Mikrotik GPON

http://mt.lv/gpon

The GPON module allows any RouterBOARD device to be used for Fiber to Home installations without any special modems or software. A plug and play solution means you simply plug it into your device, and no special configuration is needed. It is supported by all our SFP products, with any RouterOS version – all configuration will be done on the ISP side. The GPON ONU integrates GPON OMCI Stack and is fully compliant with ITU-T G.984 standards. The ONU is in a standardized MSA SFP form-factor and is designed to simply plug into a standard SFP port in your router. The product provides a pluggable GPON ONU interface for networking equipment with an uplink SFP receptacle enabling these devices to be deployed in GPON networks for FTTx, business services, and wireless backhaul applications.

 

Basic Mikrotik BGP filter rules

Below are some basic Filter Rules for Mikrotik BGP filtering.  These are not complex and can be very easily implemented on your BGP peers.

Before we get to the code there are a few assumptions
1.Your own IP space in this example is 1.1.1.0/22
2.These filters are not fancy and are geared toward upstream ISPs, not your own internal routers or clients.
3.If you copy and paste the below code make sure there is one command per line.  Some browsers will cut the line off and then it won’t paste right.  If in doubt paste it into notepad, textedit, etc. and clean it up.

/routing filter
add action=discard chain=INET-IN comment="BEGIN INET-IN" prefix=127.0.0.0/8 protocol=bgp
add action=discard chain=INET-IN prefix=10.0.0.0/8 protocol=bgp
add action=discard chain=INET-IN prefix=169.254.0.0/16 protocol=bgp
add action=discard chain=INET-IN prefix=172.16.0.0/12 protocol=bgp
add action=discard chain=INET-IN prefix=192.168.0.0/16 protocol=bgp
add action=discard chain=INET-IN prefix=224.0.0.0/3 protocol=bgp
add action=discard chain=INET-IN prefix=1.1.1.0/22 protocol=bgp
add action=discard chain=INET-IN prefix-length=25-32 protocol=bgp
add action=discard chain=INET-IN protocol=bgp
add action=accept chain=INET-OUT comment="BEGIN INET OUT" prefix=1.1.1.0/22 protocol=bgp
add action=discard chain=INET-OUT protocol=bgp

So what does this do?
-The first 6 lines filter out non routeable IP space.  There should be no reason these are being advertised to you from the public internet.

-Next we are saying if we see our own IP space being advertised to us (in this case 1.1.1.0/22) discard that.  There should be no reason we see our own IP space on a public peer.

-The next line filters out prefixes that are a /25 and smaller.  Just about every provider out there has a minimum size of a /24 they will accept as an advertisement.  If you are getting anything smaller it’s a good practice to drop that.  If there happens to be smaller prefixes they can be sent to a default route to the provider.  This helps trim your routing table, which makes lookups and convergence time quicker.

Under the INET-OUT rules we are advertising our IP space to our upstream.

Pretty simple eh? We could get complicated and add in chains, and more rules. But, this is a start.  We will do some more advanced rules in a later post.

Mikrotik Router OS 6.29 released

The fastTrack improvements are a big improvement for those of you doing such things.

What’s new in 6.29 (2015-May-27 11:19):

*) ssh server – use custom generated DH primes when possible;
*) ipsec – allow to specify custom IP address for my_id parameter;
*) ovpn server – use subnet topology in ip mode if netmask is provided (makes android & ios
clients work);
*) console – allow ‘-‘ characters in unknown command argument names;
*) snmp – fix rare bug when some OIDs where skipped;
*) ssh – added aes-ctr cipher support;
*) mesh – fixed kernel crash;
*) ipv4 fasttrack fastpath – accelerates connection tracking and nat for marked
connections (more than 5x performance improvement compared to regular slow
path conntrack/nat) – currently limited to TCP/UDP only;
*) added ~fasttrack-connection~ firewall action in filter/mangle tables for marking
connections as fasttrack;
*) added fastpath support for bridge interfaces – packets received and transmitted
on bridge interface can go fastpath (previously only bridge forwarded packets
could go fastpath);
*) packets now can go half-fastpath – if input interface supports fastpath and
packet gets forwarded in fastpath but output interface does not support fastpath
or has interface queue other than only-hw-queue packet gets converted
to slow path only at the dst interface transmit time;
*) trafflow: add natted addrs/ports to ipv4 flow info;
*) queue tree: some queues would stop working after some configuration changes;
*) tilegx: enable autoneg for sfp ports in netinstall;
*) health – fix voltage on some RB4xx;
*) romon – fix 100% CPU usage;
*) romon – moved under tools menu in console;
*) email – store hostname for consistency;
*) vrrp – do not reset interface when no interesting config changes;
*) fixed async. ppp server;
*) sstp – fixed router lockup.
*) queue tree: some queues would stop working after some configuration changes;
*) fixed CRS226 10G ports could lose link (introduced in 6.28);
*) fixed FREAK vulnerability in SSL & TLS;
*) improved support for new hEX lite;

Protecting your Mikrotik from DNS Amplification

There are several reasons and benefits to using your Mikrotik as a DNS caching server.  Queries to the client are just a tad faster, which makes the overall user experience seem snappier.  It also allows you to quickly change upstream DNS servers in the even of an outage, attack, etc.

