MikroTik

ashpri

I now 2 times experimented with containers and got them working just to see them stop working at the next hard reboot (i.e. power outage) of the router. First time was with PiHole and this second time I tried with Adguard home instead. When it happens, the container will start (status is "runn...

ashpri

asphri start your own thread if you want specific help on your config. I will cease and desist here as the thread is for the article........... Well I was responding to your: "In other words if one is forcing traffic to a WAN that is not available, how do you deal with that!" and hopefull...

ashpri

In any case the real fun begins in routing. How will you ensure that traffic from 2/0 or 2/1 and if three WANS 3/0, or 3/1 or 3/2 will be covered by the other WAN. I am following pcunite's recursive routing and so far when I disable WAN 1 and WAN 2 the failover seems to be reasonably seamless (exce...

ashpri

Bravo to pcunite for this post. I tried to follow the mikrotik wiki for dual wan in ros7 and they talk about virtual hops with no explanation. I have managed to intregrate PCC Load Balance in my ros7.10.2 setup using pcunite's as base. This is just the mangle. The routing section is the same. /ip fi...

ashpri

Problem solved. This page by pcunite "MultiWAN with RouterOS" https://forum.mikrotik.com/viewtopic.php?t=192736 solved my problems and is explained well. Load balancing is not there yet but this shouldn't be too difficult to track down. Unfortunately the mikrotik page was not clear at all ...

ashpri

I am reading this: Failover (WAN Backup) https://help.mikrotik.com/docs/pages/viewpage.action?pageId=26476608 ------------ There is something I don't understand. In the section "Adding Multiple Hosts" it says: KArlrfRH6Z.jpg What is this for exactly and what do I use in place of 10.10.10.1...

ashpri

In regards to the above topic, I use to be able to do this on ROS6 but it doesn't seem to work in ROS7.10.2 I've done the following: 1. WAN1 distance = 10, WAN2 distance = 12 2. Added out-WAN1 and out-WAN2 in Routing > Tables 3. When I copy my dynamically assigned route for WAN2 and change the routi...

ashpri

I've tried to group the export in its correct categories. I have some potentially odd rules in mangle and recursive routing but even if this is not correct, as far as I know it shouldn't impact pings from the router to client devices. Thanks ------ /interface ethernet set [ find default-name=ether1 ...

ashpri

Lately my organization's router is behaving oddly. I can't be sure if its the v6 to 7 upgrade or something else. I haven't tried backing up and completely restoring the settings since its in a remote location. I have a couple of VLANS. The problem is the router cannot ping ANY of the clients in the ...

ashpri

Problem with my HAPAC2 after 7.11 (ROS and RouterBOARD) from 7.9.2. HAPAC2 locks up every 15-30 mins consistently. Downgraded to 7.10.2.

ashpri

Another limitation of the wifiwave2 package is as a CAP, you cannot choose which which radio is to be managed by the CAPSMAN. I assume this will be fixed in a future ROS.

ashpri

I have a new hapax3. I am expecting good things but so far it has been a disappointment. I expect future ROS upgrades will make this better but currently my issues are: 1. If I uninstall wifiwave2 package, wireless adaptor no longer shows up in wireless. I can't remember the factory default behavior...

ashpri

FYI this is the relevant screen in fortigate to achieve the above.

ashpri

That logic would not work. Once you disable a route you can't check whether it is back to normal. Updated logic: 1. Ping 8.8.8.8 (recursive for ISP-1) 20 times 2. If packet loss = 0%, do nothing 3. Else If packet loss >= 20% and route to ISP-1 (find by comment) distance = 1, find route to ISP-1 (fin...

ashpri

Recursive failover has been working perfect for my connection with 2 ISPs. Last week my main ISP experienced intermittent issues. You could still ping but it was intermittent with latency spikes. I ended up having to disable (renumber) the route manually. How would I apply recursive failover by chec...

ashpri

Thank you for the various solutions. I am in the process of learning scripting so the script solution is a great start.

ashpri

Let's say I have the folllowing setup: /interface bridge vlan add bridge=bridge1 tagged=bridge1,wlan2.0,ether1,ether2,ether3,ether4,ether5 vlan-ids=3 add bridge=bridge1 tagged=wlan2.0,ether1,ether2,ether3,ether4,ether5 vlan-ids=20 add bridge=bridge1 tagged=wlan2.0 vlan-ids=25 add bridge=bridge1 tagg...

ashpri

This script is courtesy of user ukzerosniper from https://forum.mikrotik.com/viewtopic.php?p=951621 This script searches a route based on it's comment and sends an email based on status changes (UP / DOWN). In my case my office has 3 WAN routes. Because they are fail-over and load-balanced, if one I...

ashpri

Hi

i have two wan interfaces with load balancing method and i want to receive an email notification if i lost one of them or when downed link comes up again.
i dont know anything about scrip and schedule tools.

viewtopic.php?p=951621

ashpri

I hate to revive an old thread, but this script worked perfectly the first time and the poster deserves a kudos. Thank you! My condition: My office has 3 WAN routes. Because they are fail-over and load-balanced, if one ISP fails, internet access is not affected and nobody knows. So I needed a script...

