Hi,

I am looking for a way to ground (and hopefully surge/EMI/RFI protect) properly an ATL and its corresponding indoor LAN. The planned setup is pretty standard:

ATL on a metal mast -- [building wall] -- hAP ac³ indoors -- LAN

The "--" connections use U/FTP Cat 5e cable. The height of the mast is 5-6 m (which is significant and could probably attract lightnings). Right next to the building wall (outdoors) there is other metal construction which is in physical contact with the mast. That whole metal construction's base is cemented in the ground (i.e. grounded, not quite scientifically, but that is all we have). The total Ethernet cable length between the ATL and the hAP is about 15 m.

The hAP ac³ and (most of) the LAN devices are back-UPS powered. That back-UPS has Ethernet In/Out port but it does not support PoE. There are no grounding terminals anywhere in the building, so for devices indoors we rely on Schuko sockets and the neutral line (N) being properly grounded/earthed by the electrical company. Unfortunately, the two MikroTik devices have no Schuko plugs. (A) [referred below]

Information I have so far:

The user manual saying:

Use a POE injector and proper grounding, this device has a specially-designed grounding connector under the port cover. Recommended using shielded Cat5/6 cable.

The grounding connector is simply a hole with a thread in the metal plate of the ATL. There is grounding wire packed with it, not even a bolt with proper thread. For some reason this hole is *not* visible on the rendered image of the ATL. It is near the SIM card slot, i.e. under the plastic cover.

The dark-gray box with the cylindrical hole in it is actually white in reality. It is a rubber sealing through which the Ethernet cable passes (quite tightly). There are no holes or openings for any other cables whatsoever, so it is not clear (or documented) at all how exactly one is supposed to ground properly the ATL.

Information from support:

There is a separate ground connector on the  ATL under the port cover.  You need to connect the ground pin to the mast, that is grounded.   

If the mast is in contact with the ground and is not painted, you should not ground it separately.   

GESP supports PoE passthrough. You can use it on both ends of the ethernet cable between hAP and ATL to protect from lightning or surge damage. ( If you do not want to use PoE-Out, you can get GESP+PoE-In for the indoor side)

However, considering ATL's actual design, it is physically impossible to use a MikroTik GESP simply because it's RJ45 cannot pass through the rubber sealing of the ATL. The GESP+POE is not an option either because of (A).

At first sight, it seems the only option is to pass a thin wire through ATL's rubber sealing together with the Ethernet cable and put it in contact with the mast. Perhaps, I could actually use the ground wire of the cable itself, screwing it to the grounding port, pass it through the sealing, then on the mast. That would ground both the ATL and the cable shielding. This, however, equals zero surge protection.

Another possibility is:

ATL -- GPeR + GPeR IP67 Case -- GESP -- [building wall] -- hAP ac³ indoors -- LAN

However, I am questioning the benefit of this option - not only because of its added price but also because adding more (otherwise unnecessary) components along the Ethernet cable normally reduces its throughput. Honestly, I am also questioning the overall protection the GESP could provide, considering nothing can save the ATL in case of a direct lightning strike and in case of a thunderstorm I would surely unplug the cables on the indoors side.

What would you do?
Please share your experience, thoughts and advises.

However, I am questioning the benefit of this option - not only because of its added price but also because adding more (otherwise unnecessary) components along the Ethernet cable normally reduces its throughput. Honestly, I am also questioning the overall protection the GESP could provide, considering nothing can save the ATL in case of a direct lightning strike and in case of a thunderstorm I would surely unplug the cables on the indoors side.

You'll slip one (not on purpose) and forget to unplug, and based on Murphy's law, it would be when lighting strikes.

Plus, it's not quite convenient to go and unplug NAS locked in rack, TV connected from back, docking monitor, other access point(s),... and, I'll loose internet connectivity in those things.

I have personally experienced a lighting strike during a little bit cloudy day, no rain, no thunder. The lightning hit the tree next to the big open swimming pool, I was in. Frightening experience. It was the closest tree, but still maybe 20 or 30 meters away. Luckily the tree was elevated, and that probably saved us. So, I wouldn't bet also on unplug only during thunderstorm.

What would you do?
Please share your experience, thoughts and advises.

I got 5G antenna and outdoor wifi. I did optical fiber separation between outdoor facing block and indoor facing block.

Optical fiber can't transfer electricity. Lightning will try to find path to the ground, so it would search the path also through ethernet cables and devices. Lighting is not just a surge, it's mega-surge. No (not-way-too-much-expensive) surge protection can sustain lighting, if it passes through it. If you read specs, it can handle only certain amount extra voltage and current, way below power of direct lighting strike.

