MikroTik

tdw

You would still get a web browser window opening when the captive portal is detected, it may be possible to configure the browser to provide SSO credentials at this point. For deployments with many users it is more common to use WPA2-Enterprise for WiFi and 802.1X for wired connections - there is no...

tdw

See https://datatracker.ietf.org/doc/html/rfc6333 section 4.2

tdw

The Mikrotik DHCPv6 server only provides prefix delegation not client addresses, see https://help.mikrotik.com/docs/display/ ... -Summary.3.

If your clients do not support or you do not wish to use SLAAC you will have to set up a third-party DHCPv6 server

tdw

Also see viewtopic.php?t=184070

tdw

The OP is using a layer 3 switch to provide the routing for their VLANs, not the Mikrotik. I have not tried it, but from the documentation all of the DHCP servers should use the same interface= setting (the OPs bridge in this case) and also specify the Relay Agent IP with relay= for the correspondin...

tdw

I was just about to post suggesting setting add-default-route=no to the DHCPv6 client so the PPPoE default route is used. What are the /routing rule entries for? I've made posts previously regarding DS-Lite setup. These used AFTR provided by DNS, they would need some modification to use the DHCPv6 o...

tdw

Providing the print output from a random set of sections isn't particularly helpful, post the output of /export in a code block (the [] icon above the message box when composing a message) after redacting serial number and any other identifying information. The usual errors with setting up IPv6 is n...

tdw

Given the addresses posted previously you have set the NTP client on the modem to use 192.168.0.1?

tdw

Certainly in the current firmware (v5.2.5) you cannot set a default route - under Configuration > Routing when adding a new route only subnet masks of /8 to /32 are supported, so unless you know the specific address range an external NTP server, and that it will not change, using the Mikrotik is a b...

tdw

The Vigor has no routes other than 192.168.0.0/24 so cannot communicate with anything other than the directly connected Mikrotik. I normally enable the NTP server on the Mikrotik, specify its address (192.168.0.1 in this case) on the modem, and add a firewall rule to allow UDP port 123 input from th...

tdw

Yes, the election process will be the same as described for RouterOS https://help.mikrotik.com/docs/display/ROS/Spanning+Tree+Protocol#SpanningTreeProtocol-Electionprocess as this is defined by the protocol. There doesn't appear to be a mechanism to manually adjust the port path cost in SwOS, it is ...

tdw

An interface cannot be both tagged and untagged for egress with the same VLAN ID

tdw

No. The RADIUS servers enabled for a particular service are tried in order specified. The later ones are only used if there is no response, an accept or reject response terminates the request. If the first two servers are only for the login service you could remove the ppp service from those, the th...

tdw

A route gateway is usually an IP address through which the target addresses are reachable, an interface name is normally only used on point-to-point links with /32 addresses. So in your case it would be 192.168.0.x where this is the address of the router which is also connected to the 192.168.122.0/...

tdw

According to the description in the OP, folks at the ISP use the method mentioned in par. 4.1.4 of the RIPE document, i.e. they sacrifice a single /64 from the /48 they gave you as a link subnet. I still suspect on their side of the link they are doing the equivalent of /ipv6 address add address=20...

tdw

Out of interest how is the provider supplying the /48? If they are just presenting a /48 directly rather than routing it via a transit subnet they are one of the providers who really don't know what they are doing with IPv6 - see https://www.ripe.net/publications/docs/ripe-690/ section 4.1 for discu...

tdw

Ethernet-like interfaces are transparent to VLANs, it is just another ethertype. Adding an IP address to an interface handles IP and ARP ethertypes for IPoE, these are untagged on the wire. The /interface vlan entries are wrappers which add a VLAN ID for packets being sent to the parent interface, a...

tdw

Also, you didn’t mention the role of the 10.0.0.1 gateway in all this. It could be a crucial piece of information especially if it’s a router connecting the two networks. I'm not sure what that address would be, I went up and looked over all the equipment. There's no additional routers, switches, w...

tdw

If you add a logging topic of ppp, debug and post the redacted (e.g. username) results that may show something up.

tdw

Have you tried connecting both with and without encryption? If one end requires encryption and the other does not support it the connection setup will fail, I would expect the connection not to require encryption as MPPE has not been secure for years and would be unnecessary overhead for the ISP con...

tdw

From the documentation: SwOS supports SNMP v1 and v2c (the Response for GetRequest, GetNextRequest and GetBulkRequest) and uses IF-MIB, SNMPv2-MIB, BRIDGE-MIB and MIKROTIK-MIB (only for health, PoE-out and SFP diagnostics). SNMP traps and writing SwOS configuration are not supported. Available SNMP ...

tdw

Rules are evaluated in strict order, if you drop any packets arriving from an interface in the WAN list destined for an interface in the LAN list before other rules then bidirectional communication will always fail. With the not working example replies to connections initiated from LAN devices will ...

tdw

As @erlinden stated you need a UniFi controller to configure their APs as the stanadlone app only provides limited functionality. The controller is available as an appliance, baked into a number of their gateway products but also still as a software installation for Linux, MAC and Windows.

tdw

It may not be connected directly but there is an external connection "we can access their Seimens HMI's through their 3rd party website". I certainly wouldn't suggest jumping straight to v7, however v6 long-term and cleaning up whatever cruft has accumulated in the config would be a good s...

tdw

From the first post the Mikrotik is running v6.38.1 which was released seven years ago and has numerous vulnerabilites including remote authentication bypass. Hopefully it is not directly exposed to the internet otherwise it will have been compromised, even so it would make a great jumping off point...

tdw

As mentioned the Mikrotik DHCP server does not support matchind agent circuit ID information in DHCP requests so you would need to run a DHCP server elsewhere and configure that to return fixed addresses for the specific ethernet ports, or from a pool otherwise. If there are multiple routes for the ...