ashpri

Referring to this MUM by Janis Megis https://mum.mikrotik.com/presentations/EU17/presentation_4058_1490948376.pdf, page 27 "Local IP leaking to public network". On page 31 for the solution it states: 1. Use action=src-nat instead of action=masquerade where it is possible 2. Drop connection...

ashpri

I plan to install a wireless backup link (using dual SXTsq5AC) from a farther switch in my site to a node closer to the root bridge (server room). My questions are: 1. Do I increase the RSTP port path cost of the switch going to the SXT, or on the wireless port of the SXT. Currently I have increased...

ashpri

I'm afraid the whole issue is merely a misleading error handling in Winbox. auth-method=eap can only be used in identities linked to initiator peers; on responder peers, you have to use auth-method=eap -radius and configure a RADIUS server for user authentication, which may be UserManager5 (availab...

ashpri

I am pretty sure this cannot be done in mikrotik (based on lack of results to my searches) but I am wondering if it is something the team will look into. Dynamic Port Configuration (DPC) provides the ability to assign port profiles (vlan, trunk/access port, etc) to client devices based on client ID ...

ashpri

My experience is that "peer does not exist and suggestion" will disappear once I close the ipsec window and reopen (provided there is no error window). ROS v6.48.6. ----- /ip ipsec mode-config add address-pool="VPN Pool" address-prefix-length=32 name=cfg1 split-include=0.0.0.0/0 ...

ashpri

Still unsuccessful, but a different error.

I've tried:
1. EAP Methods: MSCHAP2 and TLS.
2. Selecting a Remote Client Cert and none.
3. Remote ID Type: Ignore, KeyID (entered random string in RemoteID) & Auto
4. Creating a new peer (the attached image is a new peer).

-----

HzfGQOGKOC.jpg

ashpri

After endless hours tinkering I finally managed to get IKE2 working (in win10 and android 12) with certificate.

However when I tried EAP, I received this error:

Error.jpg

Anyone manage to get EAP authentication working with IKE2/IPSEC?

ashpri

I've seen this discussed somewhere in the forum (or a MUM) but I have not been able to track it down. I have successfully implemented WAN Load Balancing across 3 ISPs, with certain VLANs going out specific WANs and certain VLANs going out all 3 WANs. My next goal is to try a scenario where WAN2 will...

ashpri

RSTP is a complex and wide Topic not to say MSTP which is even more complex Similarly I am not an expert. But I find that researching and understanding RSTP is more difficult than implementing it once you understand the basic concept. The RouterOS hill was significantly more brutal vs RSTP. Once I ...

ashpri

checking MikroTik Bridge RSTP default configuration looks like it follow diameter of 20 pre-configured with max hops and max age set at 20, but it allows configuring up to 40 Crawling through some posts on the cisco forums seems to concur with 20 being acceptable in the field, depending on the sens...

ashpri

In my installation, from the server room to the farthest device there are around 8 switches. Due to expansion this may increase to around 10 switches. According to old cisco documentation (https://community.cisco.com/t5/switching/802-1d-spanning-tree-7-hops-limitation/td-p/763269), the recommended d...

ashpri

example:
Code: Select all
/interface bridge port
add bridge=brdge1 interface=ether1 path-cost=4
https://help.mikrotik.com/docs/display/ ... e+Protocol

Thank you, I know how to change it. My question is WHERE should the change be. The switch port to the SXT or the wlan port of the SXT.

ashpri

In the following topology, where do I change the path cost for RSTP?

zzz.jpg

Do I change the path cost on the switch side A & D, or on the SXT side B & C?

Thank you.

ashpri

The question I have is this: If your server rack and internet router is in the same room, then selecting the router or any of the switches in the main server room as the root bridge is easy. What if the server room and the internet router are in opposite locations in the site. Where should the root ...

ashpri

I've just had an aha! moment with STP that might help other beginners understand the concept. I've just made my core router a root bridge. I was concerned that CPU cycles would increase but it didn't, so I became curious what is exactly the purpose of a root bridge in a redundant network. Experts co...

ashpri

60ghz is indeed interesting.

For around 180mtr distances is the wAP-60G-AP / wAP-60G combination sufficient? It seems that this is on the maximum end of the stated distance.

ashpri

Thank you both. I am not familiar with the 60ghz. I will research it.

ashpri

Hi there, I am trying to create a wireless trunk between several buildings on my site. They have line of sight and the following chart summarises their relative location.

Are the equipment I am planning for correct? Is the 15s adequate or do I need the 19s. Thank you

Network 1.jpg

ashpri

You may also want to read Dischers explanation ( i prefer it over thomas, although both are master classes )
https://mum.mikrotik.com/presentations/US12/steve.pdf

I read both Tomas and Discher. I needed a dose of contraband to understand Discher.

ashpri

So I was looking at this presentation for load balancing https://mum.mikrotik.com/presentations/US12/tomas.pdf (It is an excellent presentation and highly recommended as a Load Balancing guide) 1. One aspect of load balancing is to make sure that when a connection is initiated through one of the ISP...

ashpri

So I MAC Telnet to a new device, created bridge1 (vlan filtering not enabled at this stage), added bridge vlans, entered other basic setup. On the very last step of the setup process, I entered: /interface bridge add name=bridge1 vlan-filtering=yes and received the error "failure: already have ...