Outdoor facing block contains also edge router - hAP ax³ - which is also used as indoors AP. However, no indoor device is connected via ethernet to any router/switch in outdoor block.

I used media converter connected hAP ax³, then fiber to RB260GSP, and then from this switch I connected the rest of internal network and devices.

Also, used separate power circuit to power the outdoor block. I have UPS in the rack as 5G antenna takes age to reboot after 1s long power micro-outages. And, use PoE for everything not in the rack.

I'm willing to loose every networking device in outdoor facing block. It's low probability anyway. However, I have my much more expensive indoor devices safe.

@kravemir

Thanks for sharing your experience.

From the viewpoint of physics, I don't see how grounding nearby external devices and electrically separating them from the indoor ones could possibly save the later from the electrical currents a nearby lightning strike induces, unless the indoor block is sufficiently surge protected itself. In my case, the outdoor block is 3-4 m away from the indoor block (hAP) in the house (straight path), all equipment is on the same power line (single phase), so I don't live with the illusion that there are 2 blocks at all (from the viewpoint of electromagnetic induction). Additionally, the ATL is powered only through PoE which complicates fiber usage and does not really justify the additional cost. These are the reasons I am not considering fiber optics or outdoor AP but I am rather thinking about proper grounding of the whole thing with some (reasonable degree) of surge protection because the mast itself is a new thing here and I am concerned it may attract unwanted electrical phenomena.

Plus, it's not quite convenient to go and unplug NAS locked in rack, TV connected from back, docking monitor, other access point(s),... and, I'll loose internet connectivity in those things.

Your setup is more complicated and probably connection availability is critical, so I understand the inconvenience you explain. In my case, I meant unplugging just the WAN cable from the hAP in case that cable is not surge protected and the indoor equipment from the mains. That could protect the indoor block from currents induced in the mast, propagating through the Ethernet cable itself, as well as the non-UPS protected devices from mains surges. Something like a manually operated surge protector. Perhaps I would do it even with a surge protector outdoors. That's why, considering the proximity mentioned above, I am questioning the benefit of adding a surge protector. It would indeed serve just as an extra protection in case the manual action is not done for some reason.

My biggest confusion (and the main reason for starting this thread) is the repeated advice by MikroTik's support to use GESP with the ATL - something impossible to my mind, as explained. So, I wonder how to ground the ATL in particular (and hence the fairly small and nearby LAN connected to it). Any idea about that?

From the viewpoint of physics, I don't see how grounding nearby external devices and electrically separating them from the indoor ones could possibly save the later from the electrical currents a nearby lightning strike induces, unless the indoor block is sufficiently surge protected itself. In my case, the outdoor block is 3-4 m away from the indoor block (hAP) in the house (straight path), all equipment is on the same power line (single phase),

This is good point.

If these equipments are the on the same mains circuit, then they aren't that well electrically separated. In case of direct lightning to outdoor device, the circuit would be draining current to the ground, and it would create huge surge for devices on the same mains circuit.

However, the surge in mains can be caused by any else device, that malfunctions. Or some else induction. So surge protection of expensive devices connected to mains is needed regardless of outdoor AP presence.

so I don't live with the illusion that there are 2 blocks at all (from the viewpoint of electromagnetic induction).

I'm fully aware of that, It's not possible to have full electrical separation from mains.

Mains circuits are connected at some point. The electrical installation in the building must be done correctly, and it should have surge protection, that would drain the surge (the majority of it) to the ground instead of letting it to go to other circuits. For this to be effective, the surge protection device should be connected to low impedance ground.

And, if this big heavy duty surge protection on mains fails to drain current to ground, then I don't believe that any tiny ethernet surge protection would drain such a current from direct lightning to ground by itself.

That's why building needs proper lighting protection itself. So, it drains lighting current to ground instead.

I don't believe in lighting protection of my building. That's why I have separated networking separated by fiber, and I'm using different mains circuits. I did my best, the biggest possible separation, that I could do myself. And, I'm hoping the new electrical installation would do the job protecting the mains. The installation of proper lighting protection of the whole building is on reconstruction-todo-list.

... I am rather thinking about proper grounding of the whole thing with some (reasonable degree) of surge protection because the mast itself is a new thing here and I am concerned it may attract unwanted electrical phenomena.

