Any mismatch of time between the MikroTik Router and the real situation will result in the rule not running as required. In addition, the system logging on the router contains information about the time when that log entry was created, so it will be confusing to read time information that does not match the real situation.

Time settings on the MikroTik Router can be done on the System> Clock menu. By default the time on the MikroTik Router is 00:00:00 on Jan/02/1970. Time adjustments can be made manually on the router using this menu.

On a regular basis, RouterOS saves the current date and time to disk. Therefore when the router reboots the clock will be returned to the datetime last saved and will be then incremented every second but will however not reflect the actual current real date and time. RouterBOARD hardware does not have a battery backed up Real Time Clock (RTC). Although the date and time is likely to be roughly correct, the only way to ensure the datetime is really correct is to synchronise the internal clock to an external and more accurate time source.

We can use the NTP (Network Time Protocol) service which allows the router to synchronize time with other devices on the network. MikroTik can function as an NTP server or as a NTP Client or even both simultaneously.

Mikrotik as an NTP Client

In the RouterOS MikroTik system package, there is already a NTP (Network Time Protocol) Client feature that can be used to allow RouterOS to function as an NTP Client. Therefore no extra packages are required. When enabled and configured correctly, the router will automatically synchronise the Router’s time to the designated NTP server or servers so that the time settings will remain updated.

There are many NTP Servers on the internet that can be used and a useful place to find a NTP time server close to you is https://www.ntppool.org/.

After a successful synchronization to an upstream time server, it doesn’t necessarily mean that the router time is totally correct. Check on the menu System> Clock. You will see that the Time Zone Name can be selected. This will then ensure that day light savings and the correct timezone time offset will be applied to the time received from the time server.

MikroTik as an NTP Server

The NTP Server function on Mikrotik is also included in the default RouterOS package, so if this funationality is required it is easy to enable.

With the NTP Server function we can have a server in our network so that other RouterBOARDs obtain their time information from the local network and there is no need to use up bandwidth for access to public NTP servers on the internet.

It is also possible to configure a RouterBOARD with a GPS onboard as a time server.

We can use Broadcast, Multicast or Manycast methods to provide the information into the network. The most common mode used is Unicast, which is the default setting.

The following is an example of setting the NTP Server to Manycast.

The post Time Setting on MikroTik RouterOS V7 appeared first on MikroTik Training.

In our previous article on how to set the time on a MikroTik router we discussed the ability of the Router to obtain the correct and valid time by using an external third party NTP time server. Since RouterOS v6.14 however, a new function was added to update the Router’s time automatically, namely Cloud Time Update. This function is found in the menu IP -> Cloud. Using this feature we can update the time by synchronising to MikroTik’s cloud server at cloud.mikrotik.com automatically instead of manually setting the SNTP client to some third party NTP time server(s). Since RouterOS v6.43 this has now been changed to cloud2.mikrotik.com.

We still have to manually set the ‘Time Zone’ to match the real-time conditions in our country / region. Since RouterOS v6.27 we can enable ‘Time Zone Autodetect’ on the System -> Clock menu and MikroTik will automatically determine your country / region from your public IP address.

The default MikroTik factory configuration enables the ‘Time Zone Autodetect’ option. If you do not wish the router to communicate with MikroTik to obtain the time and to adjust the timezone automatically, ensure this setting is disabled and use the information contained in our earlier article on how to configure the SNTP Client manually to a different third party NTP time server.

The post RouterOS IP Cloud Time synchronisation appeared first on MikroTik Training.

As can be seen, there are several wireless modes and they are chosen according to their required function. Do you want RouterOS to function as an access point (master base station) or as a station (slave or client device)? We also need to know that not all wireless modes can be used in a Layer 2 bridged network because not all wireless modes support Layer 2 bridging. One such example being the wireless mode called station.

Alignment Only Mode

Alignment only mode is typically used to assist with pointing the antenna in the correct direction for optimal signal in point to point and point to multipoint links. If the RouterBOARD is fitted with a sounder, then the signal strength is indicated by a ‘Geiger counter’ like beeping sound. As the antenna is adjusted to be pointing towards the access point, the signal strength increases and the beeping becomes higher and more frequent. In this way aligning the antenna can be done more speedily and simply. While operating in this mode be mindful of the fact that when enabled, it will not permit any connection to any device as it locks the wireless interface into permanent receive only mode until this test mode is disabled. Input the MAC Address of the remote device into the Audio Monitor field and ensure that ‘SSID All’ is enabled and click start and if there is any signal detected from that MAC Address, the beeping will commence. If no sound is heard, check that the RouterBOARD is fitted with a sounder.

