MikroTik

Buckeye

I can imagine very few things as "static" as cameras, you have to go there, bring near the spot an ethernet connection, drill holes in the wall or ceiling, screw them tightly, they won't likely change. I agree that it makes sense to use static addresses for cameras, but more for the abili...

Buckeye

Without VLAN's I'm afraid your options are ... very limited ... I totally agree with @jvanhambelgium concerning vlans. What you are proposing is much more complex than learning to use vlans. It seems in your original diagrams (as it currently is), that the only MikroTik device is the hex that is be...

Buckeye

Does anyone know what do I need to perform in my microtik device in order to block the registration in the arp table?

This is a good example of the XY problem

What is ARP and why do we need it? Address Resolution Protocol (ARP)

Buckeye

- To that point, tagging the bridge is NOT needed IF the router is merely bridging traffic - i.e. NOT the router for the VLAN, e.g. acting as "smart switch". So if the router does not have an IP address (and /interface/vlan) on something "passing through" the bridge, then tagged...

Buckeye

It sounds odd to me, but it works only this way. For what it's worth, it just found this with google Why do the docs not mention adding "bridge" as its own tagged interface when doing a VLAN trunk? which has the solution post by @mkx which implies it is a bug that affected devices with mu...

Buckeye

If I remove BR1 as a tagged port and restart the switch, I can't even get access to it via the management port Ether8 (which is not part of the bridge BR1) via Winbox from my PC anymore. Well I obviously don't understand it as well as I thought I did. I will have to try some things on my RB760iGS t...

Buckeye

...If I don't set the bridge as a tagged port too, the device on the access ports don't get their IPs from the dhcp servers running on OPNsense in which I also set the VLANs interfaces. What MikroTik device is this? Is the intervlan routing happening on the OPNsense device? And are devices connecte...

Buckeye

If you learn from videos, I recommend Mikrotik VLANs - CRS1xx & CRS2xx - Mikrotik Tutorial by Wilmer Almazan / The Network Trip In the example he is configuring there are two switches connected by trunk link, and access ports. And an external router for routing between vlans. This video is three...

Buckeye

Assuming the only interface defined on the CRS using ethernet was the bridge, then I don't think there is any recovery without a serial connection, or a factory reset (and losing the previous config). The bridge interface is connected to the switch ASIC via untagged traffic over the internal trunk l...

Buckeye

The 1588 (PTP Timing) VLAN seems to be working (at least it works on Machine 1). But now I cannot SSH (or even ping) Machine 2 from Machine 1 via VLAN 5. I have tried adding a VLAN to Machine 1 SSH interface and pinging through that and still was not able to reach Machine 2. Machine 2 is a headless...

Buckeye

I would like to use two vlans: -1588: ptp travels from grandmaster clock to both machine 1 and 2. -5: packets sent between machine 1 and 2 (must be tagged) Essentially I want the RU port to be a trunk port to allow both 1588 and 5 vlan traffic simultaneously. The TIMING and SOURCE interfaces can be...

Buckeye

Because if you have lots of users, its easier to give them and have them remember a name than a number. I do understand that it is easier to remember BlueIris:81 than 192.168.0.1:81; but he doesn't want this accessible from the internet, so I don't see any advantage to using the public ip. So why n...

Buckeye

I know this is covered https://forum.mikrotik.com/viewtopic.php?t=60451 , I think, but that method doesn't work: /ip firewall filter add chain=forward action=drop src-address=192.168.0.0/24 dst-addresss=10.0.0.0/24 But that simply doesn't work at all since I'm still able to log in to the router via...

Buckeye

Is there a way to make it so that I can browse to A.dyndns.org:81

There are many things that can be done, but I have to ask; what is the advantage of accessing it via the "external" A.dyndns.org ip address?

To me, this just seems like added complexity with no real benefit.

Buckeye

I did all that. Could be the ad-blocking in my browser that kills it -- but frankly I can't digest video tutorials even in languages I understand. I use uBlock Origin and auto-translated subtitles works for me with Chrome on Win 10. Do you get subtitles in Ukranian if you don't turn on auto-transla...

Buckeye

That's why I suggested you using subtitles (forgot to mention with the option "Auto-translate" :) ) Yeah, that option exists but causes no CC at all (for me, anyway). I didn't know there was an auto-translate feature until @TheCat12 mentioned it. To get it to work you must do several thin...

Buckeye

I'm clearly having some trouble understanding some of the fundamental concepts here. Again, I agree with what @gigabyte091 said, especially the importance of understanding why things work. Confidence comes with understanding, so start there. Do you have any previous experience with tagged vlans? If...

Buckeye

I've been able to set up a DHCP server for the VLAN. I can connect to the router on eth5, and I get an address, but that's where the fun stops. You currently have: /interface bridge port add bridge=bridge comment=defconf interface=ether2 add bridge=bridge comment=defconf interface=ether3 add bridge...

Buckeye

On Ethernet 2 i want to set up an admin vlan , and on ethernet 3 a guest vlan. A simple setup. My problem is that i don t get a local ip on the mentioned vlan ports. Even if i assign a fixed ip from the correct subnet, i can t connect to the router with winbox. The interface it appears that it does...

Buckeye

So, first, is it possible to do this without having to replace the tplink dumb switch with a vlan-aware switch? And if that's possible, what are the paths forward to configure the network as such? Thanks again! What happened to vlans 30 and 99 in your diagram? They exist in your config, but not the...

Buckeye

After successfully configuring my network with VLANs, I had to change the topology, and now I have a situation where one ethernet port has to serve two machines that are in different VLANs. I tried enabling the MACVLAN, untagging the ethernet port and allowing all traffic and setting DHCP on the ma...

Buckeye

Are the only connections to the hEX S ether1 to the Fritzbox and ether3 to the external switch? What type of switch is connected to ether3. Is it a vlan-aware switch with a management interface or is it instead a basic plug and play switch with no management? If it is just a dumb switch, and you are...

Buckeye

Will there AP's do the job --> MikroTik RBWAPG-5HACD2HND I don't use them, so I can't say. My guess is that they will work, but if you really want to know, start a new thread with a title that will get more nibbles from people that use the device. i.e. a title like "Question about vlan capabil...

