MikroTik

cmacneill

I've been trying to upgrade the firmware of an LtAP R11e-LTE Modem, but failing each time. RouterOS/Bootcode: v6.48.6 LTE Firmware: MikroTik_CP_2.160.000_v018 Has anyone had experience with issues with LTE under RouterOS v6.x that have been resolved by upgrading to RouterOS v7? Is the upgrade protoc...

cmacneill

It's been a while since this was posted, but in case the OP or anyone else sees this in the future, I have just observed similar behaviour on an RB1100AH. I observed the Tx/Rx bandwidth periodically dropping to 0bps on some, but not all interfaces. Initially it was every 10-15s, but after a reboot b...

cmacneill

Hi, I know this is an old thread, but no one from MikroTik seems to have ever commented and I am hitting the same problem. When will MikroTik support TLS AUTH for OpenVPN Server/Client? This seems to be a standard option in vanilla OpenVPN Open Source, so why not implemented in MikroTik (yet)? I've ...

cmacneill

I'm trying to solve a problem of how to increase bandwidth capacity at some of our sites and route traffic by type through two or more Internet connections. Currently I am doing this successfully by using multiple SSIDs connecting to seperate Hotspot entities with unique IP address ranges, then simp...

cmacneill

Hi, I'm struggling to optimise caching for our custom Hotspot code. MikroTik web server variables allow changing the Cache Control and Expires header options for the HTML pages, but any JavaScript, CSS, Images, Icons etc. loaded from that page have default options which prevent caching. The followin...

cmacneill

"export compact" only exports changes from the factory default settings. In Factory Default, Switch ports are set to master=none, so I would say this is working as documented.

cmacneill

It would appear that the MikroTiK SessionID for RADIUS authentication gets reset on a reboot and therefore cannot be considered a unique identifier within a single device. Coupled with the fact that the SessionID start value doesn't appear to be unique across different routers, you can also get coll...

cmacneill

I have recently upgraded all routers to v5.16, but still seeing a constant rise in RAM usage.

I find it hard to believe we're the only people experiencing the problem?!

cmacneill

OK, found info on 'print as-value'. Doing :put [/int ovpn-client print as-value] works, but /int ovpn-client print as-value doesn't. A bit bizarre as all other print options work without :put and doing print ? on the CLI seems to imply you should be able to get a valid response. So this now returns ...

cmacneill

I'm posting this issue to the general list as it will affect users at the Terminal CLI, via SSH and Scripting. In v5.12, don't know about other variants, issuing a command including "print where xxx=xxx" to return a specific entry or a subset of entries, the index numbers returned are rela...

cmacneill

Hmmm, don't think the problem is with routing cache, the affected Routers only have a couple of routes on them and they're all static. v5.12 seems otherwise pretty stable, have been contemplating upgrading to v5.14, but there were no bug fixes/new features documented in the Release Notes that really...

cmacneill

Hi All, We have around 300 MikroTik routers in active use and have noticed that some appear to have excessive RAM usage, i.e. over a period of days RAM usage increases. Some older routers with only 32MB of RAM fail and lockup when down to under 2MB of free memory. I have spent a lot of time trying t...

cmacneill

Hi, We experienced some weird problems recently with our RB1200 edge router. A few weeks ago it suddenly went into Factory Reset state for no apparent reason. At the time it was running v5.6. The router was replaced with a backup unit and upgraded to v5.12. The old router had a "before reset&qu...

cmacneill

OK, after further testing it appears RADIUS variables are working, but just not quite how I expected. :) The attributes I was after were actually $(radius17-14988) and $(radius18-14988), these are substituted correctly, but if you select a RADIUS attribute which is not passed from the Server to Clie...

cmacneill

Yes, this RADIUS attribute is sent in the reply from the server following a successful authentication. Otherwise the MikroTik Hotspot wouldn't know the data remaining on the user's account. It is displayed in the logs and used internally to determine when to disconnect a user. What is currently happ...

cmacneill

Hi Sergejs, The specific attributes I'm trying to capture are:- ATTRIBUTE Mikrotik-Recv-Limit 1 integer Mikrotik ATTRIBUTE Mikrotik-Xmit-Limit 2 integer Mikrotik ATTRIBUTE Mikrotik-Recv-Limit-Gigawords 14 integer Mikrotik ATTRIBUTE Mikrotik-Xmit-Limit-Gigawords 15 integer Mikrotik From your post som...

cmacneill

I have read various post on this Forum where the $(radius<id>) variables were broken sometime ago and MikroTik response was "fixed in v4.4". However, I am using v5.6 and they don't seem to work, has this been broken again? It would be useful if anyone that has these variables working in v5...

cmacneill

OK, thanks for clarifying that. I read the RFCs about 10 years ago, but didn't recall anything about TCP being "draft" status! I had assumed that since in all Linux systems TCP and UDP is defined in /etc/services for RADIUS authentication and accounting that these were "standard"...

cmacneill

The RFC allows use of TCP, so surely the choice of protocol should be the user's? I have a problem, as currently implemented MikroTik RADIUS Client is unstable, if TCP were available I could at least test whether using it would solve my problem. I'm left with two choices, either live with something ...

cmacneill

I'm having some problems with RADIUS accounting packets going missing on heavily loaded connections. RouterOS appears to only allow UDP connections to the RADIUS server, am I missing something or is there some hidden configuration somewhere to specify TCP? If I block UDP at the Server, will MikroTik...

cmacneill

I've got around the problem by inserting some extra Firewall rules. Before authentication I now only allow port 80 traffic and port 443 traffic destined for the Hotspot through, all other traffic is dropped. Probably better that a user gets a site not available message for initial HTTPS destinations...

cmacneill

Hi, We had some problems with the R52hn. If you try to using in N mode with only one antenna you get poor results. You either need to use in a or b/g mode with one antenna or install two antennae. If using with one antenna it must be connected to J4. Also if you're only going 100 metres, try turning...

