Stubby Area
Not-so-stubby area (NSSA)

224

Manual:OSPF Case Studies

225
Each area is identified by 32-bit Area
ID and has its own link-state database,
consisting of router-LSAs and
network-LSAs describing how all
routers
within
that
area
are
interconnected. Detailed knowledge of
area's topology is hidden from all other
areas; router-LSAs and network-LSAs
are not flooded beyond the area's
borders. Area Border Routers (ABRs)
leak addressing information from one
area
into
another
in
OSPF
summary-LSAs. This allows to pick
the best area border router when
forwarding data to destinations from
another area and is called intra-area

routing.
Routing information exchange between areas is essentially Distance Vector algorithm and to prevent algorithm's
convergence problems, such as counting to infinity, all areas are required to attach directly to backbone area
making simple hub-and-spoke topology. Area-ID of backbone area is always 0.0.0.0 and can not be changed.
There are several types of routing information:
intra-area routes - routes generated from within an area (destination belongs to the area).
inter-area routes - routes originated from other areas, also called Summary Routes.
external routes - routes originated from other routing protocols and that are injected into OSPF by
redistribution.

External Routing Information


On the edge of an OSPF routing
domain, you can find routers called AS
boundary routers (ASBRs) that run
one of other routing protocols. The job
of those routers are to import routing
information learned from other routing
protocols into the OSPF routing
domain. External routes can be
imported at two separate levels
depending on metric type.
type1 - ospf metric is the sum of
the internal OSPF cost and the
external route cost
type2 - ospf metric is equal only
to the external route cost.
OSPF provides several area types:
backbone area, standard area, stub area and not-so-stubby area. All areas are covered later in the article.

Manual:OSPF Case Studies


Backbone area is the core of all OSPF network, all areas have to be connected to backbone area. Start configuring
OSPF from backbone and then expand network configuration to other areas.

Simple multi-area network


Consider the multi-area network shown below.

R1 configuration:
/ip address add address=10.0.3.1/24 interface=ether1
/ip address add address=10.0.2.1/24 interface=ether2
/routing ospf area add name=area1 area-id=1.1.1.1
/routing ospf network add network=10.0.2.0/24 area=backbone
/routing ospf network add network=10.0.3.0/24 area=area1
R2 configuration:
/ip address add address=10.0.1.1/24 interface=ether2
/ip address add address=10.0.2.2/24 interface=ether1
/routing ospf network add network=10.0.2.0/24 area=backbone
R3 configuration:
/ip address add address=10.0.3.2/24 interface=ether2
/ip address add address=10.0.4.1/24 interface=ether1
/routing ospf area add name=area1 area-id=1.1.1.1
/routing ospf network add network=10.0.3.0/24 area=area1

Route Redistribution
OSPF external routes are routes that are being redistributed from other routing protocols or from static routes.
Remember OSPF configuration setup described in previous section. As you may notice networks 10.0.1.0/24 and
10.0.4.0/24 are not redistributed into OSPF. OSPF protocol does not redistribute external routes by default.
Redistribution should be enabled in general OSPF configuration menu to do that. We need to redistribute connected
routes in our case, add following configuration to routers R3 and R2:
/routing ospf set redistribute-connected=as-type-1

226

Manual:OSPF Case Studies

227

Check routing table to see that both networks are redistributed.


[admin@MikroTik] /ip route> print
Let's add another network to R3:
/ip address add address=10.0.5.1/24 interface=ether1
10.0.5.0/24 and 10.0.4.0/24 networks are redistributed from R3 over OSPF now. But we do not want other routers to
know that 10.0.5.0/24 is reachable over router R3. To achieve it we can add rules in routing filters inside "ospf-out"
chain.
Add routing filter to R3
/routing filter add chain=ospf-out prefix=10.0.5.0/24 action=discard
Routing filters provide two chains to operate with OSPF routes: ospf-in and ospf-out. Ospf-in chain is used to filter
incoming routes and ospf-out is used to filter outgoing routes. More about routing filters can be found in routing
filters reference manual.

Virtual Link
All OSPF areas have to be attached to the backbone area, but sometimes physical connection is not possible. In this
case areas can be attached logically by using virtual links. Also virtual links can be used to glue together
fragmented backbone area.

No physical connection to backbone


Area may not have physical connection
to backbone, virtual link is used to
provide logical path to the backbone of
the disconnected area. Link has to be
established between two ABRs that
have common area with one ABR
connected to the backbone.
We can see that both R1 and R2
routers are ABRs and R1 is connected
to backbone area. Area2 will be used
as transit area and R1 is the entry
point into backbone area. Virtual link
has to be configured on both routers.
R1 configuration:
/routing ospf virtual-link add transit-area=area2 neighbor-id=2.2.2.2
R2 configuration:
/routing ospf virtual-link add transit-area=area2 neighbor-id=1.1.1.1

Manual:OSPF Case Studies

228

Partitioned backbone
OSPF allows to link discontinuous
parts of the backbone area using virtual
links. This might be required when two
separate OSPF networks are merged
into one large network. Virtual link can
be configured between separate ABRs
that touch backbone area from each
side and have a common area.
Additional area could be created to
become transit area, when common
area does not exist, it is illustrated in
the image above.
Virtual Links are not required for non-backbone areas, when they get partitioned. OSPF does not actively attempt to
repair area partitions, each component simply becomes a separate area, when an area becomes partitioned. The
backbone performs routing between the new areas. Some destinations are reachable via intra-area routing, the area
partition requires inter-area routing.
However, to maintain full routing after the partition, an address range has not to be split across multiple components
of the area partition.

Route Summarization
Route summarization is consolidation of multiple routes into one single advertisement. It is normally done at the area
boundaries (Area Border Routers), but summarization can be configured between any two areas.
It is better to summarize in the direction to the backbone. Then way the backbone receives all the aggregate
addresses and injects them into other areas already summarized. There are two types of summarization: inter-area
and external route summarization.

Inter-Area Route Summarization


Inter-area route summarization is done on ABRs, it does not apply to external routes injected into OSPF via
redistribution. Summarization configuration is done in OSPF area range menu.

Stub Area
Main purpose of stub areas is to keep such areas from carrying external routes. Routing from these areas to the
outside world is based on a default route. Stub area reduces the database size inside an area and reduces memory
requirements of routers in the area.

Manual:OSPF Case Studies

229
Stub area has few restrictions, ASBR
routers cannot be internal to the area,
stub area cannot be used as transit area
for virtual links. The restrictions are
made because stub area is mainly
configured not to carry external routes.
Totally stubby area is an extension for
stub area. A totally stubby area blocks
external routes and summarized
(inter-area) routes from going into the
area. Only intra-area routes are
injected
into
the
area.
inject-summary-lsa=no is used to
configure totally stubby area in the
RouterOS.

Let's consider the example above. Area1 is configured as stub area meaning that routers R2 and R3 will not receive
any routing information from backbone area except default route.
R1 configuration:
/routing ospf area add name=area1 area-id=1.1.1.1 type=stub inject-summary-lsa=yes
/routing ospf network
add network=10.0.0.0/24 area=backbone
add network=10.0.1.0/24 area=area1
add network=10.0.3.0/24 area=area1

R2 configuration:
/routing ospf area add name=area1 area-id=1.1.1.1 type=stub inject-summary-lsa=yes
/routing ospf network
add network=10.0.1.0/24 area=area1

R3 configuration:
/routing ospf area add name=area1 area-id=1.1.1.1 type=stub inject-summary-lsa=yes
/routing ospf network
add network=10.0.3.0/24 area=area1

Manual:OSPF Case Studies

230

NSSA
Not-so-stubby area (NSSA) is useful
when it is required to inject external
routes, but injection of type 5 LSA
routes is not required.
Look at the image above. There are
two areas (backbone and area1) and
RIP connection to area1. We need
Area1 to be configured as stub area,
but it is also required to inject external
routes from RIP protocol. Area1
should be configured as NSSA in this
case.
Configuration example does not cover RIP configuration.
R1 configuration:
/routing ospf area add name=area1 area-id=1.1.1.1 type=nssa
/routing ospf network
add network=10.0.0.0/24 area=backbone
add network=10.0.1.0/24 area=area1
R2 configuration:
/routing ospf set redistribute-rip=as-type-1
/routing ospf area add name=area1 area-id=1.1.1.1 type=nssa
/routing ospf network
add network=10.0.1.0/24 area=area1
NSSA areas have one another limitation: virtual links cannot be used over such area type.

Related Links
OSPF Configuration Examples
OSPF Reference Manual

Manual:OSPF-examples

Manual:OSPF-examples
Simple OSPF configuration
The following example illustrates how to configure single-area OSPF network. Lets assume we have the following
network.

Example network consists of 3 routers connected together within 10.10.1.0/24 network and each router has also one
additional attached network.
In this example following IP addresses are configured:
[admin@MikroTikR1]/ip address add address=10.10.1.1/30 interface=ether1
[admin@MikroTikR1]/ip address add address=10.10.1.5/30 interface=ether2
[admin@MikroTikR1]/ip address add address=210.13.1.0/28 interface=ether3
[admin@MikroTikR2]/ip address add address=10.10.1.6/30 interface=ether1
[admin@MikroTikR2]/ip address add address=10.10.1.9/30 interface=ether2
[admin@MikroTikR2]/ip address add address=172.16.1.0/16 interface=ether3
[admin@MikroTikR3]/ip address add address=10.10.1.2 /30 interface=ether1
[admin@MikroTikR3]/ip address add address=10.10.1.10/30 interface=ether2
[admin@MikroTikR3]/ip address add address=192.168.1.0/24 interface=ether3
There are three basic elements of OSPF configuration:
Enable OSPF instance
OSPF area configuration
OSPF network configuration
General information is configured in /routing ospf instance menu. For advanced OSPF setups, it is possible to run
multiple OSPF instances. Default instance configuration is good to start, we just need to enable default instance.
R1:
[admin@MikroTikR1] /routing ospf instance> add name=default
R2:

231

Manual:OSPF-examples
[admin@MikroTikR2] /routing ospf instance> add name=default
R3:
[admin@MikroTikR3] /routing ospf instance> add name=default
Show OSPF instance information:
[admin@MikroTikR1] /routing ospf instance> print
Flags: X - disabled
0
name="default" router-id=0.0.0.0 distribute-default=never
redistribute-connected=as-type-1 redistribute-static=as-type-1
redistribute-rip=no redistribute-bgp=no redistribute-other-ospf=no
metric-default=1 metric-connected=20 metric-static=20 metric-rip=20
metric-bgp=auto metric-other-ospf=auto in-filter=ospf-in
out-filter=ospf-out
As you can see router-id is 0.0.0.0, it means that router will use one of router's IP addresses as router-id. In most
cases it is recommended to set up loopback IP address as router-id. Loopback IP address is virtual, software address
that is used for router identification in network. The benefits are that loopback address is always up (active) and cant
be down as physical interface. OSPF protocol used it for communication among routers that identified by router-id.
Loopback interface are configured as follows:
Create bridge interface named, for example, loopback:
[admin@MikroTikR1] /interface bridge> add name=loopback
Add IP address:
[admin@MikroTikR1] > ip address add address=10.255.255.1/32 interface=loopback
Configure router-id as loopback:
[admin@MikroTikR1] /routing ospf instance> set 0 router-id=10.255.255.1
This can be done on other routers (R2, R3) as well.
Next step is to configure OSPF area. Backbone area is created during RouterOS installation and additional
configuration is not required.
Note: Remember that backbone area-id is always (zero) 0.0.0.0.

And the last step is to add network to the certain OSPF area.
On R1

[admin@MikroTikR1] /routing ospf network> add network=210.13.1.0/28 area=backbone


[admin@MikroTikR1] /routing ospf network> add network=10.10.1.0/30 area=backbone
[admin@MikroTikR1] /routing ospf network> add network=10.10.1.4/30 area=backbone

Instead of typing in each network, you can aggregate networks using appropriate subnet mask. For example, to
aggregate 10.10.1.0/30, 10.10.1.4/30, 10.10.1.8/30 networks, you can set up following ospf network:
[admin@MikroTikR1] /routing ospf network> add network=10.10.1.0/'''24''' area=backbone

R2:

232

Manual:OSPF-examples
[admin@MikroTikR2] /routing ospf network> add network=172.16.1.0/16 area=backbone
[admin@MikroTikR2] /routing ospf network> add network=10.10.1.0/24 area=backbone

R3:
[admin@MikroTikR3] /routing ospf network> add network=192.168.1.0/24 area=backbone
[admin@MikroTikR3] /routing ospf network> add network=10.10.1.0/24 area=backbone

You can verify your OSPF operation as follows:


Look at the OSPF interface menu to verify that dynamic entry was created:
[admin@MikroTikR1] /routing ospf interface> print
Check your OSPF neighbors, what DR and BDR is elected and adjacencies established:
[admin@MikroTikR1] /routing ospf neighbor> print
Check routers routing table (make sure OSPF routes are present):
[admin@MikroTik_CE1] > ip route print

Simple multi-area configuration


Backbone area is the core of all OSPF network, all areas have to be connected to the backbone area. Start
configuring OSPF from backbone and then expand network configuration to other areas.

Lets assume that IP addresses are already configured and default OSPF instance is enabled.
All we need to do is:
create an area
attach OSPF networks to the area
R1 configuration:
/routing ospf> add name=area1 area-id=0.0.0.1
/routing ospf> add network=10.0.1.0/24 area=backbone
/routing ospf> add network=10.1.1.0/30 area=area1
R2 configuration:
/routing ospf> add name=area2 area-id=0.0.0.2
/routing ospf> add network=10.0.1.0/24 area=backbone

233

Manual:OSPF-examples
/routing ospf> add network=10.1.2.0/30 area=area2
R3 configuration:
/routing ospf> add name=area1 area-id=0.0.0.1
/routing ospf> add network=10.1.1.0/30 area=area1
R4 configuration:
/routing ospf> add name=area2 area-id=0.0.0.2
/routing ospf> add network=10.1.2.0/30 area=area2
Now you can check routing table using command /ip route print
Routing table on router R3:
[admin@R3] > ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#
DST-ADDRESS
PREF-SRC
GATEWAY
DISTANCE
1 ADo 10.0.1.0/24
10.1.1.1
110
2 ADC 10.1.1.0/30
10.1.1.2
ether1
110
3 ADo 10.1.2.0/30
10.1.1.1
110
4 ADC 192.168.1.0/24
192.168.1.1
ether2
0
As you can see remote networks 172.16.0.0/16 and 192.168.2.0/24 are not in the routing table, because they are not
distributed by OSPF. Redistribution feature allows different routing protocols to exchange routing information
making possible, for example, to redistribute static or connected routes into OSPF. In our setup we need to
redistribute connected network. We need to add following configuration on routers R1, R2 and R3.
[admin@R3] /routing ospf instance> set 0 redistribute-connected=as-type-1
[admin@R3] /routing ospf instance> print
Flags: X - disabled
0
name="default" router-id=0.0.0.0 distribute-default=never
<u>redistribute-connected=as-type-1</u> redistribute-static=no
redistribute-rip=no redistribute-bgp=no redistribute-other-ospf=no
metric-default=1 metric-connected=20 metric-static=20 metric-rip=20
metric-bgp=auto metric-other-ospf=auto in-filter=ospf-in
out-filter=ospf-out
Now check router R3 to see if routes 192.168.2.0/24 and 172.16.0.0/16 are installed in routing table.
[admin@R3] > ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#
DST-ADDRESS
PREF-SRC
GATEWAY
DISTANCE
1 ADo 10.0.1.0/24
10.1.1.1
110
2 ADC 10.1.1.0/30
10.1.1.2
ether1
110
3 ADo 10.1.2.0/30
10.1.1.1
110
4 ADo 172.16.0.0/16
10.1.1.1
110
5 ADC 192.168.1.0/24
192.168.1.1
ether2
0

234

Manual:OSPF-examples
6 ADo

192.168.2.0/24

235
10.1.1.1

110

NBMA networks
OSPF network type NBMA (Non-Broadcast Multiple Access) uses only unicast communications, so it is the
preferred way of OSPF configuration in situations where multicast addressing is not possible or desirable for some
reasons. Examples of such situations:
in 802.11 wireless networks multicast packets are not always reliably delivered (read Multicast_and_Wireless for
details); using multicast here can create OSPF stability problems;
using multicast may be not efficient in bridged or meshed networks (i.e. large layer-2 broadcast domains).
Especially efficient way to configure OSPF is to allow only a few routers on a link to become the designated router.
(But be careful - if all routers that are capable of becoming the designated router will be down on some link, OSPF
will be down on that link too!) Since a router can become the DR only when priority on it's interface is not zero, this
priority can be configured as zero in interface and nbma-neighbor configuration to prevent that from happening.

In this setup only C and D are allowed to become designated routers.


On all routers:
routing
routing
routing
routing
routing

ospf
ospf
ospf
ospf
ospf

network add network=10.1.1.0/24 area=backbone


nbma-neighbor add address=10.1.1.1 priority=0
nbma-neighbor add address=10.1.1.2 priority=0
nbma-neighbor add address=10.1.1.3 priority=1
nbma-neighbor add address=10.1.1.4 priority=1

(For simplicity, to keep configuration the same on all routers, nbma-neighbor to self is also added. Normally you
wouldn't do that, but it does not cause any harm either.)
Configure interface priorities. On routers A, B:
routing ospf interface add interface=ether1 network-type=nbma priority=0
On routers C, D (they can become the designated router):
routing ospf interface add interface=ether1 network-type=nbma priority=1

Manual:OSPF-examples

Results
On Router A:
[admin@A] > routing ospf neighbor print
0 router-id=10.1.1.5 address=10.1.1.5 interface=ether1 priority=1 dr-address=10.1.1.4
backup-dr-address=10.1.1.3 state="Full" state-changes=6 ls-retransmits=0
ls-requests=0 db-summaries=0 adjacency=4m53s
1 router-id=10.1.1.3 address=10.1.1.3 interface=ether1 priority=1 dr-address=1.1.1.4
backup-dr-address=10.1.1.3 state="Full" state-changes=6 ls-retransmits=0
ls-requests=0 db-summaries=0 adjacency=4m43s
2 address=10.1.1.2 interface=ether1 priority=0 state="Down" state-changes=2
3 address=10.1.1.1 interface=ether1 priority=0 state="Down" state-changes=2

On Router D:
[admin@D] > routing ospf neighbor print
0 address=10.1.1.4 interface=ether1 priority=1 state="Down" state-changes=2
1 router-id=10.1.1.3 address=10.1.1.3 interface=ether1 priority=1 dr-address=10.1.1.4
backup-dr-address=10.1.1.3 state="Full" state-changes=6 ls-retransmits=0
ls-requests=0 db-summaries=0 adjacency=6m8s
2 router-id=10.1.1.2 address=10.1.1.2 interface=ether1 priority=0 dr-address=10.1.1.4
backup-dr-address=10.1.1.3 state="Full" state-changes=5 ls-retransmits=0
ls-requests=0 db-summaries=0 adjacency=6m4s
3 router-id=10.1.1.1 address=10.1.1.1 interface=ether1 priority=0 dr-address=10.1.1.4
backup-dr-address=10.1.1.3 state="Full" state-changes=5 ls-retransmits=0
ls-requests=0 db-summaries=0 adjacency=6m4s

OSPF Forwarding Address


OSPF may take extra hops at the boundary between OSPF routing domain and another Autonomous System. By
looking at the following illustration you can see that even if router R3 is directly connected, packets will travel
through the OSPF network and use router R1 as a gateway to other AS.
To overcome this problem, concept of OSPF forwarding-address was introduced. This concept allows to say "Send
traffic directly to router R1". This is achieved by setting forwarding address other than itself in LSA updates
indicating that there is an alternate next-hop. Mostly all the time forwarding address is left 0.0.0.0, suggesting that
the route is reachable only through the advertising router.
Sere the full example
[ Top | Back to Content ]

236

Manual:OSPF and Point-to-Point interfaces

Manual:OSPF and Point-to-Point interfaces


OSPF configuration on PPP interfaces often is a subject to misunderstanding. You need to keep in mind two things:
1. There is no need to explicitly configure an interface in "/routing ospf interface" to start running OSPF on it. Only
"routing ospf network" configuration determines whether the interface will be active or not. If it has matching
network network, i.e. the address of the interface falls within range of some network, then the interface will be
running OSPF. Else it won't participate in the protocol. "/routing ospf interface" is used only if specific
configuration for some interface is needed - typically to configure different link cost.
2. In case of PPP interfaces, the interface will be active if either local address or the address of remote are matched
against some network. See sample configuration for an illustration. This counterintuitive behaviour will be
changed in 3.x routing-test package. Only remote address will be considered there.
Also remember that running OSPF on a big number of (flapping) PPP interfaces is not recommended.

Configuration example: use local address as OSPF network


Assume we have a PPPoE tunnel between two routers 10.0.0.134 and 10.0.0.133. Configure OSPF on the PPPoE
interface on the first router:
[admin@I] > /ip address p
Flags: X - disabled, I - invalid, D - dynamic
#
ADDRESS
NETWORK
BROADCAST
INTERFACE
0
10.0.0.133/24
10.0.0.0
10.0.0.255
ether1
1 D 10.1.1.254/32
10.1.1.1
0.0.0.0
pppoe-out1
[admin@I] > routing ospf network add network=10.1.1.254/32 area=backbone
Do the same on the second router:
[admin@II] > /ip address p
Flags: X - disabled, I - invalid, D - dynamic
#
ADDRESS
NETWORK
BROADCAST
INTERFACE
0
10.0.0.134/24
10.0.0.0
10.0.0.255
ether1
1 D 10.1.1.1/32
10.1.1.254
0.0.0.0
<pppoe-atis>
[admin@II] > routing ospf network add network=10.1.1.1/32 area=backbone
An OSPF adjacency has been established; neighbor at 10.1.1.1 is in 'Full' state:
[admin@I] > routing ospf neighbor pr
router-id=10.0.0.133 address=10.1.1.254 priority=1 dr-address=0.0.0.0
backup-dr-address-id=0.0.0.0 state="2-Way" state-changes=0 ls-retransmits=0
ls-requests=0 db-summaries=0
router-id=10.0.0.134 address=10.1.1.1 priority=1 dr-address=0.0.0.0
backup-dr-address-id=0.0.0.0 state="Full" state-changes=5 ls-retransmits=0
ls-requests=0 db-summaries=0
[admin@I] >

237

Manual:OSPF and Point-to-Point interfaces

External links
OSPF in MT manual [1]
OSPF RFC [2]

References
[1] http:/ / www. mikrotik. com/ docs/ ros/ 2. 9/ routing/ ospf
[2] http:/ / rfc-ref. org/ RFC-TEXTS/ 2328/ contents. html

Manual:BGP Load Balancing with two interfaces


Applies to RouterOS: 3, v4

NB: RouterOS version 3.13 or later with routing-test package is required for this to work
In these examples we show how to do load balancing when there are multiple equal cost links between
two BGP routers. The "multiple recursive next-hop resolution" feature is used to achieve that.
The BGP session is established between loopback interfaces; update-source configuration setting is used to bind the
BGP connection to the right interface.

Example with iBGP


Network Diagram

Configuration
On Router A:
# loopback interface
/interface bridge add name=lobridge
# addresses
/ip address add address=1.1.1.1/24 interface=ether1
/ip address add address=2.2.2.1/24 interface=ether2
/ip address add address=9.9.9.1/32 interface=lobridge
# ECMP route to peer's loopback

238

Manual:BGP Load Balancing with two interfaces

239

/ip route add dst-address=9.9.9.2/32 gateway=1.1.1.2,2.2.2.2


# BGP
/routing bgp instance set default as=65000
/routing bgp add name=peer1 remote-address=9.9.9.2 remote-as=65000 update-source=lobridge

On Router B:
# loopback interface
/interface bridge add name=lobridge
# addresses
/ip address add address=1.1.1.2/24 interface=ether1
/ip address add address=2.2.2.2/24 interface=ether2
/ip address add address=9.9.9.2/32 interface=lobridge
# ECMP route to peer's loopback
/ip route add dst-address=9.9.9.1/32 gateway=1.1.1.1,2.2.2.1
# BGP
/routing bgp instance set default as=65000
/routing bgp add name=peer1 remote-address=9.9.9.1 remote-as=65000 update-source=lobridge
# a route to advertise
/routing bgp network add network=4.4.4.0/24

Results
Check that BGP connection is established:
[admin@B] > /routing bgp peer print status
Flags: X - disabled
0

name="peer1" instance=default remote-address=9.9.9.1 remote-as=65000


tcp-md5-key="" nexthop-choice=default multihop=no route-reflect=no hold-time=3m
ttl=255 in-filter="" out-filter="" address-families=ip
update-source=lobridge default-originate=no remote-id=1.1.1.1
local-address=9.9.9.2 uptime=28s prefix-count=0 updates-sent=1
updates-received=0 withdrawn-sent=0 withdrawn-received=0 remote-hold-time=3m
used-hold-time=3m used-keepalive-time=1m refresh-capability=yes
as4-capability=yes state=established

Route table on Router A:


[admin@A] > /ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#

DST-ADDRESS

PREF-SRC

0 ADC

1.1.1.0/24

1.1.1.1

G GATEWAY

ether1

1 ADC

2.2.2.0/24

2.2.2.1

ether2

2 ADb

4.4.4.0/24

200

ether1

r 9.9.9.2

DISTANCE INTER...

Manual:BGP Load Balancing with two interfaces

240
ether2

3 ADC

9.9.9.1/32

4 A S

9.9.9.2/32

9.9.9.1

lobridge

ether1

r 1.1.1.2
r 2.2.2.2

ether2

[admin@A] > /ip route print detail


Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
0 ADC

dst-address=1.1.1.0/24 pref-src=1.1.1.1 interface=ether1 distance=0 scope=10

1 ADC

dst-address=2.2.2.0/24 pref-src=2.2.2.1 interface=ether2 distance=0 scope=10

2 ADb

dst-address=4.4.4.0/24 gateway=9.9.9.2 interface=ether1,ether2


gateway-state=recursive distance=200 scope=40 target-scope=30
bgp-local-pref=100 bgp-origin=igp received-from=9.9.9.2

3 ADC

dst-address=9.9.9.1/32 pref-src=9.9.9.1 interface=lobridge distance=0 scope=10

4 A S

dst-address=9.9.9.2/32 gateway=1.1.1.2,2.2.2.2 interface=ether1,ether2


gateway-state=reachable,reachable distance=1 scope=30 target-scope=10

The route 4.4.4.0./24 is installed in Linux kernel now with two nexthops: 1.1.1.2 (on ether1) and 2.2.2.2 (on ether2).

Example with eBGP


Network Diagram

Configuration
Here the example given above is further developed for eBGP case. By default, eBGP peers are required to be directly
reachable. If we are using loopback interfaces, they technically are not, so multihop=yes configuration setting must
be specified.
On Router A:
/routing bgp instance set default as=65000
/routing bgp set peer1 remote-address=9.9.9.2 remote-as=65001 update-source=lobridge multihop=yes

On Router B:
/routing bgp instance set default as=65001
/routing bgp set peer1 remote-address=9.9.9.1 remote-as=65000 update-source=lobridge multihop=yes

Manual:BGP Load Balancing with two interfaces

241

Results
If we now print the route table on Router A, we see that the route from Router B is there, but it's not active:
...
2

Db

dst-address=4.4.4.0/24 gateway=9.9.9.2 interface="" gateway-state=unreachable


distance=20 scope=40 target-scope=10 bgp-as-path="65001" bgp-origin=igp
received-from=9.9.9.2

...