ashpri

And add it for all local subnets that should be looked up only in main routing table. Is this the correct routing rules to allow inter-vlan routing to work with the mangle rule to route office vlan out wan2 active. Flags: X - disabled, I - inactive 0 src-address=172.16.0.0/12 dst-address=172.16.0.0...

ashpri

And add it for all local subnets that should be looked up only in main routing table. I will try this thank you. I don't have a good handle on mangle rules yet. If I changed the mangle chain (to route VL10-Office to WAN2) from prerouting to forward and added in-interface = VL10 and out-interface=WA...

ashpri

Huge thanks to anav for helping me to clean up my settings. I had questions regarding the duplication of address lists, and other questions, which you have answered. I have identified the reason why vlan routing does not work. I have a mangle rule to test routing internet traffic from Office VLAN to...

ashpri

Nice brain teaser. Aside from useless VL01 interface, I don't see anything clearly wrong. You have bridge with ether1-3, and on all ports you have untagged vlan 1, tagged vlans 3, 5, 10, 35, with I assume some managed switches connected and access ports configured on them. Everything should be usin...

ashpri

No suggestions?

Essentially I cannot get inter-vlan routing to work unless I enable "use ip firewall" and "use ip firewall for vlan". Since this is not recommended, I have left them disabled (and inter-vlan routing does not work). I cannot spot the error in my setup.

ashpri

### IP SETTINGS: I've left this at default, should I chg anything? ip-forward: yes send-redirects: yes accept-source-route: no accept-redirects: no secure-redirects: yes rp-filter: no tcp-syncookies: no max-neighbor-entries: 8192 arp-timeout: 30s icmp-rate-limit: 10 icmp-rate-mask: 0x1818 route-cac...

ashpri

If necessary, this is the complete setup: /interface bridge add fast-forward=no name=bridge1 vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] comment="LAN 1" set [ find default-name=ether2 ] comment="LAN 2" set [ find default-name=ether3 ] comment="LAN...

ashpri

Firstly thank you for your time. I perused this excellent post (and read each .rsc file) by pcunite but it does not seem to solve my issue https://forum.mikrotik.com/viewtopic.php?f=23&t=143620. I can't remember when it stopped working, because it used to work. I wonder if one of the recent firm...

ashpri

Sorry dont use powerbox, but RoS is RoS and the same so vlan1 is the default pvid and normally is never removed or changed for vlan filtering or bridge ports. The only time one defines a PVID on a bridge port (access port) is when that port is going to a dumb device. Typically no one uses vlan1 or ...

ashpri

So reading this older post https://forum.mikrotik.com/viewtopic.php?t=118086#p582957, it states "Native VLAN (Cisco VLAN1) is translated to Mikrotik VLAN ID 0". That's clear enough. Does that mean that Mikrotik's VLAN-on-the-Bridge implementation treats Native VLAN as 1 (as the pvid defaul...

ashpri

My network is running fine. However I have a question on the different treatment of default vlan id (0 or 1) across different products for switch chip VLAN implementation. On the HAPAC2, this is the setting: (I assume with the port default vlan empty, it defaults to 1) HAPAC2.jpg On the Powerbox, th...

ashpri

I didn't say there was no difference. In case A traffic from other VLANs will bleed through ether5 (broadcasts, multicasts and some unicast packets if switch won't know exact egress port for dst MAC address, ...). It goes against the gist of setting vlan-mode=secure ... Even more so if you don't se...

ashpri

This is a decent guide. https://www.youtube.com/watch?v=Rj9aPoyZOPo Thank you, I watched this. He uses option B. Case A (ether5 member of VLANs 1, 01 and 20) doesn't make much sense since ether5 port is set to untag everything on egress and can only tag untagged frames with single default-vlan-id o...

ashpri

Port 1-4 = Trunk Port Port 5 = Access Port (VL10) --------- /interface ethernet switch port set 0 vlan-mode=secure set 1 vlan-mode=secure set 2 vlan-mode=secure set 3 vlan-mode=secure set 4 default-vlan-id=10 vlan-header=always-strip vlan-mode=secure set 5 vlan-mode=secure Is A or B correct: (or are...

ashpri

add action=dst-nat chain=dstnat comment=DVR1 dst-port=67-68 in-interface=\ ether2 protocol=tcp src-port="" to-addresses=192.168.1.71 to-ports=67-68 add action=dst-nat chain=dstnat comment=DVR2 dst-port=70-72 in-interface=\ ether2 protocol=tcp to-addresses=192.168.1.72 to-ports=70-72 The f...

ashpri

@dave this is how I have my bridge setup including DHCP Server. /interface vlan add interface=bridge1 name="VL 201 Guest" vlan-id=201 add interface=bridge1 name="VL 202 Fam" vlan-id=202 add interface=bridge1 name="VL 203 Kids" vlan-id=203 add interface=bridge1 name=&quo...

ashpri

Do all untagged ports tag every packet in input or not?

In my testing, I believe it does. In the following bridge configuration, incoming packets into eth5 are tagged with vlan 999.

My trunk port in this case is PORT 1.

zz1.png

ashpri

Try to change to proxy-arp the LAN interface on the VPN server side.