Buckeye

So, firstly, this is the cable I used: https://www.amazon.it/dp/B07ZVLDCYX. There's this one and another 7a cable for the Windows PC I'm testing. I mean, a cable could be, but in all 4 ports? Have you tested with a pre-made patch cable? If you don't have a portable device, then take the hex to the ...

Buckeye

Relevant documention for reference:

https://help.mikrotik.com/docs/display/ ... +Switching
https://help.mikrotik.com/docs/display/ ... NFiltering
https://help.mikrotik.com/docs/display/ ... se+Studies

Buckeye

If I turn on VLAN filetring on Bridge --> situation turns 180 degress. ethr1 to ethr4 works normally and gives DHCP addresses, and Trunk side just dies and doesnt want to give anything. Are you saying that when you turn on vlan-filtering, that vlan200 access ports on the switches do not work? It se...

Buckeye

Why were @anav's guide threads deleted? New User Pathway To Config Success https://forum.mikrotik.com/viewtopic.php?p=906567 New User Posting For Assistance https://forum.mikrotik.com/viewtopic.php?p=908118#p908118 Those were really useful threads with pointers to other relevant material. It's been ...

Buckeye

@anav welcome back. Were you on Holiday/vacation?

Buckeye

If you are indeed talking about Dell 28xx series, I agree with @pe1chl (at least if I am interpreting what he said correctly). Normally the easiest way to do that is to make the management network untagged, and use tags for all networks for which you know the VLAN ID. Here is what I would do in your...

Buckeye

@strods can you comment on the switch changes in more detail? Specifically the one about BPDU and HW vlan-filtering. Here are two threads which were related to the problem this seems to be addressing VLAN-Trunk not working [SOLVED - incorrect BPDU filtering on hAP ax lite HW offloaded trunk ports] -...

Buckeye

Were you able to verify that the 7.11rc1 "fix" worked for your hAP ax lite? Because @skyhawk reported in a followup post that it did not solve his problem (which was on a hEX (RB750Gr3) using the MT7621)

Buckeye

Initial testing suggests the issues is *not* fixed. Just curious, have you reached out to them about your previous ticket? Did they ever send you any update? Edit: I was mixed up, it was @thn80 that opened the ticket (see this post ) And the was using hap ax lite, not hEX. When I reported a problem...

Buckeye

Whether to use ROS vs SwOS depends of your familiarity with ROS. SwOS is more lightweight and in my opinion easier to configure if all you want is L2 (which is the primary purpose of the CRS devices). ROS can provide secure management protocols (ssh) which SwOS does not. Whether you use SwOS or ROS,...

Buckeye

This may be fixed by 7.11rc1 as reported by @skyhawk in this post from the thread Bridge VLAN-Filter Offload broken on hEXr3?

Buckeye

This may be fixed by 7.11rc1 as reported by @skyhawk in this post from the thread Bridge VLAN-Filter Offload broken on hEXr3?

More details about the problem in this thread VLAN-Trunk not working [SOLVED - incorrect BPDU filtering on hAP ax lite HW offloaded trunk ports]

Buckeye

I am using the PC as Mikrotik router (ROS 7.x). The switches are simple TP-Link managed switches, but I'd like to avoid VLANs if possible. So on the PC, you have two ethernet interfaces in an ROS bridge? Why not just create two separate subnets (no vlan is required) and then you can plug "any ...

Buckeye

/interface vlan add interface=ether1 name=vlan1.10 vlan-id=10 add interface=ether1 name=vlan1.20 vlan-id=20 add interface=ether1 name=vlan1.30 vlan-id= 20 That appears to be a typo. Shouldn't it be vlan-id= 30 What is happening to IPTV on the hAP ax2? I expected to see vlan-filtering and a port on ...

Buckeye

Read Port isolation

You don't specify what MikroTik device you have, it is done differently in SwOS than ROS.

Buckeye

But preventing later editing of posts can be bad as well. An example is @anav's "how to" posts, and @pcunites vlan topic. it is nice for long time users to be able to edit the posts. If it is easy to limit users that are new or have few posts, that is a good idea to disallow editing, becau...

Buckeye

If you can't set the default gateway for the management interface of the switch, then the only other option I am aware of is to use NAT masquerade on the Router interface connecting to the switch. That will make it appear to the switch that the traffic is sourced from the router, and therefore on th...

Buckeye

The issue appears to be that the switch I am using does not allow for a gateway configuration for the management interface IP and therefore it doesn't know to route to any other network. Perhaps it's a peculiarity of the switches we are using - Allen Bradley Stratix 5700. I don't think it is a limi...

Buckeye

I have set up eth8 as a trunk port for VLAN10 and VLAN20 and it goes to a switch that splits out the VLANs, but I also want a direct connection for my PC to the router on say, eth2. How do I configure eth2 on the router to be an access port for VLAN20 in WinBox? Without seeing your exported config,...

Buckeye

I should note that the sample router.rsc on the original forum doesn't have any lines with "untagged" so perhaps it's an error there too? That's true, but it is not an error. In that example vlan 1 is not used for user data (other than possibly by the router for spanning tree protocol). I...

Buckeye

I don't think the following is correct: # create one bridge, set VLAN mode off while we configure /interface bridge add name=BR1 protocol-mode=none vlan-filtering=no # ingress behavior /interface bridge port # Purple Trunk. Leave pvid set to default of 1 This is what you want, don't chage add bridge...

Buckeye

This reminded me of a problem on the MT7621 based ER-X (very similar architecture to the hEX), where everything goes "through" the switch ASIC. The problem was that any priority only tagged packets with PCP (Priority) != 0 would be dropped. This was fixed with a patch, so it would be inter...

Buckeye

What is the purpose of the diagram if it doesn't correspond to any export? It is especially confusing when you post a diagram and a config that doesn't correspond to the diagram in the same post. And then after people have commented on the export, to replace it with yet another unrelated one. What w...

Buckeye

I have CRS354-48G-4S+2Q+. CPU utilization is 100% every time. Ethernet is about 30% Networking is 45% Bridging is 25%. Some mac addresses (about half) in "interface ethernet switch host print" command i see behind switch1-cu interface. Does it mean that traffic going to servers with mac a...

Buckeye

I've seen quite a bit of DHCP issues because of time mismatches. What type of DHCP issues have you seen because of time mismatches, and how did you determine that it was the time mismatch that caused the error? I thought that rfc2131 section-3.3 Interpretation and representation of time values cove...