AP Bridge

The mode ‘ap bridge‘ mode is used when you require an 802.11 compliant Access Point or a radio to provide Layer 2 bridging between it’s ethernet port(s) and the wireless card. It can be used to serve multiple clients which is also often called Point To Multi Point (PtMP) mode and we can use this mode for Routing or Bridging networks. To use ‘ap bridge‘ mode, RouterBOARD devices must have a minimum of a Level 4 license. RouterBOARDs designed by MikroTik to serve as Access Points will all be supplied at the factory with a Level 4 license already. Therefore normally there is no further expense involved with License purchases.

Bridge

Bridge mode is used as an access point similar to ‘ap bridge’ with one big exception and that is that it can only serve one single client device or also called Point to Point (PtP) mode. We usually use this mode for Routing or Bridging networks between just two devices, for example between two buildings on a campus or between two radio towers over a long distance. To use this mode RouterBOARD devices must have at least a Level 3 license, for example the RBSXTSQ5ND and the RBLHGG-5HPACD2HPND-XL PtP bridging product types all only have a Level 3 license. By using bridge mode at both ends we can successfully make a point to point connection using two of these devices.

Nstreme Dual Slave

Normal 802.11 WiFi is a half duplex system. Each wireless interface can only spend it’s active time operating either as a transmitter or as a receiver and not as both at the same time. Therefore it there is a very high traffic demand in both directions it is only possible to achieve a maximum of 50% transmit and 50% receive, thus immediately halving the total available throughput. Also extra latency is added due to the radio chipset having to wait for the reception to cease before being able to transmit.

By using this mode however we can activate a true full duplex working mechanism. This mode is proprietary to MikroTik and requires 2 wireless cards and 2 antennas on each Mikrotik wireless router. One wireless card will then operate in 100% receive mode and the second wireless device will operate in 100% transmit mode. RouterOS will then bond the two interfaces together and it will operate as if it were a single interface.

It is not usually visible in any wireless scans as it does not use ‘beacons’ to advertise itself. In fact it also does not use an SSID, but instead connects purely by inputting in the MAC address of the other Nstreme Dual interface to connect to.

Station

The station wireless mode is used as a standard 802.11 wireless client in either a Point to Point or Point to Multi Point topology. The wireless mode station can only be used to form a network that is routing in nature and will not pass Layer 2 traffic such as ARP or other broadcast based protocols from the wireless interface through to any ethernet interfaces even if they are placed into the same bridge. Therefore this mode is not a mode to be used if bridging is required on the wireless client / station side.

For example if you wish to connect multiple devices behind a MikroTik router when connecting to a hotel WiFi system but make them believe only one device is connected use ‘station‘ mode and operate behind a NAT firewall configuration using a new dhcp server based network on the ethernet side. This would allow you to connect to the hotel WiFi with the one single MAC Address but have multiple devices connected. In situations where hotels operate a captive portal using voucher codes, this allows one to operate multiple devices from one single voucher provided by the front desk.

Station Bridge

The station bridge mode is a wireless interface mode that functions as a client and also provides support for bridging networks. It should be noted that this mode uses MikroTik proprietary methods on both the client and Access Point side to achieve this without also requiring WDS and therefore the access point end must also be a Mikrotik as well. Suggested modes for the other MikroTik device operating as an access point would be either ‘ap bridge’ or ‘bridge’ mode.

Station Pseudobridge

The station pseudobridge mode is a development of the standard station mode. It allows the wireless interface to act as a normal station client to another third party Access Point radio that would not normally support bridging without WDS. The station pseudobridge mode supports the creation of a bridged network but with limited support of Layer 2 protocols.

The station pseudobridge interface maintains an IPv4-to-MAC address mapping table and replaces the source MAC address with its own wireless MAC address when sending frames to the Access Point (in order to continue to be able to use the 802.11 standard 3 address frame format) and replaces the destination MAC address with the MAC address from the stored mapping table for frames received from the Access Point. IPv4-to-MAC mappings are also built for VLAN encapsulated frames.

For all other non-IPv4 protocols a single MAC address translation is used. The station pseudobridge interface learns the source MAC address from the first forwarded non-IPv4 frame and uses that MAC address as the default for all reverse translations. This MAC address is then used to replace all destination MAC address for any frames received from the Access Point if IPv4-to-MAC mapping can not be performed.

The station pseudobridge mode is only able to provide L2 bridging of data to a single device connected to the station (by means of this single MAC address translation) and only has limited support for IPv4 frame bridging. Therefore bridging of non-IP protocols to more than one device will not work.

This mode is available for all protocols except Nv2 and should be avoided if possible. The usage of this mode can only be justified if the Access Point does not support a better mode for L2 bridging or if only one end-user device will be connected to the network by means of this station pseudobridge mode.

This situation frequently occurs when one has no control over the access point device to be connected to. For example when you are attempting to extend the network to another location and can only connect to a third party vendor’s Access Point.