You should have surge protection on ethernet then. If the mast and the other metal construction is properly grounded, then this should be the main path of lightning to the ground, and it should drain lighting to the ground. However, it would still create a surge on ethernet, either via induction or directly. Ethernet surge protection are designed against this, they won't survive or drain direct strike, but protect against this weaker surge.

Perhaps I would do it even with a surge protector outdoors. That's why, considering the proximity mentioned above, I am questioning the benefit of adding a surge protector. It would indeed serve just as an extra protection in case the manual action is not done for some reason.

My biggest confusion (and the main reason for starting this thread) is the repeated advice by MikroTik's support to use GESP with the ATL - something impossible to my mind, as explained. So, I wonder how to ground the ATL in particular (and hence the fairly small and nearby LAN connected to it). Any idea about that?

... (previous post) Honestly, I am also questioning the overall protection the GESP could provide, considering nothing can save the ATL in case of a direct lightning strike and in case of a thunderstorm

Definitely it won't save it against direct lightning hit. The device would capture the lightning, and be then the origin of surge, and it burns, and tries to burn the rest of connected things. And, I don't think GESP would protect the rest of the network, in case that you do not do the manual action for some reason.

It saves it from surge created by induction created in wires, that is caused direct lightning to something nearby. Assuming the lightning hit something already properly grounded. Or, it hit the lightning protection of the build or construction itself, which drains current to the ground.

The best is to have proper lightning protection of house and construction, and prevent any direct hit. The second best is to have fiber between outdoor and indoor, using separate mains, and hoping for mains surge protector to do its job.

Yeah, the theory is clear. In an ideal world, we should have all buildings and infrastructure done by the book. Unfortunately, reality is not always like that. In the particular (imperfect) case, I am just trying to do whatever is possible (and reasonable) without rebuilding the building.

BTW, I finally received a reply from support which answers my actual question:

There is a groove in the grommet, which you can cut to get the cable through.

That explains how to use the GESP with the ATL.

I suppose one GESP right under the ATL and grounded to the mast should suffice for such a short distance (~15 m Ethernet cable).
What do you think?

I had leftovers of a WiFi cables going from the roof down to the connection point via chimney + in the seconf chimney metal pipes of a heating device. Tree next to the bulding in circa 10 meters. Power line was 20 meters from the tree. No special dedicated anti-thunder grounding.
Thunder stroke the tree (there was a long wide "scar" on the main bough visible) and inducted so much electricity that the heating device died with burnt PCB but everything else survived. TV, HiFi, computers ... the only damage was the heating device. Suspecting metal pipes + disconnected cables.

Yeah, the theory is clear. In an ideal world, we should have all buildings and infrastructure done by the book. Unfortunately, reality is not always like that. In the particular (imperfect) case, I am just trying to do whatever is possible (and reasonable) without rebuilding the building.

In ideal world we would have perfect surge arrestors. In real world we do something like @kravemir did and hope for the best. Only ample insulation (a few meters of air, similarly thick layer of electrical insulator) can prevent direct lightning hit from frying electrical devices close by. GESP doesn't cut the bill, FO does (if lightning doesn't crack open the reinforced concrete while traveling through house walls, I've seen aftermath of one such event).
But more common are indirect strikes, where voltages and amount of energy are magnitudes smaller. Only then all those gadgets (GESP, UPS with lightning protections, house surge supressors, etc.) have chance to do their job (which is saving more expensive gear from damages ... destruction of surge supressing equipment is fully acceptable consequence). And danger of indirect lightning strike damage can go hudreds of meters ...

@mkx - glad to see you join this thread!

I am not sure what you mean by ample insulation because a few kilometers of air obviously don't prevent lightnings from striking.

GESP doesn't cut the bill, FO does (if lightning doesn't crack open the reinforced concrete while traveling through house walls, I've seen aftermath of one such event).

A direct lighting strike on the mast will fry the ATL and the cable, possibly even part of the mast. The house (and everything inside it), being 3-4m from the mast, will experience very strong indirect strike (with deep surge), even if there is no ATL on the mast and no cables connecting anything. To my mind, relying on these 3-4m being FO is quite unrealistic. The main concern here is rather - will we stay alive (strong EMP can block heart beat and influence neural system from a distance). That's why, if we are discussing direct lightning at all, the only meaningful question is whether to install the mast or not. That is a big concern and I am still wondering whether I should shorten the mast (and thus risk having worse Internet connection). I will have to experiment with the height of the ATL before deciding.

And danger of indirect lightning strike damage can go hudreds of meters ...

Exactly why the additional 3-4 m of air (or FO) don't matter much. Or am I missing something?