cmacneill

Hi, I believe I have discovered a problem with the way users are captured by the MikroTik Hotspot. If the Hotspot is implemented using an SSL Certificate and only allows Hotspot Portal logins via HTTPS, any user whose Home Page or manually selected initial page is SSL protected, can receive a Certif...

cmacneill

Hi, This problem seems to have been left hanging with no solution. MikroTik Support Guys, this needs a response as it appears to be a bug. I have the same issue in that the documented $(remain-bytes-in) and $(remain-bytes-out) do not get substituted correctly when using total bytes limiting rather t...

cmacneill

We recently had an outage on our Windows XP system that houses our Dude v3.6 installation following a prolonged power outage. When power was restored the system seems OK except that the Database appears to have been truncated visually although the .DAT file appears much the same size as previously. ...

cmacneill

Here are a few things to try:- Try upgrading to RouterOS v3.22, you're way behind on software version, you may well find this solves all your problems. When I set-up my network in Scotland I used multiple virtual APs to separate the WDS traffic from the client traffic. However, if I remember correct...

cmacneill

Thanks Janisk, I hadn't thought of trying the "standard" browser method of specifying a port, that certainly simplifies things.

cmacneill

The stock answer is upgrade to v3.22 and see if that fixes the problem. I can certainly use your script on my v3.22 router without any problems. Next, can you send email via the same server from another device on the same LAN? Are you using a username and password for submitting the email? The SMTP ...

cmacneill

I would say if you're using only one R52 radio you may get away with a 12V supply, however if you trawl this forum you'll find many posts where people have had instability problems at 18V and have had to move to 24V. Most of these are trying to use multiple high power radio cards, so you might be lu...

cmacneill

In the scenario you describe everything must be bridged for the DHCP connectivity to work. As you haven't quoted any IP addresses it's impossible to tell whether you are bridging or routing.

Regards

Chris Macneill

cmacneill

You can set this up with dynamic addresses, but you'll have to manually change the config each time the address changes. One way to automate this is to use a dynamic DNS service to update a published DNS name each time the dynamic address is updated, then create a script which queries the hostname a...

cmacneill

It looks like you have more than one DHCP server on your network. Check other devices and make sure you haven't inadvertently left a DHCP server switched on somewhere else. I would check for a device with the address 192.168.30.10 as that's the most likely source, as DHCP servers are often on gatewa...

cmacneill

After some further investigation it would appear you are allowed to add host addresses to filters in the Src/Dst Address Lists under the Advanced tab (using WinBox). However, this still means that there is a difference in functionality between the IPv4 and IPv6 Firewalls in RouterOS. The IPv4 firewa...

cmacneill

I'm just starting to play with IPv6, so this may be me misunderstanding things. In the IPv6 firewall I have added rules based on source and destination network addresses, but I also want to have very specific rules for particular hosts, i.e. to make them globally visible whilst protecting the rest o...

cmacneill

Hmmm... this seems counter intuitive. If you were looking at this from a Bridging perspective you would want to detect loops. I guess as MPLS is a routing protocol loops are generally a good thing as alternative routing paths, but it would be nice to know the purpose of the "loop-detect" p...

cmacneill

Chris,

I don't follow your answer to your own question. In your example loop-detect=yes, so do you mean your solution was to set loop-detect=no?

Regards

Chris Macneill

cmacneill

I've been doing testing in a lab set-up for some months, the OSPF-test stuff doesn't really seem to be robust enough for production yet and we're also really waiting for Fast Reroute to be implemented before MPLS will be of any great benefit to us. Currently if a links fails it seems to take around ...

cmacneill

The SNMP wireless interface frequency attribute is currently only available for Stations, it cannot currently be retrieved for the master end of Bridges or AP Bridges. In order to be consistent for all nodes we really need this information available via SNMP for all wireless interface modes.

cmacneill

It would be useful if CCQ, working frequency and noise floor data from Wireless interfaces were available via SNMP. Currently we push this information to a remote syslog_ng daemon and then feed this into a PostgreSQL database from where the information is retrieved by Cricket, but it would simplify ...

cmacneill

Thanks Janisk... So does that mean the bridge filtering works differently to the Firewall? In the Firewall the Input and Output chains only refer to the router itself and you have to use the forward chain to affect "user" traffic passing through the router. A diagram somewhere would be nic...

cmacneill

I am trying to do some traffic management on customer connections and we are having problems with queueing not behaving as expected. I have created a test environment to eliminate any external factors, this consists of 2 x RB433 running v3.14. The RB433s are connected together via Ethernet, the test...

cmacneill

I am trying to do some traffic management on customer connections and we are having problems with queueing not behaving as expected. I have setup a test environment to eliminate any external factors, this consists of 2 x RB433 running v3.14. The RB433s are connected together via Ethernet, the test m...

cmacneill

It may just be necessary to make it clearer that the 9.x.x.x loopback addresses should be changed to something meaningful in a private address space when migrating from a test to production environment. Someone somewhere is bound to leave the 9.x.x.x addresses and some time down the line may run int...

cmacneill

I have some questions regarding the examples in the Wiki on setting up MPLS, these are more to do with OSPF, but they do arise from the MPLS examples:- 1. The IP addresses used as loopback addresses are public addresses, 9.0.0.0/8 belongs to IBM, should these not actually be in a private address ran...

cmacneill

Thanks for clarifying that, I'll play around a bit with various scenarios now that I have a semi stable test platform and I'll post here again if I need further help.