This worked for me.

ashpri

I uses IP firewall for VLAN because was the only way to firewalling between different VLANs, I haven't found other methods. I use vlans in my bridge (use-ip-firewall-for-vlan is disabled) and these are the rules to prevent vlans from talking to each other. Allows first then a drop all at the bottom...

ashpri

I have a bridge with multiple vlans (vlan filtering enabled). I have firewall rules and queue tree setup for wan routed traffic (different vlans have different wan bandwidth limit and priorities). Question: 1. I have "use-ip-firewall" active on the bridge. Is this necessary or not? My feel...

ashpri

My hotspot constantly asks the user to login multiple times a day, even when mac-cookie (or http-cookie) is set to 7 days. I am thinking I can get around the the above issue by disabling mac/http-cookie and increasing idle time (or keepalive timeout) to 7 days. Is there anything I need to watch out ...

ashpri

Disclaimer: I am not an expert in this. Look here: https://www.wlanpros.com/mcs-index-charts/, at the 1 Spatial Stream (top) section. Why 1SS? Because the HapACLite has 1 antenna (tx/rx chain) in the 5ghz band. It seems like your channel width setting went from 80mhz (MCS7 325) to 20mhz wide (MCS8 8...

ashpri

Thank you for your reply. It seems to be hugely impractical to manually enter the admin-mac for each device in a large network. I must be missing something. How do other admins with a large number of mtik devices monitor their device up/down status reliably. ----- This is an example of my netwatch f...

ashpri

I have 20-30 Mikrotik devices in my network, APs and Switches. I use tool>netwatch to monitor their up/down status. The issue is on some (not all) of the devices, from time to time for what seems to be no reason at all, when the AP/Switch reboots, their bridge mac changes and therefore it would get ...

ashpri

If your infrastructure (switch, router) has your vlans already set up on the uplinks to the CAPs you only have to switch to "local-forwarding=yes" in your capsman configuration. The vlan<->port association is done by the CAP on the bridge that you assign in /interface wireless cap (2. que...

ashpri

Bump, no one?

ashpri

This is how I have my CAPs setup for "CAPSMAN forwarding" scenario. VLAN assignment per SSID is working well. /interface bridge add name=bridge1 /interface vlan add interface=bridge1 name=VL03 vlan-id=3 add interface=bridge1 name=VL05 vlan-id=5 add interface=bridge1 name=VL10 vlan-id=10 /i...

ashpri

I have the following settings on my Unifi APs which has served me well. A Unifi Mesh Pro was stable serving 260 users with this setting, with the default settings it would crash. zz1.png Is the following mikrotik rates similar to the above's 2G section? zz3.png I'm not sure what do to with the HT, V...

ashpri

I know exactly what's happening now. This is the issue:

zz3.png

If I have 200 CAPs, I have to add all 200 CAP Interfaces manually to the bridge? This doesn't seem like the normal Mikrotik way. I must be missing something.

ashpri

JACKPOT! With a manually created SSID (Virtual AP), the radius properly authenticates the user and places the user in the right vlan. The only issue is I had to ipconfig/release and /renew when switching between different users in different vlans. In production, this should not be an issue. As I sus...

ashpri

Thank you for your response Dorian. I will post that data soon. I am not sure this is even a radius issue. I am now testing with Tekradius LT as instructed here https://mum.mikrotik.com/presentations/CN16/presentation_3107_1461137144.pdf. I have bypassed DHCP and placed a static address 192.168.86.1...

ashpri

Might it have to do with the fact that the radius server is on vlan86 while the client (as instructed by freeradius) is to be on vlan60? The dhcp server is on the mikrotik router, as is capsman. The client is logging in from a cap. Might a firewall rule (or something) be blocking the dhcp offers fro...

ashpri

Reviving an old but relevant thread. I've followed everything in this thread as well as https://forum.mikrotik.com/viewtopic.php?t=51817, https://forum.mikrotik.com/viewtopic.php?t=140239, https://forum.mikrotik.com/viewtopic.php?f=7&t=109431, https://forum.mikrotik.com/viewtopic.php?t=124596, h...

ashpri

The setting seems basic enough. There are 2 settings below. The top is WPA2-EAP for radius assigned VLAN, with the DHCP issue. The bottom is WPA2-PSK, with no DHCP issue. Both serving the same vlan. ----- /caps-man configuration add datapath.bridge=bridge1 mode=ap datapath.vlan-mode=use-tag name=&qu...

ashpri

I've discovered the problem isn't freeradius at all.

The error is the client isn't getting proper dhcp lease in the vlan assigned by the radius server. What could I be missing.

zz4.jpg

ashpri

I have reviewed that post and others with similar topics before posting this thread. I did not find a solution, but I will go through that post again. I did a test with radlogin (radius test client) from another pc and this is the result: zz1.png Is that response acceptable? I am assuming it is the ...

ashpri

Goal: Have a single ssid authenticated by radius, with vlans assigned based on username/password. Succeeded: - I've managed to get FreeRADIUS working with my router. My AP is a HAPAC2 (as CAP). - Authentication with freeradius works great. Issue: I cannot get the radius server to assign vlan. I hav...

ashpri

Is this possible?

I've searched for some guides and most uses external radius servers.