FWIW, I find it quite strange that in that video of Mr. Normis in which he mounts his ATL, there is no even mention of surge protection, grounding or anything along these lines. He simply mounted it as high as possible.

BTW, while researching for options, I found this device which got my attention because:

- its specs are quite similar to GESP's
- its discharge current is "10 kA+" (GESP's is 3 kA)
- it has no pre-mounted cables which would allow me not to cut the rubber sealing of the ATL (thus not reducing its weather protection)
- it is half the price of the GESP

Do you guys have any experience with this surge protector? Except being non-MikroTik, is it any worse than the GESP?

Check these ...
https://www.apc.com/shop/gr/en/categori ... /N-1r8hw9s
https://www.itwlinx.com/products/surgeg ... or-housing

@BartoszP

Neither of them seems suitable for outdoor usage + the price is higher than that of the GESP.
What are the benefits for the particular case?

@utiker: explaining mechanisms of lightning strike is beyond the scope of this thread ... I can just assert that I know a bit about lightnings (by profession I'm meteorologist which is a course on Department of physics at our University). It's up to you to take my words or reject them.

Now, none of isolation or surge suppressors will prevent a lightning to strike to a particular spot. However, these can help when lightning strikes and all those megajoules of energy try to go to ground ... and will use the path with least resistance. Copper UTP cables are good conductors while FO are not. Lightning suppressors usually contain varistors which can drain some energy (but not much) and are good enough for protecting devices from indirect strikes. But then, again, we are talking about protecting indoor equipment from mild over-voltages. Consider this: normal (non-PoE) ethernet ports can get damaged if they are presented with 48V and a few tens of joules. Most surge suppressors will take this much (and blow the included fuse if necessary) and successfully protect the electronic device connected beyond it. Indirect lightning strike can induce hundreds of volts but amount of energy will not be very high (most varistors will take it without damage).
And come centimetres of FO will gladly insulate against a few thousand volts, which will prove difficult task for usual surge suppressors. The only thing about FO is that one has to use separate power circuits powering both ends (as already suggested).

@mkx

Suppose a lightning (L) strikes 20, 50 or 100 m away from some point A.

Can you tell me, as an expert in these matters, how many volts is the difference between the electric potentials induced in point A and point B, if the horizontal distance between the two is 1 m, measured radially from the lightning bolt? L, A and B are galvanically insulated from each other:

(L) ----------- [20, 50, 100 m] ---------- (A) -- [1 m] -- (B)

I said "I know a bit about lightnings" ... if you read this as "I'm an expert in these matters", then we have some basic misunderstanding.

But anyway, calculating the example you presented isn't simple. There are plenty of articles on internet (one example) showing that calculations are far from simple and give wide range of results. We can start with wide range of current peaks of different strikes (vary by an order of magnitude), continue with geometry of conductors (in which voltage is induced), etc. But we're still talking about tens or hundreds of volts (which can cause serious damage to electronic devices). At mentioned distances, with some luck and decent surge suppressors, devices will survive. Even more so if there's a stretch of FO in between - we're talking about hundreds of volts, not milions.
At direct strike, odds for equipment surviving the event are slim. In this case a few metres of FO probably doesn't make much of a difference, voltage will get induced elsewhere, e.g. in the circuit board of the device itself.

At direct strike, odds for equipment surviving the event are slim. In this case a few metres of FO probably doesn't make much of a difference, voltage will get induced elsewhere, e.g. in the circuit board of the device itself.

So, a direct strike to something closer than few metres from devices would fry them?

I.e. direct hit to the metal roof, or to the lighting protection draining current to the ground, would fry devices in house via induction regardless whether devices are somehow connected to directly hit object or not connected to the object nor to any power, network or metal at all?

It might. The key here is induction ... and metallic cage (Faraday cage) blocks it ... the cage itself has to be grounded and anything conductive entering it as well (power cord, UTP cables). The same concept applies to wires - shiellded TP helps if shield is properly grounded as well. Coaxial cables are in advantage here as their outer conductive layer (usually copper mesh or aluminium foil) acts as Faraday cage itself.

Most of times the not-connected device won't suffer from any damage ... there has to be some voltage difference and induction in random wires which run close to each other is usually similar (think twisted-pair wires). So the whole device (all of its metallic parts) will "float" on the electric field without large voltage differences between different device parts (just like a bottle cork floats on oceanic waves, the cork doesn't tilt much).
But if device is connected to anything, then there will be potential difference and some low-voltage low-power element may get damaged.