This is because eBGP routes are installed with lesser target-scope by default. To solve this, setup routing filter that
sets larger target-scope:
/routing filter add chain=bgp-in set-target-scope=30
/routing bgp set peer1 in-filter=bgp-in
Or else, modify scope attribute of the static route:
/ip route set [find dst-address=9.9.9.2/32] scope=10
Either way, the route to 4.4.4.0/24 should be active now:
2 ADb

dst-address=4.4.4.0/24 gateway=9.9.9.2 interface=ether1,ether2


gateway-state=recursive distance=20 scope=40 target-scope=10
bgp-as-path="65001" bgp-origin=igp received-from=9.9.9.2

Notes
BGP itself as protocol does not supports ECMP routes. When a recursively resolved BGP route is propagated
further in the network, only one nexthop can be selected (as described here) and included in the BGP UPDATE
message.
Corresponding Cisco syntax can be found here: Load Sharing with BGP in Single and Multihomed Environments:
Sample Configurations [1]

References
[1] http:/ / www. cisco. com/ en/ US/ tech/ tk365/ technologies_configuration_example09186a00800945bf. shtml

Manual:IP/Firewall/Filter

Manual:IP/Firewall/Filter
Applies to RouterOS: v3, v4

Summary
Sub-menu: /ip firewall filter
The firewall implements packet filtering and thereby provides security functions that are used to manage data flow
to, from and through the router. Along with the Network Address Translation it serves as a tool for preventing
unauthorized access to directly attached networks and the router itself as well as a filter for outgoing traffic.
Network firewalls keep outside threats away from sensitive data available inside the network. Whenever different
networks are joined together, there is always a threat that someone from outside of your network will break into your
LAN. Such break-ins may result in private data being stolen and distributed, valuable data being altered or
destroyed, or entire hard drives being erased. Firewalls are used as a means of preventing or minimizing the security
risks inherent in connecting to other networks. Properly configured firewall plays a key role in efficient and secure
network infrastrure deployment.
MikroTik RouterOS has very powerful firewall implementation with features including:

stateful packet inspection


Layer-7 protocol detection
peer-to-peer protocols filtering
traffic classification by:
source MAC address
IP addresses (network or list) and address types (broadcast, local, multicast, unicast)
port or port range
IP protocols
protocol options (ICMP type and code fields, TCP flags, IP options and MSS)
interface the packet arrived from or left through
internal flow and connection marks
DSCP byte
packet content
rate at which packets arrive and sequence numbers
packet size
packet arrival time
and much more!

242

Manual:IP/Firewall/Filter

243

Chains
The firewall operates by means of firewall rules. Each rule consists of two parts - the matcher which matches traffic
flow against given conditions and the action which defines what to do with the matched packet.
Firewall filtering rules are grouped together in chains. It allows a packet to be matched against one common criterion
in one chain, and then passed over for processing against some other common criteria to another chain. For example
a packet should be matched against the IP address:port pair. Of course, it could be achieved by adding as many rules
with IP address:port match as required to the forward chain, but a better way could be to add one rule that matches
traffic from a particular IP address, e.g.: /ip firewall filter add src-address=1.1.1.2/32 jump-target="mychain" and in
case of successfull match passes control over the IP packet to some other chain, id est mychain in this example. Then
rules that perform matching against separate ports can be added to mychain chain without specifying the IP
addresses.
There are three predefined chains, which cannot be deleted:
input - used to process packets entering the router through one of the interfaces with the destination IP address
which is one of the router's addresses. Packets passing through the router are not processed against the rules of the
input chain
forward - used to process packets passing through the router
output - used to process packets originated from the router and leaving it through one of the interfaces. Packets
passing through the router are not processed against the rules of the output chain
Packet flow diagrams illustrate how packets are processed in RouterOS.
When processing a chain, rules are taken from the chain in the order they are listed there from top to bottom. If a
packet matches the criteria of the rule, then the specified action is performed on it, and no more rules are processed
in that chain (the exception is the passthrough action). If a packet has not matched any rule within the chain, then it
is accepted.

Properties
Property
action (action name; Default: accept)

Description
Action to take if packet is matched by the rule:

address-list (string; Default: )

accept - accept the packet. Packet is not passed to next firewall rule.
add-dst-to-address-list - add destination address to address list
specified by address-list parameter
add-src-to-address-list - add source address to address list
specified by address-list parameter
drop - silently drop the packet
jump - jump to the user defined chain specified by the value of
jump-target parameter
log - add a message to the system log containing following data:
in-interface, out-interface, src-mac, protocol, src-ip:port->dst-ip:port and
length of the packet. After packet is matched it is passed to next rule in the
list, similar as passthrough
passthrough - ignore this rule and go to next one (useful for statistics).
reject - drop the packet and send an ICMP reject message
return - passes control back to the chain from where the jump took place
tarpit - captures and holds TCP connections (replies with SYN/ACK to
the inbound TCP SYN packet)

Name of the address list to be used. Applicable if action is


add-dst-to-address-list or add-src-to-address-list

Manual:IP/Firewall/Filter

244

address-list-timeout (time; Default: 00:00:00)

Time interval after which the address will be removed from the address list
specified by address-list parameter. Used in conjunction with
add-dst-to-address-list or add-src-to-address-list
actions
Value of 00:00:00 will leave the address in the address list forever

chain (name; Default: )

Specifies to which chain rule will be added. If the input does not match the
name of an already defined chain, a new chain will be created.

comment (string; Default: )

Descriptive comment for the rule.

connection-bytes (integer-integer; Default: )

Matches packets only if a given amount of bytes has been transfered through
the particular connection. 0 - means infinity, for example
connection-bytes=2000000-0 means that the rule matches if more
than 2MB has been transfered through the relevant connection

connection-limit (integer,netmask; Default: )

Restrict connection limit per address or address block

connection-mark (no-mark | string; Default: )

Matches packets marked via mangle facility with particular connection mark. If
no-mark is set, rule will match any unmarked connection.

connection-rate (Integer 0..4294967295; Default: )

Connection Rate is a firewall matcher that allow to capture traffic based on


present speed of the connection. Read more >>

connection-state (estabilished | invalid | new | related;


Default: )

Interprets the connection tracking analysis data for a particular packet:

established - a packet which belongs to an existing connection


invalid - a packet which could not be identified for some reason
new - the packet has started a new connection, or otherwise associated with
a connection which has not seen packets in both directions.
related - a packet which is related to, but not part of an existing
connection, such as ICMP errors or a packet which begins FTP data
connection

connection-type (ftp | h323 | irc | pptp | quake3 | sip | tftp;


Default: )

Matches packets from related connections based on information from their


connection tracking helpers. A relevant connection helper must be enabled
under /ip firewall service-port

content (string; Default: )

Match packets that contain specified text

dscp (integer: 0..63; Default: )

Matches DSCP IP header field.

dst-address (IP/netmask | IP range; Default: )

Matches packets which destination is equal to specified IP or falls into


specified IP range.

dst-address-list (name; Default: )

Matches destination address of a packet against user-defined address list

dst-address-type (unicast | local | broadcast | multicast;


Default: )

Matches destination address type:

dst-limit (integer,time,integer,dst-address | dst-port |


src-address, time; Default: )

Matches packets within given pps limit. As opposed to the limit matcher,
every destination IP address / destination port has it's own limit. Parameters are
written in following format: count,time,burst,mode,expire.

dst-port (integer[-integer]: 0..65535; Default: )

unicast - IP address used for point to point transmission


local - if dst-address is assigned to one of router's interfaces
broadcast - packet is sent to all devices in subnet
multicast - packet is forwarded to defined group of devices

count - maximum average packet rate measured in packets per time


interval
time - specifies the time interval in which the packet rate is measured
burst - number of packets which are not counted by packet rate
mode - the classifier for packet rate limiting
expire - specifies interval after which recored ip address /port will be
deleted

List of destination port numbers or port number ranges

Manual:IP/Firewall/Filter

fragment (yes|no; Default: )

245
Matches fragmented packets. First (starting) fragment does not count. If
connection tracking is enabled there will be no fragments as system
automatically assembles every packet

hotspot (auth | from-client | http | local-dst | to-client; Default:


)
icmp-options (integer:integer; Default: )

Matches ICMP type:code fileds

in-bridge-port (name; Default: )

Actual interface the packet has entered the router, if incoming interface is
bridge

in-interface (name; Default: )

Interface the packet has entered the router

ingress-priority (integer: 0..63; Default: )

Matches ingress priority of the packet. Priority may be derived from VLAN,
WMM or MPLS EXP bit. Read more>>

ipv4-options (any | loose-source-routing | no-record-route |


no-router-alert | no-source-routing | no-timestamp | none |
record-route | router-alert | strict-source-routing | timestamp;
Default: )

Matches IPv4 header options.

any - match packet with at least one of the ipv4 options


loose-source-routing - match packets with loose source routing
option. This option is used to route the internet datagram based on
information supplied by the source
no-record-route - match packets with no record route option. This
option is used to route the internet datagram based on information supplied
by the source
no-router-alert - match packets with no router alter option
no-source-routing - match packets with no source routing option
no-timestamp - match packets with no timestamp option
record-route - match packets with record route option
router-alert - match packets with router alter option
strict-source-routing - match packets with strict source routing
option
timestamp - match packets with timestamp

jump-target (name; Default: )

Name of the target chain to jump to. Applicable only if action=jump

layer7-protocol (name; Default: )

Layer7 filter name defined in layer7 protocol menu.

limit (integer,time,integer; Default: )

Matches packets within given pps limit. Parameters are written in following
format: count,time,burst.

count - maximum average packet rate measured in packets per time


interval
time - specifies the time interval in which the packet rate is measured
burst - number of packets which are not counted by packet rate

log-prefix (string; Default: )

Adds specified text at the beginning of every log message. Applicable if


action=log

nth (integer,integer; Default: )

Matches every nth packet. Read more >>

out-bridge-port (name; Default: )

Actual interface the packet is leaving the router, if outgoing interface is bridge

out-interface (; Default: )

Interface the packet is leaving the router

p2p (all-p2p | bit-torrent | blubster | direct-connect | edonkey |


fasttrack | gnutella | soulseek | warez | winmx; Default: )

Matches packets from various peer-to-peer (P2P) protocols. Does not work on
encrypted p2p packets.

packet-mark (no-mark | string; Default: )

Matches packets marked via mangle facility with particular packet mark. If
no-mark is set, rule will match any unmarked packet.

packet-size (integer[-integer]:0..65535; Default: )

Matches packets of specified size or size range in bytes.

per-connection-classifier
(ValuesToHash:Denominator/Remainder; Default: )

PCC matcher allows to divide traffic into equal streams with ability to keep
packets with specific set of options in one particular stream. Read more >>

port (integer[-integer]: 0..65535; Default: )

Matches if any (source or destination) port matches the specified list of ports or
port ranges. Applicable only if protocol is TCP or UDP

Manual:IP/Firewall/Filter

246

protocol (name or protocol ID; Default: tcp)

Matches particular IP protocol specified by protocol name or number

psd (integer,time,integer,integer; Default: )

Attempts to detect TCP and UDP scans. Parameters are in following format
WeightThreshold, DelayThreshold, LopPortWeight,
HighPortWeight

WeightThreshold - total weight of the latest TCP/UDP packets with


different destination ports coming from the same host to be treated as port
scan sequence
DelayThreshold - delay for the packets with different destination ports
coming from the same host to be treated as possible port scan subsequence
LowPortWeight - weight of the packets with privileged (<=1024)
destination port
HighPortWeight - weight of the packet with non-priviliged destination
port

random (integer: 1..99; Default: )

Matches packets randomly with given probability.

reject-with (; Default: )

Specifies error to be sent back if packet is rejected. Applicable if


action=reject

routing-mark (string; Default: )

Matches packets marked by mangle facility with particular routing mark

src-address (Ip/Netmaks, Ip range; Default: )

Matches packets which source is equal to specified IP or falls into specified IP


range.

src-address-list (name; Default: )

Matches source address of a packet against user-defined address list

src-address-type (unicast | local | broadcast | multicast;


Default: )

Matches source address type:

src-port (integer[-integer]: 0..65535; Default: )

List of source ports and ranges of source ports. Applicable only if protocol is
TCP or UDP.

src-mac-address (MAC address; Default: )

Matches source MAC address of the packet

tcp-flags (ack | cwr | ece | fin | psh | rst | syn | urg; Default: )

Matches specified TCP flags

unicast - IP address used for point to point transmission


local - if address is assigned to one of router's interfaces
broadcast - packet is sent to all devices in subnet
multicast - packet is forwarded to defined group of devices

ack
cwr
ece
fin
psh
rst
syn
urg

- acknowledging data
- congestion window reduced
- ECN-echo flag (explicit congestion notification)
- close connection
- push function
- drop connection
- new connection
- urgent data

tcp-mss (integer: 0..65535; Default: )

Matches TCP MSS value of an IP packet

time (time-time,sat | fri | thu | wed | tue | mon | sun; Default: )

Allows to create filter based on the packets' arrival time and date or, for locally
generated packets, departure time and date

ttl (integer: 0..255; Default: )

Matches packets TTL value

Manual:IP/Firewall/Filter

247

Stats
/ip firewall filter print stats will show additional read-only properties
Property
bytes (integer)

Description
Total amount of bytes matched by the rule

packets (integer) Total amount of packets matched by the rule

By default print is equivalent to print static and shows only static rules.
[admin@dzeltenais_burkaans] /ip firewall mangle> print stats
Flags: X - disabled, I - invalid, D - dynamic
#
CHAIN
ACTION
BYTES
0
prerouting
mark-routing
17478158
1
prerouting
mark-routing
782505

PACKETS
127631
4506

To print also dynamic rules use print all.


[admin@dzeltenais_burkaans] /ip firewall mangle> print all stats
Flags: X - disabled, I - invalid, D - dynamic
#
CHAIN
ACTION
BYTES
PACKETS
0
prerouting
mark-routing
17478158
127631
1
prerouting
mark-routing
782505
4506
2 D forward
change-mss
0
0
3 D forward
change-mss
0
0
4 D forward
change-mss
0
0
5 D forward
change-mss
129372
2031
Or to print only dynamic rules use print dynamic
[admin@dzeltenais_burkaans] /ip firewall mangle> print stats dynamic
Flags: X - disabled, I - invalid, D - dynamic
#
CHAIN
ACTION
BYTES
PACKETS
0 D forward
change-mss
0
0
1 D forward
change-mss
0
0
2 D forward
change-mss
0
0
3 D forward
change-mss
132444
2079

Manual:IP/Firewall/Filter

248

Menu specific commands


Property
reset-counters (id)

Description
Reset statistics counters for specified firewall rules.

reset-counters-all () Reset statistics counters for all firewall rules.

Basic examples
Router protection
Lets say our private network is 192.168.0.0/24 and public (WAN) interface is ether1. We will set up firewall to allow
connections to router itself only from our local network and drop the rest. Also we will allow ICMP protocol on any
interface so that anyone can ping your router from internet.
/ip firewall filter
add chain=input connection-state=invalid action=drop \
comment="Drop Invalid connections"
add chain=input connection-state=established action=accept \
comment="Allow Established connections"
add chain=input protocol=icmp action=accept \
comment="Allow ICMP"
add chain=input src-address=192.168.0.0/24 action=accept \
in-interface=!ether1
add chain=input action=drop comment="Drop everything else"

Customer protection
To protect the customer's network, we should check all traffic which goes through router and block unwanted. For
icmp, tcp, udp traffic we will create chains, where will be droped all unwanted packets:
/ip firewall filter
add chain=forward protocol=tcp connection-state=invalid \
action=drop comment="drop invalid connections"
add chain=forward connection-state=established action=accept \
comment="allow already established connections"
add chain=forward connection-state=related action=accept \
comment="allow related connections"
Block "bogon" IP addresses
add
add
add
add
add
add

chain=forward
chain=forward
chain=forward
chain=forward
chain=forward
chain=forward

src-address=0.0.0.0/8 action=drop
dst-address=0.0.0.0/8 action=drop
src-address=127.0.0.0/8 action=drop
dst-address=127.0.0.0/8 action=drop
src-address=224.0.0.0/3 action=drop
dst-address=224.0.0.0/3 action=drop

Make jumps to new chains:


add chain=forward protocol=tcp action=jump jump-target=tcp
add chain=forward protocol=udp action=jump jump-target=udp

Manual:IP/Firewall/Filter
add chain=forward protocol=icmp action=jump jump-target=icmp
Create tcp chain and deny some tcp ports in it:
add chain=tcp protocol=tcp dst-port=69 action=drop \
comment="deny TFTP"
add chain=tcp protocol=tcp dst-port=111 action=drop \
comment="deny RPC portmapper"
add chain=tcp protocol=tcp dst-port=135 action=drop \
comment="deny RPC portmapper"
add chain=tcp protocol=tcp dst-port=137-139 action=drop \
comment="deny NBT"
add chain=tcp protocol=tcp dst-port=445 action=drop \
comment="deny cifs"
add chain=tcp protocol=tcp dst-port=2049 action=drop comment="deny NFS"
add chain=tcp protocol=tcp dst-port=12345-12346 action=drop comment="deny NetBus"
add chain=tcp protocol=tcp dst-port=20034 action=drop comment="deny NetBus"
add chain=tcp protocol=tcp dst-port=3133 action=drop comment="deny BackOriffice"
add chain=tcp protocol=tcp dst-port=67-68 action=drop comment="deny DHCP"

Deny udp ports in udp chain:


add chain=udp protocol=udp dst-port=69 action=drop comment="deny TFTP"
add chain=udp protocol=udp dst-port=111 action=drop comment="deny PRC portmapper"
add chain=udp protocol=udp dst-port=135 action=drop comment="deny PRC portmapper"
add chain=udp protocol=udp dst-port=137-139 action=drop comment="deny NBT"
add chain=udp protocol=udp dst-port=2049 action=drop comment="deny NFS"
add chain=udp protocol=udp dst-port=3133 action=drop comment="deny BackOriffice"

Allow only needed icmp codes in icmp chain:


add chain=icmp protocol=icmp icmp-options=0:0 action=accept \
comment="echo reply"
add chain=icmp protocol=icmp icmp-options=3:0 action=accept \
comment="net unreachable"
add chain=icmp protocol=icmp icmp-options=3:1 action=accept \
comment="host unreachable"
add chain=icmp protocol=icmp icmp-options=3:4 action=accept \
comment="host unreachable fragmentation required"
add chain=icmp protocol=icmp icmp-options=4:0 action=accept \
comment="allow source quench"
add chain=icmp protocol=icmp icmp-options=8:0 action=accept \
comment="allow echo request"
add chain=icmp protocol=icmp icmp-options=11:0 action=accept \
comment="allow time exceed"
add chain=icmp protocol=icmp icmp-options=12:0 action=accept \
comment="allow parameter bad"
add chain=icmp action=drop comment="deny all other types"
other ICMP codes are found here [1].

249

Manual:IP/Firewall/Filter

Brute force protection


Bruteforce_login_prevention_(FTP_&_SSH)
[ Top | Back to Content ]

References
[1] http:/ / www. iana. org/ assignments/ icmp-parameters

Manual:IP/Firewall/NAT
Applies to RouterOS: v3, v4 +

Summary
Sub-menu: /ip firewall nat
Network Address Translation is an Internet standard that allows hosts on local area networks to use one set of IP
addresses for internal communications and another set of IP addresses for external communications. A LAN that
uses NAT is referred as natted network. For NAT to function, there should be a NAT gateway in each natted
network. The NAT gateway (NAT router) performs IP address rewriting on the way a packet travel from/to LAN.
There are two types of NAT:
source NAT or srcnat. This type of NAT is performed on packets that are originated from a natted network. A
NAT router replaces the private source address of an IP packet with a new public IP address as it travels through
the router. A reverse operation is applied to the reply packets travelling in the other direction.
destination NAT or dstnat. This type of NAT is performed on packets that are destined to the natted network. It
is most comonly used to make hosts on a private network to be acceesible from the Internet. A NAT router
performing dstnat replaces the destination IP address of an IP packet as it travel through the router towards a
private network.
Hosts behind a NAT-enabled router do not have true end-to-end connectivity. Therefore some Internet protocols
might not work in scenarios with NAT. Services that require the initiation of TCP connection from outside the
private network or stateless protocols such as UDP, can be disrupted. Moreover, some protocols are inherently
incompatible with NAT, a bold example is AH protocol from the IPsec suite.
To overcome these limitations RouterOS includes a number of so-called NAT helpers, that enable NAT traversal for
various protocols.

Properties

250

Manual:IP/Firewall/NAT

251

Property
action (action name; Default: accept)

Description
Action to take if packet is matched by the rule:

accept - accept the packet. Packet is not passed to next NAT rule.
add-dst-to-address-list - add destination address to Address list
specified by address-list parameter
add-src-to-address-list - add source address to Address list
specified by address-list parameter
dst-nat - replaces destination address and/or port of an IP packet to
values specified by to-addresses and to-ports parameters
jump - jump to the user defined chain specified by the value of
jump-target parameter
log - add a message to the system log containing following data:
in-interface, out-interface, src-mac, protocol, src-ip:port->dst-ip:port and
length of the packet. After packet is matched it is passed to next rule in the
list, similar as passthrough
masquerade - replace source address of an IP packet to IP determined by
routing facility.
netmap - creates a static 1:1 mapping of one set of IP addresses to another
one. Often used to distribute public IP addresses to hosts on private
networks
passthrough - ignore this rule and go to next one (useful for statistics).
redirect - replaces destination port of an IP packet to one specified by
to-ports parameter and destination address to one of the router's local
addresses
return - passes control back to the chain from where the jump took place
same - gives a particular client the same source/destination IP address
from supplied range for each connection. This is most frequently used for
services that expect the same client address for multiple connections from
the same client
src-nat - replaces source address of an IP packet to values specified by
to-addresses and to-ports parameters

address-list (string; Default: )

Name of the address list to be used. Applicable if action is


add-dst-to-address-list or add-src-to-address-list

address-list-timeout (time; Default: 00:00:00)

Time interval after which the address will be removed from the address list
specified by address-list parameter. Used in conjunction with
add-dst-to-address-list or add-src-to-address-list
actions
Value of 00:00:00 will leave the address in the address list forever

chain (name; Default: )

Specifies to which chain rule will be added. If the input does not match the
name of an already defined chain, a new chain will be created.

comment (string; Default: )

Descriptive comment for the rule.

connection-bytes (integer-integer; Default: )

Matches packets only if a given amount of bytes has been transfered through
the particular connection. 0 - means infinity, for example
connection-bytes=2000000-0 means that the rule matches if more
than 2MB has been transfered through the relevant connection

connection-limit (integer,netmaks; Default: )

Restrict connection limit per address or address block/td>

connection-mark (no-mark | string; Default: )

Matches packets marked via mangle facility with particular connection mark. If
no-mark is set, rule will match any unmarked connection.

connection-rate (Integer 0..4294967295; Default: )

Connection Rate is a firewall matcher that allow to capture traffic based on


present speed of the connection. Read more>>

Manual:IP/Firewall/NAT

252

connection-state (estabilished | invalid | new | related;


Default: )

Interprets the connection tracking analysis data for a particular packet:

connection-type (ftp | h323 | irc | pptp | quake3 | sip | tftp;


Default: )

Matches packets from related connections based on information from their


connection tracking helpers. A relevant connection helper must be enabled
under /ip firewall service-port

content (string; Default: )

Match packets that contain specified text

dscp (integer: 0..63; Default: )

Matches DSCP IP header field.

dst-address (IP/netmask | IP range; Default: )

Matches packets which destination is equal to specified IP or falls into


specified IP range.

dst-address-list (name; Default: )

Matches destination address of a packet against user-defined address list

dst-address-type (unicast | local | broadcast | multicast;


Default: )

Matches destination address type:

dst-limit (integer,time,integer,dst-address | dst-port |


src-address, time; Default: )

Matches packets within given pps limit. As opposed to the limit matcher,
every destination IP address / destination port has it's own limit. Parameters are
written in following format: count,time,burst,mode,expire.

established - a packet which belongs to an existing connection


invalid - a packet which could not be identified for some reason
new - a packet which begins a new connection
related - a packet which is related to, but not part of an existing
connection, such as ICMP errors or a packet which begins FTP data
connection

unicast - IP address used for point to point transmission


local - if dst-address is assigned to one of router's interfaces
broadcast - packet is sent to all devices in subnet
multicast - packet is forwarded to defined group of devices

count - maximum average packet rate measured in packets per time


interval
time - specifies the time interval in which the packet rate is measured
burst - number of packets which are not counted by packet rate
mode - the classifier for packet rate limiting
expire - specifies interval after which recored ip address /port will be
deleted

dst-port (integer[-integer]: 0..65535; Default: )

List of destination port numbers or port number ranges

fragment (yes|no; Default: )

Matches fragmented packets. First (starting) fragment does not count. If


connection tracking is enabled there will be no fragments as system
automatically assembles every packet

hotspot (auth | from-client | http | local-dst | to-client; Default:


)
icmp-options (integer:integer; Default: )

Matches ICMP type:code fileds

in-bridge-port (name; Default: )

Actual interface the packet has entered the router, if incoming interface is
bridge

in-interface (name; Default: )

Interface the packet has entered the router

ingress-priority (integer: 0..63; Default: )

Matches ingress priority of the packet. Priority may be derived from VLAN,
WMM or MPLS EXP bit. Read more>>

Manual:IP/Firewall/NAT

ipv4-options (any | loose-source-routing | no-record-route |


no-router-alert | no-source-routing | no-timestamp | none |
record-route | router-alert | strict-source-routing | timestamp;
Default: )

253
Matches IPv4 header options.

any - match packet with at least one of the ipv4 options


loose-source-routing - match packets with loose source routing
option. This option is used to route the internet datagram based on
information supplied by the source
no-record-route - match packets with no record route option. This
option is used to route the internet datagram based on information supplied
by the source
no-router-alert - match packets with no router alter option
no-source-routing - match packets with no source routing option
no-timestamp - match packets with no timestamp option
record-route - match packets with record route option
router-alert - match packets with router alter option
strict-source-routing - match packets with strict source routing
option
timestamp - match packets with timestamp

jump-target (name; Default: )

Name of the target chain to jump to. Applicable only if action=jump

layer7-protocol (name; Default: )

Layer7 filter name defined in layer7 protocol menu.

limit (integer,time,integer; Default: )

Matches packets if given pps limit is exceeded. Parameters are written in


following format: count,time,burst.

count - maximum average packet rate measured in packets per time


interval
time - specifies the time interval in which the packet rate is measured
burst - number of packets which are not counted by packet rate

log-prefix (string; Default: )

Adds specified text at the beginning of every log message. Applicable if


action=log

nth (integer,integer; Default: )

Matches every nth packet. Read more >>

out-bridge-port (name; Default: )

Actual interface the packet is leaving the router, if outgoing interface is bridge

out-interface (; Default: )

Interface the packet is leaving the router

packet-mark (no-mark | string; Default: )

Matches packets marked via mangle facility with particular packet mark. If
no-mark is set, rule will match any unmarked packet.

packet-size (integer[-integer]:0..65535; Default: )

Matches packets of specified size or size range in bytes.

per-connection-classifier
(ValuesToHash:Denominator/Remainder; Default: )

PCC matcher allows to divide traffic into equal streams with ability to keep
packets with specific set of options in one particular stream. Read more >>

port (integer[-integer]: 0..65535; Default: )

Matches if any (source or destination) port matches the specified list of ports or
port ranges. Applicable only if protocol is TCP or UDP

protocol (name or protocol ID; Default: tcp)

Matches particular IP protocol specified by protocol name or number

psd (integer,time,integer,integer; Default: )

Attempts to detect TCP and UDP scans. Parameters are in following format
WeightThreshold, DelayThreshold, LopPortWeight,
HighPortWeight

random (integer: 1..99; Default: )

WeightThreshold - total weight of the latest TCP/UDP packets with


different destination ports coming from the same host to be treated as port
scan sequence
DelayThreshold - delay for the packets with different destination ports
coming from the same host to be treated as possible port scan subsequence
LowPortWeight - weight of the packets with privileged (<=1024)
destination port
HighPortWeight - weight of the packet with non-priviliged destination
port

Matches packets randomly with given probability.