tdw

There is not an easy way to allocate an address based on physical port rather than MAC or Client ID - whilst Mikrotik can include Option 82 for ports in a bridge the DHCP server has no mechanism to use the Agent Circuit ID. For your setup with additional small subnets then adding static routes on th...

tdw

The specific case of 2^x can be implemented as a bitwise shift: 1 << x

tdw

The source port is picked by the remote client initiating the connection, typically anything greater than 1023 but not fixed.

tdw

The bridge-to-CPU port settings are incorrect - you are trying to use it simultaneously untagged, by /interface bridge having pvid=200 , and tagged, by having an /interface vlan attached to the bridge with vlan-id=200 ). It is also missing from the /interface bridge vlan entries. Furthermore none of...

tdw

If the cAP ax is working as expected when connected directly to the router (as per OP's first image), but not when connected via the switch (per second image) the most likely cause is a misconfiguration of the switch, although it isn't clear which VLAN the cAP management connection is using - 10, 99...

tdw

An /interface vlan object merely inserts the specfied VLAN tag for packets on ingress and removes them on egress. When configuring a Mikrotik device as a switch you may have various untagged and tagged VLANs configured on several ports, but only a single VLAN configured to transit the bridge-to-CPU ...

tdw

What messages are there for the PPPoE client interface in the log?

tdw

No, 11:7 is VLAN ID 11 with priority 7.

You are missing the bridge-to-CPU interface in the bridge VLAN membership:
/interface bridge vlan
add bridge=newBridge tagged=newBridge,bonding1 vlan-ids=10
add bridge=newBridge tagged=newBridge,bonding1 vlan-ids=11

tdw

Providers initially offered IPv6+IPv4 dual stack, it is becoming more common for them to only implement IPv6 and use one of the many tunneling mechanisms for IPv4 - see https://www.rfc-editor.org/rfc/rfc9313.html for information on the most prominent ones. It is possible to configure DS-Lite on Mikr...

tdw

There are many pitfalls using multiple bridges, so best avoided. Do you need a bridge? If your network is only connected to a single port you can simply add a vlan interface to that port: /interface vlan add interface=ether1 name=vlan10 vlan-id=10 then add different subnets to the two networks ( eth...

tdw

You are attempting to use the bridge-to-CPU interface both untagged (by setting pvid=1500 under /interface bridge ) and tagged (by having an /interface vlan with vlan-ids=1500 ) which leads to all sorts of unexpected behaviour. Also setting the PVID under /interface bridge port makes no sense with f...

tdw

Degrading the cabling will never guarantee that the link will operate at 10Mbps. The endpoints transmit their capabilities in the regular fast link pulses and pick the best available speed and duplex option both are capable of, see https://en.wikipedia.org/wiki/Autonegotiation . Depending on the eth...

tdw

The BT Digital Voice offering is a closed system, you have to use the SH2. There was a thread on the thinkbroadband forum https://forums.thinkbroadband.com/fibre/t/4670157-re-bt-fttp-with-digital-voice-alternative-to-smart-hub-2.html where someone managed to detect and spoof enough information for t...

tdw

where did pvid=1 come from.. and which is what I think would be the 'native vlan' setting.. and should be changed to 666.. VLAN 1 is the default PVID as you have not specified anything different. /interface bridge port add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1...

tdw

A Mikrotik array is not JSON. Either use the :serialise function in newer versions of RouterOS v7, or construct a data variable containg valid JSON. For example:
:local jsondata "{\"mac\":\"aa:bb:cc:dd:ee:ff\",\"ip\":\"192.168.100.80\"}"

tdw

The requested pool should only hand out /64s, not the entire /62. The assigned address should not use the all-zeros host address as this is reserved for 'all routers in subnet' - either use an explicit non-zero address, or alternatively eui-64=yes to generate the host address from the interface MAC ...

tdw

I don't know if the default items in /export have changed in v7, but certainly in RouterOS v6 /interface ethernet switch ingress-vlan-translation entries have explicit customer-vid=0 . Also, are the bridge ports actually hardware-offloaded - they should have an H flag showing in /interface bridge po...

tdw

It looks like gibberish from ChatGPT or similar. With CDP being a proprietary Cisco protocol Mikrotik do not treat the multicast address it uses as special, so it should propagate throughout the broadcast domain of the layer 2 network. I've not checked EoIP interfaces specifically but certainly all ...

tdw

How did you configure your new ax3, from an /export of the old device, or from a .backup?

tdw

I would imagine rules are processed before switching, but wouldn't imagine port isolation would apply unless the ports are being switched in the chip - with hw=no the packet flow would be etherA > CPU interface > software bridge > switch chip interface > etherB, it isn't passing directly between eth...

tdw

Mikrotik added :serialize and :deserialize commands in v7 which support JSON. I've not tested to see if it handles nested arrays.

tdw

The physical ports on the device are wired to the switch chip so packets will always pass through and be processed by the switch. The underlying architecture has a single interface beween the switch chip and CPU - the ether1..etherX interfaces shown in winbox/CLI are logical interfaces, the driver m...

tdw

You cannot use the same IP subnet on multiple layer2 / ethernet interfaces, the device would have no idea of which interface to send ARP requests to.

tdw

No, traffic between VLANs passes through forward, not input. Unless your Mikrotik has a switch chip with L3 hardware offload the routed traffic is still handled by the CPU, fasttrack merely skips some of the processing and typically improves performance by a factor around 2-3 times. You could qualif...

tdw

This should not be necessary /ppp profile set *0 remote-ipv6-prefix-pool=kpn-pool it is used for PPPoE servers, not clients. This is likely the issue /ipv6 dhcp-client add add-default-route=yes interface=pppoe-kpn pool-name=kpn-pool \ pool-prefix-length=48 request=prefix use-peer-dns=no as DHCPv6 ha...

tdw

The lease client-id values for some of the entries look odd - have they been editied as they would usually be 1:xx:xx:xx:xx:xx:xx, where xx:xx:xx:xx:xx:xx is the client MAC address.