Buckeye

It seems to me @anav left out the command to actually create the vlan interface with the /interface vlan command. Then you will need to use whatever name you created for your WAN vlan interface (the example @anav provided used VlanWAN, my example used wan_107). You will need to use vlan-id=101 (not ...

Buckeye

Air Force One must then have routers installed with ROS 7.10 for quite some time.

They now have a special stairs in the back of the plane. Far away from the routers in the front of the plane. Hope it helps.

That flew over my head until I realized the context.

Buckeye

Some of the ISP replies seem strange. Why is it often sending to: 217.19.17.85.67 > 217.19.19.188 and The issue appears to be that the ISP sends the DHCP replies to the assigned address, rather than to the broadcast address. The router does not process these because it does not have that address ye...

Buckeye

both post you are referring are from newly created accounts, a factor that you are not taking into account That's correct, I did not take that into consideration. And I also did not do a google image search to see if the diagram was lifted from somewhere else to give credibility to the post. But th...

Buckeye

… Posts are starting to disappear for no reason.... Now let's see if they start accusing me on Reddit without even telling me, this time they can't blame me, let's see if Reddit users convince you on someone else.... https://forum.mikrotik.com/viewtopic.php?t=197438#p1010594 https://forum.mikrotik....

Buckeye

Yeah, IP based was just throwing a random suggestion out there for simply manually assigning a device to a specific vlan after it connects. My question was really just to see if there was any way to do it but it seems not. The reason I said I didn't understand what you meant by IP based vlan, is th...

Buckeye

Please help. Did you understand what @anav wrote? You are using bridge ports as if they were L3 interfaces, and that is a misconfiguration. See IP address in bridge or etherX . Once you add an ethernet port to a bridge device, you should not try to use layer 3 commands with the ethernet port; L3 co...

Buckeye

Unless you intend to have all devices in the same vlan, using a dumb switch isn't recommended, because a dumb switch offers no real separation of devices. Also, to use mac or protocol based vlans requires a managed switch above the "smart switch" variety, that are usually vlan aware but no...

Buckeye

Did they acknowledge as a known issue on the MT7621 based devices (with MT7530 like switch ASIC) as well as the MT7531 switch ASIC in the hAP ax lite? I also found this [net-next,4/6] net: dsa: mt7530: Add the support of MT7531 switch and this CONFIG_NET_DSA_MT7530: MediaTek MT7530 and MT7531 Ethern...

Buckeye

I don't think either the hap ax2 or hap ax3 switch chips are currently supported for HW vlan-filtering, so the bridge vlan-filtering is already done in the CPU, although I am surprised that the behavior would be different in the software implementation (other than the L2 forwarding performance and C...

Buckeye

I already came to the point STP needed to be disabled on the AXLite -bridge (otherwise no access via trunk, only via mgmt port I isolated from bridge) but clients still can not connect. @skyhawk reported a similar problem (not exactly the same) on a hEX that uses a similar switch ASIC. If intereste...

Buckeye

The Switch Features chart indicates hAP ax lite uses a MT7531 switch chip. That's a different model, but the same vendor as the MT7621 in my hEXr3. I wonder if there'd be any benefit opening a support ticket to make sure they're aware the issue affects both chips? Another indication that the switch...

Buckeye

Probably worth reporting it. They will want Supout.rif files from both ends. What is the on the other end of the link? Is it a MikroTik device as well (not that it has to be, just that if it is, it may be easier for them to reproduce the problem). I have a hex S (also based on the MT7621) and I had ...

Buckeye

This post reminded me of another recent post about a hap ax lite. VLAN-Trunk not working [SOLVED - incorrect BPDU filtering on hAP ax lite HW offloaded trunk ports] Take a read through that thread, there are at least some things you can look at. That it works when you disable HW makes me think it ma...

Buckeye

Although I have heard about Windows not ignoring tagged frames, I will say that I use multiple window 10 pro PCs connected to "hybrid" links, and they only "see" the untagged frames. The PC I am using right now is connected to a "hybrid" link, and it gets its ip address...

Buckeye

What MikroTik device do you have? How many ports does it have? Does it have a built in switch? How many ports are currently in use? How many wired devices need to connect to each "vlan"? If you have two vlans, the "best" solution would involve a vlan aware switch with enough port...

Buckeye

The MikroTik forum isn't the best place to get help for UniFi problems. Try https://community.ui.com/tags/unifi-wireless/questions

Buckeye

No matter what you do, there are some dissatisfied people. In Poland we say: No matter how you turn around, the ass is always in the back. That's funny that I thought it meant "you never see you own faults", or something like "it's hard to see the dirt on your own face". But you...

Buckeye

finding the correct part is going to be the biggest problem. That's a small switch, and most right angle switches have multiple posts that go through solder through holes; it appears this must be surface mount (based on the picture of the other side of the board, but it may be hiding under the micro...

Buckeye

(but at the same time, if he touch the board, it's no longer under warranty) What is your definition of touch? Does that also apply to the CCR2004-1G-2XS-PCIe that has part of the board protruding? There are no "seals to break", so unless you left visible evidence, how would they even kno...

Buckeye

Assuming you have a wired connection to your TV and only a single ethernet cable already running from the RB4011 to the room where the TV is, and if you want to have access to multiple subnets from different devices in the TV room, and have each subnet work correctly with dhcp, then you will need a ...

Buckeye

I tried to setup vlan 111 to bridge. All ports are in bridge. Connected my laptop to the unmanaged switch, still getting wrong IP address (not from subnet of VLAN) That is because your TV is not vlan-aware, so it is ignoring vlan 111 tagged frames. If the TV is getting an IP from what you referred ...

Buckeye

Which MikroTik router do you have? You can probably connect your TV to a different port on the router, but then you will need a dedicated cable from the router to the TV. And you will need to either remove the port connected to the TV from the bridge, or for a bit more flexibility, you can configure...

Buckeye

Have 3 vlans at home. For example, basic LAN devices has no vlan. Want to set VLAN 111 to TV device. My connection is: routerboard -> tplink switch (unmanaged) - port 1 TV, port 2 computer. So I want to set VLAN 111 TV only. What is your definition of a vlan? Because it seems your definition is dif...

