Mikrotik Export Script

export file=desirename

Web Proxy with Load Balance

[admin@MikroTik-2] > /ip ad ex

# may/16/2013 09:09:34 by RouterOS 5.20

# software id = zaib-home

 

/ip address

add address=10.0.0.1/8 disabled=no interface=WAN1 network=10.0.0.0

add address=192.168.0.1/24 disabled=no interface=WAN2 network=192.168.0.0

add address=192.168.5.1/24 disabled=no interface=LAN network=192.168.5.0

 

/ip dns

set allow-remote-requests=yes cache-max-ttl=1w cache-size=5000KiB max-udp-packet-size=512 servers=8.8.8.8

 

/ip proxy

set always-from-cache=no cache-administrator=webmaster cache-hit-dscp=4 cache-on-disk=yes enabled=yes max-cache-size=unlimited max-client-connections=600 max-fresh-time=3d \

max-server-connections=600 parent-proxy=0.0.0.0 parent-proxy-port=0 port=8080 serialize-connections=no src-address=0.0.0.0

 

/ip firewall mangle

add action=mark-connection chain=input disabled=no in-interface=WAN1 new-connection-mark=WAN1_conn passthrough=yes

add action=mark-connection chain=input disabled=no in-interface=WAN2 new-connection-mark=WAN2_conn passthrough=yes

 

add action=mark-connection chain=output comment="Marking Web Proxy Connection for WAN-1" disabled=no dst-port=80 new-connection-mark=WAN1_conn passthrough=yes per-connection-classifier=\

both-addresses-and-ports:2/0 protocol=tcp

add action=mark-connection chain=output comment="Marking Web Proxy Connection for WAN-2" disabled=no dst-port=80 new-connection-mark=WAN2_conn passthrough=yes per-connection-classifier=\

both-addresses-and-ports:2/1 protocol=tcp

 

add action=mark-connection chain=prerouting comment="Excluding Port 80 from PCC - WAN1" disabled=no dst-address-type=!local dst-port=!80 in-interface=LAN new-connection-mark=WAN1_conn passthrough=yes \

per-connection-classifier=both-addresses-and-ports:2/0 protocol=tcp

add action=mark-connection chain=prerouting comment="Excluding Port 80 from PCC - WAN2" disabled=no dst-address-type=!local dst-port=!80 in-interface=LAN new-connection-mark=WAN2_conn passthrough=yes \

per-connection-classifier=both-addresses-and-ports:2/1 protocol=tcp

 

add action=mark-routing chain=prerouting connection-mark=WAN1_conn disabled=no in-interface=LAN new-routing-mark=to_WAN1 passthrough=yes

add action=mark-routing chain=prerouting connection-mark=WAN2_conn disabled=no in-interface=LAN new-routing-mark=to_WAN2 passthrough=yes

 

add action=mark-routing chain=output connection-mark=WAN1_conn disabled=no new-routing-mark=to_WAN1 passthrough=yes

add action=mark-routing chain=output connection-mark=WAN2_conn disabled=no new-routing-mark=to_WAN2 passthrough=yes

 

add action=accept chain=prerouting disabled=no dst-address=10.0.0.0/8 in-interface=LAN

add action=accept chain=prerouting disabled=no dst-address=192.168.0.0/24 in-interface=LAN

 

/ip firewall nat

add action=masquerade chain=srcnat comment="Masquerade WAN1 Traffic" disabled=no out-interface=WAN1

add action=masquerade chain=srcnat comment="Masquerade WAN2 Traffic" disabled=no out-interface=WAN2

add action=redirect chain=dstnat comment="Redirect port 80 request to Mikrotik Web Proxy" disabled=no dst-port=80 protocol=tcp to-ports=8080

 

/ip route

add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=10.0.0.1 routing-mark=to_WAN1 scope=30 target-scope=10

add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.0.1 routing-mark=to_WAN2 scope=30 target-scope=10

 

add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.0.1 scope=30 target-scope=10

add check-gateway=ping disabled=no distance=2 dst-address=0.0.0.0/0 gateway=10.0.0.1 scope=30 target-scope=10

 

[admin@MikroTik-2] >

Pfsense 2 usermanager error fix

Would also fix itself on reboot when the users are cleaned up and resynced. For a quicker fix that doesn't require editing and files, go to Diagnostics > Command and run this in the PHP exec box:

Code: [Select]

require_once("auth.inc");
local_sync_accounts();

Air Con ၀ယ္ရင္ သိသင့္သည့္အခ်က္မ်ား ( FB post တစ္ခုမွကူးယူထားပါသည္)