If a client includes a client ID in the DHCP request the Mikrotik will use this in preference to the MAC address.

tdw

By default packets will be forwarded between subnets. As there isn't an option to change the firewall policy you could either add a firewall filter rule to drop any forwarded packets with /ip firewall filter add action=drop chain=forward or even disable all forwarding with /ip settings set ip-forwar...

tdw

You can specify an optional single IP address for L2TP users in /ppp secret, see https://help.mikrotik.com/docs/display/ ... erDatabase

tdw

On ether1 is my main vlan trunk to my base switch forwarding all vlans (including vlan 30 tagged). Those vlans were configured in the switch configuration to allow hardware offloaded vlans (vlan filtering with offload is not supported on rb3011). This interface is thus the only member of brLAN. Thi...

tdw

When running a PPPoE server having an IP address on the interface is unnecessary as the client IP traffic is encapsulated within the PPPoE packets. You can add an IP address to the interface for specific use cases, two common ones are for management of radios in fixed-wireless access networks, and f...

tdw

That isn't the CA, download it from Let's Encrypt. The RADIUS server certificate is only required by usermanager on the Mikrotik, no need to export it.

tdw

A file with a .crt extension can, and often does, contain PEM encoded content. Unless you are using self-signed certificates you will not have the private key for the CA certificate. The purpose of the the CA certificate on the client is to validate the authenticity of the signer of the server certi...

tdw

It maybe that the PSE controller provides voltage, current and power information and they choose to display it. Certainly some other vendors 802.3af/at-only switches do so. There are other converters, e.g. PoE Texas / PoE World have a huge range for a variety of uses https://shopify.poe-world.com/co...

tdw

AFAIK the Netgear only provides nominal 48v, the options change the initial negotiation. You can use an 802.3af/at to 24V passive converter - either the Mikrotik RBGPOE-CON-HP, or Ubiquiti INS-3AF-I-G (can only provide a maximum of 12W so OK as long as you don't have power consuming devices plugged ...

tdw

fasttrack is not compatible with mangle, disable it

tdw

CRS devices are primarily switches, the CPU is not particularly powerful and not intended to provide anything approaching wirespeed routing - you might get around 400Mbps on a CRS310. Whilst the switch chips in CRS3xx and CRS5xx devices support L3 hardware offloading the device in the CRS310 does no...

tdw

You will need to find out which tunneling mechanism the ISP supports. It is possible to do DS-Lite which is basically an IPv4 in IPv6 tunnel (search my posts for examples), but newer methods such as Lw4o6 and MAP-E require support in the client router which Mikrotik have not implemented.

tdw

Those device certificate settings look to be incorrect. The CA Certificate should, given the name, be the Let's Encrypt root authority certificate - Windows and other OS will already have this installed as a trusted CA. The Device Certificate should not be the server certificate and likely be not in...

tdw

It does. SFPs which support Digital Diagnostic Monitoring (DDM) as specified by SFF-8472 store a variety of threshold and calibration data in non-volatile memory at address A2h.

AFAIK RouterOS doesn't read and decode this, only the standard data as specified by INF-8074 at address A0h.

tdw

It's difficult to tell exactly as there are many redundant entries referring to objects which have been deleted ( something=*id ), but it appears the home LAN (192.168.20.1), some device management for radio links (10.20.0.1) and a local address for PPPoE client connections (172.20.0.1) share the sa...

tdw

IP packets from PPPoE clients do not arrive on the bridge, each one has its own interface named <pppoe-USERNAME> so using in-interface=bridge1 in mangle rules will not match anything from clients.

tdw

Instead of specifying an IPsec secret in the EoIP interface create IPsec proposals, policies, peers & identities as required, when the EoIP encapsulated traffic matches the policy it will have IPsec applied as specified.

tdw

Instead of specifying an IPsec secret in the IPIP interface create IPsec proposals, policies, peers & identities as required, when the IPIP encapsulated traffic matches the policy it will have IPsec applied as specified.

tdw

No. Both Mikrotik and Ubiquiti have proprietary protocols to provide better performance than regular WiFi, especially for PtMP setups. Whilst these extensions are optional on Mikrotik devices they cannot be disabled on the newer Ubiquiti devices, including airMAX AC ones. Even if you could a LiteBea...

tdw

So option a is effectively the default config but with an additional /interface vlan to handle the WAN traffic being tagged. Unless you are likely to have multiple WAN ports, want to be able to easily swap which ports are WAN and which are LAN, passthough additional provider/operator VLANs for IPTV ...

tdw

Your are missing the bridge-to-cpu port, the /interface bridge vlan entries tagged=ether1 should be tagged=bridge,ether1 . You also need /interface vlan entries to remove tags on egress from the bridge-to-cpu port / add them on ingress to the port, plus IP addresses. See https://forum.mikrotik.com/v...

tdw

When I turn off vlan-filtering, only vlan 1 works. What do you mean by 'works'. ether1-6 will be able to communicate with each other, if VLAN 1 untagged also has to transit the ether24 and sfp-sfpplus4 trunks then change frame-types=admit-only-vlan-tagged to admit-all Unrelated, there is no need to...

tdw

Set up your own RADIUS server & frontend on-prem or hosted elsewhere / subscribe to a cloud-based service (e.g. CloudRADIUS, JumpCloud, Foxpass) and use WPA2-Enterprise for wireless / 802.1X for wired authentication with username/password and/or certificates. All locations should use this data/s...

tdw

In Winbox the VLAN tab of a bridge interface contains the settings of the bridge-to-CPU port, in exactly the same way as the VLAN tab of a bridge port does for other ports added to the bridge. These are layer 2 settings - they will not stop your Guest & IoT networks from accessing some IP servic...

