สร้าง Queue อัตโนมัติ สำหรับ DHCP Lease

ใส่ในแท็บ Script ในหัวข้อ DHCP Server

:local queueName "Client- $leaseActMAC";

:if ($leaseBound = "1") do={
/queue simple add name=$queueName target=($leaseActIP . "/32") max-limit=40M/40M comment=[/ip dhcp-server lease get [find where active-mac-address=$leaseActMAC && active-address=$leaseActIP] host-name];
} else={
/queue simple remove $queueName
}

[MikroTik] เข้าทางไหน ออกทางนั้น

redirect incoming traffic in wan1 and wan2 to the local server

/ip firewall nat add chain=dstnat protocol=tcp dst-port=22 in-interface=wan1 action=dst-nat to-addresses=192.168.0.1 to-ports=22

/ip firewall nat add chain=dstnat protocol=tcp dst-port=22 in-interface=wan2 action=dst-nat to-addresses=192.168.0.1 to-ports=22

what comes from wan1, gets out from wan1

/ip firewall mangle add action=mark-connection chain=input in-interface=wan1 new-connection-mark=wan1_conn passthrough=yes disabled=no comment="in wan1,out wan1"

/ip firewall mangle add action=mark-routing chain=output connection-mark=wan1_conn new-routing-mark=wan1_traffic passthrough=no disabled=no comment="in wan1,out wan1"

what comes from wan2, gets out from wan2

/ip firewall mangle add action=mark-connection chain=input in-interface=wan2 new-connection-mark=wan2_conn passthrough=yes disabled=no comment="in wan2,out wan2"

/ip firewall mangle add action=mark-routing chain=output connection-mark=wan2_conn new-routing-mark=wan2_traffic passthrough=no disabled=no comment="in wan2,out wan2"

port forwards from wan1, gets out from wan1

/ip firewall mangle add action=mark-connection chain=forward in-interface=wan1 connection-state=new new-connection-mark=wan1_pfw passthrough=no disabled=no comment="pfw wan1, out wan1"

/ip firewall mangle add action=mark-routing chain=prerouting in-interface=lan connection-mark=wan1_pfw new-routing-mark=wan1_traffic passthrough=no disabled=no comment="pfw wan1, out wan1"

port forwards from wan2, gets out from wan2

/ip firewall mangle add action=mark-connection chain=forward in-interface=wan2 connection-state=new new-connection-mark=wan2_pfw passthrough=no disabled=no comment="pfw wan2, out wan2"

/ip firewall mangle add action=mark-routing chain=prerouting in-interface=lan connection-mark=wan2_pfw new-routing-mark=wan2_traffic passthrough=no disabled=no comment="pfw wan2, out wan2"

routing rules for wan1_traffic and wan2_traffic

/ip route add dst-address=0.0.0.0/0 gateway=wan1 distance=1 routing-mark=wan1_traffic disabled=no

/ip route add dst-address=0.0.0.0/0 gateway=wan2 distance=1 routing-mark=wan2_traffic disabled=no

Credit: MikroTik Tutoroial.

This file is in a location outside your local network.

1) Select 'Control Panel'/'Internet Properties'/'Security' tab.

(Alternatively, open Internet Explorer and select 'Tools'/'Internet Options'/'Security' tab.)

2) Highlight 'Local Intranet' and click 'Sites'.

3) Set the following:

Uncheck 'Automatically detect intranet network'.

Check 'Include all local (intranet) sites not listed in other zones'.

Uncheck 'Include all sites that bypass the proxy server'.

Check 'Include all network paths (UNCs)'.​

4) Click 'Advanced'

5) Uncheck 'Require server verification (https:) for all sites in this zone'.

6) In the field labeled 'Add this web site to the zone:', add your local, private subnet using an asterisk for a network mask and click 'Add'. E.g. If your home (local) network is 192.168.25.0 with a mask of 255.255.255.0, enter '192.168.25.*' (without the quotes).

Notes for adding to this list:

Entries can be:​

Individual IP addresses (e.g. '192.168.5.25', etc.),

Class C subnets (e.g. '192.168.27.*'),

Class B subnets (e.g. '172.16.*.*'), or

Class A subnets (e.g. '10.*.*.*')​

You can add as many addresses as you need to the list

It can be handy add the address of a VPN subnet to the list if it is also private and you TOTALLY trust it.​

7) Close out with 'Close'/'OK'/'OK' and close the Control Panel (or Internet Explorer).

Guest access in SMB2 disabled by default in Windows 10 Fall Creators Update and Windows Server 2016 version 1709

Symptoms

---

In Windows 10 Fall Creators Update and Windows Server version 1709, the SMB2 client no longer allows the following actions:

 

• Guest account access to a remote server
• Fallback to the Guest account after invalid credentials are provided

SMBv2 has the following behavior in Windows 10 Fall Creators Update and Windows Server 2016 version 1709:
 

• Windows 10 Enterprise and Windows 10 Education no longer allow a user to connect to a remote share by using guest credentials by default, even if the remote server requests guest credentials.
• Windows Server 2016 Datacenter and Standard edition no longer allow a user to connect to a remote share by using guest credentials by default, even if the remote server requests guest credentials.
• Windows 10 Home and Professional editions are unchanged from their previous default behavior.

If you try to connect to devices that request credentials of a guest instead of appropriate authenticated principals, you may receive the following error message: 

You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network.

Resolution

---

If you want to enable insecure guest access, you can configure the following Group Policy settings:

 

Computer configuration\administrative templates\network\Lanman Workstation

"Enable insecure guest logons"

 

Note By enabling insecure guest logons, this setting reduces the security of Windows clients. 

 

บังคับเว็บออก redirect จาก http เป็น https โดยใช้ mod_rewrite

เช็คว่า mod_rewrite ทำงานหรือเปล่า (เพราะเป็น default on อยู่แล้ว)

httpd -M

จะต้องมีบรรทัดเขียนว่า

...
rewrite_module (shared)
...

ถ้าไม่มีให้เพิ่ม rewrite_module ลงในไฟล์
/etc/httpd/conf.modules.d/00-base.conf

...
LoadModule rewrite_module modules/mod_rewrite.so
...

เพิ่มบรรทัดนี้ลงในไฟล์ httpd.conf

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]

จากนั้น restart httpd

Script สั่ง Reboot MikroTik

ไปที่ System > Scripts
สร้าง Script ใหม่ ตั้งชื่อตามต้องการ เช่นชื่อ reboot
ช่อง Policy ให้เลือก Reboot
ช่อง Source พิมพ์ /system reboot

ไปที่ System > Scheduler
สร้าง Schedule ใหม่ ตั้งชื่อตามต้องการ เช่น reboot
ช่อง Start Time เลือก startup
ช่อง Interval ตั้งเวลาตามต้องการ
ช่อง Policy ให้เลือก Reboot
ช่อง On Event ให้ใส่ชื่อ Script ที่เราตั้งไว้ก่อนหน้า จากตัวอย่างคือ reboot

Webmin Error 14 Peer cert cannot be verified or peer cert invalid

Add “sslverify=false” in the ‘/etc/yum.conf’ file to solve this.