Buckeye

I have an ordinary home network consisting of modem and gateway, which does ordinary home things 'fine' / okay adequately. I have no good reason to change it, and it would be difficult / inconvenient and possibly costly to try. But, the firewall is basic, and I want to give my servers additional pr...

Buckeye

For someone complaining about things that should be easy, you don't seem to care much about making it easy for others to help. 1. Your title means nothing. Most people will just skip it because if you don't put enough effort into making the title relevant, it is a good indicator that the post wont' ...

Buckeye

Did you contact the seller? The switch shouldn't just "fall off the board". Do you have a photo? Here are photos of the what the RB750Gr3 mother board looks like: from https://www.roc-noc.com/mikrotik/routerboard/hEX/RB750Gr3.html https://www.roc-noc.com/images/D/rb750Gr3_l_1200px.png comp...

Buckeye

Thanks for updating the title to make it easier to find in the future. I have this thread saved in my useful links spreadsheet. I am trying to think of a way that we could have narrowed this down faster. Does the Spanning Tree Protocol Monitoring display give any clues when you switch between HW an ...

Buckeye

@thn80 Thanks for your good documentation of the issue. I haven't seen the issue you saw with my hEX S, but the "trunk" link was a bit different on my setup, and the other end of the trunk link was a Ubiquiti ER-X with the vlan-aware switch0. And the ER-X doesn't support RSTP on the switch...

Buckeye

If you still have the "setup", and have not cycled power, are there any hints in the output of log/print ? Also just to validate that setting the pvid on the trunk port to 99 does not affect the outcome, can you manually change the pvid of ether3 back to vlan 1, because it was questioned i...

Buckeye

@thn80 good detective work. The gif "movie" is pretty convincing that you have found the root cause of the problem. BTW, for others if you want to save the .gif after you click on "Play GIF 3.2MB", while it is playing, right click on playing image and same image as. Turning on/of...

Buckeye

@sindy @tdw @mkx @Sob or any others that don't mind getting into the nitty gritty details of vlans and MikroTik vlan-filtering bridge. Do any of you see any reason why the config should not work? And why it would work for a short time shortly after link status change from down to up, but then stop w...

Buckeye

@thn80 it appears you have configured ether5 on the hapax2 as a vlan 10 access port. (evidence output of [thomas@hapax2] > /interface/bridge/port/print detail Flags: X - disabled, I - inactive; D - dynamic; H - hw-offload 0 I interface=ETH5_MGMT bridge=bridge_primary priority=0x80 path-cost=10 inter...

Buckeye

If there is someone else with a hap ax lite that is using vlans with the vlan filtering bridge with one bridge port tagged and another untagged ( using same vlan id ), can you report that it works? And also what version of firmware you are using on the hap ax lite with working vlans?

Buckeye

One odd observation: The hap ax2 sees the LLDP packets from the hap ax lite, but the hap ax lite isn't seeing the LLDP from the hap ax2 (reference of info for my observation: output of /ip/neighbor/print detail On hap ax lite: [thomas@MikroTik] > /ip/neighbor/print detail 0 interface=ETH4_MGMT,bridg...

Buckeye

@thn80 thanks, that is a much easier config to deal with. What things if any were removed (i.e. not shown in the configs posted, if anything was sanitized out)? You are not setting mac addresses on any of the interfaces are you? How many interfaces does your PC have? If multiple adapters, are they d...

Buckeye

You said it will use the default PVID=1 in case nothing is configured via console, but what is the difference between the default PVID=1 and my PVID=99 if the Frame Type is set to "admit only VLAN tagged"? In both cases it should simply be a number that is not used, right? (Just for my un...

Buckeye

I tried to simply remove the PVID, but without an PVID the error message "Error in PVID - decimal number in range [1;4094] expected!" appears. I don't think you are telling us the whole story. Copy and paste exactly what you typed, and error message as it appeared. if you entered pvid wit...

Buckeye

So far I searched for some hours and stupidly cannot find the problem :-? . The configuration is - maybe - a little bit messed up or overcomplicated at the moment, because of the fact this MikroTik device is my playground. But I don't want to reset it to the defaults and start over again, instead I...

Buckeye

add bridge=bridge_primary frame-types=admit-only-untagged-and-priority-tagged \ interface=ETH4_MGMT pvid=10 add bridge=bridge_primary frame-types=admit-only-vlan-tagged interface=\ ETH3_DOWNSTREAM_TRUNK pvid=99 Shot in the dark, but is ETH3_DOWNSTREAM_TRUNK pvid=99 causing the problem? The way I'm ...

Buckeye

The following looks suspect to me: ETH4_MGMT is part of the bridge, and should be getting access via VLAN_10_MGMT, /interface list member add interface=ETH4_MGMT list=mgmt_allowed_interfaces add interface=VLAN_10_MGMT list=mgmt_allowed_interfaces It is hard to follow your firewall rules, I would try...

Buckeye

what is connected to ether3? Is it vlan aware?

Buckeye

Ubiquiti MIPS especially caught my attention. Also OpenWRT X86-64/MIPS/PPC. The ER-X is based on the same SoC as the hEX, but the ER-X has 256MB of flash in addition to 256MB of RAM. The hEX has 256MB of RAM, but the hEX flash is limited to a paltry 16MB, although it does have an SD slot, but as fa...

Buckeye

I think that the primary thing that affects gaming is latency and jitter, not throughput.

Buckeye

If you have the hEX, try it and see if it meets your needs. The hEX will probably be fast enough for you real needs. If you lived near the autobaun, would you only buy a Bugatti Chiron so you could get the "full potential" of the road? Then after you have used the hEX and if you determine ...

Buckeye

I am trying to understand why you want a second bridge "device". You talk about wanting management to have a different (probably standard 1500) MTU. A vlan interface (created with /interface vlan) is similar to a Cisco SVI vlan interface, and it is the CPU's connection to a specific vlan o...

Buckeye

Asking if the hEX is sufficient for your use case without describing what your use case is won't get you useful answers. Why did you specifically ask about the hEX? And by hEX do you mean RB750Gr3? If you already have the hEX, I would try it to see if it is sufficient. It will be faster than the CPU...

Buckeye

Your main point in the first paragraph or your OP seemed to be a concern that the 10Gb link would be a bottleneck. I see all ports are behind the 88E6393X switch chip at 10G, so CPU routing on this platform is going to be limited to 5G FDX or 10G Aggregate since data has to pass in and out that 10G ...

