sir on minute 36:30 when you were discussing traffic generator tool, in packet templates you had 3 tabs General, MAC,IP. but in my routerOS i dont see those 3 Tabs, i only have a General TAB......i am using version 6.35, can you please tell me what version were you using when you prepared those slides? Regards azfar
i see some of those mistakes and i think... why doesn't RouterOS handles them? look at junos or IOSm they won't allow to configure overlapping ip/subnets on two interfaces in the same vrf
Nice presentation , but on the DNS filtering there is no state for UDP , for what I know UDP is connectionless so you can't filter on new connection state isn't it ?
I agree with you Marius, but DNS can use TCP when the replay is long enough for the size of UPD datagrams, and TCP is conecction oriented. I don't agree with your evaluation about the presentation in general, because hearing the speaker is a really PTA for someone not english native.
Mikrotik can keep track of the connection for TCP and UDP the same way conntrack in netfilter works in linux. Filtering new connections works well with few exceptions. Some services may reply from different port and will be also filtered. You can define allow rule that will permit established and related connections before it will filter new one.
[20:46] Why even implement this feature without any means to configure it the right way, like selecting interfaces for this service to be available on?
En realidad la lengua mas hablada es el mandarín, y en segundo lugar el ingles. El español ocupa el cuarto lugar de la lista. en.wikipedia.org/wiki/List_of_languages_by_total_number_of_speakers Deberías tomar algunos cursos de ingles, es mas fácil encontrar información o soporte realizando búsquedas en ingles.
Creo que vos deberías tomar el curso porque si supieras leer ingles podrías observar que el mandarín es el primero y el español es el SEGUNDO (L1 speakers significa nativos). Además no te vendría mal saber un poco de geografía, lo cuál explica las diferencias. Distinto es si miramos la lista de L2 speakers que es una segunda lengua y el ingles lleva lejos la delantera. Coincido que es más facil encontrar información en ingles y eso es en parte por la enorme falta de respeto que tienen los latinos con su propio lenguaje, ya que antes se traducía mucho más al español que ahora.
Just skip this guy's autopromotion about resume and M$ Cerrified B$ and jump directly to ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-BkZHRD6svQU.html
At 26 minutes in, talking about firewall inefficiency, Does this person have any knowledge of the subject matter? Apparently not. MikroTik has a stateful firewall and state tables should be examined before any of the configured rules. For traffic from any of the whitelisted IP addresses the return traffic from the web server should never reach the first firewall rule. It should just be permitted by the state table and that should happen very fast. It says this video was published by MikroTik and seeing misinformation like this gives me concern the company does not even know their own product. I have a very large investment in MikroTik equipment and maybe they have lost their talent that was knowledgeable. A better improvement would be to move the rule 9 up to the top since this is for a web server it should be expected that most of the inbound traffic would be hitting that rule. Also doesn't only the first packet of each connection run down the list of rules and all further packets of that connection would be handled in the state table?
Stateful firewall keeps track of the connection state, but it still need to know the policy against that traffic. This is why there are matchers for connection state. Each packet is being evaluated against each of the rules until it will match the rule or reach the implicit allow. Above all, the example just explains a "mistake" of allowing for firewall to scan all rules for very common traffic. Solution is to define the explicit rule as close to the top as possible in order to save CPU cycles.