Thank you

ashpri

Just relating my experience. I am using a HEX (RB750Gr3) purely as a vlan enabled switch in my production environment. I had a choice to use bridge vlan (no hardware offload) or switch chip vlan (hardware offload). I was concerned that using bridge vlan would max the cpu (and reduce performance). I ...

ashpri

This is how I set vlan on my bridge (minus the dhcp and firewall rules, to keep it simple): /interface bridge add name=bridge1 protocol-mode=none vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] comment="UPLINK - TRUNK" set [ find default-name=ether2 ] comment="...

ashpri

I can confirm that as of today, the HEX (RB750GR3) with v6.44.3 cannot yet implement vlan in switch chip (with hardware offloading).

I have a HAPAC2 with switch chip vlan enabled and the same settings does not work on the HEX.

ashpri

So, if a packet matches a rule early on in the mangle rules BUT................ will also need to be processed again by lets say 10 mangle rules later, then the first rule that packet is involved in MUST have passthrough=yes?? Noted and thanks. The ?? threw me off, thanks for clarifying they were r...

ashpri

Thank you. I've read and understood all that. The clarification I need is, and I should have been clearer on this, whether the PASSTHROUGH=NO in Packet Marking Rules 5-8 stops Packet Marking Rule 9 from processing. It shouldn't, since Packet Marking Rule 9 is based on a different connection mark tha...

ashpri

I have been following a guide in the forum as well as on youtube to setup Queue Tree QOS. Everything is working, I just don't quite understand passthrough completely. Aim: 1. To split overall bandwidth to: hotspot (higher priority and bandwidth) and office downloads (lower priority and bandwidth). 2...

ashpri

I had a HAPACLITE with this same issue. I had to do a netinstall. A note with netinstall, I had to disable all other ethernet interfaces on my PC (including eth interfaces for virtual machine software), except the one connected to the mtik.

ashpri

This is to accept CAP from the same board where runs CAPsMAN.

Ah, that's right. Thank you. Now I remember why I have this rule.

ashpri

Following some guide in the forum, I ended up with this firewall rule in the process of setting up CAPSMAN (my router is my capsman): /ip firewall filter add action=accept chain=input comment="IN - CAPSMAN Local" dst-address-list=\ "Loop Local" dst-port=5246,5247 protocol=udp src...

ashpri

I have this rule in my firewall (following a firewall guide): /ip firewall filter add action=accept chain=input comment="IN - Accept DNS Request" dst-port=53 in-interface-list=LAN protocol=tcp add action=accept chain=input comment="IN - Accept DNS Request" dst-port=53 in-interfac...

ashpri

So I put the Powerbox Pro (acting as switch) between a CCR1016-12G and a HAPAC2, and ran the bandwidth test again. Simultaneous TCP Tx/Rx yields roughly 320Mbps/320Mbps. HAPAC2 @ 100% CPU, CCR at 10% CPU. Test limited by HAPAC2 CPU. One way (CCR = test source) yields roughly 800Mbps (Rx) and 920Mbps...

ashpri

I put a PBPro as a switch in-between a HAPAC2 (source) and another PBPro (target). As you mentioned, the PBPro acting as a switch (middle) has low CPU @ 2%. However since the speed test target is another PBPro, its CPU (@ 100%) is limiting the result, whereas the HAPAC2's CPU hovers between 15-25%. ...

ashpri

This is a repost. I deleted my original post. I thought I made an error in the testing, but I did not. Throughput test between 2 Powerbox Pro routers used as a switch (I plan to use them as outdoor Gbit POE switches). Simple setup (no other config, zero firewall rules): /interface bridge add name=br...

ashpri

What is the FQDN for the mikrotik update server? I would like to make a walled garden bypass for my hotspot, so APs can update themselves without having to be bypassed.

I've added mikrotik.com and download.mikrotik.com. Is this enough?

Thanks.

ashpri

This is all I did for 2 ISP failover and it seems to work fine. Experts correct me if I am wrong. ISP1 is main, ISP2 is failover. They key is in the Distance set in /ip route. /interface ethernet set [ find default-name=ether1 ] comment="To Switch" set [ find default-name=ether2 ] comment=...

ashpri

You need a bridge with the VLANs on it. It doesn't have to be VLAN-aware, so it is possible to combine CAP with hardware switched ethernet ports. As the CAP is likely to have a single managment IP on one VLAN you don't need any firewall rules on the CAP as all the VLAN encapsulated traffic is passe...

ashpri

Are the following true, if local forwarding for caps is enabled? 1. In a wifi network with multiple vlans (internal vlan and guest hotspot vlan), each cap would need to have a vlan enabled bridge and inter-vlan drop rules set on the firewall. 2. For the guest hotspot vlan, I would need to set guest ...

ashpri

Why do you need multiple router boxes? I have one Mtik router in my office with multiple vlans. APs are mikrotik and unifi. Switches are mikrotik and unifi as well.

One vlan for office, one for guest. One cannot see the other once they are segregated via vlan with proper firewall rules.

ashpri

In addition, instead of PPTP which is old and supposedly insecure, I've managed to utilise SSTP via another acid-reflux-free guide:
http://www.dr0u.com/mikrotik-setup-sstp ... 10-client/

ashpri

I may be wrong but try enabling "Proxy-Arp" on the interface that the VLAN is attached to.