Buckeye

My guess is that ax isn't going to make much difference for IoT devices. For your use case and two choices you gave (although you don't specify which hap ax you are talking about, there are 3 (lite, 2, and 3). If choosing between hap ax2 and L009 I would choose hap ax2. I posted this about tradeoffs...

Buckeye

Unfi is a strange beast, at least their APs expect, as the default, the management subnet untagged and the data vlans tagged. This is probably to support all the folks that just want to plug in one network to their AP, ( management subnet = data subnet = single SSID wlan ) In which case there are n...

Buckeye

Oh I get it, the gap will be filled in when they add Zerotrust Cloudflare tunnel as an options package for all devices.

MikroTik Mikro Tip Host a webserver on your router using CONTAINERS! mentions Cloudflare tunnels, so let Druvis know your feelings about it with a comment.

Buckeye

See rfc5737 , IPv4 Address Blocks Reserved for Documentation there are three /24's reserved for documentation and examples. Using these makes it clear that they are meant to replace global addresses. It is easy to do, just use a text editor and do a global replace of the first 3 octets of you global...

Buckeye

Overlapping subnets is not a good long term solution. It will cause confusion to people at both sites, because to get it to work you have to make each site believe the other is on a different network than they are locally. Consider people trying to access the server from the other location, and they...

Buckeye

For completeness, here is how to change from Canvas

Where to find control panel in Canvas.png

Where to find Board Preferences in Canvas.png

How to select style in Canvas.png

Buckeye

I don't know what this "blue" theme is called, but it's broken, I can't access control panel.

If you are referring to prosilver, here is how:

Where to find control panel in phpBB.png

Where to find Board Preferences in phpBB.png

How to select board style and date format phpBB.png

Buckeye

Thanks for at least giving us some choice. I still prefer Allan Style - SUBSILVER to prosilver, but I prefer prosilver to Canvas, and I have reset to prosilver.

Buckeye

It seems requests for previous choice are falling on deaf ears.

Buckeye

Read the manuals, then ask questions about what you don't understand.
https://help.mikrotik.com/docs/pages/vi ... d=39059480
https://help.mikrotik.com/docs/display/ ... ies+Manual
https://wiki.mikrotik.com/wiki/SwOS/CSS610 (older version)

Buckeye

@Aymen1986 It seems you don't understand the purpose of NAT or the difference between private and public ip addresses.

Watch this layman's guide to NAT. How Network Address Translation Works by PieterExplainsTech (a 2012 video, but still one of the best layman's explanation I am aware of).

Buckeye

To do what you are asking (whether it is really what you want/need) you will need to use switches that have port isolation as an option. For example, see Port Isolation for how a MikroTik 24 port switch running SwOS can be configured. Assuming you want to do everything on the RB2011 which has multip...

Buckeye

If I put a static route 0.0.0.0/0 to the far end tunnel address on the ATT circuit the router immediately drops the two tunnels and they cycle 1 sec. down, 1 sec up 1 sec. down etc and the tunnels are unusable. If i put a 0.0.0.0/1 route, everything works fine (except we are missing 1/2 of the inte...

Buckeye

IMHO, OP wants partial router-on-a-stick config. You are guessing. Without more info, that's all that is possible. Part of the reason for pushing back to the OP for more clarification, is because just by trying to explain it, he will get a better understanding of what he doesn't know, and where he ...

Buckeye

I'm a bit lost in all this So are we. When posting, you need to think like a successful fisherman, and use enticing bait instead of dangling an empty hook into the water and expecting to get any nibbles. What have you tried? What was your expectation and how was it different than the result? What r...

Buckeye

Not sure exactly how you have things configured or wired. I don't think you should use two bridges.

Read through this thread that may be helpful VLAN Passthrough from WAN port to LAN bridge (specific port)

If it isn't you will need to post a network diagram and a sanitized export of your config.

Buckeye

Is the "Select all" from a code block working for anyone? It only sends me to the top of the topic.. I don't think that this ever worked anyway.. It hasn't worked since I became active again in Mar 2022. I reported it here: Code: Select all does not select text in code block It was one re...

Buckeye

What is the surprise for next week? No more access to ROS v6.

Buckeye

I agree, some of us like functionaltiy over "modern clean" look. If we wanted simple user interface with no view into details, we would get Ubitquiti UDM routers. Are you trying to complete with Google/Android and changing things "just because we can"? First you took away Allan S...

Buckeye

These events are then financed by selling the vulnerabilities on the darknet?, so it is obvious that they mysteriously do not communicate the vulnerabilities efficiently... If they fix them immediately, they earn less or nothing... There have been cases of "insider trading", like this Rog...

Buckeye

Sorry but this is also false, MikroTik was not directly involved in this event or prize.
Edit: that is about the PwnToronto event.

Yes, making any assumptions of validity of what you read/see on the internet is a dangerous activity. But it is one reason I like to include the source I am quoting.

Buckeye

They sent a screenshot of an email, but it is not clear whether it was actually sent out, or if they did not get "mail delivery failure" in return. I agree, a screen shot isn't too hard to create "after the fact" either. I also agree that a single mail doesn't qualify as "e...

Buckeye

This is interesting: https://nakedsecurity.sophos.com/2022/12/12/pwn2own-toronto-54-hacks-63-new-bugs-1-million-in-bounties/ Excerpt: The devices put forward by their vendors, and the prize money offered for successful hacks, looked like this: ---snip--- HACK A SOHO ROUTER.. AND WIN: TPLink AX1800 $...

Buckeye

I just searched for MikroTik security disclosure and did find this page. Responsible disclosure of discovered vulnerabilities And it has been there at least since 3-Dec-2022. You can verify this on the wayback machine https://web.archive.org/web/20221203224140/https://mikrotik.com/supportsec So it s...

Buckeye

Before suggesting fixes, you need to have a reasonable plan. Then the configuration should be much easier. What was the sequence you used to configure your router, and what guides/documentation did you use? I would suggest going back and rethinking your whole config, because it is far from "sta...

Buckeye

You added an interface (vlan21_guest), but have not added it to any list. When you say you can't get to the net, do you mean that ping 1.1.1.1 does not work? Or do you mean that ping one.one.one.one does not work? If these are windows host on the guest network, what does cmd command line show for ip...