There are two main avenues to think about when protecting Mikrotik from DNS.

The first is the incoming port 53 requests to the router.  You only want your customers to have access to query the Mikrotik.  In a simple scenario we have this:.

basic

ether1 is our upstream ISP connection.  Customers are other ports.  In this case if we want to block all port 53 requests from the outside world we specify the WAN interface to drop in the following code:

/ip firewall filter
add chain=input in-interface=ether1 protocol=udp dst-port=53 action=drop
add chain=input in-interface=ether1 protocol=tcp dst-port=53 action=drop

This will still allow your Mikrotik to send out DNS queries because they are sourced from a non reserved port. We are simply blocking the Mikrotik from not answering port 53 requests on the external interface.

In a later post we will talk about what to do if you have multiple wan interfaces or multiple exit paths on your router (say running OSPF)

New Software Features

RoMON
another blog post will follow on this.
Need to use Winbox 3

FastTrack
FastPath + Connection Tracking
FastTrack Accelerates packet processing for specific connection tracking entries
Full NAT support
Works with IPv4/TCP and IPv4/UDP

 

MUM2015: Janis opening Remarks

Recently Introduced

hAP Lite (Home Access Point Lite)
2.4GHZ Dual Chain
5volt USB powered

CCR1009 PC
9 Core Tilera
Passive cooling
* Gigabit, 1SFP, 1SFP+

PowerBox
Outdoor Ethernet router
POE Out

S+2332LC10D
10KM Bidirectional SFP+

New Products:

hAP
951 replacement
regular power input
POE-IN
PoE-out on port 5

hAP ac lite
2.4GHZ dual chain 802.11n
5GHZ single chain 802.11ac

hAP AC
Gigabit
2.4GHZ high power 2 chain 802.11n
5GHZ high power 3 chanin 802.11ac
5Gigabit and 1 SFP cage

CRS112-8G-4S-IN
4 SFP ports
8 Gigabit copper

QRT 5GH
miniPCIe card with 5GHZ triple chain 802.11ac

QRT 5 AC
802.11ac upgrade for QRT5

SXT HG5 AC
802.11ac

RB3011 Series
Upgrade for 2011
Dual core 1.2GHZ ARM CPU
2x performance of 2011
10x Gigabit ethernet
niniPCIe slot and SFP port

QuickMount
Easy way to mount to wall for SXT
Can have back to back setup
Available Q3

DynaDish 5
802.11ac
5GHZ dual chain board integrated into 23DBI dish
8 Degree beamwidth
$179

 

 

Mikrotik Router OS 6.25 released

What’s new in 6.25 (2015-Jan-19 10:11):

*) certificates – fix SCEP RA operation and SCEP client when operating with RA;
*) ppp – report authentication failure cause like in v6.6;
*) ovpn server – added support for address lists;
*) improved boot times;
*) api – fixed missing return values of some commands;
*) ntp – fixed vulnerabilities;
*) mpls/vpls have improved per core balancing on CCRs;
*) fixed queue tree no-mark matching (was broken since 6.24);
*) fixed nested simple queues (was broken since 6.24);
*) fixed occasional crash when ipv6 was used;
*) fixed route cache overflow (ipv4/ipv6 stops working) if ipsec is used;
*) fixed Omnitik upgrade from v5 where wireless config was not correctly saved
*) fixed Webfig Design Skin where some skin changes were not saved
*) WPS support added to CM2 wireless package

Simply click “Check for updates” in QuickSet, Webfig or Winbox packages menu. It should also work from v5

Mikrotik Router OS 6.22 Released

From the ChangeLog

What’s new in 6.22 (2014-Nov-11 14:46):

*) ovpn – added support for null crypto;
*) files – allow to remove empty disk folders;
*) sntp – fix problems with dns name resolving failures that were triggering
system watchdog timeout;
*) eoip/eoipv6/gre/gre6/ipip/ipipv6/6to4 tunnels have new features:
tunnels go down when no route to destination;
tunnels go down for 1 minute when transmit loop detected, warning gets logged;
new keepalive-retries setting;
keepalives enabled by default for new tunnels (10sec interval, 10 retries);
*) improved connection-state matcher in firewall – can match multiple states in one rule, supports negation;
*) added connection-nat-state matcher – can match connections that are srcnatted,dstnatted or both;
*) 100% CPU load caused by DNS service fixed;
*) 100% CPU load caused by unclassified services fixed;
*) 6to4 tunnel fixed;
*) new RouterBOOT firmware for Metal 2SHPn to improve wireless stability;

Download at http://www.mikrotik.com/download