That did it! Thank you. No acid reflux after all.

ashpri

On my mikrotik router, I have VLAN3 reserved for network device mgmt. Address Pool: 172.16.2.50-172.16.3.254 Since Romon doesn't work in a unifi switch environment, I need to login into the vlan for network devices, to manage my mikrotik switches and APs in the office, remotely. My steps in creating...

ashpri

Configure as a "hybrid" port with VLAN98 untagged and the other VLANs tagged, see https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#VLAN_Example_2_.28Trunk_and_Hybrid_Ports.29 . Note this is only possible on gigabit switch chips (QCA8337, Atheros8327). Be aware that management fo...

ashpri

Thank you for the link. That seems to work in the lab, although I have not tested every permutation of possible real condition. This is that I did, as a guide for others. To summarise, what I am trying to do is use a HAPAC2 and POWERBOX-PRO as a VLAN enabled switch, using the speed of switch chip, b...

ashpri

I am using a HAPAC2 (Atheros 8327 switch chip) purely as a switch, in a VLAN environment. The reason I am using the switch chip, correct me if I am wrong, is my understanding that enabling vlans on the bridge will disable hardware offloading and will reduce the throughput of the HAPAC2 as a switch s...

ashpri

Is there something in log? It's not flash ("HDD") size, if it was, it wouldn't be possible to upgrade any of these new 16MB device. Upgrade on these uses RAM. I will check the log thanks. I didn't think to look there. I did a netinstall at the end. This was also frought with issues until ...

ashpri

My router cannot update from 6.43.4 to 6.44.3 I've done a check for update, the new firmware downloaded and the unit rebooted, it comes back to 6.43.4 after reboot (instead of updating to 6.44.3). I've reset the unit to no-default-config, including manually downloading the npk file and uploading it ...

ashpri

When it reaches the user limit, I can think of 3 possibilities:
(1) prevent new logins, or
(2) drop the oldest logged in, or
(3) drop the oldest and inactive logged in (unlikely but I would be pleasantly surprised if it behaves this way)

ashpri

ROS Level 4 License limits the hotspot active user to 200.

My organisation can have up to 300 active users, however at any time only less than 100 has active rx/tx traffic.

What is mikrotik's algorithm if you exceed the active user limit for the license level. Who gets dropped first.

ashpri

Thank you, I've fixed it. I forgot to add an address for the VLAN interface, which prompted the DHCP server error. I'm basically trying to merge an old hotspot network running on an old bridge, with a flat network, connected to ether3 on the router, to a vlan on a new bridge, connected to ether2 on ...

ashpri

Thank you for the follow up. ether1: WAN ether2: new LAN (vlan split between office and hotspot), bridge2 ether3: old hotspot lan (flat network), bridge1 I would like to merge the old hotspot lan running on ether3 to the new network on ether2. The new hotspot on ether2 has a different subnet than th...

ashpri

See the following image:

zz1.jpg

The DHCP server "VL98 DHCP" gives a redline error on start. No error message pops up in the log.
Could it be because it shares the same address pool as the DHCP Server called "dhcp1"?

ashpri

I will be testing site to site EOIP, however one side is behind a NAT and I can't get my isp to port forward to the mikrotik.

Is EOIP possible in this scenario?

ashpri

This is what I did on my HAPAC2 VLAN config using switch chip (not bridge). As I understand it, if I use vlans using bridge, I believe it disables hardware offloading to the switch chip, and therefore may reduce performance. I would like to use the HAPAC2 only as a switch therefore I set the vlan on...

ashpri

That means 3 replies are received per each request. 0 reply per each request = 100% loss 1 reply per each request = 0% loss 2 replies per each request = -100% loss 3 replies per each request = -200% loss I know the number like this does not make sense, however, there is no other way to summarize pa...

ashpri

Anyone? No one has ever had issues with not seeing devices in ROMON? Researching further, it seems to be related to this thread https://forum.mikrotik.com/viewtopic.php?t=99208 And this thread in the ub forums https://community.ubnt.com/t5/EdgeSwitch/ES-24-250W-and-Mikrotik-RoMON-failure/td-p/131397...

ashpri

I have 2 kinds of MTIK devices behind my main MTIK router. 1. MTIK device that is in the default VLAN, ROMON works. 2. MTIK device that is in VLAN 03, ROMON does not work. For device #2, mac-ping from TOOLS > ROMON results in timeout, but mac-ping from IP > NEIGHBORS works but shows a -200% packet l...

ashpri

I have this script to auto-update the ROS packages, then auto-update Routerboard FW and finally do a reboot. Based on https://www.youtube.com/watch?v=3zYBvRxp_lg and the wiki. ---------- /system scheduler add interval=1d name="Check for Update" on-event="/system package update\r\ \nch...

ashpri

We have both mikrotik and unifi APs in the organisation. We have been using unifi APs much longer. We've only been using capsman for a week or so. Simple observations: 1. If we need to mesh APs, we use unifi. Unifi can adopt an AP wirelessly and they will automatically mesh and provision. Configurin...