tdw

The processor in the switch chips on SwOS-only devices is very limited so it is highly unlikely that any encryption can be added. From the Marvell datasheet Target Applications section "Smart and Lightly Managed switches: Integrated microprocessor enables lightly managed switches with the addit...

tdw

I suppose the Media Connector type (EEPROM address A0h, byte 2) could be set to either 0Bh 'Optical Pigtail' or 23h 'No separable connector' instead of 21h 'Copper pigtail' (from SFF-8024 Table 4-3 Connector Types). For SFPs, per SFF-8074, bytes 14-18 specify the maximum length for 9/125, 50/125 &am...

tdw

When you say Neighbours do you mean OSPF Neighbours or IP Neighbours? Use PTMP rather than broadcast, v7 'ptmp-broadcast' is compatible with v6 'ptmp'.

tdw

Your ISP could be intercepting any DNS requests not destined for their servers and redirecting them.

tdw

See https://help.mikrotik.com/docs/display/ROS/Services

tdw

I'd rather see bridge "the CPU facing port" become a distinct item ... just like switchX-cpu port in switch chip configs. IMO this would prevent quite some confusion which arises from the fact that there are 3 different items (switch-like entity, CPU-facing port and interface) all named t...

tdw

In fact, I think /interface/vlan should have some option/attribute that automatically adds tagged=bridge (as a dynamic .../bridge/vlan) – so Layer3/IP work without messing with bridge vlan table at all. So whole /interface/bridge/vlans complexity be only needed for hybrid ports or Layer2-only switc...

tdw

If the public address is routed via the private address it should not be attached to the interface, but rather exist on a loopback interface and the preferred source address set for traffic originated from the Mikrotik itself. /interface bridge add name=local protocol-mode=none /ip address add addre...

tdw

If the 192.168.1.x addresses use a subnet mask of /24 then 192.168.1.0 is not a valid address, so I would expect it to never work.

Also use a better VPN protocol than PPTP, fundamental vulnerabilities have been known for over 10 years making it insecure.

tdw

Also if you set edge=yes on the Mikrotik bridge ports connecting to the Cisco(s) they will ignore any received and not send any BPDUs (equivalent to PortFast ) which may allow you to change to a single bridge. This means that it will ignore the BPDUs that the Cisco's send, turning the Cisco into a ...

tdw

There are various potential pitfalls https://help.mikrotik.com/docs/display/ROS/Layer2+misconfiguration but impossible to say if you have hit any of these with seeing the configurations. Also if you set edge=yes on the Mikrotik bridge ports connecting to the Cisco(s) they will ignore any received an...

tdw

Nothing obvious assuming that change is only applied to /interface bridge port (two entries), /interface bridge vlan (three entries on two lines) and /interface vlan (one entry) as you can't have two bridges with the same name. Do the Current Tagged and Current Untagged columns under Bridge > VLANs ...

tdw

I hadn't spotted that was missing, having bridge-TPP in the tagged list for VLAN 40 is unnecessary. Under /interface bridge port the pvid= setting specifies which VLAN untagged ingress traffic is assigned to. Under /interface bridge vlan ports in the untagged= interface list have the VLAN tag remove...

tdw

The bridge name bridge-TPP refers to both the bridge and the implicit bridge-to-CPU bridge port so you are connecting VLAN 40 on ether4 untagged to the CPU tagged. To connect ether4 untagged to ether5 tagged requires the following change to /interface bridge vlan : add bridge=bridge-TPP tagged= brid...

tdw

Set reformat-hold-button and reformat-hold-button-max. The device cannot be reset, only completely reformatted by holding the reset button for a time between the two values and will then require a netinstall as described in the link provided.

tdw

See https://help.mikrotik.com/docs/display/ ... bootloader. You can disable the Winbox service but that will prevent anyone using it, a usual recommendation is to make Winbox accessible only via a VPN connection to or from the device.

tdw

Which drivers are you using on the hAP ax2? Likely https://help.mikrotik.com/docs/display/ ... stfeatures

tdw

This caught me out a few weeks ago when converting from 6.x to 7.x. Although it isn't mentioned anywhere in the documentation I could find /routing ospf interface-template has some hidden functionality where specifying type=ptp swaps the local and remote addresses, try add area=A disabled=no network...

tdw

Nothing immediately obvious. Possibly if there is much broadcast or multicast traffic on your management VLAN that will be processed by the CPU, even if then discarded.

Using VLAN 1 tagged is uncommon but shouldn't be the cause.

tdw

I don't believe you can do this as pool allocations are 'sticky' - for any particular MAC address and username combination the previously used IP is issued when reconnecting. Only a reboot, no free pool addresses (which forces a cleanup), or not being used for some time resets this behaviour.

tdw

I'm not sure why the Mikrotik supplicant works without a certificate on the server. The certificate provides the keying material for the TLS tunnel used by PEAP in addition to providing identity information. Per the previously linked page for Windows supplicants they will not work unless the certifc...

tdw

One bridge. See https://forum.mikrotik.com/viewtopic.php?t=143620 , https://forum.mikrotik.com/viewtopic.php?t=173692 , https://help.mikrotik.com/docs/display/ROS/Switch+Chip+Features#SwitchChipFeatures-SetupExamples for RouterOS, https://help.mikrotik.com/docs/pages/viewpage.action?pageId=76415036#...

tdw

Pretty much all EAP methods will not work unless the server presents a certificate - are you sure FreeRADIUS isn't using some default certificate, whereas usermanager will need one creating

tdw

What certificates are you using for the EAP part. Windows requires the CA to be in the machine certificate store, there are other caveats too https://wiki.geant.org/display/H2eduroa ... iderations

tdw

Yes, use Netinstall https://help.mikrotik.com/docs/display/ROS/Netinstall

tdw

If the client connected using an IP / layer3 VPN has an address which falls within the subnet used on a local ethernet / layer2 network it requires the use of proxy-ARP. Note the naming of L2TP can be misleading - it refers to layer2 tunneling of PPP packets, not the client IP data itself.