Regards

Chris Macneill

cmacneill

See other thread for MPLS TE tunnels setup link:-

http://forum.mikrotik.com/viewtopic.php?f=2&t=23416

Direct URL for the Wiki entry is:-

http://wiki.mikrotik.com/wiki/MPLS_TE_Tunnels

cmacneill

I'd pretty much come to the conclusion that TE tunnels weren't really going to achieve the throttling objective over the slow backup link. I guess the time for IGP to re-establish routing following a link failure is in the order of a few minutes, TE fast reroute I suppose will reduce that to seconds...

cmacneill

Andy, In the case of RouterBoards the issue is that their DC input can be a wide range, consequently there must be some kind of regulation between the DC port and the regulated 24VDC provided via the PoE interface. I used to run a small WISP in South West Scotland, but unfortunately competition from...

cmacneill

Many thanks Mplsguy, I don't know why I couldn't find this in the Wiki before! The golden nugget is:- /mpls traffic-eng tunnel-path add use-cspf=yes name=dyn I'd pretty much worked things out from the VPLS stuff and by trial and error, but nothing was connecting. I'm not sure where you're located, I...

cmacneill

What make of Wireless cards are you using? There was a bad batch of Ubiquiti XR5s which can exhibit a failure in one half of the unit, i.e. TX or RX, but not complete failure. Try changing the card at one end, if that doesn't fix it, try changing the other end! Pretty much any card can fail in this ...

cmacneill

I doubt that you can do that. The DC socket almost certainly has some regulation circuitry on it and you can't drive that in reverse. Assuming that the 24VDC source has sufficient current to drive both the RB433 and the camera, your best bet is probably to make up a custom CAT5 splitter to extract t...

cmacneill

As the title suggests I'm looking for a text dump of a router from someone that has managed to get MPLS and TE tunnels working.

I've managed to get MPLS working OK from the examples already in the Wiki, but I'm stumped with the TE tunnels.

Regards

Chris Macneill

cmacneill

OK, I've got the mpls and routing test packages installed, but is there any quick information you can give me on how to configure TE tunnels? I'm not looking for full blown Wiki documentation, even if you can just give me a config dump of what you need to enter to get a TE tunnel to work. If you giv...

cmacneill

I too have setup an MPLS test lab, but I'm struggling with getting TE working. Has there been any progress since the last post to this thread in April? Any sign of the promised documentation yet? The documentation in the Wiki on MPLS and VPLS is good, but it doesn't detail how to setup TE tunnels. R...

cmacneill

To echo freethought, using external ADSL modems won't work with ML-PPP, so you can't bond multiple ADSL channels to improve bandwidth. You'll want to check that claim. Freebsd, Windows and Linux PPP implementations work out of the box with mlppp using external dsl modems. I for one would love to se...

cmacneill

I have been running a small WISP in South West Scotland, but for personal reasons I will shortly be relocating to New Zealand. Is there anyone in the UK who would be interested in providing ongoing support to my existing customers? I can continue to provide remote assistance, but really need someone...

cmacneill

Can someone point me to information on what the LEDs mean on the RB532. The normal boot sequence appears to be:- 1. Blue and bottom yellow LED light initially. 2. Router beeps. 3. Blue and middle green LED light. I have an RB532 which has just failed in service and will no longer boot properly. When...

cmacneill

Alex, You need to use an ISP that supports ML-PPP, unfortunately not many do, you usually have to seek out the small independent technical ISPs, not the mass market ones as they're only interested in volume. If you're in the UK then the guy that produced BondedCD runs his own ISP specialising in ML-...

cmacneill

Try setting HyperTerminal speed to 9600, I've never successfully connected at anything else.

cmacneill

I guess you're trying to connect to the public address from within your private network? It looks like you've set your DNAT rule to only operate on packets originating from your WAN interface, this means packets from your internal browser will not get translated and will be trying to connect to a We...

cmacneill

Make any Firewalls allow Port 1723 TCP and GRE (Protocol 47) through to the MikroTik router. If you have any rules in the MikroTik router's Firewall input chain limiting access, ensure that you have created rules in the input chain to allow Port 1723 and GRE. The initial connection takes place on Po...

cmacneill

I have a MikroTik router acting as an Access Point and have implemented some Firewall rules to protect the router and users. In the Forward chain I have two rules to accept packets that are "Established" or "Related", I then have a log rule to identify packets that are not being ...

cmacneill

I'm still getting this problem on v2.9.50 if there is less than 2.9MB of free memory. I can get New Terminal to work if I temporarily disable the NTP Client, however I am concerned that at some point other features will eat up memory and prevent gaining access at all. This appears to have been outst...

cmacneill

My experience with 2.4GHz is forget it unless you have clear line of sight.

cmacneill

Did you test the units could communicate when close together before installing? If not, I suggest you take them down and test them when only a couple of metres apart. It's much easier to diagnose problems with the units close together than having to do it with the units many Kms apart! At least that...

cmacneill

VLANs are probably a step further than you need to go at present. There are other ways that are easier to implement on simple networks, e.g. Firewall rules, routing and subnets. Whilst you may feel you just want a simple bridged solution initially, it's easier to expand a routed solution, bridged so...

cmacneill

Make sure you use an AtherOS based wireless card in the MikroTik router, e.g. R52 or CM9. AtherOS based cards support Virtual Access Points, where multiple virtual APs with different SSIDs and other characteristics can be configured on one physical interface. Prism based wireless cards do not suppor...

cmacneill

Try a different ADSL router, I've found some work OK in PPPoE bridge mode and some don't. I don't know if this is an implementation problem in the router or with MikroTik. Billion routers work OK. Vigor routers are tricky to setup and then one of mine just decided to stop working for no apparent rea...

cmacneill

To allow all traffic through, don't add any filters at all. By default all traffic is allowed. However, this is not recommended as it is somewhat insecure. You need to learn the general principles of Firewalls and Linux "iptables" and then apply that knowledge to the specifics of the Mikro...

cmacneill

This assumes a flat landscape, don't forget to use absolute altitudes above sea level where the topography is anything other than flat as a pancake! As a rule of thumb where all client antennae are at a lower altitude than the main transmitter then down tilt by at least half the antenna's vertical b...