ashpri

I have several HAP-AC2 and CAP-AC around the house to repeat wifi signals. I am separating the radios. 2ghz is for user connections, 5ghz is for the inter-AP backbone. I am trying to understand why TX and RX rates differ for the same AP and how I can improve their connection rates. See the following...

ashpri

Use mode station-bridge for the client router. If you're running CAPsMAN on the main router, then you should go for station-pseudobridge as CAPsMAN unfortunately doesn't support the MikroTik-proprietary bridge extensions. -Chris I am using CAPSMAN on the main Router-A to provision its built-in 2G a...

ashpri

Hello all. I have a simple problem. I have looked at many guides. I must be missing something simple somewhere. From what I am reading, connecting a LAN device (in another room) to an existing network with wifi (all mikrotik), is as simple as activating the WLAN interface on STATION mode and connect...

ashpri

Is it possible to (1) initial-deploy and (2) manage the endpoint of a PTMP link (WAP AC 2 & WAP AC 3 in the following image) via CAPSMAN?

zz1.png

Thank you.

ashpri

I found the problem. If I disable "Use IP Firewall For VLAN", everything works as it should. Reading https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge, "use-ip-firewall-for-vlan" is described thus : Send bridged VLAN traffic to also be processed by IP/Firewall. This property...

ashpri

Hi guys, I have bridge1 with many vlans, one of which is the guest VLAN. I created a hotspot and tagged it to the guest VLAN interface. zz1.png When clients connect to SSID with VLAN99, they get the IP Address just fine, so I know the DHCP server works. When Hotspot is disabled, clients can access t...

ashpri

I am testing Mikrotik's hotspot feature. So far I foresee that all our organisation's needs are served by hotspot without having to use user-manager. The biggest advantage of user manager, that I can see, is splitting up mikrotik administration (winbox) and hotspot-user administration (web-browser),...

ashpri

If the device does not touch port 80 (http), then MAC login will not work. If opening a web browser for the device to connect is not an issue, then it is up to preference.

I see. Thank you.

What is Mikrotik's suggested best practice?

ashpri

Hypothetical case: I have 10 devices which need to access the internet without having to authenticate to the hotspot.

Should I set these 10 devices to login as MAC-based user or use ip-binding (bypass).

ashpri

So, I was having this problem for the last couple days.. Its true, that the UM works if you use the public interface address, however, mine was a DHCP client address, and would have been complicated to manage. TLDR; I needed an accept rule to make the 127.0.0.1 UM host work locally. /ip firewall fi...

ashpri

Following online guides, in mangle, I have: 1. Guest vlan download connection mark 2. Office vlan download connection mark 3. Upload connection mark for all vlans 4. After those connection marks, there are the corresponding packet marks. 5. Then more packet marks prioriting browsing, youtube, downlo...

ashpri

Hello Anyone else experience is this as well? I am, with Hap AC Lite on ROS 6.43.4. The router is connected to an office switch and a public area switch (both Unifi US-24-250W devices). The 5 APs are all Unifi. 1 Native mgmt vlan and 7 tagged vlans. I have tried: 1. Making sure admin mac is enabled...

ashpri

This is the mangle rule for those curious. https://i.imgur.com/3CA2E5X.png Observed oddities: Since I don't need the upload children in the Q-Tree, I disabled mangle rules AU2,3,4,5 (look in comments). When I do this, packet marks for youtube (HD3 & OD3) do not work (for both office and hotspot)...

ashpri

This is the goal https://i.imgur.com/wcmNLI8l.png Is this the correct Queue tree implementation to achieve the goal? https://i.imgur.com/5V16CsVl.png Questions, comments: 1. I've disabled the child items to upload, since uploads never reach the max limit of 100mbps, so a simple PCQ of all upload tra...

ashpri

Might be related. https://forum.mikrotik.com/viewtopic.php?f=3&t=106176 with possible solution https://forum.mikrotik.com/viewtopic.php?f=3&t=106176&start=50#p576065 https://forum.mikrotik.com/viewtopic.php?t=121875 with possible solution https://forum.mikrotik.com/viewtopic.php?t=121875...

ashpri

Thoughts:
1. If you used Mtik's prebuilt configuration, what mode did you pick.
2. The link to your ISP's router is plugged into ether1 (the wan port in your config) in your Mtik?

ashpri

I followed this youtube guide https://www.youtube.com/watch?v=3zJrNOUDNrc, and others, and resulted in this mangle rule: /ip firewall mangle "Connection marking and packet marking for overall downloads" add action=mark-connection chain=forward in-interface-list=WAN new-connection-mark=clie...

ashpri

I am new to Mtik as well. I will take a chance at helping you identify your issue.

If you go to Bridge > Port, click on each ether interface, and see whether hardware offload is checked.

2018-10-22 21_25_14-Window.png

Can you post your bridge port and interface list.

ashpri

Would the RB1100AHx4 be also sufficient for a 300mbps Uplink? If you go to its page, pick Test Results and you will see the throughput. https://mikrotik.com/product/rb1100ahx4#fndtn-testresults I've attached it here to ease your search. zz1.png I don't quite know how to translate this to my scenari...

ashpri

I suggest RB1100AHx4, almost same hardware than RB4011, redundant PSU and RouterOS license level 6. You are right. After upgrading ROS level 5 to 6 in the RB4011, it will cost more than the RB1100AHx4, and does not come with redundant PSU. I was going to order the RB4011 tomorrow, your advice is ti...

ashpri

I have a port forwarding rule set as per the left image. It works fine.

