the “magic bytes” are the first few bytes of a file that can tell you what format the file is.
https://en.wikipedia.org/wiki/List_of_file_signatures
Mikrotik Backup file magic bytes
| File type | Magic bytes |
| RC4 Encrypted | EFA89172 |
| AES Encrypted | EFA89173 |
| Not Encrypted | 88ACA1B1 |
Using the above list, we can view a Mikrotik .backup file in a hex editor like GHex or dump it with xxd.
Sometimes it is nice to have a list of just the IP addresses and the hostname or mac address. Can be especially helpful when you are trying to get a list of devices to do a bulk update in LibreNMS. Helpful LibreNMS links for renaming and showing down devices
we are going to run the command to pull the DHCP information and then use Unix utilities to parse the data out.
Replace dhcp8 with the correct dhcp server in the mikrotik.
First, SSH into your Mikrotik router.
ssh user@mikrotik
Next we’ll want to go to the ip dhcp-server lease directory
/ip dhcp-server lease
Now we can run the following command to loop through and pull out all the info we need.
You can change the info like “mac-address” for something like “status”. You can use Tab to see what options are available. Just delete mac-address and hit tab twice.
:foreach i in=[find] do={ :put ([get $i address].",".[get $i mac-address].",".[get $i server].",".[get $i host-name ])}
Found the above helpful info from the following pdf file.
https://mum.mikrotik.com/presentations/PH18/presentation_5113_1516612695.pdf
Problem : Lots of CPU utilization. Profile shows a good bit of it is DNS related.
The router is setup to allow DNS to pass through to web servers so rDNS and other records can be looked up and resolved. This is a specific IP block that gets it’s addresses from the router. The firewall rules explicitly allow this address range. We’ll say 192.168.88.0/24, and blocks everything else. This works for the web servers. But why are we still getting a bunch of CPU utilization with DNS?
As it turns out, the firewall rule that allows the server address range also includes routers own address! So we have unintentionally whitelisted DNS access to our router.
To resolve the issue we can add another firewall rule that explicitly blocks DNS traffic to the routers IP address. We are using two rules, one to block TCP and the other UDP.
ip firewall filter add chain=input dst-address=192.168.88.1 protocol=6 dst-port=53 in-interface-list=WAN action=drop ip firewall filter add chain=input dst-address=192.168.88.1 protocol=17 dst-port=53 in-interface-list=WAN action=drop
Rules 6 & 7 are the two new rules we just applied. 14 & 15 block input to the router, however rules 8 & 9 inadvertently allowed access to the router’s public IP.
The Result? Our CPU usage dropped!
Quite dramatically too as the following LibreNMS screenshot shows.
For more information about DNS Amplification attacks, refer to the following links.
https://ask.wireshark.org/question/6865/dns-amplification-attack/
https://security.stackexchange.com/questions/237127/why-would-hackers-attack-a-dns-server-with-a-dos
Go to Tools -> Packet Sniffer
Configure the Streaming options. Set the Server IP address to the computer you are running Wireshark on
Configure the Filter settings. Unless you want to stream everything from the router to your computer.
Make sure the TZSP is enabled in the “Enabled Protocols” Window. Either by going to “Analyze -> Enabled Protocols” or “Ctrl + Shift + E”
Run Wireshark.
Helpful links
Open up PPP and select L2TP Server. Set it to Enabled, set IPsec to yes, and set the IPsec secret.
Next go to PPP -> Profiles and modify the default-encryption one. You can setup an IP Pool to use for the VPN clients when they connect.
Next go to the PPP -> Secrets and configure the user to connect.
Setup your VPN client and connect.
Can look here to set a certificate up in Winbox
or here to configure from command line
To setup a OpenVPN server on a router there are a few things that need to be done.
Create an IP pool that clients can pull and address from when they connect
Modify the default-encryptoin Profile and specify the VPN IP pool.
Create new user, specify the default-encryptio profile
Enable the OVPN server. Specify the “Default Profile:” to be the default-encyption, specify the certificate to be the server-template, or whatever the name is of the certificate you created.
https://wiki.mikrotik.com/wiki/Manual:Create_Certificates
https://www.medo64.com/2016/12/simple-openvpn-server-on-mikrotik/
/certificate add name=ca-template common-name=myCa days-valid=3650 key-size=2048 key-usage=key-cert-sign,crl-sign /certificate add name=server-template common-name=server days-valid=3650 key-size=2048 key-usage=digital-signature,key-encipherment,tls-server
/certificate sign ca-template name=myCa /certificate sign server-template ca=myCa name=server
/certificate set myCa trusted=yes /certificate set server trusted=yes
Open up the Certificates window by going to /System -> Certificates. Hit the + to add a new certificate
First we are going to create a Certificate Authority template
Specify the key usage to “crl sign” and “key cert. sign” and apply
Now we are going to create a server template
We need to specify “Digital signature, key encipherment, and tls server” You may need to enable/disable more depending on your use case scenario. In this case we are setting it up for OpenVPN.
First we need to sign the ca-template by opening up the the Certificate and hitting Sign on the right hand side. Should get the little Sign window pop up.
Progress will show done when it is finished signing.
Next we need to sign the server-template. When Signing the server template, specify the ca-template in the CA: field. See below
Move all the VLANs under ether7 to ether6. Instead of an “=” sign, you can use a “~” to do a partial match.
foreach i in=[/interface vlan find where interface="ether7"] do={interface vlan set interface=ether6-master-local $i }
Move ip address from ether6 to ether7. Change 192.168.88.1/24 to the address and the find command will find it regardless of the port and assign it to ether6 or whichever port is specified.
ip address set interface=ether6-master-local [find address="192.168.88.1/24"]
You can add a delay before a command runs by specifying delay and then the time to wait.
delay 60
Use the ; to separate commands. Example below, wait 5 seconds then print the ip addresses.
delay 5 ; ip address print
The following command/s will wait 60 seconds then move all the VLANs on ether7 to ether6 and then move the 192.168.88.1/24 address to ether6.
delay 60 ; foreach i in=[/interface vlan find where interface="ether7"] do={interface vlan set interface=ether6-master-local $i } ; ip address set interface=ether6-master-local [find address="192.168.88.1/24"]
Sometime the following warning can show up in the log.
10:48:45 interface,warning ether2: bridge port received packet with own address as source address (74:4d:28:69:89:9d), probably loop
Check and verify that your interface MAC addresses are unique. VLANs look to be the exception as they should share the MAC address of the interface the VLAN is on.
More information in this thread.
https://forum.mikrotik.com/viewtopic.php?p=583064#p703228