Station Pseudobridge Clone

The mode station pseudobridge clone is almost the same as the previous ‘station pseudobridge’ mode. The difference is that in this mode you can manually chose to use either a MAC Address or by default it will read the MAC Address from the first forwarded frame header from the client side of the network and use that discovered MAC Address to connect to the Access Point with.

Station WDS

This mode is proprietary to MikroTik RouterOS and can therefore only be used when connecting to another non-CAPsMAN mode MikroTik Access Point using ‘ap bridge’ or ‘bridge’ modes. It cannot therefore be used to connect to third party vendor’s access points. As part of negotiating the wireless connection, a new ‘WDS interface‘ is created on the AP for each connected station. This interface can be thought of as a new dedicated point-to-point connection between the Access Point and the connected station which is independent of the connection the Access Point may have with other normal station clients, such as laptops, mobile phones or tablet users.

The mode uses a 4 MAC Address frame format instead of the usual 3 which when using the 802.11 protocol, but for other MikroTik protocols such as Nstreme or Nv2, internal changes are made to the protocol communications instead.

This mode provides full and complete transparent L2 bridging but one major drawback is that it can lead to a halving of throughput compared to other modes.

WDS Slave

The ‘WDS Slave‘ Mode functions as a normal Access Point as well as a Station. The station mode part of ‘WDS Slave’ allows the device to scan all the frequencies in the scan list and thus locate and connect to another Access Point as a client device while at the same time acting as an Access Point itself. This mode makes the wireless card act as a repeater. This mode is a solution if you want to build a repeater but your device only has the 1 wireless card card.

The post MikroTik Wireless Modes appeared first on MikroTik Training.

Many ISPs do not provide a static Public IPv4 with their lowest cost basic packages. Although it may be possible to obtain a fixed public IP for your home internet connection, it is often at a cost with an initial admin charge for setting this up and then a monthly ongoing cost to maintain the service. Using a dynamic often changing IP address creates its own difficulties for network admins who want to make routers provide services that can be accessed from the internet network using the assigned public IP. For example you may wish to connect to a VPN Server, or your home CCTV Cameras or just wish to connect to a remote router from anywhere on the internet.  But if the IP is constantly changing, how to find it?

Starting from RouterOS v6.14 having a dynamic public IP is no longer a problem with a new feature called IP Cloud. We already visited some of the other features of IP Cloud to provide the RouterBOARD with a valid Date and Time service. Besides that ability, this feature also provides services that are similar to those provided by a DDNS (Dynamic DNS) service that are widely available on the Internet. With this feature, we no longer connect to an ever changing IP address which is like trying to hit an ever moving target, but instead use a unique DNS name provided by Mikrotik’s cloud service. In this way whenever the public IP changes the router will send an update to MikroTik so that the router service can still be accessed with the DNS that has been previously generated the first time this service is enabled.

Before this feature was added to RouterOS we had to install complex scripts to use these DDNS services. Not all DDNS services would be able to be supported. With the IP Cloud feature, we just need to go to IP menu, then Cloud, then tick ” Enabled ” and we are done.

Before running the IP Cloud feature, you need to first make sure the router is connected to the internet, so that the router can make DNS requests to MikroTik’s Cloud based server. If the status states “updated” then we can use the generated Fully qualified domain name to access the remote router or access services running by routers from anywhere on the internet. Once a minute the router will check the Router’s outgoing Public IP address and will update that IP to MikroTik’s IP Cloud Server. In this way, even though the router’s public IP may vary, we can still remotely access or VPN into the router using that domain name which will never change.

If the router does not have a public IP as it is behind another router elsewhere, then the status information will show “DDNS server received request from IP xxx.xxx.xxx.xxx but your local IP was yyy.yyy.yyy.yyy; DDNS service might not work” (where xxx.xxx.xxx.xxx is the discovered external public IP being used by your network and yyy.yyy.yyy.yyy is the actual internal IP on your outgoing interface. If there is another router between your router and the internet, incoming services may not be reachable as they may be filtered out by a firewall.

The format of the domain name created is based on the RouterBOARD’s serial number, so the domain format is written as follows:

{SN of RouterBoard}.sn.mynetname.net

{SN of RouterBoard} here means the serial number, so the DNS is generated based on the unique serial number of the router. This IP Cloud feature only supports RouterBOARD products and does not support x86 products such as the CHR. Note the MikroTIk router uses the UDP protocol with port 15252 to make initial requests or to update the IP address to the IP Cloud server. If you create firewall filter rules do not block the UDP protocol and the outgoing destination port 15252.

Since RouterOS v6.43, if your router and DNS server also supports IPv6, then DNS AAAA records will also be set to your unique router DNS name and IPv6 Address. Disabling the IP Cloud service on your router deletes the DNS records from MikroTik Cloud Server.

The post Dynamic Public IPv4 Solution using IP Cloud appeared first on MikroTik Training.