Air Con oယ္မယ္ဆို သိထားသင့္တဲ့ အခ်က္မ်ား
1.British Thermal Unit (Btu)
Air Con တစ္လံုးရဲ ႔ ေအးႏိုင္စြမ္းကို Btu နဲ႔ပဲ ေဖာ္ျပေလ့ရွိပါတယ္။ Btu မ်ားလာတဲ့အေလ်ာက္ သူ႔ရဲ ႔ ေစ်းႏွဳန္းကလဲ လိုက္ျပီး မ်ားလာမွာပါ။
အမ်ားစု သိထားျကတယ့္ horsepower (hp) က တကယ္တမ္းေတာ့ အေရးမပါပါဘူး။
မိမိ သံုးမယ့္အခန္းရဲ႕ အလ်ားxအနံ square foot ကို 35 နဲ႔ ေျမွာက္ပါ။ ရလာတဲ့အေျဖက မိမိ အခန္းအတြက္ လိုအပ္တဲ့ Btu ပါပဲ။
ဥပမာ ၁၂ ေပx ၁၅ ေပ အခန္းဆိုရင္ square foot က ၁၈၀ ပါ။ ၁၈၀ x ၃၅ = ၆၃၀၀ Btu လိုအပ္ပါတယ္။
အရိပ္က်တဲ့အခန္းမွာဆို ရလာတဲ့ Btu ကို ၁၀% ႏွဳတ္ပါ။
ေနေရာင္တိုက္ရိုက္က်တဲ့ အခန္းမွာဆို ရလာတဲ့ Btu ကို ၁၀% ေပါင္းေပးပါ။
မီးဖိုေခ်ာင္မွာ သံုးမယ္ဆိုရင္ ရလာတဲ့ Btu ကို ၄၀၀၀ ထပ္ေပါင္းေပးပါ။
အခန္းထဲမွာ လူ ၁ ေယာက္ထပ္ ပိုေနမယ္ဆိုရင္ေတာ့ လူတစ္ဦးအတြက္ကို ၆၀၀ Btu စီ ထပ္ေပါင္းေပးပါ။