Buckeye

There is nothing like Juniper commit confirmed (or vyatta commit-confirm) if that is what you are referring to (built in).

Here's an outline of a workaround by @rextended here with a possible implementation by @lukastribus here.

Buckeye

Hopefully, this is a wakeup call that MikroTik needs to have a relationship with the vulnerability testings organizations, so things like this don't end up in junk mail. I am sure when they received the "final" notice, it was something like this xkcd students cartoon, but it didn't have as...

Buckeye

If I do not remember bad the default on both v6 and v7 is accept-router-advertisements= yes-if-forwarding-disabled and forward=yes It seems that rextended has good memory, and so by default (at least on 7.8 ) you should not be vulnerable (based on @normis post ) because forward=yes Here is RB760iGS...

Buckeye

Thanks for update on SMB problems on Win 11. I would investigate why windows updates are not being applied, as there are many security patches since Jan. When was last update applied? I thought that Windows update were supposed to now be cumulative, but there have been reports of things being missed...

Buckeye

Saturday humor: Reading this thread reminded me of several xkcd comics. They are meant for humor value only. Many of the bugs fixed in version 7.9 have been introduced in the 7.8 beta. And many errors seem to occur randomly. xkcd: New Bug xkcd: Fixing Problems Not xkcd, but relevant: 99 little bugs ...

Buckeye

Try writing in Spanish, then translate it to English with an online translator. I can't understand the part about vlans and bonding. Is https://translate.google.com blocked in Cuba? If so, you can try using https://www.deepl.com/en/translator Translated with translate.google.com Intente escribir en ...

Buckeye

Having multiple ip addresses on your ether1 interface complicates things.

Do a google search for mikrotik nat masquerade when exit interface has mulitple addresses there are many threads, I didn't read them because I don't have multiple addresses on my router's WAN.

Buckeye

...This wasn't part of the examples I was following including in the documentation at https://help.mikrotik.com/docs/display/ROS/Bridging+and+Switching#BridgingandSwitching-BridgeVLANFiltering The examples are showing how to configure the L2 parts. Here's the example that does have the bridge inclu...

Buckeye

I see you already figured it out while I was creating this. But you may still find it useful if you want to understand why, instead of just finding something that works. You need to create "connections" from the switch ASIC to the CPU. My guess is that you currently have Layer 2 connectivi...

Buckeye

MB or Mb? MegaBytes/sec or Megabits/sec

There are many variables.

You may want to review this reddit thread What should throughput speed speed for 10gbe file transfer? Jeff Geerling second to last post.

Buckeye

So it seems now to be an issue between the printer and mikrotik and not the implementation itself?

Has the printer ever been able to obtain an IP address with dhcp from any dhcp server?

Buckeye

First thing I would try is click the "always broadcast" in the dhcp server. See this post for what I mean. Probably won't change anything, but it is easy to do and undo. If that makes no difference, then more troubleshooting/testing will be needed. If you connect the printer directly to a ...

Buckeye

What speed does the RB5009 set the serial connection of the adapter it is connected to? 115200? What about flow control? The MikroTik help isn't real clear about using two serial adapters back to back. So if you got two of the USB to RS232 cisco Rj45 cables, and a "RJ45 8P8C modular coupler wit...

Buckeye

I can't imagine the RB2011 couldn't handle this data-streams and the SG105E could. (there for in the old setup the RB2011 works fine) I want to use the RB2011 as a simple managed switch, so I don't have to throw them away. Why are you using the 100Mbps ports on the RB2011 instead of the 1Gbps ether...

Buckeye

The settings on this board won't allow you to detete your post if something follows it. At least to me, that is the way it appears to work.

Buckeye

That was my lab router, not the OPs. And there isn't anything connected to ether5 at the moment.
I was just showing the OP where the "Always Broadcast" was in newer versions of WinBox/ROS than the picture in the link to another thread I posted.

Buckeye

Here's the "universal" way, but won't be done in the switch chip on the RB2011 VLAN Example - Trunk and Access Ports How is the RB5009 connected to the RB2011? Is it connected to the same switch as the cameras? You wrote "I have multiply camera, three are connected through a RB2011 (s...

Buckeye

I will be surprised if this makes a difference, but you could try forcing the dhcp server to always use broadcasts. That's generally not the best, but in a small network you probably won't notice a difference. There are some devices that periodically poll to verify that devices are still there, and ...

Buckeye

Allan Style - SUBSILVER is gone too, and it was the only one that would display dates of quotes (at least I think that is why I used it). It also had a link via the tiny uparrow to the post that the quote was from. (I see prosilver has this, but not the date, or the post # of quotes). Allan Style -...

Buckeye

Almost like you want, you need to move the trunk to ether1 and add ether2 as an access port. And adjust the vlans to the vlans you want. You should be able to figure it out from that example.
VLAN Example 1 (Trunk and Access Ports)

Buckeye

You could try using the wireless repeater feature and then adding the ethernet ports to the bridge that got created.

See this thread Bridge an existing Wifi to LAN

Buckeye

I've got the following addresses (public IPs have been changed for privacy):

So you just use someone else's public IP? Why not use the IP addresses reserved for documentation and examples? See rfc5737.
TEST-NET-1 192.0.2.0/24
TEST-NET-2 198.51.100.0/24
TEST-NET-3 203.0.113.0/24

Buckeye

I also found this post, but I haven't figured out how it works yet.

How to allow two devices with same IP access internet

Buckeye

I am reasonably sure you will need a separate router between the RB2011 and each test device to provide NAT for each test device. Something like this post And you won't need a separate vlan for the connection from the RB2011 to the NAT routers, since the NAT routers will each have a unique address o...

Buckeye

People did not "used to" buy RB2011. They buy it today. A lot. L009 is similar, but better. At the same price. But you didn't really address why people are still buying it. As pointed out in the rest of the post you quoted. and as for drop in replacement this device isn't because it only ...

Buckeye

Can you explain what the purpose of the first rule in your firewall is? /ip firewall filter add action=passthrough chain=forward out-interface=ether3_WAN More importantly, it does not appear that you are using any stateful rules, i.e. rules for returning established and related traffic. Perhaps star...

Buckeye

Maybe related, maybe not. R720 DHCP client bug

Buckeye

In other words, if you plug a wired connection into one of the Ruckus switch ports, does that work correctly?
I haven't tried it as they are on the ceiling.