cmacneill

It would be useful if the fixes in each ChangeLog could be classified with keywords, e.g. Critical, Important, Optional, to allow users to make an informed decision rather than just guess as to whether that particular release is worth applying or could be left to a subsequent release. Critical would...

cmacneill

I too messed up my network config a few days ago. You just connect to the serial port using a crossover cable and then sort out the config from the CLI (Command Line Interface), you shouldn't need to do a full reset. Make sure you set the terminal to 9600, 8bits, no parity, 1 stop bit. OK the CLI ta...

cmacneill

What point release of v2.9? You should be on v2.9.49, if not then upgrade. If it is random disconnection, then it sounds like RF interference. This could be coming from badly suppressed electrical equipment, e.g. motors and fans. To analyse this properly you would need an expensive Spectrum Analyser...

cmacneill

I'm not aware of any side by side comparison with other products, here is our experience, by no means exhaustive, but does highlight a number of widely available products MikroTik routers in their price bracket are by far the best product I've seen on the market. Yes, there are other products that m...

cmacneill

Webbox doesn't have the same functionality as Winbox and personally I'd steer well clear of it. The only time I ever used Webbox I managed to upset the configuration big time and had to reset and start afresh. MikroTik routers are not in the same league as Wireless equipment you buy in your local PC...

cmacneill

Trying upgrading to v2.9.49 you're way behind on 2.9.27. There were some fixes introduced around v2.9.45, I forget exactly when, that did a lot to improve instability problems.

cmacneill

Oldman says bridge doesn't work in station mode on a 133c. fball says he's using 133, not 133c. fball does your router have one Ethernet port or three? RB133c has one Ethernet port in which case what Oldman says is true, RB133 has three Ethernet ports in which case you should be able to Bridge wlan...

cmacneill

Whoops, my mistake, most of my units are RB532s running on 48V, I only have one RB133 and thought that was running on 48V too, I'll have to check I'm not frying it! However, I have still seen instability problems with some high powered AtherOS based cards. I had problems with the Senao 8602, but the...

cmacneill

What version of RouterOS are you running? What power supply are you using for the RB133? Some AtherOS based wireless cards draw too much current for the 12V power unit to handle resulting in frequent system crashes, change to 48V power unit. Don't forget to set the voltage range on the RB133 correct...

cmacneill

In the US your maximum EIRP on a PtP link is 36dB or 4W. EIRP is the combined gain of the antenna and output power of the wireless card minus any cable/connector losses. If you are going to use a 29dB antenna, assuming zero cable loss, the maximum transmit power of your wireless to stay legal is onl...

cmacneill

Setup the wireless of the RB133 as "station" and blank SSID, it should then attempt to connect to the AP with the strongest signal. If there are multiple APs use the Scan feature to determine the SSID and enter that in the SSID field.

cmacneill

I doubt there is a way to do what you want with RouterOS as this is a Closed Source OS and there is no way for users to extend functionality. You would be better off using a standard Linux box and develop a small server application to receive the UDP packets and forward to multiple destinations. Any...

cmacneill

What signal strength are you getting on the wireless connections? Are you trying to use encryption on your wireless links? Try disabling encryption. I've seen this kind of problem before where signal strength is poor and you're trying to use encryption. PING works OK because by default they're small...

cmacneill

DesertG8, RF Chokes are made out of a material called Ferrite and are either purchased as units which clip over the cable or can be obtained as rings in various diameters. The ring type is often more useful as you thread the cable through and wrap around a number times, so you can experiment with ho...

cmacneill

Assuming you have allocated 192.168.3.1/24 and 192.168.5.1/24 to the LAN and WiFi interfaces on the MT router. As long as PCs on the LAN segment have a default route/gateway of 192.168.3.1/24 and the PCs on the WiFi segment have a default route/gateway of 192.168.5.1/24 it should all work. The MT ro...

cmacneill

I've had so much trouble with P2P from one customer I've just throttled them down to a trickle during the day and allow them full bandwidth only during the night. For the P2P filters in MikroTik to be useful they need to be kept up to date, after all we expect Anti-Virus companies to produce updates...

cmacneill

Stuntshell, Read the solution before you comment. Whilst the underlying BWA connection is to a different ISP, the effective connection is via a VPN tunnel to the Satellite ISP. This is documented on the Satellite ISP's website as a solution for a single PC which acts as a Gateway using Microsoft's I...

cmacneill

???????????????!!!!!!!!!!!!!!!!!!!

cmacneill

You only have to edit the hosts file on the computer you are doing the traceroute from. You have a fundamental misunderstanding of how tracert/traceroute converts IP addresses to hostnames, it has nothing whatever to do with the target or intermediate systems. When using tracert on Windows or tracer...

cmacneill

The Wiki example is a little misleading, it implies but doesn't explicitly state that the LAN (note single LAN, not two) is using a 24bit netmask. The example in the Wiki doesn't show two distinctive LANs, it shows one LAN with 192.168.100.x addresses and the devices should be using a 24bit netmask ...

cmacneill

Please draw a network diagram, it's difficult working blind!

cmacneill

It depends on how your PC's network interface is configured for DNS. If you have administration access to the DNS then just add an "A" record for your MT router. Alternatively edit your local hosts file, assuming you're running Windows 2000 or later, the hosts file is in the winnroot\syste...

cmacneill

We need more information. What is the signal strength reported by each end of the link? What hardware and wireless cards are you using at each end? My experience is that the only Atheros based wireless cards that seem to work reliably are MikroTik's own R52. I have tried EnGenius/Senao and Wistron c...

cmacneill

The EasyWeb site indicates they support a VPN connection for the back channel. To configure the MT router, connect using Winbox, go to the PPP section and create a PPTP Client. In the General tab, give the connection a suitable name, e.g. Satellite. In the Dial Out tab, enter the server hostname, vp...

cmacneill

I only have limited knowledge of one way Satellite, but my understanding was you had to use a dialup back channel direct to the Satellite ISP in order to initiate the download over the Satellite link? I can't see any way of doing this over a standard two way connection unless the Satellite ISP will ...

cmacneill

I'm not sure why you have both Ethernet interfaces connected to the same switch, this would surely create a loop?