Adding 1 m to the end of 20 or 100 m is 1-5% difference. Considering the inverse-square law, this means 0.0025-0.0001% difference in the voltage between A (Va) and B (Vb). If that voltage is hundreds of volts (e.g. 200V), this means respectively:

200V = Va * 0.0025% => Va = 80,000 V (and Vb = Va - 200V = 79,800 V)
200V = Va * 0.0001% => Va = 2,000,000 V ( and Vb = Va - 200V = 1'999'800 V)

If there is 80 kV right outside and next to my house wall and 79'800 V on the inside, this is game over for everything and everyone. And the 2MV case is stronger than a direct strike. So, to my mind there is no way to protect anything and these hundreds of volts are unrealistic if we are discussing 1-5%.

That's why I am questioning if FO can add any additional protection because such high voltages are deadly anyway. Galvanic separation would make sense if A and B are further away from each other (e.g. 50-60%). Then even if A dies, B may survive. And then a surge protector can do the same.

I reserve the right to be completely wrong, so please feel free to abolish all that

Voltage alone doesn't matter. Power matters. High voltage without current won't produce much power.

You do calculations based only on voltage, which would be good strength indicator only for constant/stable power supply, because current can be derived from voltage and resistance/capacitance characteristics of connected object.

For not constant voltage power supply, the calculations of total produced power(watt hours) differ a lot.

The lightning isn't AC. Neither it is DC. It's one "oscillation of AC". Therefore it won't produce constant high supply of current/power via induction.

People survived few meters direct hit of lighting to bus-stop-waiting-shelter, open space, some died, some not.

Found interesting video with very very very high voltage https://youtu.be/U8skz484Ctk?si=eIH9u6Py2uGG2pNz.

Indeed as @kravemir hints: those milions of volts is difference in potential between cloud and ground (any point of it). However, since air resistance is pretty high, lightning can't strike until there's a conductive channel formed. Conductive channel forms by air becoming ionized and that happens when electrical field gradient gets higher than breaking voltage, for air that's around 100kV/m. This normally happens around extruding features on the ground (high trees, high buildings, grounding poles, electric and telco masts, etc.), the conductive channel thus most often forms from ground upwards. (And, BTW, grounding quality of these features foesn't play any role at this moment, the fact that the feature touches ground is enough to put it at ground potential. So no, installing grounding on the house roof does not attract lightnings). When lightning strikes, it causes a surge of current ... often it's amplitude is around 50kA and duration around 50 microseconds ... with slightly weaker secondary strike after around 200 microseconds. This current surge causes transmission of EMF surge which then causes induction in surrounding metallic objects. Its amplitude is dropping approximately with square of distance from the conductive channel. The voltage induced in metallic objects very much depends on dimension and orientation relative to direction towards lightning, for simple objects such as linear wires the voltage induced is "manageable". But it doesn't have much to do with milions of volts that cause lightning strike, it has to do with current surge amplitude and inductivity of the shape.

Again: in case of direct lightning strike no insulation (including FO) will do much, there are other effects which will cause damage - as already mentioned small distance from high current will cause very high induced voltages, also effects of conducting direct lightning inside materials which are not good conductors can be devastating (e.g. exploding concrete due to heating and consequential evaporation of any moist inside concrete) ... FO passing a stretch of affected concrete would get damaged ... but UTP cable passing same concrete might catch some of direct lightning due to insulation breakdown and that would casue much more severe damage to connected devices.
With proper grounding electronic devices can survive direct lightning strikes, many MNO towers are directly hit by lightning now and then (and some very often) and gear continues to work (and of course there are cases where all the diligence during lightning protection installation doesn't help and equipment gets damaged, even fires can start). But we're talking about some big figures for surge arrestors prices and very dilligent grounding installations, not something Joe Average does at home (and according to initial post of this thread the later not something available to @utiker).

But again: grounding of devices and wires is not really about direct lightning strikes, it's about indirect (induced) voltage peaks.

Again: in case of direct lightning strike no insulation (including FO) will do much, there are other effects which will cause damage - as already mentioned small distance from high current will cause very high induced voltages, also effects of conducting direct lightning inside materials which are not good conductors can be devastating (e.g. exploding concrete due to heating and consequential evaporation of any moist inside concrete)

Does this apply, even if the building has lightning protection done by the book, and the protection would form a Faraday cage?

Assuming, the lightning hits the lightning rod of the protection, and the current is drawn around the building, through this Faraday cage, to the ground. And, lightning did not jump to any indoors device, or any else conductive material.