The Ruckus 10 port switch is on the ceiling?

Buckeye

use 7d for 7 days.

Buckeye

As mentioned, I extended the leases to 24 hours (would prefer never but can't find that option). I don't think this is really your problem, but you can make your leases longer than 23h59m. For example: [demo@RB760iGS-1] > /ip/dhcp-server/export # may/15/2023 18:01:30 by RouterOS 7.8 # software id =...

Buckeye

It seems all your problems are related to the wifi connections. Is that correct? In other words, if you plug a wired connection into one of the Ruckus switch ports, does that work correctly? Are the Ruckus WAPs new? i.e when you had the Google OnHub was that what was providing wifi before? Does your...

Buckeye

What made you ask that question?

What problem are you trying to solve?

Buckeye

I don't have a CSS106-5G-1S switch, but the manual has this Forwarding and you should be able to select mirror to on the port connected to your wireshark device and then you can monitor another port's ingress and egress traffic and it should be copied to the mirror port.

Buckeye

Which switch model? Different SwOS switches have different places to configure mirroring.

Here is how I set up my CSS106-5G-1S for a wireshark tap.

Buckeye

Since you only want a single fail-safe port to work from, there is no need for a second bridge. Just remove the port from the bridge-shared bridge. You can name interfaces, if you want to remove the need to refer to it as ether5. Here 's the easy way to do that. You can do a google search for remove...

Buckeye

The @sindy post: RouterOS bridge mysteries explained that @mkx linked is excellent. When I was learning the MikroTik vlan-filtering bridge, it was one of the most helpful resources for me to wrap my head around how to logically map what the bridge "entity" was, coming from EdgeRouter X vla...

Buckeye

on the access port, you need to define the vlan you want access to as pvid. (this is in the /interface bridge port stanza) for ether4 as an access port for vlan 10 /interface bridge port # Assigned bridges to ports add bridge=bridge_shared frame-types=admit-only-untagged-and-priority-tagged interfac...

Buckeye

Maintenance planned 0800-0900 EEST https://www.timeanddate.com/countdown/gaming?iso=20230513T08&p0=602&msg=Forum+maintenance&font=slab One day away. When should we stop posting? Will you first kick all users off, then do the backup and upgrade? And then backup before allowing users back...

Buckeye

I really just don't get what the real world use case is for the wireless version without it being dual band. I agree with you. Hopefully MikroTik had a good reason for making this config. @normis said that the RB2011 was still a best seller, so there are still places that cost is a primary factor. ...

Buckeye

Yes, like you say, we already have RB4011 and RB5009. This is at the other end of the line up (the LOW COST model in similar form factor). except this isn't that... it's more expensive than both the hAP AC2 and hAP AC3 which is what it really competes with in performance. @normis didn't claim it wa...

Buckeye

I have used Discourse quite a bit and I find the search a lot better than phpBB.

I agree, search on phpbb could be improved a lot. Try to search for "v7.10" or v7+10, you will still get matches on many things you don't want. Maybe I just don't understand how to make the search work.

Buckeye

If we had stored passwords in the clear, there would be no need to reset ;)

Good point.

Buckeye

Be careful when/if you migrate that you don't break links to other threads in the forum itself. HPE migraged their ITRC forums and didn't "fixup" the links to internal threads. That left many dead links, with no good way to know what post they were even originally pointing to. After that f...

Buckeye

No HW encription, There may be hope, the hap ax lite is getting hw assisted ipsec in v7.10beta *) ipsec - added hardware acceleration support for IPQ-5010 (hAP ax lite); That's not the same chip as the L009 has (IPQ-5018), but they are probably closely related due to the similar performance numbers...

Buckeye

(this time, use something randomly generated). Hopefully you are not storing passwords in the clear. Not that is would matter to me, I use a password manager, and set long random passwords, different for each site. What is odd is your statement "this time, use something randomly generated"...

Buckeye

- L009 series - the perfect RB2011 upgrade; First, thanks for getting the documentation links updated with block diagram, performance test, etc. Can someone be tasked with updating the Switch Chip Features Introduction documentation to include the 88E6190 switch ASIC? Maybe all that is required is ...

Buckeye

L009 is smart home switch with posibility to manage thorough 2,4Ghz nothing more. I would say it is a good competitor of the EdgeRouter 10x (which is a MediaTek MT7621 with an RTL8367 for the second set of 5 ethernet ports). Both have console ports, 512 MB RAM (but the ER-10X has 512 MB flash, not ...

Buckeye

I think the L009 is a perfect fit for homeowners that need more then the hex and not as much as the 5009, basically anyone with a 1 gig connection and with room to grow to a 2.5 gig connection. That's what my first impression was, until I looked at the CPU specs. A dual core 800Mhz Arm processor, w...

Buckeye

Until we see performance numbers, we won't really know how it compares to other models. The dual core 800Mhz is underwhelming, the console is nice, and the switch chip has enough ports to make vlan-filtering useful as a stand alone device. 2.5 Gb on the SFP won't be as useful for many users as a 2.5...

Buckeye

but even this a rusty nail, intended to show up on the north of your foot : )

I'm slow today. Can you explain what you meant by that?

Buckeye

Something as complex as RouterOS also means that there will be exceptions and hacks needed for any existing framework, so many, that modifying anything takes more time than to make our own I realize this is drifting away from WebFig, but this post by @Larsa and the following post by @pe1chl discuss...

Buckeye

A little too young to have used punch cards, but I have seen them used and for years I carried unused punch cards for writing notes because they fit perfectly in a shirt pocket (yes, right behind the pocket protector with pens in it)... If they fit in your shirt pocket, they were probably the 96 co...

Buckeye

I thought the main advantage was that it was a standard way to do it on ROS devices. It is configured the same independent of the hardware implementation. It isn't guaranteed to be hardware assisted, so there are some platforms that for maximum performance, you can't use the vlan-filtering bridge, b...

Buckeye

These days, I limit my "framework" to jQuery, and that only because my code is a third the size when I do it that way instead of programming straight to the wordy browser APIs. I am sure there are good reasons for not using a framework for WebFig, given it needs to run on tightly memory c...