I would have thought you only need to connect ether1 to the switch and then add both IP addresses to ether1. You shouldn't need a bridge.

cmacneill

Your initial explanation seems to have a number of errors, RB333-1 is actually called RB333-2 in the later listings, RB532-2's 192.168.50.x address is 192.168.50.9, not 192.168.50.10. Looks like your default routes are wrong. You don't list the routes on RB532-1, but I guess you must at least have t...

cmacneill

Forget Scenario 2, that won't work, go with my original thoughts for Scenario 1.

Final comment, I wouldn't bother masquerading it gives no benefit, most Internet Routers do NAT/Masquerading at that point. No benefit in using more than one level of NAT, just use plain routing.

cmacneill

Doesn't look right to me, you're trying to use routing rules over a bridge. Assuming your Internet routers are on the Ethernet interface there are two possible solutions:- Scenario 1 Delete the bridge. Add 192.168.1.1/24 and 192.168.2.1/24 to the Wireless interface. Add 192.168.2.2/24 and 192.168.3....

cmacneill

What you are trying to do is NETBIOS over TCP which most definitely uses IP. In the absence of a WINS server, NETBIOS works by devices broadcasting for and electing a Browse Master, this is a device running some version of NETBIOS, usually a Microsoft operating system or Samba on Linux. There is a h...

cmacneill

If this is an active link, then normal data flow may delay the PING replies.

cmacneill

Like the old saying goes, "if it ain't broke, don't fix it", all too often with MikroTik I've had something working perfectly and then changed something to tidy it up or see what happens and then lock myself out! Personally I always put the addresses on the bridge as it reminds you they ar...

cmacneill

Make sure your cables are in good condition. Ensure no moisture has entered the cables or connectors, replace any affected items. Is there clear line of sight between the two locations? If not, that is the most likely problem. Try substituting with different wireless cards and antennae. I had a prob...

cmacneill

The losses at 5.8GHz are approximately 1.6 x that at 2.4GHz, in power terms less than 3dB difference given the same setup. This does not necessarily mean that 2.4GHz is "better" than 5.8GHz, it depends entirely on your locality. The 2.4GHz band in many areas is becoming very congested and ...

cmacneill

I upgraded most of my APs to v2.9.45 a couple of days ago and now one has thrown a wobbly and is failing to connect properly. The unit affected is connected via WDS, it connects momentarily, but then disconnects leaving a log message "failed to confirm SSID". Nothing has changed in the con...

cmacneill

The problem is other posts warn against downloading the combined package because it causes lock-ups. So caught between a rock and a hard place, I either download the combined package and risk a lock-up or download the separate packages and risk a lock-up because the routing-test package is missing!

cmacneill

Nice pictures, but some captions and explanation would be useful. Is the new power module a DIY design or a commercially available module? If it's a DIY design post the PCB track design and component list, if commercial post the supplier and product code.

cmacneill

Why subnet? Just allocate /29 addresses to customers as necessary and bridge the ethernet interfaces on the router. Subnetting /29 & /30 is inefficient as you're "losing" two addresses per subnet for the network and broadcast addresses.

cmacneill

The routing-test package seems to be missing from the RB5xx packages, why, it's in the x86 packages?

I'm using this package on my routers and I don't want to do a remote upgrade on my RB532s if it will potentially stop me from getting back in. My x86 routers upgraded remotely OK.

cmacneill

....... and is it just me or is the signal strength 1000x better? Example, a client with dynamic ACK 200 did report -85/-88 signal at 2Mb/s. NOW after upgrading to 2.9.45 the same client now reports -76/-80 ROCK SOLID!! this example is system wide across all of our clients on atheros driven MT towe...

cmacneill

I don't think you need to bother marking the packets first, just create a "drop" rule and select "all p2p" in the P2P dropdown. Also don't bother setting the Connection State, this will reject all by default. I haven't banned P2P completely, I have one customer that tries to down...

cmacneill

RouterOS will support the number of interfaces you want, but you may not get full bandwidth due to IRQ sharing. Disable all unnecessary devices in BIOS, e.g. parallel port, serial ports etc., this will maximise the number of IRQs available.

cmacneill

What is the gain of your antennae? You would be better going for higher gain antennae than higher output Wireless cards. Higher gain antennae boost the power of both the transmitted and received signal, whereas higher output wireless cards only boosts the transmitted signal.

cmacneill

What type of UPS is it? If its an APC unit, some of the higher end models support a module that provides an extra two serial ports for connecting up to 3 computers.

cmacneill

Where are you located? You need to be aware most countries have limits on the maximum EIRP (power). In Europe most countries are limited to a maximum of 20dBi (100mW) @ 2.4GHz. Assuming your AP is using an 8db Omni antenna with your amplifier, ignoring cables losses, you would be emitting 38dBi, nea...

cmacneill

You could try higher gain antennae, say 26dBi. That would give you two benefits, higher raw signal power and being more directional will cut down any background interference.

cmacneill

http://wiki.mikrotik.com/wiki/Load_Balancing

cmacneill

Try removing the amplifier, you shouldn't need it with a 600mW card. Check the specifications of your amplifier, most amplifiers are designed for an input power of 200mW or less so the Wireless card may be overloading the amplifier's input and creating distortion in the signal. If you really need 1W...

cmacneill

/ip route add dst-address=0.0.0.0/0 gateway=207.102.11.254

I assume you have the Default Gateway for your PC set to 192.168.0.45?

cmacneill

For my ISP I leave the Service and AC name blank.

cmacneill

Under normal circumstances you only use antenna a or b, not a and b. Most cards are marked Main and Aux which normally corresponds to a and b, however Wistron CM9s are reversed. The only occasion you would use both antennae together is where you are sending on one antenna and receiving on the other....