Manual:IP/Firewall/NAT

254

routing-mark (string; Default: )

Matches packets marked by mangle facility with particular routing mark

same-not-by-dst (yes | no; Default: )

Specifies whether to take into account or not destination IP address when


selecting a new source IP address. Applicable if action=same

src-address (Ip/Netmaks, Ip range; Default: )

Matches packets which source is equal to specified IP or falls into specified IP


range.

src-address-list (name; Default: )

Matches source address of a packet against user-defined address list

src-address-type (unicast | local | broadcast | multicast;


Default: )

Matches source address type:

src-port (integer[-integer]: 0..65535; Default: )

List of source ports and ranges of source ports. Applicable only if protocol is
TCP or UDP.

src-mac-address (MAC address; Default: )

Matches source MAC address of the packet

tcp-flags (ack | cwr | ece | fin | psh | rst | syn | urg; Default: )

Matches specified TCP flags

unicast - IP address used for point to point transmission


local - if address is assigned to one of router's interfaces
broadcast - packet is sent to all devices in subnet
multicast - packet is forwarded to defined group of devices

ack
cwr
ece
fin
psh
rst
syn
urg

- acknowledging data
- congestion window reduced
- ECN-echo flag (explicit congestion notification)
- close connection
- push function
- drop connection
- new connection
- urgent data

tcp-mss (integer: 0..65535; Default: )

Matches TCP MSS value of an IP packet

time (time-time,sat | fri | thu | wed | tue | mon | sun; Default: )

Allows to create filter based on the packets' arrival time and date or, for locally
generated packets, departure time and date

to-addresses (IP address[-IP address]; Default: 0.0.0.0)

Replace original address with specified one. Applicable if action is dst-nat,


netmap, same, src-nat

to-ports (integer[-integer]: 0..255; Default: )

Replace original port with specified one. Applicable if action is dst-nat,


redirect, netmap, same, src-nat

ttl (integer: 0..255; Default: )

Matches packets TTL value

/ip firewall nat print stats will show additional read-only properties
Property
bytes (integer)

Description
Total amount of bytes matched by the rule

packets (integer) Total amount of packets matched by the rule

By default print is equivalent to print static and shows only static rules.
[admin@dzeltenais_burkaans] /ip firewall mangle> print stats
Flags: X - disabled, I - invalid, D - dynamic
#
CHAIN
ACTION
BYTES
0
prerouting
mark-routing
17478158
1
prerouting
mark-routing
782505
To print also dynamic rules use print all.

PACKETS
127631
4506

[admin@dzeltenais_burkaans] /ip firewall mangle> print all stats


Flags: X - disabled, I - invalid, D - dynamic

Manual:IP/Firewall/NAT
#
0
1
2
3
4
5

D
D
D
D

255

CHAIN
prerouting
prerouting
forward
forward
forward
forward

ACTION
mark-routing
mark-routing
change-mss
change-mss
change-mss
change-mss

BYTES
17478158
782505
0
0
0
129372

PACKETS
127631
4506
0
0
0
2031

Or to print only dynamic rules use print dynamic


[admin@dzeltenais_burkaans] /ip firewall mangle> print stats dynamic
Flags: X - disabled, I - invalid, D - dynamic
#
CHAIN
ACTION
BYTES
PACKETS
0 D forward
change-mss
0
0
1 D forward
change-mss
0
0
2 D forward
change-mss
0
0
3 D forward
change-mss
132444
2079
Property
reset-counters (id)

Description
Reset statistics counters for specified firewall rules.

reset-counters-all () Reset statistics counters for all firewall rules.

Basic examples
If you want to "hide" the private LAN 192.168.0.0/24 "behind" one address 10.5.8.109 given to you by the ISP, you
should use the source network address translation (masquerading) feature of the MikroTik router. The masquerading
will change the source IP address and port of the packets originated from the network 192.168.0.0/24 to the address
10.5.8.109 of the router when the packet is routed through it.
To use masquerading, a source NAT rule with action 'masquerade' should be added to the firewall configuration:
/ip firewall nat add chain=srcnat action=masquerade out-interface=Public
All outgoing connections from the network 192.168.0.0/24 will have source address 10.5.8.109 of the router and
source port above 1024. No access from the Internet will be possible to the Local addresses. If you want to allow
connections to the server on the local network, you should use destination Network Address Translation (NAT).
If you want to link Public IP 10.5.8.200 address to Local one 192.168.0.109, you should use destination address
translation feature of the MikroTik router. Also if you want allow Local server to talk with outside with given Public
IP you should use source address translation, too.
Add Public IP to Public interface:
/ip address add address=10.5.8.200/32 interface=Public
Add rule allowing access to the internal server from external networks:
/ip firewall nat add chain=dstnat dst-address=10.5.8.200 action=dst-nat \
to-addresses=192.168.0.109
Add rule allowing the internal server to talk to the outer networks having its source address translated to 10.5.8.200:
/ip firewall nat add chain=srcnat src-address=192.168.0.109 action=src-nat \
to-addresses=10.5.8.200

Manual:IP/Firewall/NAT

256

If you want to link Public IP subnet 11.11.11.0/24 to local one 2.2.2.0/24, you should use destination address
translation and source address translation features with action=netmap.
/ip firewall nat add chain=dstnat dst-address=11.11.11.1-11.11.11.254 \
action=netmap to-addresses=2.2.2.1-2.2.2.254
/ip firewall nat add chain=srcnat src-address=2.2.2.1-2.2.2.254 \
action=netmap to-addresses=11.11.11.1-11.11.11.254
If you would like to direct requests for a certain port to an internal machine (sometimes called opening a port, port
mapping), you can do it like this:
/ip firewall nat add chain=dstnat dst-port=1234 action=dst-nat protocol=tcp to-address=192.168.1.1 to-port=1234

This rule translates to: when an incoming connection requests TCP port 1234, use the DST-NAT action and redirect
it to local address 192.168.1.1 and the port 1234
[ Top | Back to Content ]

Manual:IP/Firewall/Mangle
Applies to RouterOS: v3, v4

Summary
Sub-menu: /ip firewall mangle
Mangle is a kind of 'marker' that marks packets for future processing with special marks. Many other facilities in
RouterOS make use of these marks, e.g. queue trees, NAT, routing. They identify a packet based on its mark and
process it accordingly. The mangle marks exist only within the router, they are not transmitted across the network.
Additionally, the mangle facility is used to modify some fields in the IP header, like TOS (DSCP) and TTL fields.

Properties
Property
action (action name; Default: accept)

Description
Action to take if packet is matched by the rule:

Manual:IP/Firewall/Mangle

257

accept - accept the packet. Packet is not passed to next firewall rule.
add-dst-to-address-list - add destination address to Address list
specified by address-list parameter
add-src-to-address-list - add source address to Address list
specified by address-list parameter
change-dscp - change Differentiated Services Code Point (DSCP) field
value specified by the new-dscp parameter
change-mss - change Maximum Segment Size field value of the packet
to a value specified by the new-mss parameter
change-ttl - change Time to Live field value of the packet to a value
specified by the new-ttl parameter
jump - jump to the user defined chain specified by the value of
jump-target parameter
log - add a message to the system log containing following data:
in-interface, out-interface, src-mac, protocol, src-ip:port->dst-ip:port and
length of the packet. After packet is matched it is passed to next rule in the
list, similar as passthrough
mark-connection - place a mark specified by the
new-connection-mark parameter on the entire connection that matches the
rule
mark-packet - place a mark specified by the new-packet-mark
parameter on a packet that matches the rule
mark-routing - place a mark specified by the new-routing-mark
parameter on a packet. This kind of marks is used for policy routing
purposes only
passthrough - ignore this rule and go to next one (useful for statistics).
return - pass control back to the chain from where the jump took place
set-priority - set priority speciefied by the new-priority parameter on
the packets sent out through a link that is capable of transporting priority
(VLAN or WMM-enabled wireless interface). Read more>
strip-ipv4-options - strip IPv4 option fields from IP header.

address-list (string; Default: )

Name of the address list to be used. Applicable if action is


add-dst-to-address-list or add-src-to-address-list

address-list-timeout (time; Default: 00:00:00)

Time interval after which the address will be removed from the address list
specified by address-list parameter. Used in conjunction with
add-dst-to-address-list or add-src-to-address-list
actions
Value of 00:00:00 will leave the address in the address list forever

chain (name; Default: )

Specifies to which chain rule will be added. If the input does not match the
name of an already defined chain, a new chain will be created.

comment (string; Default: )

Descriptive comment for the rule.

connection-bytes (integer-integer; Default: )

Matches packets only if a given amount of bytes has been transfered through
the particular connection. 0 - means infinity, for example
connection-bytes=2000000-0 means that the rule matches if more
than 2MB has been transfered through the relevant connection

connection-limit (integer,netmaks; Default: )

Restrict connection limit per address or address block/td>

connection-mark (no-mark | string; Default: )

Matches packets marked via mangle facility with particular connection mark. If
no-mark is set, rule will match any unmarked connection.

connection-rate (Integer 0..4294967295; Default: )

Connection Rate is a firewall matcher that allow to capture traffic based on


present speed of the connection. Read more >>

Manual:IP/Firewall/Mangle

connection-state (estabilished | invalid | new | related;


Default: )

258
Interprets the connection tracking analysis data for a particular packet:

established - a packet which belongs to an existing connection


invalid - a packet which could not be identified for some reason
new - the packet has started a new connection, or otherwise associated with
a connection which has not seen packets in both directions
related - a packet which is related to, but not part of an existing
connection, such as ICMP errors or a packet which begins FTP data
connection

connection-type (ftp | h323 | irc | pptp | quake3 | sip | tftp;


Default: )

Matches packets from related connections based on information from their


connection tracking helpers. A relevant connection helper must be enabled
under /ip firewall service-port

content (string; Default: )

Match packets that contain specified text

dscp (integer: 0..63; Default: )

Matches DSCP IP header field.

dst-address (IP/netmask | IP range; Default: )

Matches packets which destination is equal to specified IP or falls into


specified IP range.

dst-address-list (name; Default: )

Matches destination address of a packet against user-defined address list

dst-address-type (unicast | local | broadcast | multicast;


Default: )

Matches destination address type:

dst-limit (integer,time,integer,dst-address | dst-port |


src-address, time; Default: )

Matches packets within given pps limit. As opposed to the limit matcher,
every destination IP address / destination port has it's own limit. Parameters are
written in following format: count,time,burst,mode,expire.

unicast - IP address used for point to point transmission


local - if dst-address is assigned to one of router's interfaces
broadcast - packet is sent to all devices in subnet
multicast - packet is forwarded to defined group of devices

count - maximum average packet rate measured in packets per time


interval
time - specifies the time interval in which the packet rate is measured
burst - number of packets which are not counted by packet rate
mode - the classifier for packet rate limiting
expire - specifies interval after which recored ip address /port will be
deleted

dst-port (integer[-integer]: 0..65535; Default: )

List of destination port numbers or port number ranges

fragment (yes|no; Default: )

Matches fragmented packets. First (starting) fragment does not count. If


connection tracking is enabled there will be no fragments as system
automatically assembles every packet

hotspot (auth | from-client | http | local-dst | to-client; Default:


)
icmp-options (integer:integer; Default: )

Matches ICMP type:code fileds

in-bridge-port (name; Default: )

Actual interface the packet has entered the router, if incoming interface is
bridge

in-interface (name; Default: )

Interface the packet has entered the router

ingress-priority (integer: 0..63; Default: )

Matches ingress priority of the packet. Priority may be derived from VLAN,
WMM or MPLS EXP bit. Read more >>

Manual:IP/Firewall/Mangle

ipv4-options (any | loose-source-routing | no-record-route |


no-router-alert | no-source-routing | no-timestamp | none |
record-route | router-alert | strict-source-routing | timestamp;
Default: )

259
Matches IPv4 header options.

any - match packet with at least one of the ipv4 options


loose-source-routing - match packets with loose source routing
option. This option is used to route the internet datagram based on
information supplied by the source
no-record-route - match packets with no record route option. This
option is used to route the internet datagram based on information supplied
by the source
no-router-alert - match packets with no router alter option
no-source-routing - match packets with no source routing option
no-timestamp - match packets with no timestamp option
record-route - match packets with record route option
router-alert - match packets with router alter option
strict-source-routing - match packets with strict source routing
option
timestamp - match packets with timestamp

jump-target (name; Default: )

Name of the target chain to jump to. Applicable only if action=jump

layer7-protocol (name; Default: )

Layer7 filter name defined in layer7 protocol menu.

limit (integer,time,integer; Default: )

Matches packets if given pps limit is exceeded. Parameters are written in


following format: count,time,burst.

log-prefix (string; Default: )

count - maximum average packet rate measured in packets per time


interval
time - specifies the time interval in which the packet rate is measured
burst - number of packets which are not counted by packet rate

Adds specified text at the beginning of every log message. Applicable if


action=log

new-connection-mark (string; Default: )


new-dscp (integer: 0..63; Default: )
new-mss (integer; Default: )
new-packet-mark (string; Default: )
new-priority (integer; Default: )
new-routing-mark (string; Default: )
new-ttl (decrement | increment | set:integer; Default: )
nth (integer,integer; Default: )

Matches every nth packet. Read more >>

out-bridge-port (name; Default: )

Actual interface the packet is leaving the router, if outgoing interface is bridge

out-interface (; Default: )

Interface the packet is leaving the router

p2p (all-p2p | bit-torrent | blubster | direct-connect | edonkey |


fasttrack | gnutella | soulseek | warez | winmx; Default: )

Matches packets from various peer-to-peer (P2P) protocols. Does not work on
encrypted p2p packets.

packet-mark (no-mark | string; Default: )

Matches packets marked via mangle facility with particular packet mark. If
no-mark is set, rule will match any unmarked packet.

packet-size (integer[-integer]:0..65535; Default: )

Matches packets of specified size or size range in bytes.

per-connection-classifier
(ValuesToHash:Denominator/Remainder; Default: )

PCC matcher allows to divide traffic into equal streams with ability to keep
packets with specific set of options in one particular stream. Read more >>

port (integer[-integer]: 0..65535; Default: )

Matches if any (source or destination) port matches the specified list of ports or
port ranges. Applicable only if protocol is TCP or UDP

protocol (name or protocol ID; Default: tcp)

Matches particular IP protocol specified by protocol name or number

Manual:IP/Firewall/Mangle

psd (integer,time,integer,integer; Default: )

260
Attempts to detect TCP and UDP scans. Parameters are in following format
WeightThreshold, DelayThreshold, LopPortWeight,
HighPortWeight

WeightThreshold - total weight of the latest TCP/UDP packets with


different destination ports coming from the same host to be treated as port
scan sequence
DelayThreshold - delay for the packets with different destination ports
coming from the same host to be treated as possible port scan subsequence
LowPortWeight - weight of the packets with privileged (<=1024)
destination port
HighPortWeight - weight of the packet with non-priviliged destination
port

random (integer: 1..99; Default: )

Matches packets randomly with given probability.

routing-mark (string; Default: )

Matches packets marked by mangle facility with particular routing mark

src-address (Ip/Netmaks, Ip range; Default: )

Matches packets which source is equal to specified IP or falls into specified IP


range.

src-address-list (name; Default: )

Matches source address of a packet against user-defined address list

src-address-type (unicast | local | broadcast | multicast;


Default: )

Matches source address type:

src-port (integer[-integer]: 0..65535; Default: )

List of source ports and ranges of source ports. Applicable only if protocol is
TCP or UDP.

src-mac-address (MAC address; Default: )

Matches source MAC address of the packet

tcp-flags (ack | cwr | ece | fin | psh | rst | syn | urg; Default: )

Matches specified TCP flags

unicast - IP address used for point to point transmission


local - if address is assigned to one of router's interfaces
broadcast - packet is sent to all devices in subnet
multicast - packet is forwarded to defined group of devices

ack
cwr
ece
fin
psh
rst
syn
urg

- acknowledging data
- congestion window reduced
- ECN-echo flag (explicit congestion notification)
- close connection
- push function
- drop connection
- new connection
- urgent data

tcp-mss (integer: 0..65535; Default: )

Matches TCP MSS value of an IP packet

time (time-time,sat | fri | thu | wed | tue | mon | sun; Default: )

Allows to create filter based on the packets' arrival time and date or, for locally
generated packets, departure time and date

ttl (equal | greater-than | less-than | not-equal : integer(0..255); Matches packets TTL value.
Default: )

Stats
/ip firewall filter print stats will show additional read-only properties

Manual:IP/Firewall/Mangle

261

Property
bytes (integer)

Description
Total amount of bytes matched by the rule

packets (integer) Total amount of packets matched by the rule

By default print is equivalent to print static and shows only static rules.
[admin@dzeltenais_burkaans] /ip firewall mangle> print stats
Flags: X - disabled, I - invalid, D - dynamic
#
CHAIN
ACTION
BYTES
0
prerouting
mark-routing
17478158
1
prerouting
mark-routing
782505

PACKETS
127631
4506

To print also dynamic rules use print all.


[admin@dzeltenais_burkaans] /ip firewall mangle> print all stats
Flags: X - disabled, I - invalid, D - dynamic
#
CHAIN
ACTION
BYTES
PACKETS
0
prerouting
mark-routing
17478158
127631
1
prerouting
mark-routing
782505
4506
2 D forward
change-mss
0
0
3 D forward
change-mss
0
0
4 D forward
change-mss
0
0
5 D forward
change-mss
129372
2031
Or to print only dynamic rules use print dynamic
[admin@dzeltenais_burkaans] /ip firewall mangle> print stats dynamic
Flags: X - disabled, I - invalid, D - dynamic
#
CHAIN
ACTION
BYTES
PACKETS
0 D forward
change-mss
0
0
1 D forward
change-mss
0
0
2 D forward
change-mss
0
0
3 D forward
change-mss
132444
2079

Menu specific commands


Property
reset-counters (id)

Description
Reset statistics counters for specified firewall rules.

reset-counters-all () Reset statistics counters for all firewall rules.

Basic examples
It is a well known fact that VPN links have smaller packet size due to incapsulation overhead. A large packet with
MSS that exceeds the MSS of the VPN link should be fragmented prior to sending it via that kind of connection.
However, if the packet has DF flag set, it cannot be fragmented and should be discarded. On links that have broken
path MTU discovery (PMTUD) it may lead to a number of problems, including problems with FTP and HTTP data
transfer and e-mail services.

Manual:IP/Firewall/Mangle

262

In case of link with broken PMTUD, a decrease of the MSS of the packets coming through the VPN link solves the
problem. The following example demonstrates how to decrease the MSS value via mangle:
/ip firewall mangle
add out-interface=pppoe-out protocol=tcp tcp-flags=syn action=change-mss new-mss=1300 chain=forward

Marking each packet is quite resource expensive especially if rule has to match against many parameters from IP
header or address list containing hundreds of entries.
Lets say we want to
mark all tcp packets except tcp/80 and match these packets against first address list
mark all udp packets and match them against second address list.
/ip firewall mangle
add chain=forward protocol=tcp port=!80 dst-address-list=first action=mark-packet new-packet-mark=first
add chain=forward protocol=udp dst-address-list=second action=mark-packet new-packet-mark=second

Setup looks quite simple and probably will work without problems in small networks. Now multiply count of rules
by 10, add few hundred entries in address list, run 100Mbit of traffic over this router and you will see how rapidly
CPU usage is increasing. The reason for such behavior is that each rule reads IP header of every packet and tries to
match collected data against parameters specified in firewall rule.
Fortunately if connection tracking is enabled, we can use connection marks to optimize our setup.
/ip firewall mangle
add chain=forward protocol=tcp port=!80 dst-address-list=first connection-state=new action=mark-connection \
new-connection-mark=first
add chain=forward connection-mark=first action=mark-packet new-packet-mark=first passthrough=no

add chain=forward protocol=udp dst-address-list=second connection-state=new action=mark-connection \


new-connection-mark=second
add chain=forward connection-mark=second action=mark-packet new-packet-mark=second passthrough=no

Now first rule will try to match data from IP header only from first packet of new connection and add connection
mark. Next rule will no longer check IP header for each packet, it will just compare connection marks resulting in
lower CPU consumption. Additionally passthrough=no was added that helps to reduce CPU consumption even
more.
[ Top | Back to Content ]

Manual:IP/Firewall/Address list

263

Manual:IP/Firewall/Address list
Applies to RouterOS: 2.9, v3, v4 +

Summary
Sub-menu: /ip firewall address-list
Firewall address lists allow user to create lists of IP addresses grouped together. Firewall filter, mangle and NAT
facilities can use address lists to match packets against them.
The address list records could be updated dynamically via the action=add-src-to-address-list or
action=add-dst-to-address-list items found in NAT, mangle and filter facilities.

Properties
Property

Description

address (IP address/netmask | IP-IP; Default: ) IP address or range to add to address list
list (string; Default: )

Name of the address list where to add IP address

Example
The following example creates an address list of people thet are connecting to port 23 (telnet) on the router and drops
all further traffic from them. Additionaly, the address list will contain one static entry of address=192.0.34.166/32
(www.example.com):
[admin@MikroTik] > /ip firewall address-list add list=drop_traffic address=192.0.34.166/32
[admin@MikroTik] > /ip firewall address-list print
Flags: X - disabled, D - dynamic
#

LIST

ADDRESS

drop_traffic 192.0.34.166

[admin@MikroTik] > /ip firewall mangle add chain=prerouting protocol=tcp dst-port=23 \


\... action=add-src-to-address-list address-list=drop_traffic
[admin@MikroTik] > /ip firewall filter add action=drop chain=input src-address-list=drop_traffic
[admin@MikroTik] > /ip firewall address-list print
Flags: X - disabled, D - dynamic
#

LIST

drop_traffic 192.0.34.166

ADDRESS

1 D drop_traffic 1.1.1.1
2 D drop_traffic 10.5.11.8
[admin@MikroTik] >

As seen in the output of the last print command, two new dynamic entries appeared in the address list. Hosts with
these IP addresses tried to initialize a telnet session to the router.
[ Top | Back to Content ]

Manual:IP/Firewall/Connection tracking

264

Manual:IP/Firewall/Connection tracking
Connection tracking entries
Sub-menu: /ip firewall connection
There are several ways to see what connections are making their way though the router.
In the Winbox Firewall window, you can switch to the Connections tab, to see current connections to/from/through
your router. It looks like this:

Properties
All properties in connection list are read-only
Property

Description

seen reply (yes | no)


assured (yes | no)

"assured" flag indicates that this connection is assured and that it will not be erased if maximum possible
tracked connection count is reached.

connection-mark (string)

connection mark set by mangle rule.

connection-type (pptp | ftp |


p2p)

Type of connection, property is empty if connection tracking is unable to determine predefined connection
type.

dst-address (ip[:port])

Destination address and port (if protocol is port based).

gre-key (integer)
gre-version (string)
icmp-code (string)
icmp-id (string)

Manual:IP/Firewall/Connection tracking

265

icmp-type (string)
p2p (yes | no)

Shows if connection is identified as p2p by firewall p2p matcher.

protocol (string)

IP protocol type

reply-dst-address
(ip[:port])

Destination address (and port) expected of return packets. Usually the same as "src-address:port"

reply-src-address
(ip[:port])

Source address (and port) expected of return packets. Usually the same as "dst-address:port"

src-address (ip[:port])

Source address and port (if protocol is port based).

tcp-state (string)

Current state of TCP connection :

timeout (time)

"established"
"time-wait"
"close"
"syn-sent"
"syn-received"

Time after connection will be removed from connection list.

Connection tracking settings


Sub-menu: /ip firewall connection tracking

Properties
Property

Description

enabled (yes | no; Default: yes)

Allows to disable or enable connection tracking. Disabling connection tracking will cause several
firewall features to stop working. See the list of affected features.

tcp-syn-sent-timeout (time; Default:


5s)

TCP SYN timeout.

tcp-syn-received-timeout (time;
Default: 5s)

TCP SYN timeout.

tcp-established-timeout (time;
Default: 1d)

Time when established TCP connection times out.

tcp-fin-wait-timeout (time; Default:


10s)
tcp-close-wait-timeout (time;
Default: 10s)
tcp-last-ack-timeout (time; Default:
10s)
tcp-time-wait-timeout (time; Default:
10s)
tcp-close-timeout (time; Default: 10s)
udp-timeout (time; Default: 10s)
udp-stream-timeout (time; Default:
3m)
icmp-timeout (time; Default: 10s)
generic-timeout (time; Default: 10m)
tcp-syncookie (yes | no; Default: no)

Timeout for all other connection entries

Manual:IP/Firewall/Connection tracking

266

Read-only properties
Property
max-entries (integer)

Description
Max amount of entries that connection tracking table can hold. This value depends on installed amount of RAM.

total-entries (integer) Amount of connections that currently connection table holds.

Features affected by connection tracking


NAT
firewall:
connection-bytes
connection-mark
connection-type
connection-state
connection-limit
connection-rate
layer7-protocol
p2p
new-connection-mark
tarpit
p2p matching in simple queues

Manual:BGP Case Studies


A good place to start learning about BGP in MikroTik RouterOS.

What is BGP?
The Border Getaway Protocol (BGP) is an inter-autonomous system routing protocol based on distance-vector
algorithm. It is used to exchange routing information across the Internet and is the only protocol that is designed to
deal with a network of the Internet's size and the only protocol that can deal well with having multiple connections to
unrelated routing domains.
BGP is designed to allow for sophisticated administrative routing policies to be implemented. BGP does not
exchange information about network topology but rather reachability information. As such, BGP is better suited to
inter-AS environments and special cases like informational feeds. If you just need to enable dynamic routing in your
network, consider OSPF instead.

Manual:BGP Case Studies

How Does BGP Work?


BGP operates by exchanging network layer reachability information (NLRI). This information contains an indication
to a what sequence of full paths (BGP AS numbers) the route should take in order to reach destination network
(NLRI prefix).
BGP routers exchange reachability information by means of a transport protocol, which in case of BGP is TCP (port
179). Upon forming a TCP connection these routers exchange initial messages to negotiate and confirm connection
parameters.
Any two routers that have established TCP connection to exchange BGP routing information are called peers, or
neighbors. The peers initially exchange their full routing tables. After the initial exchange incremental updates are
sent as the routing tables change. Thus, BGP does not require periodic refresh of the entire BGP routing table. BGP
maintains routing table version number which must be the same between any two given peers for the duration of the
connection. KeepAlive messages are sent periodically to ensure that the connection is up and running. BGP sends
notification messages in response to errors or special conditions.
TCP protocol connection between two peers is closed when either an error has occured or no update messages or
KeepAlive messages has been received during the period of BGP Hold Timer.

iBGP and eBGP


A particular AS might have multiple BGP speakers and provide transit service to other ASs. This implies that BGP
speakers must maintain a consistent view of routing within the AS. A consistent view of the interior routes of the AS
is provided by the interior routing protocol such as OSPF or RIP. A consistent view of the routes exterior to the AS
is provided by having all BGP routers within the AS establishing direct BGP connections with each other.
Using a set of administrative policies BGP speakers within the AS arrive to an agreement as to which entry/exit point
to use for a particular destination. This information is communicated to the interior routers of the AS using interior
routing protocol.
Two BGP neighbors from different ASs are said to maintain an "external" link. Similarly, a BGP peer in a different
AS is referred to as an external peer. BGP connections between peers within the same AS are known as "internal"
links. BGP speakers that are connected by internal link are referred as internal peers. As far as this paper is
concerned, iBGP refers to the BGP session between two peers in the same AS, or internal link. In turn, eBGP refers
to
the
links
between
external
BGP
peers
(these
that
are
in
different
ASs).