Also, how would it affect the results, if the lightning did jump also to any conductive material, that's passing through the house (power wires). Speaking of devices, that aren't connected to the power circuit, that's hit.

If building forms more or less proper Faraday cage, then devices inside should be more or less safe. With possible exception of devices which are very close to elements of such cage (e.g. a wall-mounted or ceiling-mounted AP, which is very near one if conductors forming the cage). But I'm really only guessing about possible damage in such case. If the lightning wire is placed on the outer side of wall (as it's done very often), then the distance to indoor device likely exceeds 0.5m and if circuit board is hotizontal (orthogonal to lightning wire), the induced voltage in the board connections will be next to zero. With circuit board in vertical direction, induced voltages will be higher but due to small dimensions of circuit board those voltages might be low enough not to cause damage.

Also effects of other border cases (such ad partial lightning jump to a wire inside such house) can vary a lot. Anything between almost nothing (e.g. if a low-energy surge hits a classic power supply transformer or a heating element in a boiler) and device cestruction (if equally low-energy surge hits communication port of a device without overvoltage protection ... in this case it may destroy all electronic elements). A high-energy surge (if wire insulation breaks down in the initial moments if lightning passing the building construction) can destroy even most robust electric devices, we're again talking about a few kilovolts (it's not milions of volts, it's kiloamperes flowing through non-ideal conductor and associated voltage drop) and kiloamperes.
This is the reason for the rule that lightning protection leads should not touch reinforcement elements (e.g. mesh in reinforced concrete walls or rods in pilons) ... making lightning's path more distant from wiring and thus lower probability for such "jump" to happen.

And, BTW, grounding quality of these features foesn't play any role at this moment, the fact that the feature touches ground is enough to put it at ground potential. So no, installing grounding on the house roof does not attract lightnings

It is not the grounding that attracts lightnings. It is electrical charges (in the cloud) attracting other electrical charges (in the feature), AKA electrostatic induction (as demonstrated by Michael Faraday himself). The more conductive the feature, the easier charges travel inside it, the easier they move towards the opposite charges (to its tip, closest to the cloud), the shorter the distance between both charge groups, and the less energy required for them to travel between the cloud and the feature. That's why a lightning would "choose" the conductor, not an identical dielectric object. That's why lightning rods are made of metal, not of plastic.

Your explanation is complete only if it clarifies that the (e.g. Faraday cage) grounding on the building changes its lightning attraction properties only insignificantly because normally the building already contains a lot of conducting materials anyway.

Voltage alone doesn't matter. Power matters. High voltage without current won't produce much power.

My post was focused on voltage because @mkx spoke of voltages and it was aimed to illustrate why I think 1-5% distance of FO (or air) makes no difference (which is why I consider it futile for my particular case). Strictly speaking, what matters is energy, not power per se.

In the general sense, considering resistance is the same, voltage determines current. Voltage without current does not produce any power.

[...] It's one "oscillation of AC".

The correct term is electromagnetic discharge.

Friends,

I hope you would agree though that if someone notices the thread title, willing to find the answer to the same question, one would rather get lost in this whole theoretical disquisition.

The more conductive the feature, the easier charges travel inside it, the easier they move towards the opposite charges (to its tip, closest to the cloud), the shorter the distance between both charge groups, and the less energy required for them to travel between the cloud and the feature. That's why a lightning would "choose" the conductor, not an identical dielectric object. That's why lightning rods are made of metal, not of plastic.

(Emphasis by me)

Not entirely true. As I explained, lightnings tend to strike into grounded features where there's greatest gradient in electrical field ... hence it will more likely strike into a rod (extremely pointy thingies making causing highest possible gradient) than to a flat surface. However, the material which lightning rods are made of comes into a play only right after the discharge starts. Good conductor allows lightning to discharge without losses in the material, excessive heating due to large current would mean permanent damage to the lightning rod itself (making it one-time use device). If the resistance of lightning rod was high enough (i.e. plastic), then lightning would choose to travel over diffrrent path, likely "jumping" to nearby structures after striking the tip of lightning rod (or close vicinity).

Yes, you're right, this topic doesn't have much to do with opening post and I'm definitely out of here.

Well, the direct lightning strike topic was started in the original post:

Honestly, I am also questioning the overall protection the GESP could provide, considering nothing can save the ATL in case of a direct lightning strike and in case of a thunderstorm I would surely unplug the cables on the indoors side.

What would you do?
Please share your experience, thoughts and advises.