cmacneill

You don't mention what type of file sharing you are using, I assume as you are having problems you're trying to use Microsoft/Samba Sharing? NFS should work OK. The net browse feature only works on the same network segment, so you would either need to reconfigure your network to be fully bridged or ...

cmacneill

The comment about smooth PVC surface on the Omni causing static build up seems to be counter intuitive. I would have thought a rough surface would cause more air resistance and hence higher static build up? Most directional antennae have a metal backplate which would tend to act as a static drain. T...

cmacneill

I have a fairly complex VPN network with multiple sites, to simplify matters let's consider 3 sites, A, B & C. A & C are MikroTik routers connected via PPPoE to ADSL routers. Site B is a MikroTik router connected via IP to an ADSL router. All sites are linked via PPTP VPNs and OSPF is used t...

cmacneill

Should be no problem with RouterOS itself, but you will likely run into problems with a lack of unique IRQs. Ideally each PCI card needs its own IRQ to perform optimally.

cmacneill

If this is the only Firewall rule you have applied I'm surprised you can connect to anything.

You really need to give more detail on all your Firewall settings in order for anyone to help further.

cmacneill

What are you using as a test client? If you're using a Laptop then 300 feet or 100m isn't too bad. Laptop Wireless cards are really only intended for short range indoor use, you need to install a PCMCIA card that can accept an external antenna. My MT Router at home has an 8dB Omni on it, but I can b...

cmacneill

I bought 10 x EnGenius/Senao 8602 cards and had so many problems I ended up replacing them with Wistron CM9. I haven't got around to going through them methodically to determine which are good and which are bad.

cmacneill

Bitnik, It depends where you try to connect from, you need to be somewhere out on the Internet to test it properly. If your test system is connected to the private side of the MT Router, i.e. on the same network as the public addresses are configured for, initially all your packets will be routed to...

cmacneill

You probably want to add the same rule to the forward chain too, this will also stop the attack from going through your router to devices behind it.

cmacneill

Well you've hit on the correct way to redirect incoming packets from the Public address, but you may want to add rules so that you can re- translate the outgoing packets from the Private address back to the Public address. You probably also want to restrict the ports to only those that the customer ...

cmacneill

You have to add Firewall rules in the NAT chain to translate the destination address and rules in the forward chain to allow the packets through to the DMZ host. In the NAT chain you translate the Public to Private IP address, in the forward chain you add accept rules to allow the packets to the tra...

cmacneill

Be careful about terminology, Bonding implies you have a single transparent pipe carried over two or more connections. This can only be done in two ways, the best way is using ML-PPP with an ISP that supports it, the problem is MT doesn't support ML-PPP! The only other way to Bond is to use EoIP tun...

cmacneill

You need to use a proxy in order to remap URLs. I've never done this in MikroTik, but the documentation should tell you how.

cmacneill

How is ether2 connected to the Internet? If you're connecting via ADSL Router then this will also need static routes.

I can seem to open your attachment for some reason. Try connecting to your MT router using a telnet session, you can then list the routing table and cut & paste as text.

cmacneill

Note that problems with interference with other frequencies is usually a function of the Wireless card and not MikroTik. I've had problems with SmartBridge equipment, but so far not with Senao 8602, Wistron CM9 and R52 cards in MT routers. In my experience 2.4GHz can interfere with both TV & FM ...

cmacneill

My mistake I thought 0.0.0.0 was coming from the default route. I've initiated a DHCP connection on my v3Beta10 box with "dhcp debug packet" turned on and I get the same as in your listing, so this looks like it's just a normal DHCP conversation. I'd guess you're getting some kind of Broad...

cmacneill

Where are you based? The maximum EIRP has a huge bearing on what you can achieve and this differs depending on local regulations. For example if you're based in Europe 2.4GHz won't work beyond around 10Km because EIRP is restricted to 100mW (20dBi), but in the USA maximum EIRP is 36dbi so you can go...

cmacneill

Looks like you have a DHCP server configured on your public interface, try disabling it. There is no situation I can think of that would need DHCP on the public interface.

cmacneill

Use mangle rules in the Firewall to mark packets for port 1723 and GRE, then use routing tables to setup a specific default route for the marked packets.

cmacneill

With MikroTik, most CPE seem initially to connect at -95 because they are scanning all available frequencies to find what frequency the AP is operating on. Once the CPE finds the AP's centre frequency the RX power value will usually improve. If you have CPE connecting at -95 and staying at that leve...

cmacneill

Similarly at first I used PC chassis and had some very variable results with different Wireless cards. I have recently implemented two RB 532s, one has two wireless cards which provides a backhaul Pt2Pt and AP, the second RB532 is currently only configured as the other end of the backhaul, but may a...

cmacneill

I assume that your 60-70 clients are at varying distances from the AP? Have you tuned the TX power for each client or are you just blasting out maximum power on each? You need to make sure the TX power of clients close to the AP is turned down to the bare minimum, but leaving a reasonable fade margi...

cmacneill

As far as I am aware MT doesn't support uPNP. Even if it did I would disable it, like many "ease of use" protocols it is highly insecure. Imagine a PC on your network gets infected with a virus which then uses uPNP to open up your Firewall to other traffic, very quickly your Firewall will ...

cmacneill

What you're wanting to do is technically feasible with the RB150, but due to its fairly low clock speed if you have a significant number of Firewall rules you may find throughput will be somewhat restricted. Given the price of the RB150 you're not going to lose much by trying it out. If you need mor...

cmacneill

Certainly try the Senao 8602, but my experience is trees are bad news. For the most part I avoid trees as you usually get poor results.

cmacneill

Hmmm... very strange, I don't understand how the other CPEs can be working if you can't see them in a Scan. I'm suspicious that the R52s don't actually put out 65mW, I had to use a different Wireless card on my 6Km connection to get anything to work. I assume you have set the MT Wireless mode to &qu...

cmacneill

You really need to do the routing rules at the AP or border router, hence you need Level 4 or above. You only really need higher than Level 4 if you're intending to use User Maanger with large numbers of users.

cmacneill

Use mangle in the FIrewall to mark the packets from each CPE, you can then setup individual default routes.

cmacneill

There is a basic example in the Wiki here http://wiki.mikrotik.com/wiki/Mesh_wds.

