MikroTik

jonmansey

Just upgraded to v7.14 with wifi-com-ac on a hAP ac3, the 2.4GHz wifi is down reporting "failed to select channel". Under WiFi Channel Frequency, I tried no setting, setting a range 2412-2462, and setting specific channels eg 2412, all with the same result. After enabling, it sits there wi...

jonmansey

To highlight another example where it’s a grey area, yesterday I added a cap ax to my network, and capsman set it to 5845. Of course none of my Apple (or any) devices could even see it. So is that mikrotik’s fault, or apple’s? Worked around by setting channels to 5180-5825. For it to be user-friendl...

jonmansey

@whatever thanks for this tip! Confirming ft-preserve-vlanid=no fixes the issue I described in post_id=1040082 with no other apparent ill effects.

Maybe it should default to no in non-RADIUS setups.

cli only.

/int wifi security set 0 ft-preserve-vlanid=no

jonmansey

Confirming iPad mini 2 and iPad Air work fine with WPA3, WPA2 and management frames enabled, but ft disabled.

So despite that Apple article, seems something isn't quite happy with FT on this generation of device running version 12.5.7.

jonmansey

Interesting finding that might be of use to someone. This might belong under the 7.13rc2 thread as a bug, or it may be a feature of the new wifi stuff. Bear with me, its a bit long-winded to explain. A new MacBook Air M2 was unable to pull a dhcp lease all day. It was connecting to wifi and roaming ...

jonmansey

I just added an ax3 and upgraded my cAP-ACs to the qcom-ac driver and 13rc2. I have an old iPad Mini2 on my desk with security cameras displayed on it, and wifi was working just fine on it after I got done with the upgrades, and everything else was working too. Some time later in the day I noticed i...

jonmansey

Set Default Route Distance to 2 under the LTE APN pick a test public IP such as 4.2.2.2 and nail up a static route over the ISP, and add a blackhole static route as well so 4.2.2.2 is only reachable over the ISP Here's my netwatch config, I found it helps to clear icmp and udp from conntrack. /tool ...

jonmansey

Any one have any luck with this? Im on AT&T with a EG12 modem. I got the v6 subinterface to go up once, but it didnt pull an address. I had IPv6 interface set to none, so I tried setting it to lte1 and lte1.v6 subinterface, but could never get the v6 sub interface to go up again after that. I ge...

jonmansey

its more about a bug in v7.1b4 than an issue with LTE version I think

jonmansey

lte.jpg

jonmansey

I am using snmp to pull the health voltage and create a chart. The value coming from the snmpget is always the same (I know the supply volts are not constant during the day, its a solar/lithium supply), until I open winbox and look at the System Health tab. Then the snmp value suddenly becomes dynam...

jonmansey

I just put v7.1b4 on a wAP R ac with LTE6 modem. I winbox I see a message in red "A newer version of modem firmware is available". Current modem fw version is R11e-LTE6_V026. I ran the cli command /int lte firmware-upgrade lte1 and it shows the old and new version are the same V026. I ran ...

jonmansey

Next we found a business contact who change our SIM Plans for that without limitation... and now we can use and receive even 85/30 ( @SiB, this is very interesting. Can you expand on your conversation with ATT business to get this limit removed? Did you basically request they upgrade the SIM to a b...

jonmansey

In case it helps anyone else, I found I had to use the following regex to make the static dns entry work. (I had to add the leading .)

.*.plex.direct

jonmansey

Hi, how do I pass command line arguments to the application? With the wine version, I was able to say wine winbox.exe <addr> <user> <pwd> and it would open with the fields populated, and connect. Ive tried open /Applications/Winbox-mac.app --args <addr> <user> <pwd> but it doesnt work Edit: It seems...

jonmansey

*) removed Drag and Drop support on 64-bit Winbox in Wine;

Why?

jonmansey

on the ipSec wiki hardware acceleration page, there is a note by the x86 (AES-NI) entry that states

*** AES-CBC and AES-CTR only encryption is accelerated, hashing done in software

So im guessing that's why there is no H by the entry as its not fully hardware accelerated.

jonmansey

try disabling hardware offload for the slaves.

jonmansey

For me it was as simple as setting the DHCPv6 client prefix hint to ::/62 and the ISP (TWC) gave me a /56 instead of the standard /64. Then I was able to simply add multiple ::1/64 to each vlan, and it all worked automatically. I think I could have used any prefix hint less than 64 and it would have...