@kravemir

The topic is in the title. The mention of direct lighting strike was not aimed to be the central subject, on the contrary - it was mentioned exactly because there is nothing (or very very little) one can do against it. Sorry if that caused some misunderstanding. The focus is grounding and surge protection. Yes - shared experience, thoughts and practical advises are very welcome, as I don't have experience with such outdoor protectors and don't know what they can actually do. Your setup is very interesting and in case of so much equipment I would definitely consider it.

@mkx

You came with an assertion of certain professional experience. That is great as I very much value knowledge and always like to discuss with intelligent people like you. Personally, I also know a little bit about physics but that is not important. I was just wondering if and how to use those surge protectors, as I am not planning to use FO.

The topic is in the title. The mention of direct lighting strike was not aimed to be the central subject, on the contrary - it was mentioned exactly because there is nothing (or very very little) one can do against it.

Sorry for going off-topic then. I (mis)understood it as clarification of details for the topic, that you want to protect against direct lightning strike to the mast due to it's height. Instead of this statement being just a side remark.

No worries at all! Glad we are back.

So, do I understand correctly that you have no surge protectors on your outdoor block, just an UPS powering it? Does that UPS protect the outdoor Ethernet too? How is your 5G antenna powered - PoE or some other way? What is your overall setup - how far from each other are the two blocks, how do you convert Ethernet to FO and vice versa?

So, do I understand correctly that you have no surge protectors on your outdoor block, just an UPS powering it? Does that UPS protect the outdoor Ethernet too? How is your 5G antenna powered - PoE or some other way?

No surge protectors, no ethernet protectors. The 5G antenna is powered by 802.3af/at PoE injector (two pin power connector - no ground). Just as ISP's technician installed it. I only added UPS in between power and injector. The antenna is mounted on the wall, roughly 1 meter below rooftop of the house, and the roof actually is covering the antenna - roof is roughly 1 meter extending from wall further. The PoE injector to antenna cable is roughly 7 meters long.

I was thinking however to replace the dumb injector with hEX PoE (RB960PGS), where I can script restart (power off, wait, power on), because once 5G antenna looses connection to the tower (tower was dead, no phone reception either, no LTE on phone, on calling even to call support ), it won't recover without hard reboot. It was happening only for a week, each afternoon at similar time for few consecutive days, and don't happen since that week. So, I guess either a faulty device on tower, or some maintenance or rework.

What is your overall setup - how far from each other are the two blocks, how do you convert Ethernet to FO and vice versa?

Outdoor UPS is located in unfinished top floor in a rack. I wanted a metal enclosure for UPS. This powers also hAP ax³ edge router, which is also powered by PoE for better positioning for better wireless coverage. From it, Ethernet goes to some cheap managed switch.

From switch Ethernet goes to passive gigabit PoE for wAP ac. Mounted 2 or more meters below rooftop. I'm not quite satisfied with it. Proper positioning of hAP ac³ behind outer wall brings similar outdoor coverage. The wAP ac actually has got the longest cable, in whole setup, maybe 15-20 meters.

From switch, ethernet goes to goes to TP-Link TL-FC311A-2 (or TL-FC311B-2). Which goes to TP-LINK TL-SM321B (or A - the right counterpart) in RB260GSP. The cable is 5m+3m joined with SC-SC connector.

This RB260GSP is 2 floors below, in the basement. It is powered by PoE from another UPS in another rack, in basement, and this cable is actually quite big too, maybe 15 to 20 meters too. The non-power side of injector is providing gigabit ethernet connection to NAS in the rack. And, the RB260GSP also powers the hAP ax² (now, previously hAP ac³) in the basement, and delivers ethernet connection to TV, docking monitor and else, one floor above (middle one).

From above setup, hAP ac³ is currently unused. I'm thinking to put it back though. And, put hAP ax² to a IP68 enclosure, and use it as outdoor AP instead of wAP ac. Or, maybe do the same with hAP ac³, but that would require a bigger enclosure. Or, wait for wAP ax.

As for Ethernet surge protector, I was thinking about Cyberteam SPG-8P-1U, which is also PoE injector, or other Cyberteam products. But, that increases total cost.

I don't recommend to link your main switch directly to an outdoor PoE.

I am planning to mount a WAP-LR8 with antenna on a high roof.
I am planning WAP-LR8<->small PoE switch<->fiber SFP<->main switch.

The advantage of Fiber is that it will protect your main switch for a direct strike.

Fiber is less thinking. Mikrotik does make a transceiver box for PoE to SFP* that you could in-between:
https://mikrotik.com/product/RBFTC11

*just don't use DAC SFP to switch, since typically their still cooper

I am planning WAP-LR8<->small PoE switch<->fiber SFP<->main switch.