2. Energy Efficiency Ratio(EER)
EER ဆိုတာ Btu per hour ကို input Watt(W) နဲ႔ စားထားတဲ့ အခ်ိဳးပါ။
EER မ်ားတဲ့ Air Con ေတြက ေရရွည္မွာ မီးအား ကုန္က်စရိတ္ သက္သာပါတယ္။
EER မ်ားလာရင္ Air Con ေစ်းလဲ လိုက္မ်ားလာပါတယ္။
Air Con အမ်ားစုကေတာ့ EER ၈.၂ ကေန ၁၀.၇ ၾကားမွာ ရွိၾကပါတယ္။
၂၄ နာရီ ၇ ရက္လံုး ဆက္တိုက္ သံုးရမယ့္ေနရာမ်ိဳးမွာဆို EER ျမင့္တဲ့ Air Con ကို ေရြးခ်ယ္၀ယ္ယူသင့္ပါတယ္။
3. Noise
ဆူညံမွဳဆိုတဲ့ေနရာမွာ split type မွာဆိုရင္ အတြင္း unit နဲ႔ အျပင္ unit ရဲ႔ ဆူညံမွဳဆိုျပီး ၂မ်ိဳး ရွိပါတယ္။ အတြင္း unit က ေတာ္ေတာ္ဆူညံေနတယ္ဆိုရင္ သင္ညအိပ္လို႔ရမွာ မဟုတ္ပါဘူး။
4. Copper Pipe Quality
AirCon မွာ outdoor unit ထဲမွာေရာ Indoor unit ထဲမွာေရာ ၂ခုကို ဆက္ေပးထားတဲ႔ ပိုက္မွာေရာ ေၾကးစစ္ဖို႔ လိုအပ္ပါတယ္။ ေၾကးမစစ္ရင္ေတာ့ Compressor နဲ႔ Condensor ဘယ္ေလာက္ေကာင္းေကာင္း full quality အေအးကို မရရွိနိုင္ပါဘူး။ တခ်ိဳ ႔Air Con ေတြမွာ ေၾကး(၁၀၀%) အစား အလူမီနီယမ္(၁၀၀%) သို႔မဟုတ္ အလူမီနီယမ္ ေၾကး ေရာစပ္ျပီး သံုးထားပါတယ္။ ကုန္ၾကမ္း၀ယ္စရိတ္မွာ ေၾကးက ၂ဆ ပိုကုန္က်ပါတယ္။ ေနာက္ျပီး ေၾကးက အလူမီနီယမ္ထက္ ပြတ္တိုက္စားႏွဳန္း ပိုခံႏိုင္ပါတယ္။ အပူခ်ိန္ ေျပာင္းလဲတဲ့ အျမန္ႏွဳန္းမွာလဲ ေၾကးက ၂ဆ ပိုျမန္ပါတယ္။
-ေၾကးပိုက္ေစ်းႏွဳန္းကလဲ ၁ ေကာင္ Air Con မွာ တစ္ေပ ၁၁၀၀ က်ပ္ original ( ေဖာ့စြပ္မွာ ဆက္ရာကြဲရာမပါ) ရွိပါတယ္။ ၁.၅ေကာင္ Air Con မွာ တစ္ေပ ၁၅၀၀ က်ပ္ original (ေဖာ့စြပ္မွာ ဆက္ရာကြဲရာမပါ) ပဲ ရွိပါတယ္။
5. ေၾကးပိုက္ ေဖာ့စြပ္
Outdoor နဲ႔ Indoor unit ကို ဆက္ေပးတဲ့ ေၾကးပိုက္ကို စြပ္တဲ့ ေဖာ့စြပ္က original စြပ္ျပီးသားမွ အေအးလံုမွာပါ။ ပိုက္သပ္သပ္၀ယ္ ေဖာ့စြပ္ သပ္သပ္၀ယ္ျပီး ေဖာ့စြပ္ကို ထက္ျခမ္းအလ်ားလိုက္ အစဆံုး လွီးျပီးမွ ေဖာ့စြပ္ထဲ ေၾကးပိုက္ ထည့္တာက အေအးဓာတ္ ကို ေလ်ာ့က်ေစတဲ့အျပင္ ပိုက္မွာလဲ ေရယိုေစပါတယ္။ အတြင္းမွာလဲ condensation အရည္ေတြခဲသြားျပီး အေအးဓာတ္ ေလ်ာ့က်ေစတတ္ပါတယ္။
ဒါေၾကာင့္ air con ဘယ္ေလာက္ေကာင္းတာပဲ ၀ယ္၀ယ္ ေၾကးပိုက္ စနစ္မွာ ခ်ိဳ ့ယြင္းေနရင္ေတာ့ အလကားျဖစ္သြားမွာပါ။

Block Facebook in Mikrotik Web Proxy without L7

Block HTTP or HTTPS Facebook using Mikrotik Router

9:59 AM

Shiva Mishra

5

This articles can help you to use some Technical Task to block http://www.facebook.com or https://www.facebook.com using Mikrotik Firewall in few steps. We will use IP Firewall feature included in Mikrotik. We assume the LAN (Local Area Network) address is 192.168.100.0/24

Here are the steps:


1. Login via winbox

go to IP Firewall > Filter Rules > General 

Select >Chain = Forward

Src-Add= (Your LAN's Network Address with Subnet Mask) here is 192.168.100.0/24

Select> Advance Tab
go to> Content > add> facebook.com.*

 Select> Action Tab
go to> Action > Reject with  icmp admin prohibited
or // select action>drop and apply > ok

return firewall rules>


select facebook firewall rule >click >enable

 go to browser and > type https://www.facebook.com

 and you will get the result >
this web page is not available.

L2TP VPN with 2 Mikrotik

VPN (any type) between 2 Mikrotik routers and no static IP addresses

VPN is very useful when you have a dislocated office, but it requires that at least one location has static IP addresses. Below is the script that allows you to establish a VPN link even if you don't have static IP addresses on any location. This example shows this using L2TP VPN but it works on any VPN type. (With minor changes of course) Network layout for this example:

Server side

On the server side we first create an user who will connect to the server: (Be sure to set a complex password and a longer username)

/ppp secret add caller-id="" comment="Some description" disabled=no limit-bytes-in=0 \
limit-bytes-out=0 local-address=10.0.16.9 name=ka password=ka profile=default \
remote-address=10.0.16.10 routes="" service=l2tp

Then we create a L2TP server interface for the created user:

/interface l2tp-server add disabled=no name=l2tp-ka user=ka

Creating the server interface is not nececery for all this to work since the ROS will dynamicly create the interface each time the user authenticates, but will ease creation of firewall rules.
Enable the server:

/interface l2tp-server server set authentication=pap,chap,mschap1,mschap2 \
default-profile=default-encryption enabled=yes max-mru=1460 max-mtu=1460 mrru=disabled

Add a route to the client side network:

/ip route add comment=Ka disabled=no distance=1 dst-address=10.1.16.0/28 gateway=10.0.16.10 \
scope=30 target-scope=10

Don't forget to change the dst-address to your IP range on the client side

Here is where you have to take a break from this script and read this script. Since you don't have any static IP addresses, you will need a dynamic DNS on the serve side. Once you have configured the ChangeIP.org script from the link, proceed to the client side configuration.

Client side

Create a l2tp client interface to connect to the server. Change IP_OF_L2TP_SERVER to an IP address of your server side router.

/interface l2tp-client add add-default-route=no allow=pap,chap,mschap1,mschap2 \
connect-to=IP_OF_L2TP_SERVER dial-on-demand=no disabled=no max-mru=1460 \
max-mtu=1460 mrru=disabled name=l2tp-BL password=ka profile=default-encryption user=ka

Add a route to the server side network:

/ip route add disabled=no distance=1 dst-address=10.0.0.0/24 gateway=10.0.16.9 scope=30 \
target-scope=10

Don't forget to change the dst-address to your IP range on the server side
Now to make the link work after one of the IP addresses change.

First add a script named 'SetL2TP' and with the following code:

:global newr1 [:resolve hostname.changeip.org]
/int l2tp-client set l2tp-BL connect-to=$newr1
:log info "SetL2TPscript:Changing IP"

When executed, this will resolve the new IP to the ChangeIP.org hostname you have set on the server side.
Then add a scheduler that will execute the above script every 60 seconds (make sure the schedular is now disabled):

/system scheduler add disabled=yes interval=1m name=SetL2TP on-event="system script run SetL2TP" \
policy=read,write,test start-time=startup

Experiment with this interval. You don't want too short an interval because you might get an IP from cache and not be able to reconnect for a longer time.
Now add two scripts that enable and disable the scheduler above. Just paste these two lines on the MT terminal:

/system script add name=EnaSched_1 policy=ftp,reboot,read,write,policy,test,winbox,password,sniff \
source="sys sched ena SetL2TP"
/system script add name=DisaSched_1 policy=ftp,reboot,read,write,policy,test,winbox,password,sniff \
source="sys sched disa SetL2TP"

Finally, create a netwatch that checks if server side is avaliable:

/tool netwatch add disabled=no down-script=EnaSched_1 host=10.0.16.9 interval=15s timeout=1s \
up-script=DisaSched_1

Dynamic DNS

# No-IP automatic Dynamic DNS update

#--------------- Change Values in this section to match your setup ------------------

# No-IP User account info

:local noipuser "ggg@gmail.com"

:local noippass "xxxxxx"

# Set the hostname or label of network to be updated.

# Hostnames with spaces are unsupported. Replace the value in the quotations below with your host names.

# To specify multiple hosts, separate them with commas.

:local noiphost "xxxxx.no-ip.biz"

# Change to the name of interface that gets the dynamic IP address

:local inetinterface "WAN"

#------------------------------------------------------------------------------------

# No more changes need

:global previousIP

:if ([/interface get $inetinterface value-name=running]) do={

# Get the current IP on the interface

   :local currentIP [/ip address get [find interface="$inetinterface" disabled=no] address]

# Strip the net mask off the IP address

   :for i from=( [:len $currentIP] - 1) to=0 do={

       :if ( [:pick $currentIP $i] = "/") do={

           :set currentIP [:pick $currentIP 0 $i]

       }

   }

   :if ($currentIP != $previousIP) do={

       :log info "No-IP: Current IP $currentIP is not equal to previous IP, update needed"

       :set previousIP $currentIP

# The update URL. Note the "\3F" is hex for question mark (?). Required since ? is a special character in commands.

       :local url "http://dynupdate.no-ip.com/nic/update\3Fmyip=$currentIP"

       :local noiphostarray

       :set noiphostarray [:toarray $noiphost]

       :foreach host in=$noiphostarray do={

           :log info "No-IP: Sending update for $host"

           /tool fetch url=($url . "&hostname=$host") user=$noipuser password=$noippass mode=http dst-path=("no-ip_ddns_update-" . $host . ".txt")

           :log info "No-IP: Host $host updated on No-IP with IP $currentIP"

       }

   }  else={

       :log info "No-IP: Previous IP $previousIP is equal to current IP, no update needed"

   }

} else={

   :log info "No-IP: $inetinterface is not currently running, so therefore will not update."

}