tdw

It forces any bridged traffic to also pass through IP firewall chains https://help.mikrotik.com/docs/display/ROS/Packet+Flow+in+RouterOS#PacketFlowinRouterOS-BridgeForward , this is only required if you wish to apply firewall rules, where bridge ACLs are insufficient (e.g. as they are stateless), or...

tdw

CRS devices are primarily ethernet / layer2 switches with some IP / layer3 functionality, i.e. limited performance as the CPU is not particularly capable. RouterOS v7 introduced L3 hardware offloading, however the DX2000 in the CRS310-8G+2S+ only supports routing offload, not fasttrack and NAT conne...

tdw

Using a bridge as a local/loopback interface will not work if the addresses are presented directly - just add the addresses to the WAN interface, for example: /ip address add address=155.13.35.202/29 interface=ether1 add address=155.13.35.203/29 interface=ether1 Only if the additional addresses are ...

tdw

See https://help.mikrotik.com/docs/display/ROS/Dot1X#Dot1X-Server . The guest-vlan-id functionality is odd, other vendors allow access to a guest VLAN immediately until dot1x authentication completes. Other than making a feature request to Mikrotik there isn't much you can do to reduce the time. Not...

tdw

The RouterBoard firmware is equivalent to the BIOS on a PC - it handles the initial chipset configuration and RouterOS loading. It is persistent unless upgraded or the device is completely reflashed with netinstall. Historically the firmware and OS used different version numbering. At some point the...

tdw

Did you drop the existing connection? The server binding will be used when the client reconnects.

tdw

That isn't something I have used, if it doesn't have options for specfic RADIUS reply attributes it depends if it has any mechanism for adding generic/custom ones.

tdw

Two routes is correct - one from the point-to-point tunnel, the second the subnet route.

However you can't have the same subnet on both your CHR and the remote client, routing relies on subnets not overlapping with each other as it has no way of knowing which interface to use if they do.

tdw

You do not have pppoe-out1 added to the WAN interface list.

tdw

It doesn't need any scripting, use a server binding : /interface sstp-server add name=sstp-in-lsstp user=lsstp When a connection is made with the username specified the named interface, sstp-in-lsstp in this case, is created instead of the usual <sstp-lsstp> dynamic one. Obviouly only works for a si...

tdw

Is 192.168.0.1 the client remote address? It is safer to use 0.0.0.0 which indicates to use the tunnel regardless of address. An alternate method is to use Framed-IP-Address and Framed-IP-Netmask if the address is part of the routed subnet, in place of using Framed-IP-Address and Framed-Route .

tdw

Info is in the help pages https://help.mikrotik.com/docs/display/ROS/MikroTik+wired+interface+compatibility#MikroTikwiredinterfacecompatibility-10GSFP+/25GSFP28 and https://help.mikrotik.com/docs/display/ROS/MikroTik+wired+interface+compatibility#MikroTikwiredinterfacecompatibility-SFP+interfacecomp...

tdw

In this case leaving all the interfaces set to autonegotiate should be fine. The highest speed of those advertised by both devices is chosen so the 2.5Gb advertisment from the CRS will be ignored. The example is using a bond in isolation, hence adding the IP address to it. When adding any ethernet-l...

tdw

I can't immediately recall if the Mikrotik rejects routes where the subnet bits are not zero, so for 192.168.0.1/24 it should really be 192.168.0.0/24

tdw

Per the wiki page for the Framed-Route attribute Format is specified in RFC 2865 (Ch. 5.22) so you should be sending 192.168.0.1/24 0.0.0.0 1

tdw

Copper ethernet connections operating at a rate of 1Gb or above will not work without autonegotiation, fixed settings only work for 10Mb or 100Mb with half or full duplex.

If you require a specific rate you can use autonegotiation but only advertise that one rate.

tdw

They will appear as dynamic entries under /ip route with the name of the PPPTP/L2TP connection as the gateway.

tdw

See viewtopic.php?p=1037400#p924602 as an example

tdw

I'm not sure that the supported RADIUS attributes https://wiki.mikrotik.com/wiki/Manual:R ... Attributes have made it to the new help pages.

And stop using PPTP, it has been known to be insecure for at least a decade.

tdw

No. The OP states the provider supplies five IPs with a /24 netmask, these should just be added to the WAN ethernet interface with a single default route to the provided gateway. All you need to know is same as routing on a NAT a /32 is higher precedence than a /24 No. You are conflating two things ...

tdw

If you are not using the hotspot functionality the hotspot=auth should be removed from the PCC rules

tdw

It is annoying that on new devices Mikrotik have picked voltage ranges which are not directly compatible with float-charged lead-acid batteries. Historically devices supported 8-30V so were quite happy running off nominal 12V (13.8V on charge down to ~10V cutoff) or 24V (27.6V on charge down to ~20V...

tdw

You cannot, it requires a NAT64 translator.

tdw

Also as mentioned in an earlier post if you have multiple VLAN IDs specified in a single entry: /interface bridge vlan add bridge=br0 tagged=ether1,br0 vlan-ids=X,Y,Z you should not use these VLANs untagged, i.e. by setting pvid=X or Y or Z under /interface bridge port or dynamically by CAPsMAN. In ...

tdw

I do not get the chance to use our existing network cabling for this to work properly, right ? I mean, I need to send a wire from each deco to the other directly and not connecting each one to the switch. It this latter option is possible, It would make the move easier. It depends if the switches y...

tdw

No, having a subnet hint does not work. There are a number of grumbles about this in other forum posts.

tdw

You did enable ether1 in /interface bridge port ? Yes, set the PVID for those ports under /interface bridge port and add any tagged membership under /interface bridge vlan , explicitly adding untagged membership is optional as it will be dynamically added from the PVID setting. Some people prefer to...

