TheseBytes

Mikrotik Site To Site WireGuard VPN Setup

By Daniel in Networking, VPN August 8, 2024

Post Notes: as of RouterOS 7.18 – ip – added support for /31 address

The steps below aim to illustrate how to setup a site to site VPN between two Mikrotik devices using WireGuard. Pre-existing local networks and firewalls exist on both R1 and R2. Between R1 and R2 the WireGuard tunnel will use 172.17.0.0/30. R2 has 172.17.0.1 assigned to its WireGuard interface, while R1 has 172.17.0.2 assigned to its WireGuard interface. The network used, or the order in which IP addresses are assigned is not important, however it is considered best practice to use a point to point subnet between peers.

Mikrotik: How to block websites/apps and force DNS queries to specific servers

By Daniel in Networking January 30, 2024

In this post we’ll discuss two different ways to control standard DNS queries (UDP/TCP port 53) within a network using Mikrotik RouterOS. The intended outcome for doing this is to be able to either send all DNS queries from devices on your network to a specific external DNS server, such as 1.1.1.3 (CloudFlare DNS for Families), or to send all DNS queries on your network to the routers internal DNS server. The latter configuration allows for the addition of blackhole DNS records to be put within your routers cache for hosts to query.

How ARP Works

By Daniel in Networking January 16, 2024

ARP or Address Resolution Protocol is the mechanism used by hosts in a network to map IP addresses to MAC addresses of other hosts within the same network segment. It is also used for next hop resolution between edge devices to enable routing between networks.

When a packet is created by a host intended for another host on that network, an ARP request is broadcast out out from the sender. Since this ARP request is a broadcast message it will be sent to every

Tagged VLANS vs Untagged VLANS (what’s the difference?)

By Daniel in Networking December 16, 2023

In networking when we talk about untagged VLANs, or untagged traffic, we’re referring to ethernet frames that don’t carry any VLAN tag information e.g., traffic that contains no VLAN tag information for a receiving switch port or device to read. In contrast, tagged traffic includes a VLAN tag inside the ethernet frame that can be viewed and read by switches and devices as a way of identifying what VLAN network it belongs to, and then make a forwarding decision based on that information.

How To Host an FTP Server On a Mikrotik Router

By Daniel in Networking October 25, 2022

Setting up FTP file transfer between your Mikrotik router and FTP client is quite easy. This guide will show you how to allow local, and remote users access to your router routers file system using FTP.

Local FTP Access:

ip service enable ftp

Mikrotik RouterOS: Simple Guest Vlan Configuration

By Daniel in Networking October 3, 2022

In this guide I will explain one possible way to setup a guest network using a bridge and VLANS on Mikrotik RouterOS. I’ll be using a hAP running v6.45.9.

This guide assumes you already have basic configuration knowledge as we will not be covering topics such as NAT, DNS, Wi-Fi adapter settings, basic firewall rules and/or breakout interfaces. It also assumes that a basic LAN network and bridge exists. The default out the box Mikrotik config should work fine for this.

How to Remove The Preshared Key on Ubiquiti AP’s

By Daniel in Wireless August 2, 2022

At the time of writing the latest firmware for popular Ubiquiti Point to Point/Point to Multipoint AP’s such as the RP-5AC-GEN2 and PS-5AC is v8.7.11. So far Ubiquiti have not made it possible to disable the need for a preshared key via the GUI i.e. you will not be able to connect a compatible device to the AP without having matching credentials. To get around this we can edit the system config via the CLI: