How to Make Web Cache in Mikrotik Router

Easy way to set proxy settings for web cache mikrotik server. Adeel Ahmad explaining how can you configure mikrotik router for cache server.

Different Limits and Traffic Priorities Mikrotik Hotspot Server

Many users are always asking about how to prioritize the traffic using the Mikrotik RouterOS Hotspot service.

The following method helps to manage the network traffic and customize it the way you want. It also insure to provide the correct service for a specific use in a big network, giving priority for the VIPs, Special users or services in a congested network.

Also, you can use the same method if you want to make sure that heavy users should not keep downloading or uploading files for long period in order to save the rest of available traffic for light users who are looking for good speed for browsing or occasionally access. This can be applied using the burst limit or a combination of minimum and burst limit with priority.

The trick with bandwidth management in Hotspot is to use the Users Profiles, and assign the different type of speeds that is related to a specific group.
== The question is, How to do that? ==

Using the Winbox, in: IP >> Hotspot >> User Profiles >> rate limit:

use the following string: x1k/y1k x2k/y2k x3k/y3k x5/y5 P x6k/y6k


where:
x1k/y1k: Rate (txrate/rxrate i.e 128k/1024k)
x2k/y2k: Burst Rate (i.e 256k/2048k)
x3k/y3k: Burst Threshold (i.e 160k/1280k)
x5/y5: Burst Time (in seconds i.e: 60/60)
Priority: P (use integer from 1-8)
Minimum rate: x6k/y6k (i.e 32k/256k)

for example: 24k/128k 32k/256k 24k/196k 30/30 8 16k/64k

The following example show you what you have to do exactly:

means:

Rate:24k/128k

Burst Rate: 32k/256k

Burst Threshold: 24k/196k

Burst Time: 30/30

Priority: 8

Minimum rate: 16k/64k

In Queues table, you can see what happened exactly for the user having the same profile: 

Also, you can check the configured priority here: 

if you just want to use rate and priority, then use:

Rate, Burst Rate, Burst Priority, Minimum rate.

Learn How to Make Mikrotik Daily Backup Automatically

In this video Mr. Adeel Ahmad telling you how to setup a script that makes your mikrotik routers backup automatically and sent it to your email address automatically. It's very important in some cases if your router damaged this backup will help you to make your new server quickly.

BACKUP AUTO EMAIL

Mikrotik Routers Protection from Bruteforce Attacking

It's very important to protect your devices, routers from bruteforce attacking. If you have big competition in your area and you have many doubts that some body can try to hack your system, you must prepare for it. Use some cool scripts that prevent your mikrotik router from bruteforce attacking.

/ip firewall filter 
add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop \
comment="drop ftp brute forcers"

add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m

add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login incorrect" \
address-list=ftp_blacklist address-list-timeout=3h


This will prevent a SSH brute forcer to be banned for 10 days after repetitive attempts. Change the timeouts as necessary.


/ip firewall filter

add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \
comment="drop ssh brute forcers" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist \
address-list-timeout=10d comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 \
address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 \
action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list \
address-list=ssh_stage1 address-list-timeout=1m comment="" disabled=no

If you want to block downstream access as well, you need to block the with the forward chain:

add chain=forward protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \
comment="drop ssh brute downstream" disabled=no

Mikrotik Loadbalancing 2 WAN 1 LAN Full Script Download Backup

First of all change the interfaces name set as Local, wlan1 and wlan2 and then open new terminal from winbox and paste bellow code there. All settings successfully done.

/ ip address
add address=192.168.0.1/24 network=192.168.0.0 broadcast=192.168.0.255 interface=Local 
add address=10.111.0.2/24 network=10.111.0.0 broadcast=10.111.0.255 interface=wlan2
add address=10.112.0.2/24 network=10.112.0.0 broadcast=10.112.0.255 interface=wlan1

/ ip route
add dst-address=0.0.0.0/0 gateway=10.111.0.1,10.112.0.1 check-gateway=ping 

/ ip firewall nat 
add chain=srcnat out-interface=wlan1 action=masquerade
add chain=srcnat out-interface=wlan2 action=masquerade

/ ip firewall mangle
add chain=input in-interface=wlan1 action=mark-connection new-connection-mark=wlan1_conn
add chain=input in-interface=wlan2 action=mark-connection new-connection-mark=wlan2_conn
add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla1    
add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla2    

/ ip route
add dst-address=0.0.0.0/0 gateway=10.111.0.1 routing-mark=to_wla1 
add dst-address=0.0.0.0/0 gateway=10.111.0.2 routing-mark=to_wla2

1 LAN 4 WAN Mikrotik Load Balancing Full Setting with Backup File

Its very easy to configure you mikrotik router for load balancing there is nothing any difficulty if you feel you can't do that you can get backup file from us in just $20 or Rs 1500 Pakistani rupees. 

You can configure according to bellow settings.

#|/ip address 

/ip address add address=192.168.1.2/24 network=192.168.1.0 broadcast=192.168.1.255 interface=ether1

/ip address add address=192.168.2.2/24 network=192.168.2.0 broadcast=192.168.2.255 interface=ether2

/ip address add address=192.168.3.2/24 network=192.168.3.0 broadcast=192.168.3.255 interface=ether3

/ip address add address=192.168.4.2/24 network=192.168.4.0 broadcast=192.168.4.255 interface=ether4

/ip address add address=192.168.0.1/24 network=192.168.0.0 broadcast=192.168.0.255 interface=ether5 comment="default configuration"

#|/ip firewall mangle

/ip firewall mangle add chain=input in-interface=ether1 action=mark-connection new-connection-mark=ether1_conn

/ip firewall mangle add chain=input in-interface=ether2 action=mark-connection new-connection-mark=ether2_conn

/ip firewall mangle add chain=input in-interface=ether3 action=mark-connection new-connection-mark=ether3_conn

/ip firewall mangle add chain=input in-interface=ether4 action=mark-connection new-connection-mark=ether4_conn

/ip firewall mangle add chain=output connection-mark=ether1_conn action=mark-routing new-routing-mark=to_ether1

/ip firewall mangle add chain=output connection-mark=ether2_conn action=mark-routing new-routing-mark=to_ether2

/ip firewall mangle add chain=output connection-mark=ether3_conn action=mark-routing new-routing-mark=to_ether3

/ip firewall mangle add chain=output connection-mark=ether4_conn action=mark-routing new-routing-mark=to_ether4

/ip firewall mangle add chain=prerouting dst-address=192.168.1.0/24 action=accept in-interface=ether5

/ip firewall mangle add chain=prerouting dst-address=192.168.2.0/24 action=accept in-interface=ether5

/ip firewall mangle add chain=prerouting dst-address=192.168.3.0/24 action=accept in-interface=ether5

/ip firewall mangle add chain=prerouting dst-address=192.168.4.0/24 action=accept in-interface=ether5

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=ether5 per-connection-classifier=both-addresses-and-ports:4/0 action=mark-connection new-connection-mark=ether1_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=ether5 per-connection-classifier=both-addresses-and-ports:4/1 action=mark-connection new-connection-mark=ether2_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=ether5 per-connection-classifier=both-addresses-and-ports:4/2 action=mark-connection new-connection-mark=ether3_conn passthrough=yes

/ip firewall mangle add chain=prerouting dst-address-type=!local in-interface=ether5 per-connection-classifier=both-addresses-and-ports:4/3 action=mark-connection new-connection-mark=ether4_conn passthrough=yes

/ip firewall mangle add chain=prerouting connection-mark=ether1_conn in-interface=ether5 action=mark-routing new-routing-mark=to_ether1

/ip firewall mangle add chain=prerouting connection-mark=ether2_conn in-interface=ether5 action=mark-routing new-routing-mark=to_ether2

/ip firewall mangle add chain=prerouting connection-mark=ether3_conn in-interface=ether5 action=mark-routing new-routing-mark=to_ether3

/ip firewall mangle add chain=prerouting connection-mark=ether4_conn in-interface=ether5 action=mark-routing new-routing-mark=to_ether4

#|/ip route

/ip route add dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-mark=to_ether1 check-gateway=ping

/ip route add dst-address=0.0.0.0/0 gateway=192.168.2.1 routing-mark=to_ether2 check-gateway=ping

/ip route add dst-address=0.0.0.0/0 gateway=192.168.3.1 routing-mark=to_ether3 check-gateway=ping

/ip route add dst-address=0.0.0.0/0 gateway=192.168.4.1 routing-mark=to_ether4 check-gateway=ping

/ip route add dst-address=0.0.0.0/0 gateway=192.168.1.1 distance=1 check-gateway=ping

/ip route add dst-address=0.0.0.0/0 gateway=192.168.2.1 distance=2 check-gateway=ping

/ip route add dst-address=0.0.0.0/0 gateway=192.168.3.1 distance=3 check-gateway=ping

/ip route add dst-address=0.0.0.0/0 gateway=192.168.4.1 distance=4 check-gateway=ping

#|/ip firewall nat

/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade

/ip firewall nat add chain=srcnat out-interface=ether2 action=masquerade

/ip firewall nat add chain=srcnat out-interface=ether3 action=masquerade

/ip firewall nat add chain=srcnat out-interface=ether4 action=masquerade

#| DHCP server is on switch, with address pool 192.168.0.100-192.168.0.200

/ip pool add name=default-dhcp ranges=192.168.0.100-192.168.0.200

/ip dhcp-server add name=default address-pool=default-dhcp interface=ether5 disabled=no

/ip dhcp-server network add address=192.168.0.0/24 gateway=192.168.0.1 dns-server=192.168.0.1 comment="default configuration"

#| DNS

/ip dns set allow-remote-requests=yes

/ip dns static add name=router address=192.168.0.1

#| Now Configure DNS server so users can resolve hostnames,

#| Ex.cache-size=5000KiB

#| DNS Google = 8.8.8.8,8.8.4.4

#| DNS 3BB = 110.164.252.222,110.164.252.223

/ip dns set allow-remote-requests=yes cache-max-ttl=1w cache-size=5000K max-udp-packet-size=512 servers=8.8.8.8,8.8.4.4

After configuring please give us feed back.

Learn How to Block Hotspot Shield in Mikrotik Router

As you know in the all countries of the world some of the websites are blocked by their government or other policies. For example in Pakistan Youtube is blocked for some reasons and all other dirty websites are also blocked in Pakistan that has dirty contents and peoples used different software that unblock these sites with proxy. When they activate proxy server that bypass all the policies that you have applied therefore here is a trick from which you can block hotspot ports and special ips that hotspot shield used.

/ip firewall address-list

add address=157.56.106.0/24 disabled=no list=hotspotshield_zaib

add address=157.56.144.0/24 disabled=no list=hotspotshield_zaib

add address=198.144.116.0/24 disabled=no list=hotspotshield_zaib

add address=204.14.77.0/24 disabled=no list=hotspotshield_zaib

add address=204.14.0.0/16 disabled=no list=hotspotshield_zaib

add address=205.164.34.0/24 disabled=no list=hotspotshield_zaib

add address=209.73.0.0/16 disabled=no list=hotspotshield_zaib

add address=212.118.232.0/24 disabled=no list=hotspotshield_zaib

add address=216.172.138.0/24 disabled=no list=hotspotshield_zaib

add address=216.172.0.0/16 disabled=no list=hotspotshield_zaib

add address=46.0.0.0/8 disabled=no list=hotspotshield_zaib

add address=66.171.229.0/24 disabled=no list=hotspotshield_zaib

add address=68.68.107.0/24 disabled=no list=hotspotshield_zaib

add address=68.68.108.0/24 disabled=no list=hotspotshield_zaib

add address=69.22.168.0/24 disabled=no list=hotspotshield_zaib

add address=69.22.170.0/24 disabled=no list=hotspotshield_zaib

add address=74.115.0.0/16 disabled=no list=hotspotshield_zaib

add address=94.245.121.0/24 disabled=no list=hotspotshield_zaib

add address=69.22.185.0/24 disabled=no list=hotspotshield_zaib

add address=174.129.0.0/16 disabled=no list=hotspotshield_zaib

add address=216.172.135.0/24 disabled=no list=hotspotshield_zaib

add address=67.220.0.0/16 disabled=no list=hotspotshield_zaib

add address=50.0.0.0/8 disabled=no list=hotspotshield_zaib

add address=79.125.0.0/16 disabled=no list=hotspotshield_zaib

add address=75.101.0.0/16 disabled=no list=hotspotshield_zaib

add address=176.56.0.0/16 disabled=no list=hotspotshield_zaib

add address=54.75.0.0/16 disabled=no list=hotspotshield_zaib

add address=54.161.0.0/16 disabled=no list=hotspotshield_zaib

add address=199.188.0.0/16 disabled=no list=hotspotshield_zaib

# Now create Rules to block above address list and additional ports

/ip firewall filter

add action=drop chain=forward comment="Block_Hotspot_Shield_Addresses_(test phase_zaib)" disabled=no src-address-list=hotspotshield_zaib

add action=drop chain=forward comment="Block_Hotspot_Shield_Ports_(test phase_zaib)" disabled=no dst-port=990,179,105,706,5245,3451,15009 protocol=tcp

Learn How to Configure NTP Client in Mikrotik for Correct Time/Date

Mikrotik router time and date is very important to set because when we use radius server with mikrotik than we required correct time and date because we set the time and date in users profile when users profile will be expired how much time left to expire any profile. If date and time will be wrong than admin and user can't get correct results. It's very easy to change the time in mikrotik by NTP Client.
Click on Settings Tab in Mikrotik and than enter the NTP Client IP there.
Primary NTP Server     : 218.189.210.4
Secondary NTP Server : 62.201.215.14