jonmansey

jonmansey

Hi, I have a SXT cpe out at a remote location that seems to have been factory reset and looks like its running the default config. I have it registered to a test AP bridge, its clearly in station mode. I can mac-ping it, but cannot mac-telnet. I have a dhcp server set up on the wlan of the AP bridge...

jonmansey

Early results look promising for v6.42.3 fixing this nv2 issue with ar7240 stations, today I installed on an OmniTik and a mixture of SXT5 Lite and SXT5HnD stations, and I no longer get the TX Rate dropping to 6Mbps and the terrible jitter and pauses seen with 6.42.1.

jonmansey

Have you eliminated all the ar7240 stations and still having problems? that was the cause of the new nv2 instability for me.

jonmansey

@Uldis, so can we expect any kind of fix for this poor station performance under nv2 on ar7240 chips in a future firmware release? Or are we SOL?

jonmansey

@hapi, I see a couple of ar7240 devices in your registration table there, the ones with 00:0C:42 Mac addresses, try blocking them with access list and see if nv2 clears up.

jonmansey

Further testing reveals the problem is caused by any station with ar7240 chipset connecting to omnitik AP running nv2 and 6.42 causes the problem. I noticed in the AP registration table that some stations TX rate was dropping to 6.5Mbps randomly, typically all stations show over 100Mbps tx-rate cons...

jonmansey

Replying to Uldis, What is the distance from the SXTs to the OmniTik? All under 1km Does all the clients suffer from this or only few? All which exact SXT models you have as CPEs? mixture of SXT 5HPnD, 5HnD, 5nD r2, running various 6.40, 6.41 and 6.42 it seems the CPEs lose connectivity for a few se...

jonmansey

Add me to the list of disasters with the 6.42. I also have an OmniTik 5HnD. With 6.42 running nv2 with about 15 SXT5 lite clients, the ping time went crazy, super jittery with a lot of timeouts, plus I couldn't maintain a winbox connection to the SXTs, winbox file transfers kept failing and overall ...

jonmansey

I found that having connection tracking set to auto was the problem for me, I had to set it to yes to make EoIP have real 1500 MTU.

jonmansey

Thats very interesting, thanks for posting. There must be some special difference, I tried with a Lexar JumpDrive S45 128GB USB 3.0 Flash Drive - LJDS45-128ABNL and it wasn't even recognized in USB or Disks areas of winbox. I will try with a 32GB USB3 drive and report back. Could it be simply about ...

jonmansey

+1 I have the same problem, hope they can fix in a future update.

jonmansey

How do you set just one element of such a hash? :global assoc {a=1;b=2;c=3}; :put ($assoc->"a") 1 :put ($assoc->"b") 2 env pr assoc={a=1; b=2; c=3} now i want to change the value of b :set assoc {b=5} :put ($assoc->"b") 5 but now when I look at the other rows, they are ...

jonmansey

/ip fire add chain=input proto=udp dst-port=53 action=drop

jonmansey

you can use bonding over these unequal pipes by creating three EoIP tunnels that run over the two pipes, route two over the 100M and one over the 50M, then bond the 3 EoIPs, each will be close to 50Mbps and get the traffic shared evenly across the pipes with twice as much on the 100Mb as the 50Mb

jonmansey

I recommend dropping incoming DNS requests from the internet unless specifically required, there is huge active DNS amplification attacks going on and mikrotik is kinda vulnerable when it runs the dns proxy with "allow remote requests" checked. Typical symptoms to look out for would be CPU...

jonmansey

any update on this issue? comment from mikrotik guys? seems there are a few nasty gotchas with v6 and hotspots currently, also queues dont work quite right, im tempted to go back to 5.25 but i really like the mac cookie login method.

jonmansey

Glad to see the nv2 stalling bug reported as fixed, need to ask if it depends on only bridge/AP side, or also stations need upgrade?

jonmansey

I big "me too" on this. ethernet port problems are killing my business reputation for reliable service. and a big +1 to previous poster Gazza. This along with the wlans stopping randomly, its seriously making me doubt if mikrotik kit is "carrier grade" any more, or is it just che...