Do the first three configs on each router that will be a member of the mesh, leave the last sections on WPA security until you're happy it works without, you can always add this later.

cmacneill

I've never used Zcom, but it's pretty irrelevant if you haven't configured your MikroTik router correctly. The vast majority of people do get good results with MT, hence it's popularity. However, as I found out when I started with MT, the learning curve can be painful as there are so many variables ...

cmacneill

Try turning STP off. You only need Spanning Tree Protocol where there is the likelihood you could create loops in your network. Unless you have clients with two WiFi cards or are simultaneously connected to Ethernet and WiFi there should be no possibility for loops in your network and hence no need ...

cmacneill

Queues can limit bandwidth in both the upload and download paths. You can either set an absolute maximum bandwidth for each client or allow them to exceed their nominal maximum by "borrowing" bandwidth from other queues if they have any spare capacity.

cmacneill

If you run a scan from the AP do you see anything? It could be your AP has failed or you're using the wrong antenna connector. Did you try the units on a test bench first to see if your config is OK when the devices are only a couple of metres apart? Assuming your Omni is vertical polarisation, you'...

cmacneill

You can use queues to allocate bandwidth to individual addresses or address ranges.

cmacneill

Basically yes, but it depends on other configuration options in RouterOS. A Hub or a Switch is usually a pretty dumb device passing packets between ports. Higher end models will allow Layer 2 or 3 management. If you set RouterOS options as default all users on the AP will be able to see one another....

cmacneill

I've just upgraded two routers connected via PPP to 3.0Beta10, but RIP is now weird. Routes are propagated, but the gateway address octets are reversed, so the routes are shown as inactive, e.g. real gateway 10.254.5.1 shows in the route list as 1.5.254.10. This bug is apparent when both ends are Mi...

cmacneill

Please post the link to the Orthogon manual here so that others, including me, can have a look at it.

Regards

Chris Macneill

cmacneill

Uldis, I'm not sure about 40MHz channels, the only 5.8GHz equipment I use other than MikroTik is from Alvarion and that uses fixed 20MHz channels. See my earlier post for centre frequencies. I think the main problem with 40MHz channels in the UK is you would end up with only 1 usable (non-overlappin...

cmacneill

/ip route add dst-address=10.0.0.0/24 gateway=169.254.132.52 (laptop) This is wrong delete it, you're telling the router to send packets for 10.0.0.0/24 to your Laptop, so they'll never reach your ADSL modem. What have you set the default gateway to on your PC/Laptop? It should be 169.254.132.52 fo...

cmacneill

You either need to masquerade (NAT) the 169.254.0.0 network on the MT router or add a static route to your ADSL router telling it to find the 169.254.0.0 network at 10.0.0.217. You've also got a problem with your netmasks on your 169.254.0.0 networks, really you want both set to 16 bit or 24 bit. Ma...

cmacneill

I guess you might be trying to find a higher power omni? You would be better to use multiple higher power sector antennae than one omni. Google for an antenna supplier, some people have reported using parabolic dishes of up to 36dBi, but the maximum I have seen in the UK is 26dBi. Don't forget to st...

cmacneill

Post the MACs you're using, it might help diagnose the problem. I have had 6 VAPs working fine on AtherOS chipset via WindowsXP and NetStumbler can see them all.

cmacneill

The frequencies quoted are those which appear as options in the Alvarion configuration software for 20MHz channels, I guess that means centre frequencies. Alvarion don't allow use of anything other than 20MHz channels in their UK firmware. I don't know if this is Alvarion's limitation or another odd...

cmacneill

Normis, What you say about blocking the 802.11a Band C frequencies for UK because MikroTik cannot control who has and who has not registered with OfCom is ridiculous if you still then allow manual setting. You're just making our life difficult, without really enforcing anything. Either you need to e...

cmacneill

Don't worry, I've fixed it myself. It seems that after configuring RIP or OSPF you have to reboot the router in order for it to work properly. Seems a bit weird as nothing else, other than a package upgrade, needs a reboot.

cmacneill

Here's a bit more info:- All routers running v2.9.43 Main site router is running on x86 hardware. Two remote sites, one on x86 and one is an RB532. The RB532 has fully populated route lists from server, but x86 based system only has local routes, nothing from server. Both routers are configured exac...

cmacneill

I can't seem to get RIP or OSPF to correctly propagate over PPTP links. I have MT routers both ends and with RIP I setup neighbour iP addresses for each end of the PPTP link, but for some reason routes on the Client end get propagated to the PPTP server end, but the Server end routes do not appear o...

cmacneill

Normis, As i understand it ETSI only lists unregulated frequencies, but in the UK and possibly other countries in Europe 5.7-5.8GHz Band C is available under a soft licensing scheme, i.e. you register your locations on an OfCom website and pay a nominal £1 per site fee per year. RouterOS needs to al...

cmacneill

Thanks for the responses, but no one has answered my original question. Why are 802.11a Band C frequencies unavailable for UK? These frequencies have been available under a soft licensing scheme since April 2004.

cmacneill

Why are 802.11a Band C (5.740-5.840GHz) frequencies missing when using United Kingdom as country in RouterOS? I know the UK has some specific requirements regarding radar detection and channel shifting, but isn't that handled by DFS? Also OfCom, the UK regulatory authority, has recently relaxed EIRP...

cmacneill

Sounds like the ISP's DHCP lease time is set very low and the IP address is getting changed. How is this a problem? You probably need to contact the ISP to resolve this, they may be willing to create a static DHCP lease for you.

cmacneill

If you want all three devices to communicate they must ALL be setup as APs.

interface wireless set wlan1 ssid=OnALot frequency=5805 mode=ap-bridge disabled=no

cmacneill

Bill is correct, set mode=ap bridge on all three wireless interfaces and they should magically connect.

cmacneill

Use mangle firewall rules to tag packets to/from VoIP server, then add routing table rules to specifically route tagged packets to/from isp2 connection. There are examples on how to do this in the routing and mangle sections of the manual.

cmacneill

If it's a RouterBoard then connect to the serial port, you can then see what's wrong with IP connection.

cmacneill

Create a bridge containing ether1, wlan1, wlan2 & wlan3. Move IP address from ether1 to the bridge.

cmacneill

The example must be entered via a terminal session via serial port, direct telnet or WinBox Terminal session.