267

Manual:BGP Case Studies

Enabling BGP
To enable BGP assuming only one BGP process will be present in the system, it is enough to do the following:
modify configuration of the default BGP instance. In particular, change instance AS number to the desired ASN:
[admin@rb11] > /routing bgp instance set default as=100 redistribute-static=no
[admin@rb11] > /routing bgp instance print Flags: X - disabled
0
as=100 router-id=0.0.0.0 redistribute-static=no redistribute-connected=no
redistribute-rip=no redistribute-ospf=no redistribute-other-bgp=no
name="default" out-filter=""
[admin@rb11] >
Note, that, unless explicitly specified, BGP router ID is set as the least IP address on the router.
add at least one BGP peer. Refer to the next section for more information on how to configure BGP peers.

BGP Peers
Two BGP routers have to establish TCP connection between each other to be considered as BGP peers. Since BGP
requires a reliable transport for routing information, a TCP connection is essential for it to operate properly.
Once TCP connection is up, routers exchange some initial information such as the BGP router ID, the BGP version,
the AS number and the Hold Time interval value in the OPEN message. After these values are communicated and
agreed upon, the BGP session is established and the routers are ready to exchange routing information via BGP
UPDATE messages.
To establish TCP connection to another BGP router, issue the following command:
[eugene@SM_BGP] > /routing bgp peer add remote-address=10.20.1.210 remote-as=65534
[eugene@SM_BGP] > /routing bgp peer print
Flags: X - disabled
0

instance=default remote-address=10.20.1.210 remote-as=65534 tcp-md5-key=""


multihop=no route-reflect=no hold-time=3m ttl=3 in-filter=""
out-filter=""

[eugene@SM_BGP] >

Issue the following command to verify the connection is established:


[eugene@SM_BGP] > /routing bgp peer print status
Flags: X - disabled
0
instance=default remote-address=10.20.1.210 remote-as=65534 tcp-md5-key=""
multihop=no route-reflect=no hold-time=3m ttl=3 in-filter=""
out-filter="" remote-id=10.20.1.210 uptime=1d1h43m16s
prefix-count=180000 remote-hold-time=3m used-hold-time=3m
used-keepalive-time=1m refresh-capability=yes state=established
[eugene@SM_BGP] >
The BGP connection between two peers is up (state=established) with used value of Hold Time of 3 minutes. The
prefix-count parameter indicates the total number of prefixes received from this particular peer. In case a peer later
withdraws some prefixes from its routing announcements, the total number of prefixes is reduced by the appropriate
value.

268

Manual:BGP Case Studies

Route Redistribution
BGP process does not redistribute routes by default. You need to set one or more of the redistribute-connected,
redistribute-static, redistribute-rip, redistribute-ospf and redistribute-other-bgp BGP instance parameters to
yes to enable redistribution of the routes of the particular type. Thus issuing the /routing bgp instance set default
redistribute-static=yes redistribute-connected=yes command enables redistribution of static and connected routes to
all BGP peers that are configured to use default BGP instance. This might not be the desired behavior, since now you
are announcing all of your internal routes into BGP. Moreover, some of the advertised prefixes might be too small
and should be substituted with larger ones. You need to configure routing filters and route aggregation to avoid these
problems.

Routing Filters
Unfiltered redistribution of routes might lead to undesired results. Consider the example below. R3 has a static route
to the 192.168.0.0/24 network and since it has redistribute-static set to yes it announces the route to its BGP peer R1.
This makes R1 believe that the AS300 is the source of the 192.168.0.0/24 network, which is misleading. To avoid
this problem a routing filter that permits redistribution only of the 192.168.11.0/24 network must be applied on the
R3.

To enable the router R3 to advertise static networks to its peers:


/routing bgp instance set default redistribute-static=yes
To filter out all prefixes except the 192.168.11.0/24 network:
/routing filter add chain=to_R1 prefix=192.168.11.0/24 invert-match=yes action=discard
/routing bgp peer set R1 out-filter=to_R1

Note the invert-match parameter. It makes the rule to match everything except the 192.168.11.0/24 prefix and
discard it.
Routing filters are accessible through /routing filter menu. A routing filter consists of one or more filter rules
identified by common chain. Rules are processed from top to bottom. Each rule consists of condition(s) to be
satisfied in order for rule to match and action(s) to be performed on the matched prefixes. To enable routing filter,
specify corresponding chain name as either in-filter or out-filter for BGP peer, or as out-filter for BGP instance.

269

Manual:BGP Case Studies

270

Routing Filter Example


[eugene@SM_BGP] routing filter> print chain=Latnet-in
Flags: X - disabled
0

chain=Latnet-in prefix=10.0.0.0/8 prefix-length=8-32 invert-match=no action=discard

chain=Latnet-in prefix=192.168.0.0/16 invert-match=no action=discard

chain=Latnet-in prefix=169.254.0.0/16 invert-match=no action=discard

chain=Latnet-in prefix=4.23.113.0/24 invert-match=no action=passthrough


set-bgp-communities=64550:14

chain=Latnet-in prefix=4.36.116.0/23 invert-match=no action=passthrough set-routing-mark="LAN"


set-route-comment="Remote offices"

chain=Latnet-in prefix=8.8.0.0/16 prefix-length=16-32 bgp-communities=2588:800 invert-match=no


action=discard

[eugene@SM_BGP] routing filter>

rule #0 matches prefix 10.0.0.0/8 and more specific prefixes like 10.0.1.0/24, 10.1.23.0/28, etc. and discards them
(these prefixes are silently dropped from inbound update messages and do not appear in memory)
rule #3 sets BGP COMMUNITY attribute for prefix 4.23.113.0/24
rule #4 has two actions. It simultaneously sets routing mark and comment for route to 4.36.116.0/23
rule #5 discards prefix 8.8.0.0/16 and more specific ones, if they have COMMUNITY attribute of 2588:800
To use the filter above, add it as in-filter to the Latnet peer:
[eugene@SM_BGP] routing bgp peer> set Latnet in-filter=Latnet-in
[eugene@SM_BGP] routing filter> print
Flags: X - disabled
0

name="C7200" instance=latnet remote-address=10.0.11.202 remote-as=64527 tcp-md5-key=""


nexthop-choice=default multihop=no route-reflect=no hold-time=3m ttl=1 in-filter=""
out-filter=to_C7200

name="Latnet" instance=latnet remote-address=10.0.11.55 remote-as=2588 tcp-md5-key=""


nexthop-choice=default multihop=yes route-reflect=no hold-time=3m ttl=5 in-filter="Latnet-in"
out-filter=to_Latnet

name="gated" instance=latnet remote-address=10.0.11.20 remote-as=64550 tcp-md5-key=""


nexthop-choice=default multihop=no route-reflect=no hold-time=3m ttl=1 in-filter=""
out-filter=""

[eugene@SM_BGP] routing bgp peer>

Manual:BGP Case Studies

271

BGP Networks
The information in this article may be deprecated, and is described better elsewhere in the Wiki.

BGP allows to specify some arbitrary prefixes to be unconditionally advertised. These prefixes
should be added to the /routing bgp networks list. The prefixes in this list are advertised as IGP
routes. The redistribution of the BGP networks is affected by peer's routing filters. On the other
hand, BGP networks are not installed in main routing table. As a consequence, they are not
considered in best path selection algorithm, and do not affect aggregate processing.
Issue the following command to make the router advertise the 192.168.0.0/24 network to its peers:
[eugene@SM_BGP] > /routing bgp network add network=192.168.0.0/24
[eugene@SM_BGP] > /routing bgp network print
Flags: X - disabled
#
NETWORK
0
192.168.0.0/24
[eugene@SM_BGP] >
Note: consider aggregates as an alternative to BGP networks.

Static Routes
You could always use a static route to originate a subnet. With the routing-test package bringing many bgp-related
enhancements into the /ip route menu, the static routes become a more powerful tool to originate prefixes. For
example, you could add a static route to the 10.8.0.0/16 network and set BGP Local Preference attribute value for
this route simultaneously:
/ip route add dst-address=10.8.0.0/16 gateway=10.0.11.1 bgp-local-pref=110
[admin@MikroTik] > /ip ro print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf
#
DST-ADDRESS
PREF-SRC
G GATEWAY
DISTANCE INTERFACE
0 A S 0.0.0.0/0
r 10.0.11.1
1
ether1
1 ADC 10.0.11.0/24
10.0.11.51
0
ether1
2 A S 10.8.0.0/16
r 10.0.11.1
1
ether1
3 ADC 10.12.0.0/24
10.12.0.2
0
bonding1
[admin@MikroTik] >

BGP Advertisements
RouterOS provides a way to view what prefixes the router is redistributing to its peers. Issue /routing bgp
advertisements print <peer's address> command to view prefixes sent to this peer.
[eugene@SM_BGP] routing bgp advertisements> print 10.0.11.20
# DST-ADDRESS

NEXTHOP

AS-PATH

ORIGIN

LOCAL-PREF MED

0 3.0.0.0/8

159.148.254.250 2588,6747,1299,701,703,80

1 4.0.0.0/8

10.0.11.155

igp

100

2588,6747{174,1273,1299,2914... igp

100

2 6.0.0.0/8

10.0.11.155

2588,6747,1299,701,668

igp

100

3 8.0.0.0/8

159.148.254.250 2588,6747,1299,3356

igp

100

4 8.0.0.0/9

159.148.254.250 2588,6747,1299,3356

igp

100

5 8.2.64.0/23

159.148.254.250 2588,6747,1299,3356,16803

igp

100

Manual:BGP Case Studies

272

6 8.2.144.0/22

159.148.254.250 2588,6747,1299,3356,36394

igp

100

7 8.3.12.0/24

159.148.254.250 2588,6747,1299,3356,14711

igp

100

8 8.3.13.0/24

159.148.254.250 2588,6747,1299,3356,26769

igp

100

9 8.3.15.0/24

159.148.254.250 2588,6747,1299,3356,14711

igp

100

10 8.3.17.0/24

159.148.254.250 2588,6747,1299,25973

igp

100

11 8.3.19.0/24

159.148.254.250 2588,6747,1273,22822,26769

igp

100

12 8.3.37.0/24

159.148.254.250 2588,6747,1299,3356,3356,21640

igp

100

13 8.3.38.0/23

159.148.254.250 2588,6747,1299,3549,16420

igp

100

14 8.3.46.0/24

159.148.254.250 2588,6747,1299,3356,3356,21640

igp

100

15 8.3.208.0/24

159.148.254.250 2588,6747,1299,3549,36431

igp

100

16 8.3.209.0/24

159.148.254.250 2588,6747,1273,22822,26769

igp

100

17 8.3.210.0/24

159.148.254.250 2588,6747,1299,27524

igp

100

18 8.3.216.0/24

159.148.254.250 2588,6747,1299,3356,15170

igp

100

19 8.4.86.0/24

159.148.254.250 2588,6747,1299,3356,14627

igp

100

20 8.4.96.0/20

159.148.254.250 2588,6747,1299,3356,15162

igp

100

21 8.4.113.0/24

159.148.254.250 2588,6747,1299,3356,15162

igp

100

22 8.4.224.0/24

159.148.254.250 2588,6747,1299,3356,13546

igp

100

23 8.5.192.0/22

159.148.254.250 2588,6747,1299,209,13989

igp

100

24 8.6.48.0/21

159.148.254.250 2588,6747,1299,3356,36492

igp

100

25 8.6.89.0/24

159.148.254.250 2588,6747,1299,3356,11734

igp

100

26 8.6.90.0/24

159.148.254.250 2588,6747,1299,3356,16541

igp

100

27 8.6.220.0/22

159.148.254.250 2588,6747,1299,3356,13680

igp

100

[eugene@SM_BGP] routing bgp advertisements>

BGP Aggregates
This feature allows to redistribute one big prefix instead of many smaller ones.
[eugene@SM_BGP] routing bgp aggregate> print
Flags: X - disabled
0

prefix=3.0.0.0/8 summary-only=yes inherit-attributes=yes attribute-filter="" suppress-filter=""


advertise-filter=""

prefix=6.0.0.0/8 summary-only=yes inherit-attributes=yes attribute-filter="" suppress-filter=""


advertise-filter=""

prefix=4.0.0.0/8 summary-only=yes inherit-attributes=yes attribute-filter="" suppress-filter=""


advertise-filter=""

[eugene@SM_BGP] routing bgp aggregate>

The rules above suppress specific prefixes in ranges 3.0.0.0/8, 6.0.0.0/8 and 4.0.0.0/8 from being advertised:
[eugene@SM_BGP] routing bgp advertisements> print 10.0.11.20
# DST-ADDRESS

NEXTHOP

AS-PATH

ORIGIN

LOCAL-PREF MED

0 3.0.0.0/8

159.148.254.250 2588,6747,1299,701,703,80

1 4.0.0.0/8

10.0.11.155

igp

100

2588,6747{174,1273,1299,2914... igp

100

2 6.0.0.0/8

10.0.11.155

2588,6747,1299,701,668

igp

100

3 8.0.0.0/8

159.148.254.250 2588,6747,1299,3356

igp

100

Manual:BGP Case Studies

273

4 8.0.0.0/9

159.148.254.250 2588,6747,1299,3356

igp

100

5 8.2.64.0/23

159.148.254.250 2588,6747,1299,3356,16803

igp

100

Manual:HTB
Applies to RouterOS: 2.9, v3, v4

Theory
Structure
HTB (Hierarchical Token Bucket) is a classful queuing method that is useful for handling different kind of traffic.
We have to follow three basic steps to create HTB:
Match and mark traffic classify traffic for further use. Consists of one or more matching parameters to select
packets for the specific class.
Create rules (policy) to mark traffic put specific traffic class into specific queue and to define the actions that
are taken for each class.
Attach policy for specific interface(-s) append policy for all interfaces (global-in, global-out or global-total),
for specific interface or for specific parent queue.
HTB allows to create a hierarchical queue structure and determine relations between queues, like "parent-child" or
"child-child".
As soon as queue has at least one child it becomes a inner queue, all queues without children - leaf queues. Leaf
queues make actual traffic consumption, Inner queues are responsible only for traffic distribution. All leaf queues
are treated on equal basis.
In RouterOS it is necessary to specify parent option to assign queue as a child to other queue

Dual Limitation
Each queue in HTB has two rate limits:
CIR (Committed Information Rate) (limit-at in RouterOS) worst case scenario, flow will get this amount of
traffic no matter what (assuming we can actually send so much data)
MIR (Maximal Information Rate) (max-limit in RouterOS) best case scenario, rate that flow can get up to, if
there queue's parent has spare bandwidth
In other words, at first limit-at (CIR) of the all queues will be satisfied, only then child queues will try to borrow the
necessary data rate from their parents in order to reach their max-limit (MIR).
Note: CIR will be assigned to the corresponding queue no matter what. (even if max-limit of the parent is exceeded)
That is why, to ensure optimal (as designed) usage of dual limitation feature, we suggest to stick to these rules:
Sum of committed rates of all children must be less or equal to amount of traffic that is available to parent.
CIR(parent)* CIR(child1) +...+ CIR(childN)
*in case if parent is main parent CIR(parent)=MIR(parent)
Maximal rate of any child must be less or equal to maximal rate of the parent

Manual:HTB

274
MIR (parent) MIR(child1) & MIR (parent) MIR(child2) & ... & MIR (parent) MIR(childN)

Queue colors in Winbox:


0% - 50% available traffic used - green
51% - 75% available traffic used - yellow
76% - 100% available traffic used - red

Priority
We already know that limit-at (CIR) to all queues will be given out no matter what.
Priority is responsible for distribution of remaining parent queues traffic to child queues so that they are able to reach
max-limit
Queue with higher priority will reach its max-limit before the queue with lower priority. 8 is the lowest priority, 1 is
the highest.
Make a note that priority only works:
for leaf queues - priority in inner queue have no meaning.
if max-limit is specified (not 0)

Examples
In this section we will analyze HTB in action. To do that we will take one HTB structure and will try to cover all the
possible situations and features, by changing the amount of incoming traffic that HTB have to recycle. and changing
some options.

Structure
Our HTB structure will consist of 5 queues:

Queue01 inner queue with two children - Queue02 and Queue03


Queue02 inner queue with two children - Queue04 and Queue05
Queue03 leaf queue
Queue04 leaf queue
Queue05 leaf queue

Queue03, Queue04 and Queue05 are clients who require 10Mbps all the time Outgoing interface is able to handle
10Mbps of traffic.

Manual:HTB

Example 1 : Usual case

Queue01 limit-at=0Mbps max-limit=10Mbps


Queue02 limit-at=4Mbps max-limit=10Mbps
Queue03 limit-at=6Mbps max-limit=10Mbps priority=1
Queue04 limit-at=2Mbps max-limit=10Mbps priority=3
Queue05 limit-at=2Mbps max-limit=10Mbps priority=5

Result of Example 1
Queue03 will receive 6Mbps
Queue04 will receive 2Mbps
Queue05 will receive 2Mbps
Clarification: HTB was build in a way, that, by satisfying all limit-ats, main queue no longer have throughput to
distribute

275

Manual:HTB

Example 2 : Usual case with max-limit

Queue01 limit-at=0Mbps max-limit=10Mbps


Queue02 limit-at=4Mbps max-limit=10Mbps
Queue03 limit-at=2Mbps max-limit=10Mbps priority=3
Queue04 limit-at=2Mbps max-limit=10Mbps priority=1
Queue05 limit-at=2Mbps max-limit=10Mbps priority=5

276

Manual:HTB

Result of Example 2

Queue03 will receive 2Mbps


Queue04 will receive 6Mbps
Queue05 will receive 2Mbps
Clarification: After satisfying all limit-ats HTB will give throughput to queue with highest priority.

Example 3 : Inner queue limit-at

Queue01 limit-at=0Mbps max-limit=10Mbps


Queue02 limit-at=8Mbps max-limit=10Mbps
Queue03 limit-at=2Mbps max-limit=10Mbps priority=1
Queue04 limit-at=2Mbps max-limit=10Mbps priority=3
Queue05 limit-at=2Mbps max-limit=10Mbps priority=5

Result of Example 3

Queue03 will receive 2Mbps


Queue04 will receive 6Mbps
Queue05 will receive 2Mbps
Clarification: After satisfying all limit-ats HTB will give throughput to queue with highest priority. But in this
case inner queue Queue02 had limit-at specified, by doing so, it reserved 8Mbps of throughput for queues
Queue04 and Queue05. From these two Queue04 have highest priority, that is why it gets additional throughput.

277

Manual:HTB

Example 4 : Leaf queue limit-at

Queue01 limit-at=0Mbps max-limit=10Mbps


Queue02 limit-at=4Mbps max-limit=10Mbps
Queue03 limit-at=6Mbps max-limit=10Mbps priority=1
Queue04 limit-at=2Mbps max-limit=10Mbps priority=3
Queue05 limit-at=12Mbps max-limit=15Mbps priority=5

Result of Example 4
Queue03 will receive ~3Mbps
Queue04 will receive ~1Mbps
Queue05 will receive ~6Mbps
Clarification: Only by satisfying all limit-ats HTB was forced to allocate 20Mbps - 6Mbps to Queue03, 2Mbps
to Queue04, 12Mbps to Queue05, but our output interface is able to handle 10Mbps. As output interface queue is
usually FIFO throughput allocation will keep ratio 6:2:12 or 3:1:6

278

Manual:HTB

HTB configuration example


Assume that we want to limit maximum download speed for subnet 10.1.1.0/24 to 2Mbps and distribute this amount
of traffic between the server and workstations using HTB (limit upload to 2Mbps). Since HTB works in one
direction and is implemented on outbound interface, HTB for download will be on ether2 and HTB for upload will
be on ether1.

279

Manual:HTB

280

The first, we need to classify traffic.


Mark traffic form/to server. The first rule we will mark the outgoing connection from server and with the second
one, all packets, which belong to this connection (download and upload packets for this connection):
/ip firewall mangle> add chain=prerouting src-address=10.1.1.1/32 action=mark-connection \
new-connection-mark=server_con

/ip firewall mangle> add chain=forward connection-mark=server_con action=mark-packet

new-packet-mark=server

Do the same for workstation too. Match all workstation connections, mark it with the same mark
(new-connection-mark=workstation_con) and after that mark all packets which belong to these workstation.
/ip firewall mangle> add chain=prerouting src-address=10.1.1.2
action=mark-connection new-connection-mark=workstation_con
/ip firewall mangle> add chain=prerouting src-address=10.1.1.3
action=mark-connection new-connection-mark=workstation_con
/ip firewall mangle> add chain=prerouting src-address=10.1.1.4
action=mark-connection new-connection-mark=workstation_con

/ip firewall mangle> add chain='''forward''' connection-mark=workstation_con


new-packet-mark=workstations

At the end create /queue tree for upload and download based on figure 8.8 and figure 8.9.
Queue tree for upload limitation is implemented on ether1 interface.
;;; Queue_A1 creation
/queue tree> add name=Queue_A1 parent='''ether1''' max-limit=2048k

action=mark-packet \

Manual:HTB

;;; Queue_B1 creation


/queue tree> add name=Queue_B1 parent=Queue_A1 max-limit=2048k limit-at=1024k

;;; Queue_C1 creation


/queue tree> add name=Queue_C1 parent=Queue_A1 max-limit=2048k limit-at=1024k priority=7 \
packet-mark=server

;;; Queue_D1, Queue_E1 and Queue_F1 creation


/queue tree> add name=Queue_D1 parent=Queue_B1 max-limit=2048k limit-at=340k priority=8 \
packet-mark=workstations
/queue tree> add name=Queue_E1 parent=Queue_B1 max-limit=2048k limit-at=340k priority=8 \
packet-mark=workstations
/queue tree> add name=Queue_F1 parent=Queue_B1 max-limit=2048k limit-at=340k priority=8 \
packet-mark=workstations

Priority value by default is 8 so it is not specified here.


Queue tree for download limitation is implemented on ether2 interface.
;;; Queue_A2 creation
/queue tree> add name=Queue_A2 parent='''ether1''' max-limit=2048k

;;; Queue_B2 creation


/queue tree> add name=Queue_B2 parent=Queue_A2 max-limit=2048k limit-at=1536k

;;; Queue_C creation


/queue tree> add name=Queue_C2 parent=Queue_A2 max-limit=2048k limit-at=512k priority=7 \
packet-mark=server

;;; Queue_D2, Queue_E2 and Queue_F2 creation


/queue tree> add name=Queue_D2 parent=Queue_B2 max-limit=2048k limit-at=512k priority=8 \
packet-mark=workstations
/queue tree> add name=Queue_E2 parent=Queue_B2 max-limit=2048k limit-at=512k priority=8 \
packet-mark=workstations
/queue tree> add name=Queue_F2 parent=Queue_B2 max-limit=2048k limit-at=512k priority=8 \
packet-mark=workstations

[ Top | Back to Content ]

281

Manual:Queue Size

Manual:Queue Size
Applies to RouterOS: 2.9, v3, v4

Queue Size Example


This example was created to highlight queue size impact on traffic that was queued by specific queue.
In Mikrotik RouterOS queue size can be specified in the "/queue type" menu. Each queue type have a different
option for specifying queue size (pfifo-limit, bfifo-limit, pcq-limit, pcq-total-limit, red-limit), but all principles are
the same - queue size is main option that decide should the package be dropped or scheduled for later time.
In real time environment this process is happening continuously without any stops, steps or other interruptions, but in
order to show it as an example we will divide it into steps, where it is possible to know exactly how many packets
will be received/transited in every step.
We will not go into specific details of TCP and dropped packet retransmission - consider these packets as simple
UDP stream.

As you can see in the picture above there are 25 steps and there are total of 1610 incoming packets over this time
frame.

282

Manual:Queue Size

100% Shaper
Queue is 100% shaper when every packet that is over allowed limits will be dropped immediately. This way all
packages that are not dropped will be sent out without any delay.
Lets apply max-limit=100 packets per step limitation to our example:

With this type of limitation only 1250 out of 1610 packets were able to pass the queue (22,4% packet drop), but all
packets arrive without delay.

100% Scheduler
Queue is 100% Scheduler when there is no packet drops at all, all packets are queued and will be sent out at the first
possible moment.
In each step queue must send out queued packets from previous steps first and only then sent out packets from this
step, this way it is possible to keep right sequence of packets.
We will again use same limit (100 packets per step)

There was no packet loss, but 630 (39,1%) packets had 1 step delay, and other 170 (10,6%) packets had 2 step
delay. (delay = latency)

283

Manual:Queue Size

Default-small queue type


It is also possible to choose the middle way, when queue use both of these queuing aspects (shaping and scheduling)
By default most of the queues in RouterOS have queue size of 10.

There were 320 (19,9%) packets dropped and 80 (5,0%) packets had 1 step delay.

Default queue type


Other popular queue size in RouterOS is 50

There were 190 (11,8%) packets dropped and 400 (24,8%) packets had 1 step delay.

284

Manual:Queues - Burst

Manual:Queues - Burst
Applies to RouterOS: v2.9 and newer

Theory
Burst is a feature that allows to satisfy queue requirement for additional bandwidth even if required rate is bigger that
MIR (max-limit) for a limited period of time.
Burst can occur only if average-rate of the queue for the last burst-time seconds is smaller that burst-threshold.
Burst will stop if average-rate of the queue for the last burst-time seconds is bigger or equal to burst-threshold
Burst mechanism is simple - if burst is allowed max-limit value is replaced by burst-limit value. When burst is
disallowed max-limit value remains unchanged.
1. burst-limit (NUMBER) : maximal upload/download data rate which can be reached while the burst is allowed
2. burst-time (TIME) : period of time, in seconds, over which the average data rate is calculated. (This is NOT the
time of actual burst)
3. burst-threshold (NUMBER) : this is value of burst on/off switch
4. average-rate (read-only) : Every 1/16 part of the burst-time, the router calculates the average data rate of each
class over the last burst-time seconds
5. actual-rate (read-only) : actual traffic transfer rate of the queue

285

Manual:Queues - Burst

286

Example
Values: limit-at=1M , max-limit=2M , burst-threshold=1500k , burst-limit=4M
Client will try to download two 4MB (32Mb) blocks of data, first download will start at zero seconds, second
download will start at 17th second. Traffic was unused for last minute.

