[研究所] MikroTik RouterOS 學習 (持續更新) (第662頁)

coolcliff01
個人積分：21分
文章編號：69808616

21分

6611樓

2018-08-22 4:01

kd1100 wrote:
請問MikroTik 這種路由器有支援 PPPOE Offload 嗎?

沒有，即便 CPU 原生有這功能，在 RouterOS 裡也不會出現

版上有其他前輩問過官方了
https://www.mobile01.com/topicdetail.php?f=110&t=4597959&p=11

畢竟這功能一開，QoS 或流量統計之類的幾乎半殘或全殘，那 RouterOS 有何用處呢？

舉個實例：RB750Gr3

https://mikrotik.com/product/RB750Gr3

這台的 CPU 是 MTK MT7621A，確定是有搭載 PPPoE Offloading 的，不過 RouterOS 裡沒這功能

搭載同樣 CPU 比方像是：EdgeRouter X 以及可刷 Padavan 第三方韌體的機器 (比如小米路由器 mini/小米路由器 3) 就會出現 PPPoE Offloading 的選項

(更正：小米路由器 mini/小米路由器 3 的 CPU 是 MTK 7620A，不過一樣有 PPPoE Offloading)

gfx wrote:
我查到的pppoe-offload=traffic-pppoe,除了pppoe的封包外全都丟棄...
用firewall filter過濾補強不就好?

PPPoE Offloading 指的是 CPU 內建專門用來處理 PPPoE 連線的電路，好處是開啟後從此 CPU 使用率都會低到不行，用別的方式比喻就像是硬解和軟解 HEVC 4K 高畫質影片，有硬解功能的話就無腦看片，就算是低階 CPU 還會像是睡著般，軟解的話就是 CPU 硬上，低階 CPU 可能會直接吃土

壞處在上面已經提到了，因為網路流量繞過軟體/韌體的處理，所以一堆功能半殘或全殘

kd1100

kd1100
個人積分：91分
文章編號：69808896

91分

6612樓

2018-08-22 7:04

coolcliff01 wrote:
沒有，即便 CPU...(恕刪)

謝謝coolcliff01 大的說明，了解了

kti

kti
個人積分：1094分
文章編號：69811953

1094分

6613樓

2018-08-22 11:07

coolcliff01 wrote:
沒有，即便 CPU...(恕刪)

類似的硬體加速其實是有的
開啟

關閉

NeverGiveUp!!

NeverGiveUp!!
個人積分：44507分
文章編號：69812429

44507分

6614樓

2018-08-22 11:33

沒錯！‍‍‍‍‍

kti wrote:
類似的硬體加速其實...(恕刪)

人品是做人最好的底牌．

coolcliff01

coolcliff01
個人積分：21分
文章編號：69813600

21分

6615樓

2018-08-22 12:51

kti wrote:
類似的硬體加速其實是有的

印象中在 RouterOS 中是叫「FastPath」還是「FastTrack」之類的(沒記錯的話)，不過他是軟體程式達成的 NAT 轉發最佳化，不太算是硬體實現，比較像高通開發的 Shortcut Forwarding Engine 這種東西，SFE 這東東在版上也有人玩過：
https://www.mobile01.com/topicdetail.php?f=110&t=5484538

優點就是不像 PPPoE Offloading 那樣專一，僅限 PPPoE 連線

另外跟硬體電路加速一樣，打開之後也會造成一些服務/功能不能開

gfx

gfx
個人積分：1603分
文章編號：69866594

1603分

6616樓

2018-08-26 15:31

P2P應該遵行共享的原則,彼此分享檔案.但常有吸血軟件吸很大,卻從它身上榨不出任何資源.

尤其當吸血軟件吃了您大量的上載,導致其他人給予的上傳變少,
以致間接也影響他人分享上載給您的意願...

所以小弟接下來要說明的即利用pcq ,將上載均分給不同的地址,
將吸血的影響降至最低,讓更多人收到我們的上傳後願意以更高的上載分享檔案給您.