tdw

Do you get an address via DHCP on ether7? You have no DNS server specified in /ip dhcp-server network for that subnet which may cause issues. Can you ping the gateway addresses when connected via those ports having obtained or set an address? Most likely is the firewall filter rules don't allow acce...

tdw

Configure the TP-Link in Access Point mode, not the default WiFi Router mode, e.g. https://www.tp-link.com/uk/support/faq/1842/ . Where possible connect the Deco units with ethernet cables as meshing reduces capacity - each device has to receive each packet and then transmit onwards. I seem to recal...

tdw

Unfortunatelly now I'm using vlan id=1 in my network and on some devices I have this hardcoded. That will not be fast and easy configure and switch the router :/ Using VLAN ID 1 is not incorrect, however you can easily get things wrong as a result unless you are familiar with exactly how manufactur...

tdw

You haven't copied the /interface bridge vlan settings for VLAN ID 10 correctly - missing tagged=br0

tdw

To simplify broadcasts ect. every VLAN shall reside in a separate partition of the same /24 subnet. That will not work, and it is not specific to using a Mikrotik. Each VLAN is its own layer 2 broadcast domain so broadcasts will not pass between them. Having overlapping subnets would require specia...

tdw

I discovered that the switch is only receiving PoE from one Ethernet port, despite the requirement for a minimum power input from three ports. Power is only taken from the input with the greatest voltage, each input should be capable of providing all the power necessary to operate the switch itself...

tdw

You're referring to 2 different products:
CSS610
and
netPower Lite 7R

Just for info, the netPower Lite 7R is one of the CSS610 range - its full model name is CSS610-1Gi-7R-2S+OUT

tdw

The configuration doesn't make sense - you have name=aBridge in /interface bridge but references to bridge=3TSBridge in /interface bridge vlan.
Also, do not set the bridge-to-CPU PVID in /interface bridge to have the same ID as an /interface vlan attached to the bridge.

tdw

According to https://help.mikrotik.com/docs/display/ROS/CRS3xx%2C+CRS5xx%2C+CCR2116%2C+CCR2216+switch+chip+features#CRS3xx,CRS5xx,CCR2116,CCR2216switchchipfeatures-ConfiguringSwOSusingRouterOS using /system swos upgrade should upgrade the primary backup version of SwOS, and you then install the seco...

tdw

That doesn't agree with your diagram, it shows ether5 and ether6 connected between the CRS and RB3011

tdw

It seems like once port is enabled in the bridge, only 802.2 (what the hell is it?) are seen on the interface. Why? Spanning tree, and the port will be ending up in the blocking state to prevent a network loop. STP & RSTP are not VLAN-aware, they allow or block all traffic be it untagged or tag...

tdw

I am a novice with this but the ISP have provided me with the following. It doesn't really make sense, the LAN information is OK LAN First IP Address: 51.x.x.33 LAN Subnet Mask: 255.255.255.240 Customer IP Assignement: 51.x.x.32/28 so when presented as IP over ethernet connections .32 is the networ...

tdw

A 4011 or 5009 would be fine, ICUK use them or Ubiquiti EdgeRouters on their managed 1Gb EAD circuits. The ISP information seems incomplete - typically they would specify a /30 or /31 WAN connection, together with a routed subnet which you can present on the LAN side of your router as a conventional...

tdw

You have to apply the tagging in the wireless interface with vlan-id=XXX and vlan-mode=use-tag - this is only possible in the old (6.x or 7.x upto and including 7.12) /interface wireless settings, it is a lost feature with the new /interface/wifi/ drivers

tdw

I think the problem is with Neighbout Solicitation, not sure if can forward it between bridges. When pinging ISP router from br_lan it sends NS but does not get a reply as multicast packet is not forwarded between br_wan and br_lan to host No it can't, see post #6. The ISP should be routing the /48...

tdw

They just forwarded to us /48 prefix.

Forwarded to what address? This is different to the interface on their gateway being given a /48 subnet mask.

A few ISPs seem clueless about this. I suggest reading https://www.ripe.net/publications/docs/ripe-690/, in particular section 4.1

tdw

For example br_wan - 2a02:a3XX:8::2/64 br_lan - 2a02:a3XX:8::3/64 Mikrotik in my opinion should be able to route between those GUA addresses as those are internally assigned and GUA must be routed, but it does not. No. This doesn't just apply to Mikrotik, addresses in the same subnet are only reach...

tdw

The br_wan address should be /64, and the ISP router should be configured to route the /48 to this address. The br_lan address should again be /64 and also a different subnet. It does not matter what I configure on br_wan and br_lan as IPv6 routing between br_lan and br_wan does not work Example as...

tdw

The br_wan address should be /64, and the ISP router should be configured to route the /48 to this address.
The br_lan address should again be /64 and also a different subnet.

tdw

link local addresses, as the name suggests, are only valid within a layer2 broadcast domain. You say "From br_lan I can not reach br_wan via GUA if both bridges are configured with the GUA address" - you should assign different GUA addresses to each otherwise routing will not work. Typical...

tdw

There is a layer 2 bridging option for any PPP-based protocols (e.g. L2TP, SSTP) using BCP, although it doesn't work fully with vlan-aware bridges, or OpenVPN using TAP.