The text of the example states that 69.69.69.69 is the example public IP address, replace this with your public address.

cmacneill

To connect another AP to MikroTik router you need to use WDS and your remote AP needs to support WDS. It's probably easier to replace the AP with another MT router, then you don't have to worry about incompatibility.

Regards

Chris Macneill

cmacneill

It should be self explanitory, somewhere you have two bits of equipment with the same IP address. If all your PCs are complaining. I would think one of the devices is something common to all of them, i.e. the default gateway. Try changing this to a different address, hopefully you're using DHCP, so ...

cmacneill

Which Atheros card are you using? Some makes have been reported to cause problems with RouterOS.

Regards

Chris Macneill

cmacneill

Do you really need to map these public addresses to users? Just because your ISP gives them to you, isn't a reason to map public addresses. The only reason to need more than one public IP address is if some users require to host incoming services, e.g. VPN, HTTP. If your Internet link is slow or ADS...

cmacneill

You don't say how you are connecting to your ISP, I assume Cable Modem or ADSL? The most common mistake when routing through an MT Router is to forget to add a static route to the Cable/ADSL Modem to tell it where to find the network on Ether2. You also need to ensure that systems on Ether2 are give...

cmacneill

The short answer is no, MikroTik do not currently support ADSL cards directly, so you need to use external ADSL routers and connect via Ethernet. There is support for Xpeed SDSL cards. Several people have the same issue and have requested MikroTik to develop support for Sangoma S518 ADSL cards. If y...

cmacneill

Try inputing the routes seperately using:-

/ip route add dst-address 0.0.0.0/0 gateway=112.135.10.17/24
/ip route add dst-address 0.0.0.0/0 gateway=112.135.10.18/24

cmacneill

There isn't a Wiki page specifically for two nodes, but this link is a more complex scenario that you should be able to interpret. http://wiki.mikrotik.com/wiki/Wireless_repeater Just watch out for the MAC addresses they quote, where addresses of the form 00:00:00:00:00:0x are quoted, substitute the...

cmacneill

I don't yet have the per AP client loadings that you guys have, but I did have problems with using dynamic WDS and AP on the same Atheros radio card. In the end I switched to static WDS and no more problems.

cmacneill

Some Atheros chipset wireless cards can cause problems, I had some Senao 8602 cards that kept crashing RouterOS.

Try removing the wireless card to see if you can then connect via Ethernet.

cmacneill

The command is lspci -v

cmacneill

The analogy with Cisco is somewhat lost on me, never got to grips with them, that's why I use MikroTik! :-) Anyway, I think it's clearer what you're trying to do. I haven't tried to route/bridge a subnet of one range to another interface, but I would think one of the two following methods should wor...

cmacneill

You need to create Virtual Links, i.e. each router not directly connected to the backbone needs to know about it's backbone conneced partner.

cmacneill

Switching all your antennae to horizontal polarisation is unlikely to make any difference to co-location interference. It may reduce interference from other APs though. Are you sure you aren't misleading yourself? If you are using the Scan option in the MT wireless interface, then you will see the o...

cmacneill

Unfortunately it's not clear what you're trying to do. Do you have an existing internal IP address range? If yes, what is it? If you have less than 29 devices on you internal network you could just bridge it, allocating addresses from the 217.219.100.224/27 range to internal devices. If you have mor...

cmacneill

1dB loss is about right for 5m (15ft) of LMR400 cable. Note that losses are also frequency dependent. This is the loss at 2.4GHz, at 5.8GHz loss is approx. 60% more. The loss stated doesn't include connector losses. warick09 also incorrectly states 4W = 34dBm, actually 4W = 36dBm. I believe you are ...

cmacneill

I know I stateing the obvious, but you have got your 3 x 2.4GHz radios on different frequencies? If they're all on the same or very close frequencies then I'm not surprised you see high power levels, after all that's what they're supposed to do!! You need to use non-overlapping channels, e.g. 1, 6 &...

cmacneill

I'm using Via EPIA miniITX boards without any problems. The only lockup problems I had were with Senao high power wireless cards.

However, I'm not trying to use ultra high speed, 6Mbits/s is the maximum speed of my Internet connection.

cmacneill

There's something seriously wrong with your installation if you have signal fluctuations as big as 20dB in good weather. Before throwing more power and gain at the problem, go back to basics and make sure all your existing cabling is in good condition and properly weatherproofed. It could be as simp...

cmacneill

Turn off wireless debug and you probably won't see the messages anymore. The debug messages are confirming that your access list rule is working properly and stopping the unit from associating, consequently it keeps retrying. I don't think there's anything more you can do other than to trace the loc...

cmacneill

You have a number of problems with your setup. You don't state what netmasks you're using, this makes it hard to tell which interfaces are routing and which are bridging. I'll assume you're using a 24 bit netmask in each case, i.e. 255.255.255.0, if not then everything from here on is probably wrong...

cmacneill

I haven't used MT for this purpose, but the documentation indicates what you want to do should be possible. However, you might be better off using an external Linux box running some variant of Asterisk. Asterisk is better documented and supports a wider range of interface cards if you need to connec...

Search found 293 matches