TOP 10 RouterOS Configuration Mistakes

[@thanatos454]

10 - 3:12 - Same IP on different interfaces 09 - 5:15 - Lack of monitoring 08 - 20:45 - DNS Issues 07 - 25:15 - Firewall Inefficiency 06 - 27:33 - NAT Issues 05 - 33:44 - Allowed IP Spoofing 04 - 39:45 - Bridge Issues 03 - 44:45 - PoE Issues 02 - 48:40 - Waiting for Hackers 01 - 52:00 - admin / no password

[@thanatos454]

Link to presentation slides mum.mikrotik.com//presentations/US16/presentation_3001_1462450916.pdf

[@Lann91]

A real hero, thanks

[@azfarhameedkhan7117]

sir on minute 36:30 when you were discussing traffic generator tool, in packet templates you had 3 tabs General, MAC,IP. but in my routerOS i dont see those 3 Tabs, i only have a General TAB......i am using version 6.35, can you please tell me what version were you using when you prepared those slides? Regards azfar

[@gunnargu]

2 interfaces can share the same LINK LOCAL address just fine, right? Such as using fe80::1 as ipv6 gw

[@xuxamelo]

At the NAT section, I supose I don't need the third rule since I'm only accepting related / established connections right?

[@karlbooklover]

Very interesting talk, thank you!

[@daaumarius]

Nice presentation , but on the DNS filtering there is no state for UDP , for what I know UDP is connectionless so you can't filter on new connection state isn't it ?

[@pubdigitalix]

I agree with you Marius, but DNS can use TCP when the replay is long enough for the size of UPD datagrams, and TCP is conecction oriented. I don't agree with your evaluation about the presentation in general, because hearing the speaker is a really PTA for someone not english native.

[@Roman_4x5]

Mikrotik can keep track of the connection for TCP and UDP the same way conntrack in netfilter works in linux. Filtering new connections works well with few exceptions. Some services may reply from different port and will be also filtered. You can define allow rule that will permit established and related connections before it will filter new one.

[@ItalianDiveExplorer]

i see some of those mistakes and i think... why doesn't RouterOS handles them? look at junos or IOSm they won't allow to configure overlapping ip/subnets on two interfaces in the same vrf

[@sardarharis5558]

Great 👍

[@nirmalacharya3960]

just wow sir.

[@RmFrZQ]

[20:46] Why even implement this feature without any means to configure it the right way, like selecting interfaces for this service to be available on?

[@kjeldschouten-lebbing6260]

Because IP/Port binding is never supposed to be a replacement for a firewall.

[@reion78]

Hi Andis! Where slides can be downloaded? Thanks

[@Akrobs]

Благодарю.

[@sankareshkannan9239]

I was disabled the lan interface by winbox now I can’t able to access the router how to solve this issue

[@nickandritsos6190]

You need to reset the router

[@sankareshkannan9239]

nick andritsos its possible to enable by WAN interface

[@mzakelj]

Conect cable to other port and connect over MAC !!

[@NwasFalih]

Great !

[@janseniogonzalesvenegas2649]

Haber si las vídeos sean traducidos en español ya que es la lengua que mas se habla en el mundo seria genial

[@scarranza22]

En realidad la lengua mas hablada es el mandarín, y en segundo lugar el ingles. El español ocupa el cuarto lugar de la lista. en.wikipedia.org/wiki/List_of_languages_by_total_number_of_speakers Deberías tomar algunos cursos de ingles, es mas fácil encontrar información o soporte realizando búsquedas en ingles.

[@pubdigitalix]

Creo que vos deberías tomar el curso porque si supieras leer ingles podrías observar que el mandarín es el primero y el español es el SEGUNDO (L1 speakers significa nativos). Además no te vendría mal saber un poco de geografía, lo cuál explica las diferencias. Distinto es si miramos la lista de L2 speakers que es una segunda lengua y el ingles lleva lejos la delantera. Coincido que es más facil encontrar información en ingles y eso es en parte por la enorme falta de respeto que tienen los latinos con su propio lenguaje, ya que antes se traducía mucho más al español que ahora.

[@wreckedzilla]

my traineeer

[@jovanjanevski3747]

GNU/MikroTik

[@thegorn]

Using Mikrotik without studying all the bugs that affect you is probably #1

[@misaelcampos5589]

underated

[@moetarded7757]

Get an network interpreter. Preferably a network genius with glasses and pen protector.

[@sp4c33]

Use long-term builds...

[@ميكروتيكموسى]

mikrotik

[@SteveWrightNZ]

too long

[@BillAnt]

LOL... play in at 2x speed, it will be half as long. ;D

[@chuck091955]

At 26 minutes in, talking about firewall inefficiency, Does this person have any knowledge of the subject matter? Apparently not. MikroTik has a stateful firewall and state tables should be examined before any of the configured rules. For traffic from any of the whitelisted IP addresses the return traffic from the web server should never reach the first firewall rule. It should just be permitted by the state table and that should happen very fast. It says this video was published by MikroTik and seeing misinformation like this gives me concern the company does not even know their own product. I have a very large investment in MikroTik equipment and maybe they have lost their talent that was knowledgeable. A better improvement would be to move the rule 9 up to the top since this is for a web server it should be expected that most of the inbound traffic would be hitting that rule. Also doesn't only the first packet of each connection run down the list of rules and all further packets of that connection would be handled in the state table?

[@Roman_4x5]

Stateful firewall keeps track of the connection state, but it still need to know the policy against that traffic. This is why there are matchers for connection state. Each packet is being evaluated against each of the rules until it will match the rule or reach the implicit allow. Above all, the example just explains a "mistake" of allowing for firewall to scan all rules for very common traffic. Solution is to define the explicit rule as close to the top as possible in order to save CPU cycles.

[@melonmusk3976]

Just skip this guy's autopromotion about resume and M$ Cerrified B$ and jump directly to kzbin.info/www/bejne/eJy9eYV6a9iph7c