Buckeye

Please answer these questions: Does this problem only affect wifi (UniFi) clients? If so, then you should take your problem to the UI community forum. If you use a wired connection to the switch, and tell your pc not to use wifi, and to obtain an ip address via dhcp, what ip does it get? If appears ...

Buckeye

Are you so brave to say that language on my avatar seems to be a bit unmaintained? :) :) :) My first intro to programming class was Fortran IV on an IBM SYS/3 (running single user mode) and using 80 column punch cards. Also had other classes in RPG II, Cobol and IBM SYS/3 assembler (none that I eve...

Buckeye

In my pc, which is by network cable, I put a static ip inside the DHCP and the printer works perfectly. What exactly did you do? What ip address did you set it to? If you let it get its address via dhcp it should get an address from 192.168.3.x, if you do that does it work? If if does not, post the...

Buckeye

You are going to need to provide more info than you have. Do you have wireshark installed on your laptop? If not, can you install it? What type of switch is the 48 port switch? Is it a managed switch with a span (cisco terminology) or mirror port ? That along with wireshark on your laptop connected ...

Buckeye

Started in Windows 7 if I recall. Still that way as far as I know on a fresh new install. Public vs Private vs Domain network does not matter - all three default to blocked for Ping. Stupid. One of several thing I change almost immediately on a new Windows install. I don't remember having to change...

Buckeye

Note that in current Windows installations, ping is blocked by default in the Windows firewall. I am not sure what "current" means, does that include Win 10 22H2? I think it may depend on whether you have the more restrictive "Public" profile (for use when connecting to untruste...

Buckeye

RouterOS is not made using any frameworks. Webfig is made from scratch / by hand That may have been the correct choice when it was written, but for new things going forward, for example in the hinted at MikroTik Devices Controller , I don't think it makes much sense. But it can lead to many later s...

Buckeye

Here is the relevant documentation: https://help.mikrotik.com/docs/display/ROS/Switch+Chip+Features#SwitchChipFeatures-PortMirroring I have never used this feature, I have a CSS106-5G-1S (RB260GS) with SwOS that I use as a network tap, and it is more flexible. Here's a youtube video (in Dutch?) Mikr...

Buckeye

Port mirroring is a switch ASIC feature, so I don't think you can mirror with an MT device without a switch. See Bridge-based port mirroring And mirroring is different than capturing. It is essentially a "tap" for another device that will capture the traffic (e.g. something running wiresha...

Buckeye

Why uselessly autoquote yourself? Not intentional. I edited the post, phpbb won't allow me to delete it once there is a following post. (That's another difference between phpbb and other forum software I use). Also on image 7679, 7374, and.... 4? Was that for me? Here is an example of when quoting ...

Buckeye

If you look at the CRS310-1G-5S-4S+IN block diagram everything should be done by the 98DX226S SoC with integrated CPU and line rate switch ASIC. That includes tagging/untagging on vlan 20. https://i.mt.lv/cdn/product_files/CRS310-1G-5S-4SIN_220936.png There is always the issue of compatibility betwe...

Buckeye

--- self quote removed to save space --- I really don't know exactly how this post got here. My guess is it was accidental. You may ask how could you accidentally make a post? That's a valid question. I post on this and the Ubiquiti forums frequently, and on Tom Lawrence's forum to a much lower ext...

Buckeye

You can use sniffer to capture only 7a7a ethertype (The sniffer uses name "MAC protocol") See Mikro Tip MikroTik packet sniffer basics at offset 01:33 You should be able to capture only 7a7a with this setting: Sniff 7a7a ethetype.png Then you should be able to see what mac addresses are in...

Buckeye

I just did a google search using Konica bizhub C226i netmask 255.255.252.0 as the search query. The documentation isn't as clear as it could be, but if I understand it, it seems that the first option, Synchronize IP Address assumes that the netmask is /24 or 255.255.255.0 and only allows access from...

Buckeye

If for some reason one or more are true — that is, you really do have to set a static IP, switch the VM to the 192.168.88.1/24 subnet, and/or use a direct copper connection to make the Windows method work — I'm tempted to say it isn't worth it relative to mine even for folk a-scairt o' the CLI. All...

Buckeye

It is easy to tell if other people can see your post. Just log out of the forum, and if you can see your post when you are not logged in, then other people can see it too. I don't have the equipment you have, so made no comment. But since you are wondering if your post was muted and want any feedbac...

Buckeye

I did try a dumb switch, and it did work, but that led me to the question, "Why?" I quickly tracked it down to the Trusted setting on bridge ports in my CRS328 Thanks for testing it and better, finding the root cause. Like you, I like to know why when things don't behave the way I expect ...

Buckeye

In your article it says: "The only trick that seems to matter is that you DO have to connect the Ethernet cable from the router straight into the host's copper Ethernet port. You can't put a switch between it and the router, not even a MikroTik brand switch." I am curious if you tried a no...

Buckeye

I have a printer with fixed IP 192.168.0.116 Subnet mask 255.255.252.0 and the gateway: 192.168.0.222. Are you 100% sure the netmask on the printer is /22 (255.255.252.0) and not /24 (255.255.255.0)? Because if it was /24, I can see why you would be seeing the symptoms you describe. If you ping the...

Buckeye

Here' another similar thread, with some links he used, but no real resolution that I saw.

AT&T FTTH, VLANs, CapsMAN Full Config

Buckeye

I have to agree with @djmuk, your post (and your other related threads Home network setup advice , VLANs and unmanaged switches ) is more like a Request for Proposal than something that can be easily answered on a forum. My suggestion is to use your "top floor" hAP ac2 as a lab router and ...

Buckeye

it doesn't matter, in the initial configuration script just put it to nand-only, as it should be done. You have obviously thought this through. I have never needed to deploy MikroTik routers, but it seems that router boot is pretty flexible in what it allows. I did a google search for "MiktroT...

Buckeye

Okay, after a little investigation, the help page has been updated: Thanks for fixing the docs. Incorrect documentation is worse than no documentation. Thanks for making the Mikro Tip about FlashFig and all your other Mikro Tips as well. (Edit: Just notice you posted a new one to address the issue ...

Buckeye

In Mass-config MikroTik with flashfig (what rextended linked above), Druvis shows using "system/routerboard/settings/set boot-device=flash-boot", perhaps because that leaves the router in a permanent "flashfig ready" state, and will probably generate fewer "support calls&quo...

Search found 930 matches