The advantage of Fiber is that it will protect your main switch for a direct strike.

The main switch is a cheap managed Zyxel switch, which costs half of RB260GSP. What difference, in case of direct lighting strike, would your proposal make, if PoE switch and main switch are connected to the same power outlet / strip / UPS / power circuit anyway?

Fiber optics is between this cheap Zyxel main switch (using media converter box) and RB260GSP, which is powered from separate UPS on different power circuit. The expensive indoor stuff is after this RB260GSP.

@kravemir

Thanks for the details.
As an owner of the hAP ac³ and the wAP ac, could you tell me:

- Is it possible to have the wAP ac outdoors and the hAP ac³ indoors, so that wAP can "get Internet" from the ATL, then "send Internet" to the hAP ac³, while the hAP ac³ itself can simultaneously "get Internet" from the wAP ac and "send Internet" to the devices on the indoor LAN? If yes, how do I configure that in RouterOS?

Also:

Do you guys know if Ubiquity's ETH-SP-G2's surge protector supports passive PoE passthrough? It's specs say "Passive surge-protected RJ45 Ethernet ports" but what does that mean? And won't its higher (90V) DC spark-over voltage (compared to the 75V of the GESP) be a problem, as it would obviously allow higher voltage surge on the Ethernet line (potentially damaging for the ATL/wAP/hAP ac³)?

As an owner of the hAP ac³ and the wAP ac, could you tell me:

- Is it possible to have the wAP ac outdoors and the hAP ac³ indoors, so that wAP can "get Internet" from the ATL, then "send Internet" to the hAP ac³, while the hAP ac³ itself can simultaneously "get Internet" from the wAP ac and "send Internet" to the devices on the indoor LAN? If yes, how do I configure that in RouterOS?

It can work. The general flow is passthrough on the ATL, wAP as bridge, and use ether5 as WAN on hAPac3. You'd want to two VLANs, one for the LTE passthrough, and one VLAN for management to get to RouterOS on the ATL and hAPac3. Also PoE is tricky: the wAPac's ether1 can get power from ether5 of hAPac3; but, you'd still need an injector on ether2 of wAP to go to the ATL.

I am trying to evaluate the possibility of galvanic separation of the indoor and outdoor devices - not through FO but through WiFi. Hence my question. I am not considering Ethernet connections between hAP ac3 and wAP ac.

From the way you reply I understand are advanced in playing with things like VLAN, LTE passthrough, bridge etc. I am not a network expert though, so I guess I have a lot to learn, including the meaning of those terms. I guess my own question is beyond my current level.

Hence my question. I am not considering Ethernet connections between hAP ac3 and wAP ac.

Yes, it's possible. The hAP ac³ can act as station (client), and provide/route connection further via ethernet ports. I assume, but didn't try myself, it's possible to set one radio as station, and use the other radio as access point to provide connection further.

Coincidentally, I have been working on something similar over past days, but the other way around - sharing connection to second build. However, I bought SXTsq Lite2 - RBSXTsq2nD second hand together with wAP ac, and I am using it as a station (connected wirelessly to hAP ax³), and it is passing connection via ethernet further to the hAP ac³ that acts as access point.

Now, there are multiple options how to configure things:

• hAP ac³ has own separated LAN network, and treats connection to wAP ac as WAN port, therefore it does own DHCP to LAN, routing, NAT to WAN, and firewalling.
  
  • This is the easiest way, and you can try this with any wireless connection as "internet provider connection", i.e. connect from hAP ac³ to hotspot shared from smartphone, and pass connectivity access further.
  • The wAP ac with ATL need to be setup to be their own LAN network. Which results in double NAT on hAP ac³'s LAN. And, connectivity between those LANs would be one directional.
  • Though,.. if you don't setup firewall on hAP ac³ and neither setup NAT on it, then you can do NAT only on wAP or ATL (hope lower license level allows it) and have simple routing between subnets, and you would have bi-directional connectivity between those LANs, but they would still be separate broadcast domain (some apps have issues). A bit more complex to setup, but should provide better experience.
• bridging devices, that they would provide connectivity as one L2 broadcast domain (i.e. switch). This much more complex, requires either compatibility on wireless devices (station-bridge), or using L2 tunnel (EoIP or else). If you do the first option first, then you can expand and reconfigure to this.

Thank you.

I need to learn more about networking. To avoid further off-topic, I started a new thread, so I hope we can discuss there.