/queue type裡有預設的pcq設置檔可利用,我們先展開觀察：

這區分pcq-upload與pcq-download:
pcq-upload-default 的classsifier控制的是src-address ,即依本地的地址均分.
pcq-download-default 的classsifier控制的是dst-address ,即依遠端的地址均分.

p2p設置,假設我是用192.168.88.104這台電腦進行下載：

target設置本地電腦地址:192.168.88.104 ,upload max-limit設置最高的上載速率(bits/s)

接下則是queue協定:
注意我們是要均分上載給遠端不同的地址,所以該選擇的是pcq-download-default

若您選的是pcq-upload-default,因為qos對象本地就只有192.168.88.104一台電腦.
所以完全不會有本地均分的效果,更徨論最終目的了.

BoowB

BoowB
個人積分：46分
文章編號：69870348

46分

6617樓

2018-08-26 22:06

gfx wrote:
P2P應該遵行共享...(恕刪)

那如果目標改成整個網段，如：192.168.88.0/24
就是網段中所有電腦的每個上傳連線都會依照遠端地址均分
電腦A 有3個連線(到不同遠端地址)
電腦B 有1個連線
電腦C 有4個連線
就會變成共8個連線每個連線上傳分成總流量1/8

而不是依據本地端地址
電腦A 192.168.88.2
電腦B 192.168.88.3
電腦C 192.168.88.4
(3台電腦)上傳分成總流量1/3

不知道這樣理解對不對?謝謝g大分享~

(最近有時間偶爾來研究一下，雖然不一定會用到

倒是最近想將mod無線化，一直不成功待解決)

gfx

gfx
個人積分：1603分
文章編號：69870566

1603分

6618樓

2018-08-26 22:24

BoowB wrote:
那如果目標改成整個網段，如：192.168.88.0/24
就是網段中所有電腦的每個上傳連線都會依照遠端地址均分
電腦A 有3個連線(到不同遠端地址)
電腦B 有1個連線
電腦C 有4個連線
就會變成共8個連線每個連線上傳分成總流量1/8

是的,不管本地有多少台電腦,依上述設置
就是要均分本地上載(queue-type=pcq-download-default)給所有遠端ip,所以是1/8沒錯.

只有queue type=pcq-upload-default時,
才會均分本地的上載給本地電腦,即每台電腦擁有本地1/3的上載頻寬.

deanma

deanma
個人積分：74分
文章編號：69873547

74分

6619樓

2018-08-27 8:48

deanma wrote:
各位版大日安小弟公...(恕刪)

回覆自己在 #6555 提出的問題
跟VPN廠商討論後，測試在內網加了一台router當作getway
只做routing，設置完成後，
將要往VPN流量直接導向VPN的小烏龜
其他則往RB3011AiUS
大陸端點回不來台灣的問題就都解決了...

不知為什麼RB3011AiUS上設置的routing會有這樣的隱性問題
orz

kclonline

kclonline
個人積分：11分
文章編號：69969480

11分

6620樓

2018-09-03 14:00

記得更新

What's new in 6.40.9 (2018-Aug-20 07:46):

MAJOR CHANGES IN v6.40.9:
----------------------
!) security - fixed vulnerabilities CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159;
----------------------