With RouterOS v7 there is also VXLAN and L2TPv3 but the documentation and examples are rather sparse.

tdw

Mikrotik do not support RFC3021 /31 addressing, use /32 for the local and gateway addresses: /ip address add address=88.xx.xx. 15 interface=vlan835 network=88.xx.xx.14 If the subnet public IP is routed to you then adding those addresses to the WAN interface is incorrect. The conventional use case wo...

tdw

The SIM provider unfortunately does not give me public IP, so I'm under cgnat. Cgnat renders UPnP useless ? I know that port forwarding and DDNS are not working Yes. UPnP merely automates port forwarding on your router, it doesn't cascade the forwarding rules/requirements to the providers CGNAT inf...

tdw

Not directly related, but does your SIM provide an unfiltered public IP as most either block inbound traffic or use CGNAT which renders UPnP useless. Setting up port forwarding either manually or with UPnP is only required on older Hikvision devices, more recent ones can be configured to establish a...

tdw

IIRC v7 will always be slower due to kernel changes between v6 and v7, e.g. no more route cache.

tdw

It appears that way, although it is a limiting factor if you want to use an indoor device in a weatherproof enclosure outdoors, or the L11UG-5HaxD which could be used in either situation.

tdw

It appears not to be included in the new wifi package, see viewtopic.php?p=1052150

tdw

Likely skip DFS channels with 10min CAC is incompatible with the channel selection as 5580/Ceee uses 5570-5650.

If the same settings work on a hAP that could be a bug where it is not excluding the extension channels which overlap with 5600-5650.

tdw

Actually, I have frame-types=admit-only-vlan-tagged set too, on the bridge.

That is only applicable to the implicit bridge-to-CPU port. Each port added under /interface bridge port has its own frame-types= setting.

tdw

Mikrotik have likely added the warning as it is a common misconfiguration. RouterOS does not restrict many configuration settings which could be questionable or not sensible making it much more flexible than offerings from other vendors.

tdw

You can either use switch ACL rules, remembering to also permit broadcast IP addresses in addition each clients unicast IP address, or disable hardware offload and use /ip firewall filter rules after applying /interface bridge settings use-ip-firewall=yes . The CPU performance is likely to limit thr...

tdw

Any tagged= or untagged= entries under /interface bridge vlan should only be ports listed under /interface bridge port or bridge names (for the bridge-to-CPU port) You are also mixing tagged and untagged traffic for VLAN 20 on the bridge by having both an /interface vlan with vlan-id=20 attached to ...

tdw

MSCHAP will definitely work against plaintext credentials, if your setup does not it is most likely a FreeRADIUS configuration error - run it with debugging enabled and look at the logs. Depending on how your password changing is implemented you should be able to incorporate something which will sto...

tdw

It is a design fault, and easy enough to make when you are not familiar with all of the complexities of USB-C. The original Raspberry Pi 4 had a similar problem, although that was caused due to the two CC pins being wired together to a single resistor as described in this in-depth article https://ha...

tdw

I probably haven't used bridge filters with mac-protocol qualifiers since before VLAN-aware bridges were introduced. It appears that with vlan-filtering=yes on a bridge much of the bridge filtering options become unusable, all I can suggest is opening a support case with Mikrotik regarding not being...

tdw

An easy mistake to make is thinking the RJ45 on a PC/laptop is a IP connection. It isn't, layer 3 IP packets are encapsulated in layer 2 ethernet frames sent with layer 1 signalling/coding, e.g. 10BASE-T/100BASE-TX/1000BASE-T. The IP addressing is straightforward - if the destination IP address is w...

tdw

The standard way to set this up would be to assign 180.2.220.50/28 to your WAN bridge with a default route to 180.2.220.49. The servers would be assigned addresses of 180.2.220.51/28 (likewise .52, .53, etc. for additional servers) again with a default route to 180.2.220.49. If you wish to firewall ...

tdw

I don't really understand why? default gateway IP 192.168.1.1, remote IP when connected via VPN 192.168.1.2. It's /24 network so I am on the same subset. Using the same subnet for L2TP connections as the LAN does not make the connection part of the same network . You could either: use an L2TP serve...

tdw

No. You only need to add the bridge as a tagged member for traffic which interacts with services provided by the CPU, e.g. a router-on-as-stick setup with multiple VLANs. See viewtopic.php?t=173692 for more information.

tdw

This fixes being able to read any data from SFPs which do not correctly handle multi-byte I2C read requests correctly. The actual data, and location thereof, is specified by https://members.snia.org/document/dl/25916 - some is mandatory, some is optional and some is vendor-specific. Mikrotik decode ...

tdw

Any devices using SLAAC to acquire an IPv6 address require the subnet to be /64, you can't arbitrarily use a different size just because you don't have a suitable block of addresses. It is possible to use smaller subnets if the hosts are assigned static addresses, or acquire addresses from a suitabl...

tdw

You appear to be using the hEX to connect two networks each of which has existing gateways. Whilst the dst-nat rule will forward packets for any TCP port 80 packets arriving on ether5 to 10.100.10.210 those packets will still have a 192.168.178.x source address, and as 10.100.10.210 knows nothing of...

tdw

IIRC you will have to both identify and drop packets in the bridge. Using the IP firewall to identify them would be too late in the packet flow as the packet will have left the bridge by that point. The minimal case to drop any DHCP requests via a bridge port would be /interface bridge filter add ac...

tdw

Why are you posting this in Mikrotik forums? As Video Station is a QNAP application their forums would be a good starting point.

tdw

DHCP servers use raw sockets, not regular UDP sockets as you may expect. So whilst the DHCP packets traverse /ip firewall they are actually processed before the packets can be dropped, and from previous threads I don't believe it is possible in /ip firewall raw either, you would have to use /bridge ...

tdw

Which OS are the PCs running? Windows, for example, by default blocks ICMP from outside the directly connected LAN subnet.