Burst-time=16s

As we can see as soon as client requested bandwidth it was able to get 4Mpbs burst for 6 seconds. This is longest
possible burst with given values (longest-burst-time = burst-threshold * burst-time / burst-limit). As soon as burst
runs out rest of the data will be downloaded with 2Mbps. This way block of data was downloaded in 9 seconds without burst it would take 16 seconds. Burst have 7 seconds to recharge before next download will start.
Note that burst is still disallowed when download started and it kicks in only afterwards - in the middle of download.
So with this example we proved that burst may happen in the middle of download. Burst was ~4 seconds long and
second block of was downloaded 4 seconds faster then without burst.
Average rate is calculated every 1/16 of burst time, so in this case 1s
Time

average-rate

burst

actual-rate

(0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0)/16=0Kbps

average-rate < burst-threshold Burst is allowed

4Mbps

(0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+4)/16=250Kbps

average-rate < burst-threshold Burst is allowed

4Mbps

(0+0+0+0+0+0+0+0+0+0+0+0+0+0+4+4)/16=500Kbps

average-rate < burst-threshold Burst is allowed

4Mbps

(0+0+0+0+0+0+0+0+0+0+0+0+0+4+4+4)/16=750Kbps

average-rate < burst-threshold Burst is allowed

4Mbps

(0+0+0+0+0+0+0+0+0+0+0+0+4+4+4+4)/16=1000Kbps average-rate < burst-threshold Burst is allowed

4Mbps

(0+0+0+0+0+0+0+0+0+0+0+4+4+4+4+4)/16=1250Kbps average-rate < burst-threshold Burst is allowed

4Mbps

(0+0+0+0+0+0+0+0+0+0+4+4+4+4+4+4)/16=1500Kbps average-rate = burst-threshold Burst not allowed 2Mbps

(0+0+0+0+0+0+0+0+0+4+4+4+4+4+4+2)/16=1625Kbps average-rate > burst-threshold Burst not allowed 2Mbps

(0+0+0+0+0+0+0+0+4+4+4+4+4+4+2+2)/16=1750Kbps average-rate > burst-threshold Burst not allowed 2Mbps

(0+0+0+0+0+0+0+4+4+4+4+4+4+2+2+2)/16=1750Kbps average-rate > burst-threshold Burst not allowed 2Mbps

10

(0+0+0+0+0+0+4+4+4+4+4+4+2+2+2+2)/16=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps

Manual:Queues - Burst

287

11

(0+0+0+0+0+4+4+4+4+4+4+2+2+2+2+0)/16=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps

12

(0+0+0+0+4+4+4+4+4+4+2+2+2+2+0+0)/16=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps

13

(0+0+0+4+4+4+4+4+4+2+2+2+2+0+0+0)/16=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps

14

(0+0+4+4+4+4+4+4+2+2+2+2+0+0+0+0)/16=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps

15

(0+4+4+4+4+4+4+2+2+2+2+0+0+0+0+0)/16=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps

16

(4+4+4+4+4+4+2+2+2+2+0+0+0+0+0+0)/16=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps

17

(4+4+4+4+4+2+2+2+2+0+0+0+0+0+0+0)/16=1625Kbps average-rate > burst-threshold Burst not allowed 2Mbps

18

(4+4+4+4+2+2+2+2+0+0+0+0+0+0+0+2)/16=1500Kbps average-rate = burst-threshold Burst not allowed 2Mbps

19

(4+4+4+2+2+2+2+0+0+0+0+0+0+0+2+2)/16=1375Kbps average-rate < burst-threshold Burst is allowed

4Mbps

20

(4+4+2+2+2+2+0+0+0+0+0+0+0+2+2+4)/16=1375Kbps average-rate < burst-threshold Burst is allowed

4Mbps

21

(4+2+2+2+2+0+0+0+0+0+0+0+2+2+4+4)/16=1375Kbps average-rate < burst-threshold Burst is allowed

4Mbps

22

(2+2+2+2+0+0+0+0+0+0+0+2+2+4+4+4)/16=1375Kbps average-rate < burst-threshold Burst is allowed

4Mbps

23

(2+2+2+0+0+0+0+0+0+0+2+2+4+4+4+4)/16=1500Kbps average-rate = burst-threshold Burst not allowed 2Mbps

24

(2+2+0+0+0+0+0+0+0+2+2+4+4+4+4+2)/16=1500Kbps average-rate = burst-threshold Burst not allowed 2Mbps

25

(2+0+0+0+0+0+0+0+2+2+4+4+4+4+2+2)/16=1500Kbps average-rate = burst-threshold Burst not allowed 2Mbps

26

(0+0+0+0+0+0+0+2+2+4+4+4+4+2+2+2)/16=1500Kbps average-rate = burst-threshold Burst not allowed 2Mbps

27

(0+0+0+0+0+0+2+2+4+4+4+4+2+2+2+2)/16=1625Kbps average-rate > burst-threshold Burst not allowed 2Mbps

28

(0+0+0+0+0+2+2+4+4+4+4+2+2+2+2+2)/16=1750Kbps average-rate > burst-threshold Burst not allowed 2Mbps

29

(0+0+0+0+2+2+4+4+4+4+2+2+2+2+2+2)/16=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps

30

(0+0+0+2+2+4+4+4+4+2+2+2+2+2+2+0)/16=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps

31

(0+0+2+2+4+4+4+4+2+2+2+2+2+2+0+0)/16=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps

Burst-time=8s

Manual:Queues - Burst

288

If we decrease burst-time to 8 seconds - we are able to see that in this case bursts are only at the beginning of
downloads
Average rate is calculated every 1/16th of burst time, so in this case every 0.5 seconds.
Time

average-rate

burst

actual-rate

0.0

(0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0)/8=0Kbps

average-rate < burst-threshold Burst is allowed

4Mbps (2Mb per 0,5sek)

0.5

(0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+2)/8=250Kbps

average-rate < burst-threshold Burst is allowed

4Mbps (2Mb per 0,5sek)

1.0

(0+0+0+0+0+0+0+0+0+0+0+0+0+0+2+2)/8=500Kbps

average-rate < burst-threshold Burst is allowed

4Mbps (2Mb per 0,5sek)

1.5

(0+0+0+0+0+0+0+0+0+0+0+0+0+2+2+2)/8=750Kbps

average-rate < burst-threshold Burst is allowed

4Mbps (2Mb per 0,5sek)

2.0

(0+0+0+0+0+0+0+0+0+0+0+0+2+2+2+2)/8=1000Kbps average-rate < burst-threshold Burst is allowed

4Mbps (2Mb per 0,5sek)

2.5

(0+0+0+0+0+0+0+0+0+0+0+2+2+2+2+2)/8=1250Kbps average-rate < burst-threshold Burst is allowed

4Mbps (2Mb per 0,5sek)

3.0

(0+0+0+0+0+0+0+0+0+0+2+2+2+2+2+2)/8=1500Kbps average-rate = burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

3.5

(0+0+0+0+0+0+0+0+0+2+2+2+2+2+2+1)/8=1625Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

4.0

(0+0+0+0+0+0+0+0+2+2+2+2+2+2+1+1)/8=1750Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

4.5

(0+0+0+0+0+0+0+2+2+2+2+2+2+1+1+1)/8=1875Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

5.0

(0+0+0+0+0+0+2+2+2+2+2+2+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

5.5

(0+0+0+0+0+2+2+2+2+2+2+1+1+1+1+1)/8=2125Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

6.0

(0+0+0+0+2+2+2+2+2+2+1+1+1+1+1+1)/8=2250Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

6.5

(0+0+0+2+2+2+2+2+2+1+1+1+1+1+1+1)/8=2375Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

7.0

(0+0+2+2+2+2+2+2+1+1+1+1+1+1+1+1)/8=2500Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

7.5

(0+2+2+2+2+2+2+1+1+1+1+1+1+1+1+1)/8=2625Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

8.0

(2+2+2+2+2+2+1+1+1+1+1+1+1+1+1+1)/8=2750Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

8.5

(2+2+2+2+2+1+1+1+1+1+1+1+1+1+1+1)/8=2625Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

9.0

(2+2+2+2+1+1+1+1+1+1+1+1+1+1+1+1)/8=2500Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

9.5

(2+2+2+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2375Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

10.0

(2+2+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2250Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

10.5

(2+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2125Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

11.0

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

11.5

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

12.0

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

12.5

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

13.0

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 0Mbps (0Mb per 0,5sek)

13.5

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+0)/8=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps (0Mb per 0,5sek)

14.0

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+0+0)/8=1750Kbps average-rate > burst-threshold Burst not allowed 0Mbps (0Mb per 0,5sek)

14.5

(1+1+1+1+1+1+1+1+1+1+1+1+1+0+0+0)/8=1625Kbps average-rate > burst-threshold Burst not allowed 0Mbps (0Mb per 0,5sek)

15.0

(1+1+1+1+1+1+1+1+1+1+1+1+0+0+0+0)/8=1500Kbps average-rate > burst-threshold Burst not allowed 0Mbps (0Mb per 0,5sek)

15.5

(1+1+1+1+1+1+1+1+1+1+1+0+0+0+0+0)/8=1375Kbps average-rate < burst-threshold Burst is allowed

0Mbps (0Mb per 0,5sek)

16.0

(1+1+1+1+1+1+1+1+1+1+0+0+0+0+0+0)/8=1250Kbps average-rate < burst-threshold Burst is allowed

0Mbps (0Mb per 0,5sek)

16.5

(1+1+1+1+1+1+1+1+1+0+0+0+0+0+0+0)/8=1125Kbps average-rate < burst-threshold Burst is allowed

0Mbps (0Mb per 0,5sek)

17.0

(1+1+1+1+1+1+1+1+0+0+0+0+0+0+0+0)/8=1000Kbps average-rate < burst-threshold Burst is allowed

2Mbps (1Mb per 0,5sek)

Manual:Queues - Burst

289

17.5

(1+1+1+1+1+1+1+0+0+0+0+0+0+0+0+1)/8=1000Kbps average-rate < burst-threshold Burst is allowed

4Mbps (2Mb per 0,5sek)

18.0

(1+1+1+1+1+1+0+0+0+0+0+0+0+0+1+2)/8=1125Kbps average-rate < burst-threshold Burst is allowed

4Mbps (2Mb per 0,5sek)

18.5

(1+1+1+1+1+0+0+0+0+0+0+0+0+1+2+2)/8=1250Kbps average-rate < burst-threshold Burst is allowed

4Mbps (2Mb per 0,5sek)

19.0

(1+1+1+1+0+0+0+0+0+0+0+0+1+2+2+2)/8=1375Kbps average-rate < burst-threshold Burst is allowed

4Mbps (2Mb per 0,5sek)

19.5

(1+1+1+0+0+0+0+0+0+0+0+1+2+2+2+2)/8=1500Kbps average-rate = burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

20.0

(1+1+0+0+0+0+0+0+0+0+1+2+2+2+2+1)/8=1500Kbps average-rate = burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

20.5

(1+0+0+0+0+0+0+0+0+1+2+2+2+2+1+1)/8=1500Kbps average-rate = burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

21.0

(0+0+0+0+0+0+0+0+1+2+2+2+2+1+1+1)/8=1500Kbps average-rate = burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

21.5

(0+0+0+0+0+0+0+1+2+2+2+2+1+1+1+1)/8=1625Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

22.0

(0+0+0+0+0+0+1+2+2+2+2+1+1+1+1+1)/8=1750Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

22.5

(0+0+0+0+0+1+2+2+2+2+1+1+1+1+1+1)/8=1875Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

23.0

(0+0+0+0+1+2+2+2+2+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

23.5

(0+0+0+1+2+2+2+2+1+1+1+1+1+1+1+1)/8=2125Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

24.0

(0+0+1+2+2+2+2+1+1+1+1+1+1+1+1+1)/8=2250Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

24.5

(0+1+2+2+2+2+1+1+1+1+1+1+1+1+1+1)/8=2375Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

25.0

(1+2+2+2+2+1+1+1+1+1+1+1+1+1+1+1)/8=2500Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

25.5

(2+2+2+2+1+1+1+1+1+1+1+1+1+1+1+1)/8=2500Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

26.0

(2+2+2+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2375Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

26.5

(2+2+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2250Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

27.0

(2+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2125Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

27.5

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

28.0

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

28.5

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

29.0

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

29.5

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

30.0

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 2Mbps (1Mb per 0,5sek)

30.5

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1)/8=2000Kbps average-rate > burst-threshold Burst not allowed 0Mbps (0Mb per 0,5sek)

31.0

(1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+0)/8=1875Kbps average-rate > burst-threshold Burst not allowed 0Mbps (0Mb per 0,5sek)

Manual:Queues - PCQ

Manual:Queues - PCQ
Applies to RouterOS: 2.9, v3, v4

Usage
PCQ was introduced to optimize massive QoS systems, where most of the queues are exactly the same for different
sub-streams. For example a sub-stream can be download or upload for one particular client (IP) or connection to
server.
PCQ algorithm is very simple - at first it uses selected classifiers to distinguish one sub-stream from another, then
applies individual FIFO queue size and limitation on every sub-stream, then groups all sub-streams together and
applies global FIFO queue size and limitation.
PCQ parameters:

pcq-classifier (dst-address | dst-port | src-address | src-port; default: "") : selection of sub-stream identifiers
pcq-rate (number) : maximal available data rate of each sub-steam
pcq-limit (number) : queue size of single sub-stream (in KB)
pcq-total-limit (number) : queue size of global FIFO queue (in KB)

So instead of having 100 queues with 1000kbps limitation for download we can have one PCQ queue with 100
sub-streams

290

Manual:Queues - PCQ

Classification Examples
To better understand classification we will take a list of 18 packet streams from specific address and port, to a
specific address and port. Then we will choose a classifier and divide all 18 packet streams into PCQ sub-streams

291

Manual:Queues - PCQ

PCQ Rate Examples


Here it is possible to see what happens if PCQ-rate is, or isn't specified. I must noted that if both limits (pcq-rate and
max-limit) are unspecified, queue behavior can be imprecise. So it is strongly suggested to have at least one of these
options set.

New PCQ implementation (v5.0RC5)


PCQ was rewritten in v5.0RC4 to optimize it high throughput both in Mbps and pps. This implementation properly
utilize all new Linux Kernel features, this makes PCQ faster and less resource demanding.
Now as soon as new stream activates it will get 1/4th of rate with highest priority. If rate is "0" sub-stream will not
have this feature (as 1/4th of "0" is "0")
This is necessary to know for one good reason: Lets assume that sub-stream's rate is 10Mbps, so in the moment when
new sub-stream will request traffic it will get first 2500k of traffic without limitation. This may result in higher that
expected results in such programs as Speedtest.net. To avoid that make sure that Speedtest.net is not the first
program that utilize bandwidth that you run on PC.
Also starting from v5.0RC5 PCQ have new features

292

Manual:Queues - PCQ
PCQ Burst for sub-streams. PCQ will have burst implementation identical to Simple Queues and Queue Tree
PCQ parameters:
pcq-burst-rate (number) : maximal upload/download data rate which can be reached while the burst for
substream is allowed
pcq-burst-threshold (number) : this is value of burst on/off switch
pcq-burst-time (time) : period of time, in seconds, over which the average data rate is calculated. (This is NOT
the time of actual burst)
For detailed burst explanation refer to:
Burst
PCQ also allows to use different size IPv4 and IPv6 networks as sub-stream identifiers . Before it was locked to
single IP address. This is done mainly for IPv6 as customers from ISP point of view will be represented by /64
network, but devices in customers network will be /128. PCQ can be used for both of these scenarios and more.
PCQ parameters:
pcq-dst-address-mask (number) : size of IPv4 network that will be used as dst-address sub-stream identifier
pcq-src-address-mask (number) : size of IPv4 network that will be used as src-address sub-stream identifier
pcq-dst-address6-mask (number) : size of IPV6 network that will be used as dst-address sub-stream identifier
pcq-src-address6-mask (number) : size of IPV6 network that will be used as src-address sub-stream identifier

See Also
PCQ Examples

Manual:Queues - PCQ Examples


Per Connection Queue (PCQ) is a queuing discipline that can be used to dynamically equalize or shape traffic for
multiple users, using little administration. It is possible to divide PCQ scenarios into three major groups: equal
bandwidth for a number of users, certain bandwidth equal distribution between users, unknown bandwidth equal
distribution between users.

Equal Bandwidth for a Number of Users


Use PCQ type queue when you need to equalize the bandwidth [and set max limit] for a number of users. We will set
the 64kbps download and 32kbps upload limits.

293

Manual:Queues - PCQ Examples

There are two ways how to make this: using mangle and queue trees, or, using simple queues.
1. Mark all packets with packet-marks upload/download: (lets constider that ether1-LAN is public interface to the
Internet and ether2-LAN is local interface where clients are connected
/ip firewall mangle add chain=prerouting action=mark-packet \
in-interface=ether1-LAN new-packet-mark=client_upload
/ip firewall mangle add chain=prerouting action=mark-packet \
in-interface=ether2-WAN new-packet-mark=client_download
2. Setup two PCQ queue types - one for download and one for upload. dst-address is classifier for user's download
traffic, src-address for upload traffic:
/queue type add name="PCQ_download" kind=pcq pcq-rate=64000 pcq-classifier=dst-address
/queue type add name="PCQ_upload" kind=pcq pcq-rate=32000 pcq-classifier=src-address

3. Finally, two queue rules are required, one for download and one for upload:
/queue tree add parent=global-in queue=PCQ_download packet-mark=client_download
/queue tree add parent=global-out queue=PCQ_upload packet-mark=client_upload
If you don't like using mangle and queue trees, you can skip step 1, do step 2, and step 3 would be to create one
simple queue as shown here:
/queue simple add target-addresses=192.168.0.0/24 queue=PCQ_upload/PCQ_download \
packet-marks=client_download,client_upload

294

Manual:Queues - PCQ Examples

295

Note: More information about certain and unknown Distribution between routers can be found in PCQ
manual.

See Also
PCQ

Manual:System/Log
Applies to RouterOS: v3, v4 +

Summary
RouterOS is capable of logging various system events and status information. Logs can be saved in routers memory
(RAM), disk, file, sent by email or even sent to remote syslog server (RFC 3164).

Log messages
Sub-menu level: /log
All messages stored in routers local memory can be printed from /log menu. Each entry contains time and date
when event occurred, topics that this message belongs to and message itself.
[admin@ZalaisKapots] /log> print
jan/02/1970 02:00:09 system,info router rebooted
sep/15 09:54:33 system,info,account user admin logged in from 10.1.101.212 via winbox
sep/15 12:33:18 system,info item added by admin
sep/15 12:34:26 system,info mangle rule added by admin
sep/15 12:34:29 system,info mangle rule moved by admin
sep/15 12:35:34 system,info mangle rule changed by admin
sep/15 12:42:14 system,info,account user admin logged in from 10.1.101.212 via telnet
sep/15 12:42:55 system,info,account user admin logged out from 10.1.101.212 via telnet
01:01:58 firewall,info input: in:ether1 out:(none), src-mac 00:21:29:6d:82:07, proto UDP,
10.1.101.1:520->10.1.101.255:520, len 452

If logs are printed at the same date when log entry was added, then only time will be shown. In example above you
can see that second message was added on sep/15 current year (year is not added) and the last message was added
today so only the time is displayed.
Note: print command accepts several parameters that allows to detect new log entries, print only necessary
messages and so on. For more information about parameters refer to scripting manual

For example following command will print all log messages where one of the topics is info and
will detect new log entries until Ctrl+C is pressed

Manual:System/Log

296

[admin@ZalaisKapots] /log > print follow where topics~".info"


12:52:24 script,info hello from script
-- Ctrl-C to quit.
If print is in follow mode you can hit 'space' on keyboard to insert separator:
[admin@ZalaisKapots] /log > print follow where topics~".info"
12:52:24 script,info hello from script
= = =

= = =

= = =

= = =

= = =

= = =

= = =

= = =

= = =

-- Ctrl-C to quit.

Logging configuration
Sub-menu level: /system logging
Property

Description

action (name; Default: memory)

specifies one of the system default actions or user


specified action listed in actions menu

prefix (string; Default: )

prefix added at the beginning of log messages

topics (account, async, backup, bgp, calc, critical, ddns, debug, dhcp, e-mail, error,
event, firewall, gsm, hotspot, igmp-proxy, info, ipsec, iscsi, isdn, l2tp, ldp, manager,
mme, mpls, ntp, ospf, ovpn, packet, pim, ppp, pppoe, pptp, radius, radvd, raw, read,
rip, route, rsvp, script, sertcp, state, store, system, telephony, tftp, timer, ups, warning,
watchdog, web-proxy, wireless, write; Default: info)

log all messages that falls into specified topic or list of


topics.
'!' character can be used before topic to exclude messages
falling under this topic. For example, we want to log NTP
debug info without too much details:
/system logging add
topics=ntp,debug,!packet

Actions
Sub-menu level: /system logging action
Property

Description

bsd-syslog (yes|no; Default: )

whether to use bsd-syslog as defined in RFC 3164

disk-file-count (integer [1..65535]; Default: 2)

specifies number of files used to store log messages, applicable


only if action=disk

disk-file-name (string; Default: log)

name of the file used to store log messages, applicable only if


action=disk

disk-lines-per-file (integer [1..65535]; Default: 100)

specifies maximum size of file in lines, applicable only if


action=disk

disk-stop-on-full (yes|no; Default: no)

whether to stop to save log messages to disk after the specified


disk-lines-per-file and disk-file-count number is reached,
applicable only if action=disk

email-to (string; Default: )

email address where logs are sent, applicable only if


action=email

memory-lines (integer [1..65535]; Default: 100)

number of records in local memory buffer, applicable only if


action=memory

memory-stop-on-full (yes|no; Default: no)

whether to stop to save log messages in local buffer after the


specified memory-lines number is reached

Manual:System/Log

297

name (string; Default: )

name of an action

remember (yes|no; Default: )

whether to keep log messages, which have not yet been


displayed in console, applicable if action=echo

remote (IP/IPv6 Address[:Port]; Default: 0.0.0.0:514)

remote logging server's IP/IPv6 address and UDP port,


applicable if action=remote

src-address (IP address; Default: 0.0.0.0)

source address used when sending packets to remote server

syslog-facility (auth, authpriv, cron, daemon, ftp, kern, local0, local1,


local2, local3, local4, local5, local6, local7, lpr, mail, news, ntp, syslog, user,
uucp; Default: daemon)
syslog-severity (alert, auto, critical, debug, emergency, error, info, notice, Severity level indicator defined in RFC 3164:
warning; Default: auto)
Emergency: system is unusable
Alert: action must be taken immediately
Critical: critical conditions
Error: error conditions
Warning: warning conditions
Notice: normal but significant condition
Informational: informational messages
Debug: debug-level messages
target (disk, echo, email, memory, remote; Default: memory)

storage facility or target of log messages

disk - logs are saved to the hard drive more>>


echo - logs are displayed on the console screen
email - logs are sent by email
memory - logs are stored in local memory buffer
remote - logs are sent to remote host

Note: default actions can not be deleted or renamed.

Topics
Each log entry have topic which describes the origin of log message. There can be more than one
topic assigned to log message. For example, OSPF debug logs have four different topics: route,
ospf, debug and raw.
11:11:43 route,ospf,debug SEND: Hello Packet 10.255.255.1 -> 224.0.0.5 on lo0
11:11:43 route,ospf,debug,raw PACKET:
11:11:43 route,ospf,debug,raw

02 01 00 2C 0A FF FF 03 00 00 00 00 E7 9B 00 00

11:11:43 route,ospf,debug,raw

00 00 00 00 00 00 00 00 FF FF FF FF 00 0A 02 01

11:11:43 route,ospf,debug,raw

00 00 00 28 0A FF FF 01 00 00 00 00

List of Facility independent topics

Manual:System/Log

298

Topic

Description

critical Log entries marked as critical, these log entries are printed to console each time you log in.
debug

Debug log entries

error

Error messages

info

Informative log entry

packet

Log entry that shows contents from received/sent packet

raw

Log entry that shows raw contents of received/sent packet

warning

Warning message.

Topics used by various RouterOS facilities


Topic

Description

account

Log messages generated by accounting facility.

async

Log messages generated by asynchronous devices

backup

Log messages generated by backup creation facility.

bfd

Log messages generated by Manual:Routing/BFD protocol

bgp

Log messages generated by Manual:Routing/BGP protocol

calc

Routing calculation log messages.

ddns

Log messages generated by Manual:Tools/Dynamic DNS tool

dhcp

DHCP client, server and relay log messages

e-mail

Messages generated by Manual:Tools/email tool.

event

Log message generated at routing event. For example, new route have been installed in routing table.

firewall

Firewall log messages generated when action=log is set in firewall rule

gsm

Log messages generated by GSM devices

hotspot

Hotspot related log entries

igmp-proxy IGMP Proxy related log entries


ipsec

IpSec log entries

iscsi
isdn
l2tp

Log entries generated by Manual:Interface/L2TP client and server

ldp

Manual:MPLS/LDP protocol related messages

manager

User manager log messages.

mme

MME routing protocol messages

mpls

MPLS messages

ntp

sNTP client generated log entries

ospf

Manual:Routing/OSPF routing protocol messages

ovpn

OpenVPN tunnel messages

pim

Multicast PIM-SM related messages

ppp

ppp facility messages

pppoe

PPPoE server/client related messages

Manual:System/Log

299

pptp

PPTP server/client related messages

radius

Log entries generated by RADIUS Client

radvd

IPv6 radv deamon log messages.

read

SMS tool messages

rip

RIP routing protocol messages

route

Routing facility log entries

rsvp

Resource Reservation Protocol generated messages.

script

Log entries generated from scripts

sertcp

Log messages related to facility responsible for "/ports remote-access"

simulator
state

DHCP Client and routing state messages.

store

Log entries generated by Store facility

system

Generic system messages

telephony
tftp

TFTP server generated messages

timer

Log messages that are related to timers used in RouterOS. For example bgp keepalive logs
12:41:40 route,bgp,debug,timer KeepaliveTimer expired
12:41:40 route,bgp,debug,timer
RemoteAddress=2001:470:1f09:131::1

ups

Messages generated by UPS monitoring tool

watchdog

Watchdog generated log entries

web-proxy

Log messages generated by web proxy

wireless

M:Interface/Wireless log entries.

write

SMS tool messages.

Logging to file
To log everything to file, add new log action:
/system logging action add name=file target=disk disk-file-name=log
and then make everything log using this new action:
/system logging action=file
You can log only errors there by issuing command:
/system logging topics=error action=file
This will log into files log.0.txt and log.1.txt.
You can specify maximum size of file in lines by specifying disk-lines-per-file. <file>.0.txt is active file were new
logs are going to be appended and once it size will reach maximum it will become <file>.1.txt, and new empty
<file>.0.txt will be created.
You can log into USB flashes or into MicroSD/CF (on Routerboards) by specifying it's directory name before file
name. For example, if you have accessible usb flash as usb1 directory under /files, you should issue following
command:

Manual:System/Log
/system logging action add name=usb target=disk disk-file-name=usb1/log

Example:Webproxy logging
These two screenshots will show you how to configure the RouterOS logging facility to send Webrpoxy logs to a
remote syslog server, in this example, located at 192.168.100.12. The syslog server can be any software that supports
receiving syslogs, for example Kiwi syslog.

Add a new logging action, with "remote" and the IP of the remote server. Call it whatever you like

300

Manual:System/Log

Then add a new logging rule with the topic "webproxy" and then newly created action. Note that you must have
webproxy running on this router already, for this to work. To test, you can temporary change the action to "memory"
and see the "log" window if the webproxy visited websites are logged. If it works, change it back to your new remote
action
Note: it's a good idea to add another topic in the same rule: !debug. This would be to ensure you don't get any debug
stuff, only the visited sites.

301

Manual:IP/Traffic Flow

302

Manual:IP/Traffic Flow
Applies to RouterOS: 2.9, v3, v4 +

Summary
Sub-menu: /ip traffic-flow
MikroTik Traffic-Flow is a system that provides statistic information about packets which pass through the router.
Besides network monitoring and accounting, system administrators can identify various problems that may occur in
the network. With help of Traffic-Flow, it is possible to analyze and optimize the overall network performance. As
Traffic-Flow is compatible with Cisco NetFlow, it can be used with various utilities which are designed for Cisco's
NetFlow.
Traffic-Flow supports the following NetFlow formats:
version 1 - the first version of NetFlow data format, do not use it, unless you have to
version 5 - in addition to version 1, version 5 has the BGP AS and flow sequence number information included
version 9 - a new format which can be extended with new fields and record types thank's to its template-style
design

General
Sub-menu: /ip traffic-flow
This section lists the configuration properties of Traffic-Flow.
Property
interfaces (string | all; Default: all)

Description
Names of those interfaces which will be used to gather statistics for traffic-flow. To specify more than
one interface, separate them with a comma.

cache-entries (128k | 16k | 1k | 256k | Number of flows which can be in router's memory simultaneously.
2k | ... ; Default: 4k)
active-flow-timeout (time; Default: Maximum life-time of a flow.
30m)
inactive-flow-timeout (time;
Default: 15s)

How long to keep the flow active, if it is idle. If connection does not see any packet within this
timeout, then traffic-flow will send packet out as new flow. If this timeout is too small it can create
significant amount of flows and overflow the buffer.