Is there a security risk in blanking the "Dst Address" field? The ip address of ether2-wan is currently static, I would like to make it dynamic.

zz3.png

ashpri

RB4011 for you! Thank you. My experience with Mtik is only a week. It looks like the winbox interface and ROS code is the same across all devices. The code sections (so far) that will be part of my deployment include interface, bridge, vlan, dhcp server, firewall, nat, mangle, queue trees. I am tes...

ashpri

1. If I remember correctly, on blank config all of this is allowed on all static interfaces, which is not very good for security. 2. But I strongly advise to have neighbour discovery and mac-winbox configured at least for one of the LAN ports - to have an emergency access to the router on L2 in cas...

ashpri

I am not aware of any "product" that will manage a large network of devices. I am thinking of publishing my system, but I haven't gotten around to developing a web interface for it yet. It currently runs/updates via the command line on the virtual machine that it resides on. In my limited...

ashpri

What is the significance of the following lines. It was there by default from ROS configured as dual-band home AP. /interface list member add interface="wlan1 - 2.4g" list=discover add interface="wlan2 - 5g" list=discover add interface=ether2 list=discover add interface=ether3 li...

ashpri

I've been reading that QOS and Firewall consume the most CPU. What about RAM? Source: viewtopic.php?f=2&t=93518&hilit=ram Just to add: 1. I foresee my firewall rules to be simple. 2. There will be no (or very little, less than 10) VPN connections inbound. 3. We are not running any servers in...

ashpri

I've searched the forum for choosing the right router but I am still unclear. My condition: 1. I am deploying for a hotel of 200 rooms. 2. 5-ethernet interfaces on the router is sufficient (2 WAN (Main and Redundant) & 1 LAN). 3. Internet bandwidth is 100mbps (75 for guests, 25 for office). Comm...

ashpri

all examples here work with ONE bridge? https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#VLAN_Example_.231_.28Trunk_and_Access_Ports.29 is there a simple "rule" when more than one bridge is neded? Correct me if I am wrong, you shouldn't ever need more than one bridge (when it comes ...

ashpri

What a great thread. I hope my revival of it is relevant. I am failing in trying to set the new way of vlan bridging. I have followed your guide and this https://wiki.mikrotik.com/wiki/Manual:CAPsMAN_with_VLANs (v6.41+ way of vlan bridging). The problem is this code. /ip dhcp-server add address-pool...

ashpri

1. everey bridge is a separated sub-net, an there is per default no communication possible between this sub-nets and the firewall makes the communication possible.. or is it the other way round the firewall blocks the communication (with "drop all" or somthing similar?) 2. "bridge vl...

ashpri

I don't know if this helps you. I am new to mikrotik. I got 5 vlans (me (yes I deserve my own vlan), family, kids, office, guest) working over a root ap (hap-ac2) running capsman and one cap (cap-ac). I followed this guide (https://www.youtube.com/watch?v=1ZJ-pM89N7o) to set up vlans and dhcp server...

ashpri

Seems that in the provision for cap AC “Client to client forwarding” is set to “no”.

Problem solved. When I first received my Mikrotik I feel like I married a router with a thousand check-boxes and dropdown-lists. I knew one of those would make her happy, I just don't know which one. Thanks

ashpri

This is what I'm getting in my cap-ac. A able to ping B (and vice versa) A able to ping C (and vice versa) A, B & C able to ping HAP-AC2 and CAP-AC B cannot ping C (and vice versa). The message is "destination host unreachable" 2018-10-16 21_39_07-Book1 - Excel.png If A, B & C are ...

ashpri

I've been wondering this since I learned about capsman in mikrotik (my mikrotik experience has only been 2 days). Gateway/1st AP/capsman = hap-ac2 Repeater/cap = cap-ac I setup the cap-ac 5ghz-wlan in station mode (as a client of the hap-ac2) as the backbone link. Gave the 5ghz-wlan interface 88.2 a...

ashpri

Not in repeater mode, that works only for one SSID. You could trunk the traffic together over the Wifi link with VLAN and then separate on the repeater into the subnets with their SSID. It will then look as if the SSID are "repeated". It is basically two AP with each having same SSID and ...

ashpri

Bridges involved?

Here is my bridge and port. Physical ports on the hap ac2 (eth1-5) are on default setting (on default lan 88.x). ether1 is WAN.

Thank you

ashpri

I have multiple ssids setup on my 2.4ghz radio (guest, family, kids, office), each with its own subnet and in its own vlan. I've successfully setup the repeater using the "setup repeater" button on the 2nd AP, however I can only repeat a single ssid, and whichever ssid I choose does not ge...

ashpri

This is my first day with Mikrotik (hap ac2). So I followed this guide (https://www.youtube.com/watch?v=1ZJ-pM89N7o) and created several wifi VLANS (SSIDs: Family, Kids, Guest, Office, Staff). Each SSID has their own separate 192.168. address and dhcp server. Each VLAN only has 1 subnet. I want isol...

Search found 155 matches