Using bridge-to-CPU interface as hybrid instead of all tagged is not an error, some people just do not like the cosmetics.

tdw

No. Only packages signed by Mikrotik can be installed directly on the device. Only Mikrotik know what their plans for future functionality is. If you have a model capable of supporting containers you can add functionality that way.

tdw

A list of commands applied to a device plus prints of a random selection of settings is not representative of the actual configuration on the device. The usual recommendation is to post the output of an /export after redacting any sensitive information (serial number, public IPs, credentials in scri...

tdw

Having built an interface which allows the Mikrotik UPS package to monitor the likes of Meanwell and PULS PSU with battery charging I've looked into the communications in depth. For the USB HID power device class there are both standard and vendor-specific reports, for the serial APC smart protocol ...

tdw

Having the www-ssl service running, or not, on the Mikrotik itself has nothing to do with running an HTTPS webserver elsewhere.

tdw

As the error message suggested port 443 is in use:
/ip service
set www-ssl disabled=no

tdw

My WAN was PPPoE, but configured to use baby jumbo frames giving an MTU of 1500, so I used the defaults of mtu=auto and clamp-tcp-mss=yes on the 6to4 interface. The minimum MTU for IPv6 is 1280, normally you should set your MTU correctly and let path MTU discovery do its thing. IPv6 fragmentation is...

tdw

blackhole would be acceptable - any traffic to unallocated subnets would just be dropped. Otherwise adapting the IPv4 workaround as discussed in a related thread viewtopic.php?p=853939#p853939 would be needed to return unreachable.

tdw

And remember to add unreachable or blackhole routes to any routed subnets so packets to any unused portions don't bounce back and forth between you and HE until the TTL expires. From a previous setup before getting native IPv6: /ipv6 route add distance=1 dst-address=2000::/3 gateway=2001:470:xxxC:xx...

tdw

A Mikrotik bridge has two roles, see viewtopic.php?t=173692

For translating between Cisco and Mikrotik switch port terminology this may be useful viewtopic.php?p=920720#p920720

tdw

Might as well continue here for now. If not set the outer identity should use the inner identity, but it may be worth trying setting it explicitly. It isn't clear from the documentation if the dot1x client will refuse to authenticate if no CA has been imported. You should be able to add additional l...

tdw

Also you have configured the bridge-to-CPU interface to be both tagged and untagged, and there is a mismatch between the bridge ports pvid= and bridge vlan untagged= settings - if you remove all of the untagged= entries these will be created dynamically from the pvid= settings. Depending on how othe...

tdw

There is no possibility for communicating classless routes to IPv6 clients. (Apart from the usual default route, of course) That may be the case for DHCPv6, but that does not acquire the default route in any case. The default route is acquired from RA messages with non-zero RA lifietimes, other rou...

tdw

I am still not sure how to convince the routing tables on laptops etc. to only route to those three ipv6 address blocks and perfer-v4 otherwise. Perhaps I need to just live with the default route and use firewall to achieve what I want? Maybe I send back an ICMP unreachable for all but the blocks I...

tdw

Yes.VLAN5 & VLAN10 are transporting the two internet connections to the router. Attaching VLAN interfaces with those IDs to the router P5 provides your 'WAN' interfaces.

tdw

As hEX PoE use the QCA8337 switch chip which does not support hardware-offloaded vlan-aware bridges use a single bridge and configure the switch chip to handle the VLAN filtering, see the examples https://help.mikrotik.com/docs/display/ ... upExamples

tdw

If client devices resolve both IPv4 and IPv6 addresses for a target site they will use IPv6 in preference to IPv4 to connect. AFAIK Android and iOS implement 'Happy Eyeballs' for fast fallback to IPv4, and some PC programs do but I don't believe Windows itself does. Static IPv6 NXDOMAIN DNS entries ...

tdw

As it is only peripherally related you should really start a new topic rather than resurrecting a years old one. Your site may require a realm in the outer / anonymous identity to direct the request to the appropriate servers (e.g. local or a national proxy). A CA certificate is not required but wit...

tdw

The CRS1xx/2xx VLAN handling is very different to all the other models as the UI exposes much of the inner switch workings. The bridge should be set to vlan-filtering=no , any ingress-filtering= , frame-types= and pvid= settings on the bridge and bridge ports should be left at they default values. T...

tdw

How can you connect three devices to a single ethernet cable? I would expect each device to be connected to a switch port, in which case you can use port isolation or bridge horizon to prevent packets from one of these devices being sent on the links to the others. Some vendors have 'ip helpers' whi...

tdw

As the PADI/PADO/PADR/PADS handshake completes successfully the PPPoE session should work, but there is no response to the LCP negotiation. I would suggest connecting the modem directly to a PC/Mac and configuring a PPPoE client on that to verify a connection can be established, if that also fails t...

tdw

Given the volume of outdated or incorrect configuration settings which may be found searching the internet GPT4 isn't going to be very good. Your VLAN interfaces have not been assigned IP addresses. Remove the relay= settings for the DHCP servers, this is to forward requests to a server elsewhere. Y...

tdw

Yes, only any specific settings for managment. Here the factory defaults are bridge mode so the modem will establish a DSL connection and allow PPPoE or DHCP connections from the Mikrotik (or other router) to be established (most of our ISPs use PPPoE but some use DHCP). The firmware for other count...

tdw

For the UK (modem 4 or modem 8 ) there was an issue going from 3.7.x to 3.8.x with the introduction of QinQ support which had the symptoms you describe. Resetting to factory defaults and reconfiguring any settings required, e.g. LAN IP address for management access, resolved the problem. There are v...

tdw

Screenshots don't particularly help, an /export of the configuration with any senstive data redacted (serial number, public IP addresses, etc.) shows exactly what you have. There is bound to be fragmentation over a conventional WAN, so it is a case of finding potentially a combination of tunneling t...

tdw

The tunnel MTU should be set to 1500 to allow the transport full-sized Ethernet frames over the tunnel. As the tunnel overheads [40 (IPv6) + 8 (GRE) + 14 (ethernet) + some amount for IPsec (depends on settings)] will result in a total packet size greater than your WAN MTU it will be fragmented. IPv6...

tdw

What you have attempted is the pre-VLAN-aware bridge method which has a number of caveats, see https://help.mikrotik.com/docs/display/ ... figuration

Search found 1983 matches