jonmansey

in my case its affecting 5GHz, im not sure why its a atheros problem only if it affects 2.4, seems it could be a driver issue either way, or in the nv2 code more likely.

jonmansey

seems same issues as this thread

http://forum.mikrotik.com/viewtopic.php ... 08#p305163

jonmansey

Ill add a 'me too' here, im seeing bridge and AP wlans go to 0bps tx data, stations remain connected, just unreachable. disable/enable fixes it. completely random, might be triggered by low signal or flapping station, only seems to affect nv2. support have been sent multiple supouts with no result a...

jonmansey

Thanks for the tip, unfortunately it doesnt appear to solve the issue. The workaround for now seems to be putting a random static IP on these vista machines, which restores connectivity through the hotspot. Narrows it down to broken dhcp client only on vista after recent windows update.

jonmansey

Hi, Im starting to get reports of DHCP not responding to Vista machines that have a new update, anyone else? They are on a hotspot and where they worked fine before, they now get 169 addresses.

Jon

jonmansey

seems bridge filters dont work in v5.1, anyone confirm this?

jonmansey

it doesnt seem to work though, we have a random problem of locking up RB333s right now, i have ping watchdog enabled, but the box hangs up, needs power cycle to restore it. if ping watchdog was in hardware, it would always be up or rebooting, these RB333s are totally hung, dead OS, no console respon...

jonmansey

almost certainly the application is a custom windows XP software with unknown and proprietary functionality that must work together with the device at the satellite teleport where the service originates.

mikrotik OS has no way to intercept and modify or spoof tcp sockets as far as I know.

jm

jonmansey

are you using a DNS cache?

jonmansey

TCP ack spoofing and acceleration are very specialized functions that intercept the tcp socket and fake the endpoints at each end of the satellite connection. RouterOS cannot do this, it requires specially written code and tcp stack running on devices at each end of the satellite link symmetrically....

jonmansey

do you have conntrack enabled each end of the eoip?

jonmansey

2.9.50. i havent had the courage to go to V3 on our main hotspots yet.

jm

jonmansey

we have the same problem as this, but on busy hotpsot servers, sometimes the queue mechanism seems to just break down and allow unlimited bandwidth through to users. quite annoying.

jm

jonmansey

for the hotspot to work, DNS must be functional on the device. I see you have public IPs entered for DNS servers, but your default route seems to point to 10.5.50.1, which seems just wrong, and you have no public IP address configured on your board to originate these DNS requests, and for them to be...

jonmansey

for what its worth, remember V3 is based on linux 2.6 kernel which is just so much better than linux 2.4, in so many ways.... conntrack is a kernel function (under netfilter), so its highly likely to work better under V3. I am faced with the same problem of upgrading thousands of routers to V3, but ...

jonmansey

you're getting 2 accounting records, possibly because the radius client (your access server) is not hearing the accounting ack back from the radius server, and its resending, even though the first one was received just fine, you end up with 2. check your logs for red entries that say 'accounting rec...

jonmansey

ive had very good experience using OpenDNS for porn filtering, it just works. Theres no way you will be able to keep up a list of keywords to filter, and its a lot of load for your router to do it. with OpenDNS, free by the way, you just use their DNS servers, and register your IP, then you can cont...

jonmansey

afaik uptime is measured in ticks which are 100th of a second.

2^32 = 4294967296

so 2^32 ticks = about 497.1 days.

Im guessing they only use 32 bits long counter for uptime. hence the rollover.

jm

jonmansey

I heard that failover to the second radius server works, but it never reverts back to using the primary. this could be fixed with a periodic script to disable the secondary thus leaving only the primary, this ought to force it to fail back to the primary. I havent tested it.

jm

jonmansey

you need proxy-arp on the lan port

jonmansey

/ppp act rem [find name=user1]

jonmansey

sorry, on pocket pc, i see the list of system types, but they are not clickable items.

how about putting the changelog link above the system selector? its the same for all versions, isnt it?

jonmansey

id like to at least be able to read the changelog....

jonmansey

also on pocketPC IE....

jonmansey

heres a suggestion that may strengthen the hotspot against the trial period hack a little more against simple mac address rotation, perhaps the trial user can be sent a cookie, then if they come back in with one of these cookies later from a different MAC and try to get trial, they are blocked. Triv...

jonmansey

there is a bug when deleting EoIP interface, its been around for many versions now, just disable, dont delete.