Targets
Sub-menu: /ip traffic-flow target
With Traffic-Flow targets we specify those hosts which will gather the Traffic-Flow information from router.

Manual:IP/Traffic Flow

303

Property

Description

address (IP:port; Default: )

IP address and port (UDP) of the host which receives Traffic-Flow statistic packets from the
router.

v9-template-refresh (integer; Default:


20)

Number of packets after which the template is sent to the receiving host (only for NetFlow
version 9)

v9-template-timeout (time; Default: )

After how long to send the template, if it has not been sent.

version (1 | 5 | 9; Default: )

Which version format of NetFlow to use

Notes
By looking at packet flow diagram you can see that traffic flow is at the end of input, forward and output chain stack.
It means that traffic flow will count only traffic that reaches one of those chains.
For example, you set up mirror port on switch, connect mirror port to router and set traffic flow to count mirrored
packets. Unfortunately such setup will not work, because mirrored packets are dropped before they reach input
chain.
Other interfaces will appear in report if traffic is passing thorugh them and monitored interface.

Examples
This example shows how to configure Traffic-Flow on a router
Enable Traffic-Flow on the router:
[admin@MikroTik] ip traffic-flow> set enabled=yes
[admin@MikroTik] ip traffic-flow> print
enabled: yes
interfaces: all
cache-entries: 1k
active-flow-timeout: 30m
inactive-flow-timeout: 15s
[admin@MikroTik] ip traffic-flow>
Specify IP address and port of the host, which will receive Traffic-Flow packets:
[admin@MikroTik] ip traffic-flow target> add address=192.168.0.2:2055 \
\... version=9
[admin@MikroTik] ip traffic-flow target> print
Flags: X - disabled
#
ADDRESS
VERSION
0
192.168.0.2:2055
9
[admin@MikroTik] ip traffic-flow target>
Now the router starts to send packets with Traffic-Flow information.
Some screenshots from NTop program [1], which has gathered Traffic-Flow information from our router and displays
it in nice graphs and statistics. For example, where what kind of traffic has flown:

Manual:IP/Traffic Flow

304

Manual:IP/Traffic Flow

See more
NetFlow Fundamentals [2]
[ Top | Back to Content ]

References
[1] http:/ / www. ntop. org/ download. html
[2] http:/ / etutorials. org/ Networking/ network+ management/ Part+ II+ Implementations+ on+ the+ Cisco+ Devices/ Chapter+ 7. + NetFlow/
Fundamentals+ of+ NetFlow/

Manual:SNMP
Applies to RouterOS: v5

Overview
Standards: RFC 1157
Package: system
Simple Network Management Protocol (SNMP) is an Internet-standard protocol for managing devices on IP
networks. SNMP can be used to graph various data with tools such as CACTI, MRTG or The Dude [1]
RouterOS supports SNMP v1,2 and 3. SNMP write is also supported.

Quick Configuration
To enable SNMP in RouterOS:
[admin@MikroTik] /snmp> print
enabled: no
contact:
location:
engine-id:
trap-community: (unknown)
trap-version: 1
[admin@MikroTik] /snmp> set enabled yes

305

Manual:SNMP

306

You can also specify administrative contact information in the above settings. All SNMP data will be available to
communities configured in community menu.

General Properties
Sub-menu: /snmp
This sub menu allows to enable SNMP and to configure general settings.
Property

Description

contact (string; Default: "")

Contact information

enabled (yes | no; Default: no)

Used to disable/enable SNMP service

engine-id (string; Default: "")


location (string; Default: "")

Location information

trap-community (string; Default: public)

Which communities configured in community menu to use when sending out the trap.

trap-generators (interfaces | start-trap; Default: ) What action will generate traps:

interfaces - interface changes;


start-trap - snmp server starting on the router

trap-interfaces (string | all; Default: )

List of interfaces that traps are going to be sent out.

trap-target (list of IP/IPv6; Default: 0.0.0.0)

IP (IPv4 or IPv6) addresses of SNMP data collectors that have to receive the trap

trap-version (1|2|3; Default: 1)

Version of SNMP protocol to use for trap

Community
Sub-menu: /snmp community
This sub-menu allows to set up access rights for the SNMP data.
There is little security in v1 and v2c, just Clear text community string (username) and ability for Limiting access
by IP adress.
Since SNMP v3, better options have been introduced - Authorisation (User + Pass) with MD5/SHA1, Encryption
with DES.
[admin@MikroTik] /snmp community> print value-list
name: public
address: 0.0.0.0/0
security: none
read-access: yes
write-access: no
authentication-protocol: MD5
encryption-protocol: DES
authentication-password: *****
encryption-password: *****
Warning: Default settings only have one community named public without any additional security settings.
These settings should be considered insecure and should be adjusted according required security profile.

Properties

Manual:SNMP

307

Property

Description

address (IP/IPv6 address; Default: 0.0.0.0/0)

Addresses from which connections to SNMP server is allowed

authentication-password (string; Default: "")

Password used to authenticate connection to the server (SNMPv3)

authentication-protocol (MD5 | SHA1; Default: MD5) Protocol used for authentication (SNMPv3)
encryption-password (string; Default: "")

password used for encryption (SNMPv3)

encryption-protocol (DES; Default: DES)

encryption protocol to be used to encrypt the communication (SNMPv3)

name (string; Default: )


read-access (yes | no; Default: yes)

Whether read access is enabled for this community

security (authorized | none | private; Default: none)


write-access (yes | no; Default: no)

Whether write access is enabled for this community. Read more >>

Management information base (MIB)


The Management Information Base (MIB) is the database of information maintained by the agent that the manager
can query. You can download the latest MikroTik RouterOS MIB [2] file.
MIBs used in RouterOS v5.x:

MIKROTIK-MIB
MIB-2
HOST-RESOURCES-MIB
IF-MIB
IP-MIB
IP-FORWARD-MIB
IPV6-MIB
BRIDGE-MIB
DHCP-SERVER-MIB
CISCO-AAA-SESSION-MIB
ENTITY-MIB
UPS-MIB
SQUID-MIB

Object identifiers (OID)


Each OID identifies a variable that can be read via SNMP. Although the MIB file contains all the needed OID
values, you can also print individual OID information in the console with the print oid command at any menu level:
[admin@MikroTik] /interface> print oid
Flags: D - dynamic, X - disabled, R - running, S - slave
0 R name=.1.3.6.1.2.1.2.2.1.2.1 mtu=.1.3.6.1.2.1.2.2.1.4.1
mac-address=.1.3.6.1.2.1.2.2.1.6.1 admin-status=.1.3.6.1.2.1.2.2.1.7.1
oper-status=.1.3.6.1.2.1.2.2.1.8.1 bytes-in=.1.3.6.1.2.1.2.2.1.10.1
packets-in=.1.3.6.1.2.1.2.2.1.11.1 discards-in=.1.3.6.1.2.1.2.2.1.13.1
errors-in=.1.3.6.1.2.1.2.2.1.14.1 bytes-out=.1.3.6.1.2.1.2.2.1.16.1
packets-out=.1.3.6.1.2.1.2.2.1.17.1 discards-out=.1.3.6.1.2.1.2.2.1.19.1
errors-out=.1.3.6.1.2.1.2.2.1.20.1

Manual:SNMP

308

Traps
SNMP traps enable router to notify data collector of interface changes and SNMP service status changes by sending
traps. It is possible to send out traps with security features to support SNMPv1 (no security). SNMPv2 and variants
and SNMPv3 with encryption and authorization.
For SNMPv2 and v3 you have to set up appropriately configured community as a trap-community to enable required
features (password or encryption/authorization)

SNMP write
Since RouterOS v3, SNMP write is supported for some functions. SNMP write allows to change router configuration
with SNMP requests. Consider to secure access to router or to router's SNMP, when SNMP and write-access are
enabled.
To change settings by SNMP requests, use the command below to allow SNMP write for the selected community,
Write-access option for SNMP is available from v3.14,
/snmp community set <number> write-access=yes
System Identity
It's possible to change router system identity by SNMP set command,
snmpset -c public -v 1 192.168.0.0 1.3.6.1.2.1.1.5.0

s New_Identity

snmpset - SNMP application used for SNMP SET requests to set information on a network entity;
public - router's community name;
192.168.0.0 - IP address of the router;
1.3.6.1.2.1.1.5.0 - SNMP value for router's identity;

SNMPset command above is equal to the RouterOS command,


/system identity set identity=New_Identity
Reboot
It's possible to reboot the router with SNMP set commamd, you need to set value for reboot SNMP settings, which is
not equal to 0,
snmpset -c public -v 1 192.168.0.0 1.3.6.1.4.1.14988.1.1.7.1.0 s 1
1.3.6.1.4.1.14988.1.1.7.1.0, SNMP value for the router reboot;
s 1, snmpset command to set value, value should not be equal to 0;
Reboot snmpset command is equal to the RouterOS command,
/system reboot

Manual:SNMP
Run Script
SNMP write allows to run scripts on the router from system script menu, when you need to set value for SNMP
setting of the script,
snmpset -c public -v 1 192.168.0.0 1.3.6.1.4.1.14988.1.1.8.1.1.3.X s 1
X, script number, numeration starts from 1;
s 1, snmpset command to set value, value should not be equal to 0;
The same command on RouterOS,
/system script> print
Flags: I - invalid
0
name="kaka" owner="admin" policy=ftp,reboot,read,write,policy,
test,winbox,password,sniff last-started=jan/01/1970
01:31:57 run-count=23 source=:beep
/system script run 0

See Also
SNMP MRTG
[ Top | Back to Content ]

References
[1] http:/ / www. mikrotik. com/ thedude. php
[2] http:/ / mikrotik. com/ download/ Mikrotik. mib

309

Manual:Router AAA

310

Manual:Router AAA
Applies to RouterOS: 2.9, v3, v4, v5+

Summary
Sub-menu: /user
MikroTik RouterOS router user facility manage the users connecting the router from the local console, via serial
terminal, telnet, SSH or Winbox. The users are authenticated using either local database or designated RADIUS
server.
Each user is assigned to a user group, which denotes the rights of this user. A group policy is a combination of
individual policy items.
In case the user authentication is performed using RADIUS, the RADIUS Client should be previously configured.

User Groups
Sub-menu: /user group
The router user groups provide a convenient way to assign different permissions and access rights to different user
classes.

Properties
Property
name (string; Default: )

Description
The name of the user group

policy (local | telnet | ssh | ftp | reboot | read List of allowed policies:
| write | policy | test | web | sniff | api | winbox |
password | sensitive; Default: )

Manual:Router AAA

311

local - policy that grants rights to log in locally via console


telnet - policy that grants rights to log in remotely via telnet
ssh - policy that grants rights to log in remotely via secure shell protocol
ftp - policy that grants full rights to log in remotely via FTP and to transfer files from and to
the router. Users with this policy can both read, write and erase files, regardless of
"read/write" permission, as that deals only with RouterOS configuration.
reboot - policy that allows rebooting the router
read - policy that grants read access to the router's configuration. All console commands
that do not alter router's configuration are allowed. Doesn't affect FTP
write - policy that grants write access to the router's configuration, except for user
management. This policy does not allow to read the configuration, so make sure to enable
read policy as well
policy - policy that grants user management rights. Should be used together with write
policy
test - policy that grants rights to run ping, traceroute, bandwidth-test and wireless scan,
sniffer and snooper commands
web - policy that grants rights to log in remotely via WebBox
winbox - policy that grants rights to log in remotely via WinBox
password - policy that grants rights to change the password
sensitive - grants rights to see sensitive information in the router, see below list as to
what is regarded as sensitive.
api - grants rights to access router via API.
sniff - policy that grants rights to use packet sniffer tool.

Sensitive information
Starting with RouterOS v3.27, the following information is regarded as sensitive, and can be hidden from certain
user groups with the 'sensitive' policy unchecked.
Also, since RouterOS v4.3, backup files are considered sensitive, and users without this policy will not be able to
download them in any way.
system package
/radius: secret
/snmp/community: authentication-password, encryption-password
advanced-tools package
/tool/sms: secret
wireless package
/interface/wireless/security-profiles: wpa-pre-shared-key,
wpa2-pre-shared-key, static-key-0, static-key-1, static-key-2,
static-key-3, static-sta-private-key
/interface/wireless/access-list: private-key, private-pre-shared-key
wireless-test package
/interface/wireless/security-profiles: wpa-pre-shared-key, wpa2-pre-shared-key,
static-key-0, static-key-1, static-key-2, static-key-3, static-sta-private-key, management-protection-key
/interface/wireless/access-list: private-key, private-pre-shared-key, management-protection-key

user-manager package
/tool/user-manager/user: password
/tool/user-manager/customer: password

Manual:Router AAA
hotspot package
/ip/hotspot/user: password
ppp package
/ppp/secret: password
security package
/ip/ipsec/installed-sa: auth-key, enc-key
/ip/ipsec/manual-sa: ah-key, esp-auth-key, esp-enc-key
/ip/ipsec/peer: secret
routing package
/routing/bgp/peer: tcp-md5-key
/routing/rip/interface: authentication-key
/routing/ospf/interface: authentication-key
/routing/ospf/virtual-link: authentication-key
routing-test package
/routing/bgp/peer: tcp-md5-key
/routing/rip/interface: authentication-key
/routing/ospf/interface: authentication-key
/routing/ospf/virtual-link: authentication-key

Notes
There are three system groups which cannot be deleted:
[admin@rb13] > /user group print
0 name="read" policy=local,telnet,ssh,reboot,read,test,winbox,password,web,!ftp,!write,!policy

1 name="write" policy=local,telnet,ssh,reboot,read,write,test,winbox,password,web,!ftp,!policy

2 name="full" policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web

3 name="test" policy=ssh,read,policy,!local,!telnet,!ftp,!reboot,!write,!test,!winbox,!password,!web
[admin@rb13] >

Exclamation sign '!' just before policy item name means NOT.

Example
To add reboot group that is allowed to reboot the router locally or using telnet, as well as read the router's
configuration, enter the following command:
[admin@rb13] user group> add name=reboot policy=telnet,reboot,read,local
[admin@rb13] user group> print
0 name="read" policy=local,telnet,ssh,reboot,read,test,winbox,password,web,!ftp,!write,!policy

1 name="write" policy=local,telnet,ssh,reboot,read,write,test,winbox,password,web,!ftp,!policy

312

Manual:Router AAA

313

2 name="full" policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web

3 name="reboot" policy=local,telnet,reboot,read,!ssh,!ftp,!write,!policy,!test,!winbox,!password,!web
[admin@rb13] user group>

Router Users
Sub-menu: /user
Router user database stores the information such as username, password, allowed access addresses and group about
router management personnel.

Properties
Property

Description

address (IP/mask | IPv6


prefix; Default: )

Host or network address from which the user is allowed to log in

group (string; Default: )

Name of the group the user belongs to

name (string; Default: )

User name. Although it must start with an alphanumeric character, it may contain "*", "_", "." and "@" symbols.

password (string; Default: ) User password. If not specified, it is left blank (hit [Enter] when logging in). It conforms to standard Unix
characteristics of passwords and may contain letters, digits, "*" and "_" symbols.

Notes
There is one predefined user with full access rights:
[admin@MikroTik] user> print
Flags: X - disabled
#
NAME
0
;;; system default user
admin

GROUP ADDRESS
full

0.0.0.0/0

[admin@MikroTik] user>
There always should be at least one user with fulls access rights. If the user with full access rights is the only one, it
cannot be removed.

Monitoring Active Users


Sub-menu: /user active
/user active print command shows the currently active users along with respective statisics information.

Properties
All properties are read-only.

Manual:Router AAA

314

Property

Description

address (IP/IPv6 address)

Host IP/IPv6 address from which the user is accessing the router. 0.0.0.0 means that user is logged in
locally

group (string)

Group that user belongs to.

name (string)

User name.

radius (true | false)

Whether user is authenticated by RADIUS server.

via (console | telnet | ssh |winbox | api |


web)

User's access method

when (time)

Time and date when user logged in.

Example
To print currently active users, enter the following command:
[admin@dzeltenais_burkaans] /user active> print detail
Flags: R - radius
0

when=dec/08/2010 16:19:24 name="admin" address=10.5.8.52 via=winbox

when=dec/09/2010 09:23:04 name="admin" address=10.5.101.38 via=telnet

when=dec/09/2010 09:34:27 name="admin" address=fe80::21a:4dff:fe5d:8e56 via=api

Remote AAA
Sub-menu: /user aaa
Router user remote AAA enables router user authentication and accounting via RADIUS server. The RADIUS user
database is consulted only if the required username is not found in the local user database

Properties
Property

Description

accounting (yes | no; Default:


yes)
exclude-groups (list of group
names; Default: )

Exclude-groups consists of the groups that should not be allowed to be used for users authenticated by
radius. If radius server provides group specified in this list, default-group will be used instead.
This is to protect against privilege escalation when one user (without policy permission) can change radius
server list, setup it's own radius server and log in as admin.

default-group (string; Default: User group used by default for users authenticated via RADIUS server.
read)
interim-update (time; Default: Interim-Update time interval
0s)
use-radius (yes |no; Default: no) Enable user authentication via RADIUS

Manual:Router AAA

315
Note: If you are using RADIUS, you need to have CHAP support enabled in the RADIUS server for Winbox
to work

SSH Keys
Sub-menu: /user ssh-keys
This menu allows to import public keys used for ssh authentication.
Warning: User is not allowed to login via ssh by password if ssh-keys for the user is added

Properties:

Property

Description

user (string; Default: ) username to which ssh key is assigned.

Read-only properties:
Property

Description

key-owner (string)

When importing ssh key by /user ssh-keys import command you will be asked for two parameters:
public-key-file - file name in routers root directory containing the key.
user - name of the user to which key will be assigned

Private keys
Sub-menu: /user ssh-keys private
This menu is used to import and list imported private keys. Private keys are used to authenticate remote login
attempts using certificates.
Read-only properties:
Property

Description

user (string)
key-owner (string)

When importing ssh keys from this sub menu using /user ssh-keys private import command you will be
asked for three parameters:
private-key-file - file name in routers root directory containing private key.
public-key-file - file name in routers root directory containing public key.
user - name of the user to which key will be assigned

Manual:Router AAA

316

Example
Read full example >>

Manual:RADIUS Client
Applies to RouterOS: 2.9, v3, v4, v5

Summary
Sub-menu: /radius
Standards: RADIUS RFC 2865
RADIUS, short for Remote Authentication Dial-In User Service, is a remote server that provides authentication and
accounting facilities to various network apliances. RADIUS authentication and accounting gives the ISP or network
administrator ability to manage PPP user access and accounting from one server throughout a large network. The
MikroTik RouterOS has a RADIUS client which can authenticate for HotSpot, PPP, PPPoE, PPTP, L2TP and ISDN
connections. The attributes received from RADIUS server override the ones set in the default profile, but if some
parameters are not received they are taken from the respective default profile.
The RADIUS server database is consulted only if no matching user acces record is found in router's local database.
Traffic is accounted locally with MikroTik Traffic Flow and Cisco IP pairs and snapshot image can be gathered
using Syslog utilities. If RADIUS accounting is enabled, accounting information is also sent to the RADIUS server
default for that service.

Radius Client
This sub-menu allows to add/remove radius clients.
Note: The order of added items in this list is significant.

Properties

Manual:RADIUS Client

317

Property

Description

accounting-backup (yes | no; Default: no)

Whether configuration is for backup RADIUS server

accounting-port (integer [1..65535]; Default:


1813)

RADIUS server port used for accounting

address (IPv4/IPv6 address; Default: 0.0.0.0)

IPv4 or IPv6 address of RADIUS server.

authentication-port (integer [1..65535];


Default: 1812)

RADIUS server port used for authentication.

called-id (string; Default: )

Value depends on Point-to-Point protocol: PPPoE - service name, PPTP - server's IP


address, L2TP - server's IP address.

comment (string; Default: )


disabled (yes | no; Default: no)
domain (string; Default: )

Microsoft Windows domain of client passed to RADIUS servers that require domain
validation.

realm (string; Default: )

Explicitly stated realm (user domain), so the users do not have to provide proper ISP
domain name in user name.

secret (string; Default: )

Shared secret used to access the RADIUS server.

service (ppp|login|hotspot|wireless|dhcp; Default: ) Router services that will use this RADIUS server:

hotspot - HotSpot authentication service


login - router's local user authentication
ppp - Point-to-Point clients authentication
wireless - wireless client authentication (client's MAC address is sent as
User-Name)
dhcp - DHCP protocol client authentication (client's MAC address is sent as
User-Name)

src-address (ipv4/ipv6 address; Default: 0.0.0.0)

Source IP/IPv6 address of the packets sent to RADIUS server

timeout (time; Default: 100ms)

Timeout after which the request should be resend

Note: Microsoft Windows clients send their usernames in form domain\username

Note: When RADIUS server is authenticating user with CHAP, MS-CHAPv1, MS-CHAPv2, it is not using
shared secret, secret is used only in authentication reply, and router is verifying it. So if you have wrong
shared secret, RADIUS server will accept request, but router won't accept reply. You can see that with /radius
monitor command, "bad-replies" number should increase whenever somebody tries to connect.

Manual:RADIUS Client

Example
To set a RADIUS server for HotSpot and PPP services that has 10.0.0.3 IP address and ex shared secret, you need to
do the following:
[admin@MikroTik] radius> add service=hotspot,ppp address=10.0.0.3 secret=ex
[admin@MikroTik] radius> print
Flags: X - disabled
#
SERVICE
CALLED-ID
DOMAIN
ADDRESS
SECRET
0
ppp,hotspot
10.0.0.3
ex
[admin@MikroTik] radius>
AAA for the respective services should be enabled too:
[admin@MikroTik] radius> /ppp aaa set use-radius=yes
[admin@MikroTik] radius> /ip hotspot profile set default use-radius=yes
To view some statistics for a client:
[admin@MikroTik] radius> monitor 0
pending: 0
requests: 10
accepts: 4
rejects: 1
resends: 15
timeouts: 5
bad-replies: 0
last-request-rtt: 0s
[admin@MikroTik] radius>

Connection Terminating from RADIUS


Sub-menu: /radius incoming
This facility supports unsolicited messages sent from RADIUS server. Unsolicited messages extend RADIUS
protocol commands, that allow to terminate a session which has already been connected from RADIUS server. For
this purpose DM (Disconnect-Messages) are used. Disconnect messages cause a user session to be terminated
immediately.
Note: RouterOS doesn't support POD (Packet of Disconnect) the other RADIUS access request packet that
performs a similar function as Disconnect Messages

318

Manual:RADIUS Client

319

Properties
Property

Description

accept (yes | no; Default: no) Whether to accept the unsolicited messages
port (integer; Default: 1700) The port number to listen for the requests on

Supported RADIUS Attributes


Here you can download the RADIUS reference dictionary, which incorporates all the needed RADIUS attributes.
This dictionary is the minimal dictionary, which is enough to support all features of MikroTik RouterOS. It is
designed for FreeRADIUS [1], but may also be used with many other UNIX RADIUS servers (eg. XTRadius [2]).
Note: it may conflict with the default configuration files of RADIUS server, which have references to the
Attributes, absent in this dictionary. Please correct the configuration files, not the dictionary, as no other
Attributes are supported by MikroTik RouterOS.

There is also the RADIUS MikroTik specific dictionary that can be included in an existing
dictionary to support MikroTik vendor-specific Attributes.