*) certificate - fixed "add-scep" template existence check when signing certificate;
*) defconf - fixed wAP LTE kit default configuration;
*) ethernet - improved large packet handling on ARM devices with wireless;
*) ethernet - removed obsolete slave flag from "/interface vlan" menu;
*) filesystem - fixed NAND memory going into read-only mode;
*) hotspot - fixed user authentication when queue from old session is not removed yet;
*) interface - fixed interface configuration responsiveness;
*) ipsec - fixed policies becoming invalid if added after a disabled policy;
*) ldp - properly load LDP configuration;
*) ppp - fixed "hunged up" grammar to "hung up" within PPP log messages;
*) sfp - hide "sfp-wavelength" parameter for RJ45 transceivers;
*) snmp - added remote CAP count OID for CAPsMAN;
*) supout - added "partitions" section to supout file;
*) tile - fixed Ethernet interfaces becoming unresponsive;
*) tr069-client - fixed unresponsive tr069 service when blackhole route is present;
*) userman - fixed compatibility with PayPal TLS 1.2;
*) userman - improved unique username generation process when adding batch of users;
*) winbox - added missing "dscp" and "clamp-tcp-mss" settings to IPv6 tunnels;
*) winbox - allow to specify full URL in SCEP certificate signing process;
*) winbox - by default specify keepalive timeout value for tunnel type interfaces;
*) winbox - show firmware upgrade message at the bottom of "System/RouterBOARD" menu;
*) winbox - show "scep-url" for certificates;
*) winbox - show "sector-writes" on ARM devices that have such counters;
*) winbox - show "sector-writes" on devices that have such counters;
*) winbox - show "System/Health" only on boards that have health monitoring;
*) wireless - added option to disable PMKID for WPA2;
*) wireless - enable all chains by default on devices without external antennas after configuration reset;
*) wireless - fixed packet processing after removing wireless interface from CAP settings;
*) wireless - improved client "channel-width" detection;
*) wireless - improved Nv2 PtMP performance;
*) wireless - increased stability on hAP ac^2 and cAP ac with legacy data rates;
*) wireless - updated "united-states" regulatory domain information;

-

What's new in 6.42.7 (2018-Aug-17 09:48):

MAJOR CHANGES IN v6.42.7:
----------------------
!) security - fixed vulnerabilities CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159;
----------------------

*) bridge - improved bridge port state changing process;
*) crs326/crs328 - fixed untagged packet forwarding through tagged ports when pvid=1;
*) crs3xx - added command that forces fan detection on fan-equipped devices;
*) crs3xx - fixed port disable on CRS326 and CRS328 devices;
*) crs3xx - fixed tagged packet forwarding without VLAN filtering (introduced in 6.42.6);
*) crs3xx - fixed VLAN filtering when there is no tagged interface specified;
*) dhcpv4-relay - fixed false invalid flag presence;
*) dhcpv6-client - allow to set "default-route-distance";
*) dhcpv6 - improved reliability on IPv6 DHCP services;
*) dhcpv6-server - properly update interface for dynamic DHCPv6 servers;
*) ethernet - improved large packet handling on ARM devices with wireless;
*) ethernet - removed obsolete slave flag from "/interface vlan" menu;
*) ipsec - fixed "sa-src-address" deduction from "src-address" in tunnel mode;
*) ipsec - improved invalid policy handling when a valid policy is uninstalled;
*) ldp - properly load LDP configuration;
*) led - fixed default LED configuration for RBLHGG-5acD-XL devices;
*) lte - added signal readings under "/interface lte scan" for 3G and GSM modes;
*) lte - fixed memory leak on USB disconnect;
*) lte - fixed SMS send feature when not in LTE network;
*) package - do not allow to install out of bundle package if it already exists within bundle;
*) ppp - fixed interface enabling after a while if none of them where active;
*) sfp - hide "sfp-wavelength" parameter for RJ45 transceivers;
*) tr069-client - fixed unresponsive tr069 service when blackhole route is present;
*) upgrade - fixed RouterOS upgrade process from RouterOS v5;
*) userman - fixed compatibility with PayPal TLS 1.2;
*) vrrp - fixed VRRP packet processing on VirtualBox and VMWare hypervisors;
*) w60g - added distance measurement feature;
*) w60g - fixed random disconnects;
*) w60g - general stability and performance improvements;
*) w60g - improved MCS rate detection process;
*) w60g - improved MTU change handling;
*) w60g - properly close connection with station on disconnect;
*) w60g - stop doing distance measurements after first successful measurement;
*) winbox - added "secondary-channel" setting to wireless interface if 80 MHz mode is selected;
*) winbox - fixed "sfp-connector-type" value presence under "Interface/Ethernet";
*) winbox - fixed warning presence for "IP/IPsec/Peers" menu;
*) winbox - properly display all flags for bridge host entries;
*) winbox - show "System/RouterBOARD/Mode Button" on devices that has such feature;
*) wireless - added option to disable PMKID for WPA2;
*) wireless - fixed memory leak when performing wireless scan on ARM;
*) wireless - fixed packet processing after removing wireless interface from CAP settings;
*) wireless - updated "united-states" regulatory domain information;