jonmansey

there is some chat about remote monitoring solar system in this other thread

http://forum.mikrotik.com//viewtopic.php?t=13875

jonmansey

this would be so much simpler if the recent RB series boards had a LM sensor that could show supply rail voltage. what happened to /sys health anyways? Having DC rail be measurable by SNMP would just make my solar life perfect, Ive been experimenting with an Omnitronix SL-12 and its working great, b...

jonmansey

what about using PPPOE? using radius to assign static IP and rate-limit to customers as they authenticate, you can sell them encrypted link also

jm

jonmansey

as Uldis told me, you can still enter timeout of 10000 for example via command line, just not from winbox. thats fixed it for me.

jonmansey

to actually set the time, the NTP must be 'syncronized' and it will only do this with 2 NTP servers configured and reachable, then it can syncronize and set the system clock to NTP time.

jonmansey

seems this post may have the answer

http://forum.mikrotik.com/viewtopic.php?t=13042

so the wireless access list on V3 has power limits? niiice.

jon

jonmansey

Hi We have a tower with 3 x 120 deg 2.4 sectors fed by RB532+RB564 with CM-9s. We have about 50-60 total users connected, ie about 18-20 per radio, but sometimes the users complain of pages not loading, erratic ping and packet loss. I would not expect this until about maybe 50 users per radio. We ha...

jonmansey

it sounds like this is a centrino chipset? you need post 2.9.25 proprietary-extensions

jonmansey

When the On Login script fires when a user logs in the hotspot, is the username passed to the script in any kind of environment variable?

How can I grab the username of the user who fired the On Login script pls?

thx

Jon

jonmansey

the reason for my slowness is due to the MT server being on the other side of a satellite link from the radius box, hence snmpwalk is pedestrian at best ;-) checkrad times out after 10sec. im now working on tweaking the telnet script, its working much faster. the two command lines to spit out the li...

jonmansey

heres some input on the issue. hotspot connections appear in the MIB as follows # /usr/bin/snmpwalk -r 1 -t 5 -v1 -c 'snmpcommunity' 10.0.0.10 1.3.6.1.4.1.9.9.150.1.1.3 SNMPv2-SMI::enterprises.9.9.150.1.1.3.1.2.2150629408 = STRING: "username1" SNMPv2-SMI::enterprises.9.9.150.1.1.3.1.2.2150...

jonmansey

no the pppoe checking works fine by itself, but i run pppoe and hotspot on the same server with the same radius, and i need to prevent simlutaneous login on pppoe and hotspot, hence ifdesc checking isnt sufficent as hotspot connections dont create interfaces as such. i beleive there is some kind of ...

jonmansey

begs the question, why isnt change mss=yes the default if its required to "make it work"? What does "default" mean anyway?

jonmansey

is turning off conntrack on a pure bridge considered a useful performance tweak in light of issues such as this?

jonmansey

any tips on how to prevent simultaneous login to pppoe and hotspot?

Seems the checkrad script needs some tweaks to check for more than just ifDesc entry in the mib.

jm

jonmansey

i would like to propose the bw test server should be disabled by default in the OS.

jonmansey

for what its worth, Im having suprious problems with paypal in the walled garden too. I was wondering if there was any comment from mikrotik folks on this thorny issue.

jm

jonmansey

Hi Can anyone help me with a sort of urgent problem, we just put up a 3 radio tower with 120 degree sectors, it seemed to work fine the first day but now we are getting major issues with deauths and disconnects, no 2.4 clients can connect for more than about 1 second aparently. Here is a sample of t...

jonmansey

Thanks for the tips friends, the first time I had uploaded both wireless and wireless-legacy, found it to be terrrible in latency, so un-installed wireless, leaving wireless-legacy, but in fact what this did upon reboot is leave me with no wireless interface. This time I only FTPd wireless-legacy al...

jonmansey

so only wireless-legacy, not wireless as well? When i did that the router had no wireless interface. Hmm, ill try it again.

jm

jonmansey

Hi I am having the by-now-infamous disconnects issue with 2.8.13 and would like to try 2.8.16 as Ive read it helps certain folks on the board here. However, I tried upgrading to 2.8.16 with wireless and wireless-legacy package loaded, but got the also-by-now-infamous slowness issue, which shows up f...

Search found 85 matches