Definitions
PPPs - PPP, PPTP, PPPoE and ISDN
default configuration - settings in default profile (for PPPs) or HotSpot server settings (for HotSpot)

Access-Request

Service-Type - always is "Framed" (only for PPPs)


Framed-Protocol - always is "PPP" (only for PPPs)
NAS-Identifier - router identity
NAS-IP-Address - IP address of the router itself
NAS-Port - unique session ID
Acct-Session-Id - unique session ID
NAS-Port-Type - async PPP - "Async"; PPTP and L2TP - "Virtual"; PPPoE - "Ethernet"; ISDN - "ISDN
Sync"; HotSpot - "Ethernet | Cable | Wireless-802.11" (according to the value of nas-port-type parameter in /ip
hotspot p
Calling-Station-Id - PPPoE and HotSpot- client MAC address in capital letters; PPTP and L2TP - client
public IP address; ISDN - client MSN
Called-Station-Id - PPPoE - service name; PPTP and L2TP - server IP address; ISDN - interface MSN;
HotSpot - name of the HotSpot server
NAS-Port-Id - async PPP - serial port name; PPPoE - ethernet interface name on which server is running;
HotSpot - name of the physical HotSpot interface (if bridged, the bridge port name is showed here); not present
for ISDN, PPTP and L2TP
Framed-IP-Address - IP address of HotSpot client after Universal Client translation
Mikrotik-Host-IP - IP address of HotSpot client before Universal Client translation (the original IP address
of the client)

User-Name - client login name


MS-CHAP-Domain - User domain, if present
Mikrotik-Realm - If it is set in /radius menu, it is included in every RADIUS request as Mikrotik-Realm
attribute. If it is not set, the same value is sent as in MS-CHAP-Domain attribute (if MS-CHAP-Domain is
missing, Realm is not included neither)

Manual:RADIUS Client
WISPr-Location-ID - text string specified in radius-location-id property of the HotSpot server
WISPr-Location-Name - text string specified in radius-location-name property of the HotSpot server
WISPr-Logoff-URL - full link to the login page (for example, http://10.48.0.1/lv/logout)
Depending on authentication methods (NOTE: HotSpot uses CHAP by default and may use also PAP if unencrypted
passwords are enabled, it can not use MSCHAP):
User-Password - encrypted password (used with PAP authentication)
CHAP-Password, CHAP-Challenge - encrypted password and challenge (used with CHAP authentication)
MS-CHAP-Response, MS-CHAP-Challenge - encrypted password and challenge (used with MS-CHAPv1
authentication)
MS-CHAP2-Response, MS-CHAP-Challenge - encrypted password and challenge (used with
MS-CHAPv2 authentication)

Access-Accept
Framed-IP-Address - IP address given to client. If address belongs to 127.0.0.0/8 or 224.0.0.0/3 networks,
IP pool is used from the default profile to allocate client IP address. If Framed-IP-Address is specified,
Framed-Pool is ignored
Framed-IP-Netmask - client netmask. PPPs - if specified, a route will be created to the network
Framed-IP-Address belongs to via the Framed-IP-Address gateway; HotSpot - ignored by HotSpot
Framed-Pool - IP pool name (on the router) from which to get IP address for the client. If Framed-IP-Address
is specified, this attribute is ignored
Framed-IPv6-Prefix - Ipv6 prefix assigned for the client. Added in v5.8
Mikrotik-Delegated-IPv6-Pool - IPv6 pool used for Prefix Delegation. Added in v5.9
NOTE: if Framed-IP-Address or Framed-Pool is specified it overrides remote-address in default configuration
Idle-Timeout - overrides idle-timeout in the default configuration
Session-Timeout - overrides session-timeout in the default configuration
Port-Limit - maximal mumber of simultaneous connections using the same username (overrides te
shared-users property of the HotSpot user profile)
Class - cookie, will be included in Accounting-Request unchanged
Framed-Route - routes to add on the server. Format is specified in RFC 2865 (Ch. 5.22), can be specified as
many times as needed
Filter-Id - firewall filter chain name. It is used to make a dynamic firewall rule. Firewall chain name can
have suffix .in or .out, that will install rule only for incoming or outgoing traffic. Multiple Filter-id can be
provided, but only last ones for incoming and outgoing is used. For PPPs - filter rules in ppp chain that will jump
to the specified chain, if a packet has come to/from the client (that means that you should first create a ppp chain
and make jump rules that would put actual traffic to this chain). The same applies for HotSpot, but the rules will
be created in hotspot chain
Mikrotik-Mark-Id - firewall mangle chain name (HotSpot only). The MikroTik RADIUS client upon
receiving this attribute creates a dynamic firewall mangle rule with action=jump chain=hotspot and jump-target
equal to the atribute value. Mangle chain name can have suffixes .in or .out, that will install rule only for
incoming or outgoing traffic. Multiple Mark-id attributes can be provided, but only last ones for incoming and
outgoing is used.
Acct-Interim-Interval - interim-update for RADIUS client. PPP - if 0 uses the one specified in RADIUS
client; HotSpot - only respected if radius-interim-update=received in HotSpot server profile
MS-MPPE-Encryption-Policy - require-encryption property (PPPs only)
MS-MPPE-Encryption-Types - use-encryption property, non-zero value means to use encryption (PPPs
only)

320

Manual:RADIUS Client
Ascend-Data-Rate - tx/rx data rate limitation if multiple attributes are provided, first limits tx data rate,
second - rx data rate. If used together with Ascend-Xmit-Rate, specifies rx rate. 0 if unlimited. Ignored if
Rate-Limit attribute is present
Ascend-Xmit-Rate - tx data rate limitation. It may be used to specify tx limit only instead of sending two
sequental Ascend-Data-Rate attributes (in that case Ascend-Data-Rate will specify the receive rate). 0 if
unlimited. Ignored if Rate-Limit attribute is present
MS-CHAP2-Success - auth. response if MS-CHAPv2 was used (for PPPs only)
MS-MPPE-Send-Key, MS-MPPE-Recv-Key - encryption keys for encrypted PPPs provided by RADIUS
server only is MS-CHAPv2 was used as authentication (for PPPs only)
Ascend-Client-Gateway - client gateway for DHCP-pool HotSpot login method (HotSpot only)
Mikrotik-Recv-Limit - total receive limit in bytes for the client
Mikrotik-Recv-Limit-Gigawords - 4G (2^32) bytes of total receive limit (bits 32..63, when bits 0..31
are delivered in Mikrotik-Recv-Limit)
Mikrotik-Xmit-Limit - total transmit limit in bytes for the client
Mikrotik-Xmit-Limit-Gigawords - 4G (2^32) bytes of total transmit limit (bits 32..63, when bits 0..31
are delivered in Mikrotik-Recv-Limit)
Mikrotik-Wireless-Forward - not forward the client's frames back to the wireless infrastructure if this
attribute is set to "0" (Wireless only)
Mikrotik-Wireless-Skip-Dot1x - disable 802.1x authentication for the particulat wireless client if set to
non-zero value (Wireless only)
Mikrotik-Wireless-Enc-Algo - WEP encryption algorithm: 0 - no encryption, 1 - 40-bit WEP, 2 104-bit WEP (Wireless only)
Mikrotik-Wireless-Enc-Key - WEP encruption key for the client (Wireless only)
Mikrotik-Rate-Limit - Datarate limitation for clients. Format is: rx-rate[/tx-rate]
[rx-burst-rate[/tx-burst-rate] [rx-burst-threshold[/tx-burst-threshold] [rx-burst-time[/tx-burst-time] [priority]
[rx-rate-min[/tx-rate-min]]]] from the point of view of the router (so "rx" is client upload, and "tx" is client
download). All rates should be numbers with optional 'k' (1,000s) or 'M' (1,000,000s). If tx-rate is not specified,
rx-rate is as tx-rate too. Same goes for tx-burst-rate and tx-burst-threshold and tx-burst-time. If both
rx-burst-threshold and tx-burst-threshold are not specified (but burst-rate is specified), rx-rate and tx-rate is used
as burst thresholds. If both rx-burst-time and tx-burst-time are not specified, 1s is used as default. Priority takes
values 1..8, where 1 implies the highest priority, but 8 - the lowest. If rx-rate-min and tx-rate-min are not specified
rx-rate and tx-rate values are used. The rx-rate-min and tx-rate-min values can not exceed rx-rate and tx-rate
values.
Mikrotik-Group - Router local user group name (defines in /user group) for local users. HotSpot default
profile for HotSpot users.
Mikrotik-Advertise-URL - URL of the page with advertisements that should be displayed to clients. If this
attribute is specified, advertisements are enabled automatically, including transparent proxy, even if they were
explicitly disabled in the corresponding user profile. Multiple attribute instances may be send by RADIUS server
to specify additional URLs which are choosen in round robin fashion.
Mikrotik-Advertise-Interval - Time interval between two adjacent advertisements. Multiple attribute
instances may be send by RADIUS server to specify additional intervals. All interval values are threated as a list
and are taken one-by-one for each successful advertisement. If end of list is reached, the last value is continued to
be used.
WISPr-Redirection-URL - URL, which the clients will be redirected to after successfull login
WISPr-Bandwidth-Min-Up - minimal datarate (CIR) provided for the client upload
WISPr-Bandwidth-Min-Down - minimal datarate (CIR) provided for the client download
WISPr-Bandwidth-Max-Up - maxmal datarate (MIR) provided for the client upload

321

Manual:RADIUS Client
WISPr-Bandwidth-Max-Down - maxmal datarate (MIR) provided for the client download
WISPr-Session-Terminate-Time - time, when the user should be disconnected; in
"YYYY-MM-DDThh:mm:ssTZD" form, where Y - year; M - month; D - day; T - separator symbol (must be
written between date and time); h - hour (in 24 hour format); m - minute; s - second; TZD - time zone in one of
these forms: "+hh:mm", "+hhmm", "-hh:mm", "-hhmm"
Note: the received attributes override the default ones (set in the default profile), but if an attribute is not
received from RADIUS server, the default one is to be used.

Rate-Limit takes precedence over all other ways to specify data rate for the client. Ascend data rate
attributes are considered second; and WISPr attributes takes the last precedence.
Here are some Rate-Limit examples:

128k - rx-rate=128000, tx-rate=128000 (no bursts)


64k/128M - rx-rate=64000, tx-rate=128000000
64k 256k - rx/tx-rate=64000, rx/tx-burst-rate=256000, rx/tx-burst-threshold=64000, rx/tx-burst-time=1s
64k/64k 256k/256k 128k/128k 10/10 - rx/tx-rate=64000, rx/tx-burst-rate=256000,
rx/tx-burst-threshold=128000, rx/tx-burst-time=10s

Accounting-Request
The accounting request carries the same attributes as Access Request, plus these ones:

Acct-Status-Type - Start, Stop, or Interim-Update


Acct-Authentic - either authenticated by the RADIUS or Local authority (PPPs only)
Class - RADIUS server cookie, as received in Access-Accept
Acct-Delay-Time - how long does the router try to send this Accounting-Request packet

Stop and Interim-Update Accounting-Request


Additionally to the accounting start request, the following messages will contain the following attributes:
Acct-Session-Time - connection uptime in seconds
Acct-Input-Octets - bytes received from the client
Acct-Input-Gigawords - 4G (2^32) bytes received from the client (bits 32..63, when bits 0..31 are
delivered in Acct-Input-Octets)
Acct-Input-Packets - nubmer of packets received from the client
Acct-Output-Octets - bytes sent to the client
Acct-Output-Gigawords - 4G (2^32) bytes sent to the client (bits 32..63, when bits 0..31 are delivered in
Acct-Output-Octets)
Acct-Output-Packets - number of packets sent to the client

322

Manual:RADIUS Client

323

Stop Accounting-Request
These packets will, additionally to the Interim Update packets, have:
Acct-Terminate-Cause - session termination cause (see RFC 2866 ch. 5.10)

Change of Authorization
RADIUS disconnect and Change of Authorization (according to RFC3576) are supported as well. These attributes
may be changed by a CoA request from the RADIUS server:

Mikrotik-Group
Mikrotik-Recv-Limit
Mikrotik-Xmit-Limit
Mikrotik-Rate-Limit
Ascend-Data-Rate (only if Mikrotik-Rate-Limit is not present)
Ascend-XMit-Rate (only if Mikrotik-Rate-Limit is not present)
Mikrotik-Mark-Id
Filter-Id
Mikrotik-Advertise-Url

Mikrotik-Advertise-Interval
Session-Timeout
Idle-Timeout
Port-Limit

Note that it is not possible to change IP address, pool or routes that way - for such changes a user must be
disconnected first.

MikroTik Specific RADIUS Attribute Numeric Values


Click here to get plain text attribute list of MikroTik specific attributes (FreeRadius comaptible) .
Name

VendorID Value RFC

MIKROTIK_RECV_LIMIT

14988

MIKROTIK_XMIT_LIMIT

14988

MIKROTIK_GROUP

14988

MIKROTIK_WIRELESS_FORWARD

14988

MIKROTIK_WIRELESS_SKIPDOT1X

14988

MIKROTIK_WIRELESS_ENCALGO

14988

MIKROTIK_WIRELESS_ENCKEY

14988

MIKROTIK_RATE_LIMIT

14988

MIKROTIK_REALM

14988

MIKROTIK_HOST_IP

14988

10

MIKROTIK_MARK_ID

14988

11

MIKROTIK_ADVERTISE_URL

14988

12

MIKROTIK_ADVERTISE_INTERVAL

14988

13

MIKROTIK_RECV_LIMIT_GIGAWORDS

14988

14

MIKROTIK_XMIT_LIMIT_GIGAWORDS

14988

15

MIKROTIK_WIRELESS_PSK

14988

16

Manual:RADIUS Client

324
MIKROTIK_TOTAL_LIMIT

14988

17

MIKROTIK_TOTAL_LIMIT_GIGAWORDS 14988

18

MIKROTIK_ADDRESS_LIST

14988

19

MIKROTIK_WIRELESS_MPKEY

14988

20

MIKROTIK_WIRELESS_COMMENT

14988

21

MIKROTIK_DELEGATED_IPV6_POOL

14988

22

All Supported Attribute Numeric Values


Note: FreeRadius already has these attributes predefined. If you are using other radius server then use table
below to create dictionary file

Name

VendorID Value

RFC

Acct-Authentic

45

RFC 2866

Acct-Delay-Time

41

RFC 2866

Acct-Input-Gigawords

52

RFC 2869

Acct-Input-Octets

42

RFC 2866

Acct-Input-Packets

47

RFC 2866

Acct-Interim-Interval

85

RFC 2869

Acct-Output-Gigawords

53

RFC 2869

Acct-Output-Octets

43

RFC 2866

Acct-Output-Packets

48

RFC 2866

Acct-Session-Id

44

RFC 2866

Acct-Session-Time

46

RFC 2866

Acct-Status-Type

40

RFC 2866

Acct-Terminate-Cause

49

RFC 2866

Ascend-Client-Gateway

529

132

Ascend-Data-Rate

529

197

Ascend-Xmit-Rate

529

255

Called-Station-Id

30

RFC 2865

Calling-Station-Id

31

RFC 2865

CHAP-Challenge

60

RFC 2866

CHAP-Password

RFC 2865

Class

25

RFC 2865

Filter-Id

11

RFC 2865

Framed-IP-Address

RFC 2865

Framed-IP-Netmask

RFC 2865

Framed-IPv6-Prefix

97

RFC 3162

Manual:RADIUS Client

325
Framed-Pool

88

RFC 2869

Framed-Protocol

RFC 2865

Framed-Route

22

RFC 2865

Idle-Timeout

28

RFC 2865

MS-CHAP-Challenge

311

11

RFC 2548

MS-CHAP-Domain

311

10

RFC 2548

MS-CHAP-Response

311

RFC 2548

MS-CHAP2-Response

311

25

RFC 2548

MS-CHAP2-Success

311

26

RFC 2548

MS-MPPE-Encryption-Policy

311

RFC 2548

MS-MPPE-Encryption-Types

311

RFC 2548

MS-MPPE-Recv-Key

311

17

RFC 2548

MS-MPPE-Send-Key

311

16

RFC 2548

NAS-Identifier

32

RFC 2865

NAS-Port

RFC 2865

NAS-IP-Address

RFC 2865

NAS-Port-Id

87

RFC 2869

NAS-Port-Type

61

RFC 2865

Port-Limit

62

RFC 2865

Redback-Agent-Remote-Id

2352

96

Redback-Agent-Circuit-Id

2352

97

Service-Type

RFC 2865

Session-Timeout

27

RFC 2865

User-Name

RFC 2865

User-Password

RFC 2865

WISPr-Bandwidth-Max-Down

14122

wi-fi.org

WISPr-Bandwidth-Max-Up

14122

wi-fi.org

WISPr-Bandwidth-Min-Down

14122

wi-fi.org

WISPr-Bandwidth-Min-Up

14122

wi-fi.org

WISPr-Location-Id

14122

wi-fi.org

WISPr-Location-Name

14122

wi-fi.org

WISPr-Logoff-URL

14122

wi-fi.org

WISPr-Redirection-URL

14122

wi-fi.org

WISPr-Session-Terminate-Time 14122

wi-fi.org

Manual:RADIUS Client

Troubleshooting
My radius server accepts authentication request from the client with "Auth: Login OK:...", but the user cannot log
on. The bad replies counter is incrementing under radius monitor.
This situation can occur, if the radius client and server have high delay link between them. Try to increase the
radius client's timeout to 600ms or more instead of the default 300ms! Also, double check, if the secrets match
on client and server!
[ Top | Back to Content ]

References
[1] http:/ / freeradius. org
[2] http:/ / xtradius. sourceforge. net/

Manual:Hotspot Introduction
Summary
HotSpot is a way to authorize users to access some network resources, but does not provide traffic encryption. To log
in, users may use almost any web browser (either HTTP or HTTPS protocol), so they are not required to install
additional software. The gateway is accounting the uptime and amount of traffic each client have used, and also can
send this information to a RADIUS server. The HotSpot system may limit each particular user's bitrate, total amount
of traffic, uptime and some other parameters mentioned further in this document.
The HotSpot system is targeted to provide authentication within a local network (for the local network users to
access the Internet), but may as well be used to authorize access from outer networks to access local resources (like
an authentication gateway for the outside world to access your network). It is possible to allow users to access some
web pages without authentication using Walled Garden feature.

Getting an Address
First of all, a client have to get an IP address. It may be set on the client statically, or leased from a DHCP server.
The DHCP server may provide ways of binding lent IP addresses to clients MAC addresses, if required. The HotSpot
system does not care how client get an address before he/she gets to the HotSpot login page.
Moreover, HotSpot server may automatically and transparently change any IP address (yes, meaning really any IP
address) of a client to a valid unused address from the selected IP pool. If a user is able to get his/her Internet
connection working at their place, he/she will be able to get his/her connection working in the HotSpot network. This
feature gives a possibility to provide a network access (for example, Internet access) to mobile clients that are not
willing (or are disallowed, not qualified enough or otherwise unable) to change their networking settings. The users
will not notice the translation (i.e., there will not be any changes in the users' config), but the router itself will see
completely different (from what is actually set on each client) source IP addresses on packets sent from the clients
(even the firewall mangle table will 'see' the translated addresses). This technique is called one-to-one NAT, but is
also known as "Universal Client" as that is how it was called in the RouterOS version 2.8.
One-to-one NAT accepts any incoming address from a connected network interface and performs a network address
translation so that data may be routed through standard IP networks. Clients may use any preconfigured addresses. If
the one-to-one NAT feature is set to translate a client's address to a public IP address, then the client may even run a
server or any other service that requires a public IP address. This NAT is changing source address of each packet just
after it is received by the router (it is like source NAT that is performed early in the packet path, so that even firewall

326

Manual:Hotspot Introduction
mangle table, which normally 'sees' received packets unaltered, can only 'see' the translated address).
Note: arp mode must be enabled on the interface where one-to-one NAT is used

Before the authentication


When enabling HotSpot on an interface, the system automatically sets up everything needed to
show login page for all clients that are not logged in. This is done by adding dynamic destination
NAT rules, which you can observe on a working HotSpot system. These rules are needed to redirect all HTTP and
HTTPS requests from unauthorized users to the HotSpot authentication proxy. Other rules that are also inserted, will
be described later in a special section of this manual.
In most common setup, opening any HTTP page will bring up the HotSpot servlet login page (which can be
customized extensively, as described later on). As normal user behavior is to open web pages by their DNS names, a
valid DNS configuration should be set up on the HotSpot gateway itself (it is possible to reconfigure the gateway so
that it will not require local DNS configuration, but such a configuration is impractical and thus not recommended).

Walled Garden
You may wish not to require authorization for some services (for example to let clients access the web server of your
company without registration), or even to require authorization only to a number of services (for example, for users
to be allowed to access an internal file server or another restricted area). This can be done by setting up Walled
Garden system.
When a not logged-in user requests a service allowed in the Walled Garden configuration, the HotSpot gateway does
not intercept it, or in case of HTTP, simply redirects the request to the original destination. Other requests are
redirected to the HotSpot servlet (login page infrastructure). When a user is logged in, there is no effect of this table
on him/her.
Walled Garden for HTTP requests is using the embedded proxy server . This means that all the configured
parameters of that proy server will also be effective for the WalledGarden clients (as well as for all clients that have
transparent proxy enabled)

Authentication
There are currently 6 different authentication methods. You can use one or more of them simultaneously:
HTTP PAP - simplest method, which shows the HotSpot login page and expect to get the authentication info (i.e.
username and password) in plain text. Another use of this method is the possibility of hard-coded authentication
information in the servlet's login page simply creating the appropriate link.
Note: passwords are not encrypted when transferred over the network
HTTP CHAP - standard method, which includes CHAP challenge in the login page. The
CHAP MD5 hash challenge is used together with the user's password for computing the string
which will be sent to the HotSpot gateway. The hash result (as a password) together with
username is sent over network to HotSpot service (so, password is never sent in plain text over
IP network). On the client side, MD5 algorithm is implemented in JavaScript applet, so if a browser does not
support JavaScript (like, for example, Internet Explorer 2.0 or some PDA browsers) or it has JavaScipt disabled, it
will not be able to authenticate users. It is possible to allow unencrypted passwords to be accepted by turning on
HTTP PAP authentication method, but it is not recommended due to security considerations.
HTTPS - the same as HTTP PAP, but uses SSL protocol to encrypt transmissions. HotSpot user just sends his/her
password without additional hashing (note that there is no need to worry about plain-text password exposure over
the network, as the transmission itself is encrypted). In either case, HTTP POST method (if not possible, then -

327

Manual:Hotspot Introduction
HTTP GET method) is used to send data to the HotSpot gateway.
HTTP cookie - after each successful login, a cookie is sent to the web browser and the same cookie is added to
active HTTP cookie list. Next time the same user will try to log in, web browser will send the saved HTTP
cookie. This cookie will be compared with the one stored on the HotSpot gateway and only if source MAC
address and randomly generated ID matches the ones stored on the gateway, user will be automatically logged in
using the login information (username and password pair) was used when the cookie was first generated.
Otherwise, the user will be prompted to log in, and in the case authentication is successful, old cookie will be
removed from the local HotSpot active cookie list and the new one with different random ID and expiration time
will be added to the list and sent to the web browser. It is also possible to erase cookie on user manual logoff (not
in the default server pages, but you can modify them to perform this). This method may only be used together
with HTTP PAP, HTTP CHAP or HTTPS methods as there would be nothing to generate cookies in the first
place otherwise.
MAC address - try to authenticate clients as soon as they appear in the hosts list (i.e., as soon as they have sent
any packet to the HotSpot server), using client's MAC address as username.
Trial - users may be allowed to use the service free of charge for some period of time for evaluation, and be
required to authenticate only after this period is over. HotSpot can be configured to allow some amount of time
per MAC address to be freely used with some limitations imposed by the provided user profile. In case the MAC
address still has some trial time unused, the login page will contain the link for trial login. The time is
automatically reset after the configured amount of time (so that, for example, any MAC address may use 30
minutes a day without ever registering). The username of such a user (as seen in the active user table and in the
login link) is "T-XX:XX:XX:XX:XX:XX" (where XX:XX:XX:XX:XX:XX is his/her MAC address). The
authentication procedure will not ask RADIUS server permission to authorise such a user.
HotSpot can authenticate users consulting the local user database or a RADIUS server (local database is consulted
first, then - a RADIUS server). In case of HTTP cookie authentication via RADIUS server, the router will send the
same information to the server as it was used when the cookie was first generated. If authentication is done locally,
profile corresponding to that user is used, otherwise (in case RADIUS reply did not contain the group for that user)
the default profile is used to set default values for parameters, which are not set in RADIUS access-accept message.
For more information on how the interaction with a RADIUS server works, see the respective manual section.
The HTTP PAP method also makes it possible to authenticate by requesting the page:
/login?username=username&password=password
In case you want to log in using telnet connection, the exact HTTP request would look like that:
GET /login?username=username&password=password HTTP/1.0
Note that the request is case-sensitive.

Authorization
After authentication user gets access to the Internet and receives some limitations (which are user profile specific).
HotSpot may also perform a one-to-one NAT for the client, so that a particular user would always receive the same
IP address regardless of what PC is used.
The system will automatically detect and redirect requests to a proxy server that client is using (if any; it may be set
in his/her settings to use an unknown proxy server) to the proxy server embedded in the router.
Authorization may be delegated to a RADIUS server, which delivers similar configuration options as the local
database. For any user requiring authorization, a RADIUS server gets queried first, and if no reply received, the local
database is examined. RADIUS server may send a Change of Authorization request according to standards to alter
the previously accepted parameters.

328

Manual:Hotspot Introduction

Advertisement
The same proxy used for unauthorized clients to provide Walled-Garden facility, may also be used for authorized
users to show them advertisement popups. Transparent proxy for authorized users allows to monitor http requests of
the clients and to take some action if required. It enables the possibility to open status page even if client is logged in
by mac address, as well as to show advertisements time after time
When the time has come to show an advertisement, the server redirects client's web browser to the status page. Only
requests, which provide html content, are redirected (images and other content will not be affected). The status page
displays the advertisement and next advertise-interval is used to schedule next advertisement. If status page is unable
to display an advertisement for configured timeout starting from moment, when it is scheduled to be shown, client
access is blocked within walled-garden (just as unauthorized clients are). Client is unblocked when the scheduled
page is finally shown. Note that if popup windows are blocked in the browser, the link on the status page may be
used to open the advertisement manually.
While client is blocked, FTP and other services are not allowed. Thus requiring client to open an advertisement for
any Internet activity not especially allowed by the Walled-Garden.

Accounting
The HotSpot system implement accounting internally, you are not required to do anything special for it to work. The
accounting information for each user may be sent to a RADIUS server.

Configuration menus
/ip hotspot - HotSpot servers on particular interfaces (one server per interface). HotSpot server must be added in
this menu in order for HotSpot system to work on an interface /ip hotspot profile - HotSpot server profiles.
Settings, which affect login procedure for HotSpot clients are configured here. More than one HotSpot servers
may use the same profile
/ip hotspot host - dynamic list of active network hosts on all HotSpot interfaces. Here you can also find IP address
bindings of the one-to-one NAT
/ip hotspot ip-binding - rules for binding IP addresses to hosts on hotspot interfaces
/ip hotspot service-port - address translation helpers for the one-to-one NAT
/ip hotspot walled-garden - Walled Garden rules at HTTP level (DNS names, HTTP request substrings)
/ip hotspot walled-garden ip - Walled Garden rules at IP level (IP addresses, IP protocols)
/ip hotspot user - local HotSpot system users
/ip hotspot user profile - local HotSpot system users profiles (user groups)
/ip hotspot active - dynamic list of all authenticated HotSpot users
/ip hotspot cookie - dynamic list of all valid HTTP cookies
[ Top | Back to Content ]

329

Article Sources and Contributors

Article Sources and Contributors


Manual:First time startup Source: http://wiki.mikrotik.com/index.php?oldid=22160 Contributors: Jandrade28, Janisk, Kirshteins, Marisb, MarkSorensen, Nest, Normis, Rock on all you f little
dudes!, SergejsB
Manual:Console login process Source: http://wiki.mikrotik.com/index.php?oldid=21955 Contributors: Eep, Janisk, Marisb, Normis
Manual:Troubleshooting tools Source: http://wiki.mikrotik.com/index.php?oldid=22862 Contributors: Andriss, Janisk, Marisb, Normis
Manual:Connection oriented communication (TCP/IP) Source: http://wiki.mikrotik.com/index.php?oldid=19069 Contributors: Andriss, Marisb
Manual:RouterOS features Source: http://wiki.mikrotik.com/index.php?oldid=22206 Contributors: Janisk, Marisb, Megis, Normis, SergejsB, Uldis
Manual:Console Source: http://wiki.mikrotik.com/index.php?oldid=22857 Contributors: Eep, Janisk, Marisb, Normis
Manual:Winbox Source: http://wiki.mikrotik.com/index.php?oldid=21085 Contributors: Janisk, Marisb, Nz monkey
Manual:Webfig Source: http://wiki.mikrotik.com/index.php?oldid=23656 Contributors: Janisk, Marisb, Normis
Manual:License Source: http://wiki.mikrotik.com/index.php?oldid=23621 Contributors: Becs, Eep, Janisk, Marisb, Maximan, NathanA, Nest, Normis, SergejsB
Manual:Purchasing a License for RouterOS Source: http://wiki.mikrotik.com/index.php?oldid=21858 Contributors: Eep, Janisk, Marisb, Normis, SergejsB, Sunfire
Manual:Entering a RouterOS License key Source: http://wiki.mikrotik.com/index.php?oldid=16869 Contributors: Eep, Janisk, Ldvaden, Marisb, Nest, Normis
Manual:Default Configurations Source: http://wiki.mikrotik.com/index.php?oldid=23713 Contributors: Marisb, Normis
Manual:System/Packages Source: http://wiki.mikrotik.com/index.php?oldid=21218 Contributors: Enk, Janisk, Marisb, Normis, SergejsB
Manual:Upgrading RouterOS Source: http://wiki.mikrotik.com/index.php?oldid=23774 Contributors: Axtell, Eep, Janisk, Marisb, Normis, SergejsB
Manual:Netinstall Source: http://wiki.mikrotik.com/index.php?oldid=23025 Contributors: Janisk, Marisb, MarkSorensen, Normis, SergejsB
Manual:Configuration Management Source: http://wiki.mikrotik.com/index.php?oldid=23563 Contributors: Janisk, Marisb, Normis, SergejsB
Manual:Interface/Bonding Source: http://wiki.mikrotik.com/index.php?oldid=20456 Contributors: Janisk, Marisb, Normis
Manual:Interface/Bridge Source: http://wiki.mikrotik.com/index.php?oldid=22068 Contributors: Janisk, Kirshteins, Marisb
Manual:Interface/VRRP Source: http://wiki.mikrotik.com/index.php?oldid=20047 Contributors: Burek, Janisk, Marisb, Normis
Manual:Bonding Examples Source: http://wiki.mikrotik.com/index.php?oldid=19357 Contributors: Eep, Eugene, Marisb, Normis, Peson
Manual:VRRP-examples Source: http://wiki.mikrotik.com/index.php?oldid=21961 Contributors: Janisk, Marisb
Manual:Wireless AP Client Source: http://wiki.mikrotik.com/index.php?oldid=20439 Contributors: Marisb, SergejsB
Manual:Making a simple wireless AP Source: http://wiki.mikrotik.com/index.php?oldid=16483 Contributors: Marisb, Normis
Manual:Interface/VLAN Source: http://wiki.mikrotik.com/index.php?oldid=19562 Contributors: Janisk, Kirshteins, Marisb
Manual:IP/IPsec Source: http://wiki.mikrotik.com/index.php?oldid=23661 Contributors: Eep, Eugene, Janisk, Marisb, Normis, SacXs2, SergejsB
Manual:Interface/Gre Source: http://wiki.mikrotik.com/index.php?oldid=21702 Contributors: Marisb
Manual:Interface/PPPoE Source: http://wiki.mikrotik.com/index.php?oldid=23491 Contributors: Janisk, Marisb, Normis
Manual:Interface/PPTP Source: http://wiki.mikrotik.com/index.php?oldid=22895 Contributors: Janisk, Marisb, SergejsB
Manual:Interface/L2TP Source: http://wiki.mikrotik.com/index.php?oldid=23434 Contributors: Janisk, Marisb
Manual:IP/Address Source: http://wiki.mikrotik.com/index.php?oldid=20446 Contributors: Janisk, Marisb
Manual:IP/ARP Source: http://wiki.mikrotik.com/index.php?oldid=20824 Contributors: Janisk, Marisb
Manual:Load balancing multiple same subnet links Source: http://wiki.mikrotik.com/index.php?oldid=16963 Contributors: Janisk, Marisb
Manual:Simple Static Routing Source: http://wiki.mikrotik.com/index.php?oldid=21612 Contributors: Marisb, SergejsB
Manual:Virtual Routing and Forwarding Source: http://wiki.mikrotik.com/index.php?oldid=16975 Contributors: Eep, Janisk, Marisb, Normis, Route
Manual:IP/DHCP Server Source: http://wiki.mikrotik.com/index.php?oldid=22637 Contributors: Janisk, Marisb
Manual:IP/DHCP Client Source: http://wiki.mikrotik.com/index.php?oldid=22648 Contributors: Janisk, Marisb
Manual:IP/DHCP Relay Source: http://wiki.mikrotik.com/index.php?oldid=23521 Contributors: Janisk, Marisb
Manual:IP/Pools Source: http://wiki.mikrotik.com/index.php?oldid=17294 Contributors: Janisk, Marisb, Normis
Manual:OSPF Case Studies Source: http://wiki.mikrotik.com/index.php?oldid=23058 Contributors: Janisk, Marisb
Manual:OSPF-examples Source: http://wiki.mikrotik.com/index.php?oldid=22871 Contributors: Janisk, Marisb, Normis, Route
Manual:OSPF and Point-to-Point interfaces Source: http://wiki.mikrotik.com/index.php?oldid=17390 Contributors: Atis, Eep, Marisb
Manual:BGP Load Balancing with two interfaces Source: http://wiki.mikrotik.com/index.php?oldid=16878 Contributors: Janisk, Marisb, Route
Manual:IP/Firewall/Filter Source: http://wiki.mikrotik.com/index.php?oldid=22181 Contributors: Janisk, Kirshteins, Marisb, Normis, SergejsB
Manual:IP/Firewall/NAT Source: http://wiki.mikrotik.com/index.php?oldid=23043 Contributors: Janisk, Marisb, Normis, SergejsB
Manual:IP/Firewall/Mangle Source: http://wiki.mikrotik.com/index.php?oldid=22182 Contributors: Janisk, Marisb, Normis
Manual:IP/Firewall/Address list Source: http://wiki.mikrotik.com/index.php?oldid=17287 Contributors: Janisk, Marisb
Manual:IP/Firewall/Connection tracking Source: http://wiki.mikrotik.com/index.php?oldid=23655 Contributors: Janisk, Marisb, Normis
Manual:BGP Case Studies Source: http://wiki.mikrotik.com/index.php?oldid=16876 Contributors: Atis, Eep, Eugene, Hellbound, Janisk, Marisb, Route, SergejsB

330

Article Sources and Contributors


Manual:HTB Source: http://wiki.mikrotik.com/index.php?oldid=22317 Contributors: Eep, Janisk, Marisb, Megis, Normis
Manual:Queue Size Source: http://wiki.mikrotik.com/index.php?oldid=16951 Contributors: Janisk, Marisb, Megis
Manual:Queues - Burst Source: http://wiki.mikrotik.com/index.php?oldid=23428 Contributors: Eep, Janisk, Marisb, Megis, Normis
Manual:Queues - PCQ Source: http://wiki.mikrotik.com/index.php?oldid=21847 Contributors: Eep, Janisk, Marisb, Megis, Normis
Manual:Queues - PCQ Examples Source: http://wiki.mikrotik.com/index.php?oldid=23527 Contributors: Eep, Janisk, Marisb, Megis, Normis, Rieks, SergejsB, Wiki1981
Manual:System/Log Source: http://wiki.mikrotik.com/index.php?oldid=19957 Contributors: Janisk, Marisb, Normis
Manual:IP/Traffic Flow Source: http://wiki.mikrotik.com/index.php?oldid=22987 Contributors: Janisk, Marisb, Normis
Manual:SNMP Source: http://wiki.mikrotik.com/index.php?oldid=22814 Contributors: Janisk, Marisb, Normis, Uldis
Manual:Router AAA Source: http://wiki.mikrotik.com/index.php?oldid=22021 Contributors: Janisk, Marisb, Normis
Manual:RADIUS Client Source: http://wiki.mikrotik.com/index.php?oldid=22741 Contributors: Agris, Janisk, Marisb, Normis, SergejsB, Uldis
Manual:Hotspot Introduction Source: http://wiki.mikrotik.com/index.php?oldid=19393 Contributors: Marisb

331

Image Sources, Licenses and Contributors

Image Sources, Licenses and Contributors


Image:Version.png Source: http://wiki.mikrotik.com/index.php?title=File:Version.png License: unknown Contributors: Normis
File:Winbox-loader2.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-loader2.png License: unknown Contributors: Marisb
File:Winbox-workarea.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-workarea.png License: unknown Contributors: Marisb
File:Webfig-2.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-2.png License: unknown Contributors: Marisb
Image:image11001.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image11001.gif License: unknown Contributors: Andriss
Image:image11002.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image11002.gif License: unknown Contributors: Andriss
Image:Icon-note.png Source: http://wiki.mikrotik.com/index.php?title=File:Icon-note.png License: unknown Contributors: Marisb, Route
File:profiler.png Source: http://wiki.mikrotik.com/index.php?title=File:Profiler.png License: unknown Contributors: Marisb
Image:image2001.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image2001.gif License: unknown Contributors: Andriss
Image:image2002.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image2002.gif License: unknown Contributors: Andriss
Image:image2003.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image2003.gif License: unknown Contributors: Andriss
Image:image2004.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image2004.gif License: unknown Contributors: Andriss
Image:image2005.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image2005.gif License: unknown Contributors: Andriss
Image:2009-04-06 1317.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-04-06_1317.png License: unknown Contributors: Normis
File:win-web-snap.png Source: http://wiki.mikrotik.com/index.php?title=File:Win-web-snap.png License: unknown Contributors: Marisb, SergejsB
File:winbox-loader.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-loader.png License: unknown Contributors: Marisb
File:winbox-loader2.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-loader2.png License: unknown Contributors: Marisb
Image:Icon-warn.png Source: http://wiki.mikrotik.com/index.php?title=File:Icon-warn.png License: unknown Contributors: Marisb, Route
File:winbox-ipv6-loader.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-ipv6-loader.png License: unknown Contributors: Marisb
File:winbox-ipv6nd.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-ipv6nd.png License: unknown Contributors: Marisb
File:winbox-win-child.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-win-child.png License: unknown Contributors: Marisb
File:win-add.png Source: http://wiki.mikrotik.com/index.php?title=File:Win-add.png License: unknown Contributors: Marisb
File:win-remove.png Source: http://wiki.mikrotik.com/index.php?title=File:Win-remove.png License: unknown Contributors: Marisb
File:win-enable.png Source: http://wiki.mikrotik.com/index.php?title=File:Win-enable.png License: unknown Contributors: Marisb
File:win-disable.png Source: http://wiki.mikrotik.com/index.php?title=File:Win-disable.png License: unknown Contributors: Marisb
File:win-comment.png Source: http://wiki.mikrotik.com/index.php?title=File:Win-comment.png License: unknown Contributors: Marisb
File:win-sort.png Source: http://wiki.mikrotik.com/index.php?title=File:Win-sort.png License: unknown Contributors: Marisb
File:winbox-window-search.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-window-search.png License: unknown Contributors: Marisb
File:Winbox-window-sort.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-window-sort.png License: unknown Contributors: Marisb
File:Winbox-window-field.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-window-field.png License: unknown Contributors: Marisb
File:Winbox-window-detail.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-window-detail.png License: unknown Contributors: Marisb
File:Winbox-window-category.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-window-category.png License: unknown Contributors: Marisb
File:Winbox1.jpg Source: http://wiki.mikrotik.com/index.php?title=File:Winbox1.jpg License: unknown Contributors: Normis
File:winbox-window-trafmon.png Source: http://wiki.mikrotik.com/index.php?title=File:Winbox-window-trafmon.png License: unknown Contributors: Marisb
Image:2009-04-02_1241.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-04-02_1241.png License: unknown Contributors: Normis
Image:2009-04-02_1241_001.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-04-02_1241_001.png License: unknown Contributors: Normis
Image:2009-04-02_1242.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-04-02_1242.png License: unknown Contributors: Normis
Image:2009-04-02_1242_001.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-04-02_1242_001.png License: unknown Contributors: Normis
File:Webfig-1.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-1.png License: unknown Contributors: Marisb
File:Webfig-submenu.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-submenu.png License: unknown Contributors: Marisb
File:webfig-enable.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-enable.png License: unknown Contributors: Marisb
File:webfig-disable.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-disable.png License: unknown Contributors: Marisb
File:webfig-remove.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-remove.png License: unknown Contributors: Marisb
File:webfig-3.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-3.png License: unknown Contributors: Marisb
File:Webfig-upload.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-upload.png License: unknown Contributors: Marisb
File:Webfig-download.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-download.png License: unknown Contributors: Marisb
File:webfig-add-to-stsatus-page.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-add-to-stsatus-page.png License: unknown Contributors: Janisk
File:webfig-two-columns.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-two-columns.png License: unknown Contributors: Janisk
File:webfig-set-field-limits-design.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-set-field-limits-design.png License: unknown Contributors: Janisk
File:webfig-set-field-limits-done.png Source: http://wiki.mikrotik.com/index.php?title=File:Webfig-set-field-limits-done.png License: unknown Contributors: Janisk
Image:License menu.png Source: http://wiki.mikrotik.com/index.php?title=File:License_menu.png License: unknown Contributors: Normis
Image:2009-05-21 1608.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-05-21_1608.png License: unknown Contributors: Normis
File:PasteLicense.png Source: http://wiki.mikrotik.com/index.php?title=File:PasteLicense.png License: unknown Contributors: SergejsB
File:ApplyLicenseWinbox.png Source: http://wiki.mikrotik.com/index.php?title=File:ApplyLicenseWinbox.png License: unknown Contributors: SergejsB
Image:Purchase1.png Source: http://wiki.mikrotik.com/index.php?title=File:Purchase1.png License: unknown Contributors: Normis
Image:Purchase2.png Source: http://wiki.mikrotik.com/index.php?title=File:Purchase2.png License: unknown Contributors: Normis
Image:Purchase3.png Source: http://wiki.mikrotik.com/index.php?title=File:Purchase3.png License: unknown Contributors: Normis
Image:Purchase4.png Source: http://wiki.mikrotik.com/index.php?title=File:Purchase4.png License: unknown Contributors: Normis
Image:Purchase5.png Source: http://wiki.mikrotik.com/index.php?title=File:Purchase5.png License: unknown Contributors: Normis
Image:Key0.png Source: http://wiki.mikrotik.com/index.php?title=File:Key0.png License: unknown Contributors: Normis
Image:Key1.png Source: http://wiki.mikrotik.com/index.php?title=File:Key1.png License: unknown Contributors: Normis
Image:Key2.png Source: http://wiki.mikrotik.com/index.php?title=File:Key2.png License: unknown Contributors: Normis
Image:Key3.png Source: http://wiki.mikrotik.com/index.php?title=File:Key3.png License: unknown Contributors: Normis
Image:Key4.png Source: http://wiki.mikrotik.com/index.php?title=File:Key4.png License: unknown Contributors: Normis
Image:Downl.jpg Source: http://wiki.mikrotik.com/index.php?title=File:Downl.jpg License: unknown Contributors: Normis
Image:Winbox1.jpg Source: http://wiki.mikrotik.com/index.php?title=File:Winbox1.jpg License: unknown Contributors: Normis
Image:Winb2.jpg Source: http://wiki.mikrotik.com/index.php?title=File:Winb2.jpg License: unknown Contributors: Normis
Image:Up4.jpg Source: http://wiki.mikrotik.com/index.php?title=File:Up4.jpg License: unknown Contributors: Normis

332

Image Sources, Licenses and Contributors


Image:Dude1.png Source: http://wiki.mikrotik.com/index.php?title=File:Dude1.png License: unknown Contributors: SergejsB
Image:Dude2.png Source: http://wiki.mikrotik.com/index.php?title=File:Dude2.png License: unknown Contributors: SergejsB
Image:Dude3.png Source: http://wiki.mikrotik.com/index.php?title=File:Dude3.png License: unknown Contributors: SergejsB
Image:Dude5.png Source: http://wiki.mikrotik.com/index.php?title=File:Dude5.png License: unknown Contributors: SergejsB
Image:Dude6.png Source: http://wiki.mikrotik.com/index.php?title=File:Dude6.png License: unknown Contributors: SergejsB
Image:Dude7.png Source: http://wiki.mikrotik.com/index.php?title=File:Dude7.png License: unknown Contributors: SergejsB
Image:Dude8.png Source: http://wiki.mikrotik.com/index.php?title=File:Dude8.png License: unknown Contributors: SergejsB
Image:Dude13.png Source: http://wiki.mikrotik.com/index.php?title=File:Dude13.png License: unknown Contributors: SergejsB
Image:Dude14.png Source: http://wiki.mikrotik.com/index.php?title=File:Dude14.png License: unknown Contributors: SergejsB
File:2009-01-27 1224.jpg Source: http://wiki.mikrotik.com/index.php?title=File:2009-01-27_1224.jpg License: unknown Contributors: Normis
Image:NetinstallStart.png Source: http://wiki.mikrotik.com/index.php?title=File:NetinstallStart.png License: unknown Contributors: SergejsB
Image:Nconfig.PNG Source: http://wiki.mikrotik.com/index.php?title=File:Nconfig.PNG License: unknown Contributors: SergejsB
Image:NConfig3.png Source: http://wiki.mikrotik.com/index.php?title=File:NConfig3.png License: unknown Contributors: SergejsB
Image:NetinstallC4.png Source: http://wiki.mikrotik.com/index.php?title=File:NetinstallC4.png License: unknown Contributors: SergejsB
Image:NetinstallC5.png Source: http://wiki.mikrotik.com/index.php?title=File:NetinstallC5.png License: unknown Contributors: SergejsB
Image:NetinstallC6.png Source: http://wiki.mikrotik.com/index.php?title=File:NetinstallC6.png License: unknown Contributors: SergejsB
Image:PasswordReset.png Source: http://wiki.mikrotik.com/index.php?title=File:PasswordReset.png License: unknown Contributors: SergejsB
File:bonding-lacp-example.png Source: http://wiki.mikrotik.com/index.php?title=File:Bonding-lacp-example.png License: unknown Contributors: Marisb
Image:bon-tlb.png Source: http://wiki.mikrotik.com/index.php?title=File:Bon-tlb.png License: unknown Contributors: Marisb
Image:bon-alb.png Source: http://wiki.mikrotik.com/index.php?title=File:Bon-alb.png License: unknown Contributors: Marisb
Image:vrrp-simple.png Source: http://wiki.mikrotik.com/index.php?title=File:Vrrp-simple.png License: unknown Contributors: Marisb
Image:vrrp-no-owner.png Source: http://wiki.mikrotik.com/index.php?title=File:Vrrp-no-owner.png License: unknown Contributors: Marisb
Image:Vrrp-State.png Source: http://wiki.mikrotik.com/index.php?title=File:Vrrp-State.png License: unknown Contributors: Marisb
Image:Bonding ARP Monitoring Exam.jpg Source: http://wiki.mikrotik.com/index.php?title=File:Bonding_ARP_Monitoring_Exam.jpg License: unknown Contributors: Eugene
Image:vrrp-basic.png Source: http://wiki.mikrotik.com/index.php?title=File:Vrrp-basic.png License: unknown Contributors: Marisb
Image:vrrp-load-sharing.png Source: http://wiki.mikrotik.com/index.php?title=File:Vrrp-load-sharing.png License: unknown Contributors: Marisb
Image:AP_CLIENT.png Source: http://wiki.mikrotik.com/index.php?title=File:AP_CLIENT.png License: unknown Contributors: SergejsB
Image:ap_client2.png Source: http://wiki.mikrotik.com/index.php?title=File:Ap_client2.png License: unknown Contributors: SergejsB
Image:ap_client3.png Source: http://wiki.mikrotik.com/index.php?title=File:Ap_client3.png License: unknown Contributors: SergejsB
Image:ap_client4.png Source: http://wiki.mikrotik.com/index.php?title=File:Ap_client4.png License: unknown Contributors: SergejsB
Image:ap_client5.png Source: http://wiki.mikrotik.com/index.php?title=File:Ap_client5.png License: unknown Contributors: SergejsB
Image:ap_client6.png Source: http://wiki.mikrotik.com/index.php?title=File:Ap_client6.png License: unknown Contributors: SergejsB
Image:2009-06-04 1555.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-06-04_1555.png License: unknown Contributors: Normis
Image:2009-06-04 1556.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-06-04_1556.png License: unknown Contributors: Normis
Image:2009-06-04 1557.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-06-04_1557.png License: unknown Contributors: Normis
Image:2009-06-04 1558.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-06-04_1558.png License: unknown Contributors: Normis
Image:2009-06-04 1559.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-06-04_1559.png License: unknown Contributors: Normis
Image:2009-06-04 1560.png Source: http://wiki.mikrotik.com/index.php?title=File:2009-06-04_1560.png License: unknown Contributors: Normis
Image:image12001.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image12001.gif License: unknown Contributors: Andriss
Image:image12003.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image12003.gif License: unknown Contributors: Andriss
Image:image12004.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image12004.gif License: unknown Contributors: Andriss
Image:image12005.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image12005.gif License: unknown Contributors: Andriss
File:Slash32.png Source: http://wiki.mikrotik.com/index.php?title=File:Slash32.png License: unknown Contributors: Janisk
file:site-to-site-ipsec-example.png Source: http://wiki.mikrotik.com/index.php?title=File:Site-to-site-ipsec-example.png License: unknown Contributors: Marisb
File:site-to-site-gre-example.png Source: http://wiki.mikrotik.com/index.php?title=File:Site-to-site-gre-example.png License: unknown Contributors: Marisb
Image:pppoe-discovery.png Source: http://wiki.mikrotik.com/index.php?title=File:Pppoe-discovery.png License: unknown Contributors: Marisb
File:pppoe-apex.png Source: http://wiki.mikrotik.com/index.php?title=File:Pppoe-apex.png License: unknown Contributors: Marisb
File:pptp-rem-offoce.png Source: http://wiki.mikrotik.com/index.php?title=File:Pptp-rem-offoce.png License: unknown Contributors: Marisb
File:site-to-site-pptp-example.png Source: http://wiki.mikrotik.com/index.php?title=File:Site-to-site-pptp-example.png License: unknown Contributors: Marisb
File:l2tp-rem-office.png Source: http://wiki.mikrotik.com/index.php?title=File:L2tp-rem-office.png License: unknown Contributors: Marisb
File:site-to-site-l2tp-example.png Source: http://wiki.mikrotik.com/index.php?title=File:Site-to-site-l2tp-example.png License: unknown Contributors: Marisb
Image:image10002.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image10002.gif License: unknown Contributors: Andriss
File:two-link-example.png Source: http://wiki.mikrotik.com/index.php?title=File:Two-link-example.png License: unknown Contributors: Marisb
Image:SR1.png Source: http://wiki.mikrotik.com/index.php?title=File:SR1.png License: unknown Contributors: Marisb, SergejsB
Image:l3vpn-simple.png Source: http://wiki.mikrotik.com/index.php?title=File:L3vpn-simple.png License: unknown Contributors: Route
Image:l3vpn-two-customers.png Source: http://wiki.mikrotik.com/index.php?title=File:L3vpn-two-customers.png License: unknown Contributors: Route
Image:dhcp-relay.png Source: http://wiki.mikrotik.com/index.php?title=File:Dhcp-relay.png License: unknown Contributors: Marisb
Image:ospf-header.png Source: http://wiki.mikrotik.com/index.php?title=File:Ospf-header.png License: unknown Contributors: Marisb
Image:ospf-hello.png Source: http://wiki.mikrotik.com/index.php?title=File:Ospf-hello.png License: unknown Contributors: Marisb
Image:ospf-adjacency.png Source: http://wiki.mikrotik.com/index.php?title=File:Ospf-adjacency.png License: unknown Contributors: Marisb
Image:sp-net.png Source: http://wiki.mikrotik.com/index.php?title=File:Sp-net.png License: unknown Contributors: Marisb
Image:sp-tree.png Source: http://wiki.mikrotik.com/index.php?title=File:Sp-tree.png License: unknown Contributors: Marisb
Image:ospf-basic.png Source: http://wiki.mikrotik.com/index.php?title=File:Ospf-basic.png License: unknown Contributors: Marisb
Image:backbone-s.png Source: http://wiki.mikrotik.com/index.php?title=File:Backbone-s.png License: unknown Contributors: Marisb
Image:area-br.png Source: http://wiki.mikrotik.com/index.php?title=File:Area-br.png License: unknown Contributors: Marisb
Image:basic-multi-area.png Source: http://wiki.mikrotik.com/index.php?title=File:Basic-multi-area.png License: unknown Contributors: Marisb
Image:vlink-area.png Source: http://wiki.mikrotik.com/index.php?title=File:Vlink-area.png License: unknown Contributors: Marisb
Image:vlink-backbone.png Source: http://wiki.mikrotik.com/index.php?title=File:Vlink-backbone.png License: unknown Contributors: Marisb
Image:stub-example.png Source: http://wiki.mikrotik.com/index.php?title=File:Stub-example.png License: unknown Contributors: Marisb
Image:nssa-example.png Source: http://wiki.mikrotik.com/index.php?title=File:Nssa-example.png License: unknown Contributors: Marisb
Image:image6005.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image6005.gif License: unknown Contributors: Andriss

333

Image Sources, Licenses and Contributors


Image:image6006.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image6006.gif License: unknown Contributors: Andriss
Image:ospf-nbma.png Source: http://wiki.mikrotik.com/index.php?title=File:Ospf-nbma.png License: unknown Contributors: Route
Image:ibgp_load_bal.png Source: http://wiki.mikrotik.com/index.php?title=File:Ibgp_load_bal.png License: unknown Contributors: Route
Image:ebgp_load_bal.png Source: http://wiki.mikrotik.com/index.php?title=File:Ebgp_load_bal.png License: unknown Contributors: Route
Image:2009-01-26 1346.jpg Source: http://wiki.mikrotik.com/index.php?title=File:2009-01-26_1346.jpg License: unknown Contributors: Normis
Image:IBGP eBGP.jpg Source: http://wiki.mikrotik.com/index.php?title=File:IBGP_eBGP.jpg License: unknown Contributors: Eugene
Image:BGP redistribution simple.jpg Source: http://wiki.mikrotik.com/index.php?title=File:BGP_redistribution_simple.jpg License: unknown Contributors: Eugene
Image:Icon-important.png Source: http://wiki.mikrotik.com/index.php?title=File:Icon-important.png License: unknown Contributors: Marisb, Route
Image:HTB_Example1.png Source: http://wiki.mikrotik.com/index.php?title=File:HTB_Example1.png License: unknown Contributors: Megis
Image:HTB_Example2.png Source: http://wiki.mikrotik.com/index.php?title=File:HTB_Example2.png License: unknown Contributors: Megis
Image:HTB_Example3.png Source: http://wiki.mikrotik.com/index.php?title=File:HTB_Example3.png License: unknown Contributors: Megis
Image:HTB_Example4.png Source: http://wiki.mikrotik.com/index.php?title=File:HTB_Example4.png License: unknown Contributors: Megis
Image:image8008.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image8008.gif License: unknown Contributors: Andriss
Image:image8009.gif Source: http://wiki.mikrotik.com/index.php?title=File:Image8009.gif License: unknown Contributors: Andriss
Image:Queue_size_No_Limit.PNG Source: http://wiki.mikrotik.com/index.php?title=File:Queue_size_No_Limit.PNG License: unknown Contributors: Megis
Image:Queue_size_0_packets.PNG Source: http://wiki.mikrotik.com/index.php?title=File:Queue_size_0_packets.PNG License: unknown Contributors: Megis
Image:Queue_size_Unlimited_Packets.PNG Source: http://wiki.mikrotik.com/index.php?title=File:Queue_size_Unlimited_Packets.PNG License: unknown Contributors: Megis
Image:Queue_size_10_packets.PNG Source: http://wiki.mikrotik.com/index.php?title=File:Queue_size_10_packets.PNG License: unknown Contributors: Megis
Image:Queue_size_50_packets.PNG Source: http://wiki.mikrotik.com/index.php?title=File:Queue_size_50_packets.PNG License: unknown Contributors: Megis
Image:Burst time.16.part1.JPG Source: http://wiki.mikrotik.com/index.php?title=File:Burst_time.16.part1.JPG License: unknown Contributors: Megis
Image:Burst time.16.part2.JPG Source: http://wiki.mikrotik.com/index.php?title=File:Burst_time.16.part2.JPG License: unknown Contributors: Megis
Image:Burst time.8.part1.JPG Source: http://wiki.mikrotik.com/index.php?title=File:Burst_time.8.part1.JPG License: unknown Contributors: Megis
Image:Burst time.8.part2.JPG Source: http://wiki.mikrotik.com/index.php?title=File:Burst_time.8.part2.JPG License: unknown Contributors: Megis
Image:PCQ_Alg.png Source: http://wiki.mikrotik.com/index.php?title=File:PCQ_Alg.png License: unknown Contributors: Megis
Image:PCQ_Example1.png Source: http://wiki.mikrotik.com/index.php?title=File:PCQ_Example1.png License: unknown Contributors: Megis
Image:PCQ_Example2.png Source: http://wiki.mikrotik.com/index.php?title=File:PCQ_Example2.png License: unknown Contributors: Megis
Image:PCQ3.png Source: http://wiki.mikrotik.com/index.php?title=File:PCQ3.png License: unknown Contributors: Megis
Image:PCQ4.png Source: http://wiki.mikrotik.com/index.php?title=File:PCQ4.png License: unknown Contributors: Megis
Image:PCQ.png Source: http://wiki.mikrotik.com/index.php?title=File:PCQ.png License: unknown Contributors: SergejsB
Image:Logging2.png Source: http://wiki.mikrotik.com/index.php?title=File:Logging2.png License: unknown Contributors: Normis
Image:Logging1.png Source: http://wiki.mikrotik.com/index.php?title=File:Logging1.png License: unknown Contributors: Normis
Image:traffic-flow-1.png Source: http://wiki.mikrotik.com/index.php?title=File:Traffic-flow-1.png License: unknown Contributors: Marisb
Image:traffic-flow-2.png Source: http://wiki.mikrotik.com/index.php?title=File:Traffic-flow-2.png License: unknown Contributors: Marisb
Image:traffic-flow-4.png Source: http://wiki.mikrotik.com/index.php?title=File:Traffic-flow-4.png License: unknown Contributors: Marisb
File:Total-download-cacti.png Source: http://wiki.mikrotik.com/index.php?title=File:Total-download-cacti.png License: unknown Contributors: Normis

334

You might also like