MikroTik

bpwl

Unfortunatly .... didn't work as expected. Both DHCP servers assign conflicting IP addresses from the identical pool (same IP address to different devices) . One of the DHCP servers is authoritative the other even never. Didn't help. Wifi devices are often off-line. When both are on-line conflict ca...

bpwl

... gives me problems, as the used IP address to answer an access request is not defined, seems not to be controllable, and flaps from time to time (e.g. when something is done and un-done to IP addresses, like adding or removing a VRRP). If the User Manager then answers with a different IP address ...

bpwl

Wow ... a bit old those 54Mbps , this is for 802.11G , single stream. See: https://mcsindex.com/ 1. Mostly we get dual stream (=2S) see it in the registration table. Like 144Mbps interface (*) rate, for 2 spatial streams, with only 20MHz bandwidth and short-guard interval 2. After G (g) comes N (n :...

bpwl

Thx a lot @mkx. Was thinking to do the same, based on VRRP interface. But indeed, why depend on VRRP? Actually never saw a problem with a DHCP server that did not store the leases on disk. Clients came back with the same IP address in the leases, after reboot of the DHCP server. Have seen scripts to...

bpwl

Aha MKX, I was hoping you would react. In my case I have only 2 DHCP servers on a subnet (VLAN) , and one of the devices was flapping between the 2 DHCP servers. The DHCP servers are full split scope, but if they respond alternatingly the client gets a lot of NAK , and disconnects from the wifi. (Do...

bpwl

Hi, have the same with at least one wifi connected device. Devices are BYOD, so I have no client device information or access to its settings. The setup is with 2 hAP ax3 with ROS 7.12 , with each having a DHCP server per VLAN serving the same subnets, but with non-overlapping address pools. (split ...

bpwl

when you have virtual wireless interface and wireless security does not match main wireless interface's security,; this bug occurs. hope this wireless driver bug can be fixed. thanks! best regards & wishes. Not my experience. I do have many times a RADIUS controlled (EAP secured) wifi interface...

bpwl

Using multiple devices with the same IP address ... many exemples here in this forum. This is just one of these : https://forum.mikrotik.com/viewtopic.php?t=119134 General idea is to give each device a unique IP address so you can differentiate [and route] them in your network , and then DST-NAT to ...

bpwl

I don't think 1500 as MTU for EoIP is a good idea here. EoIP is 42 bytes overhead already. https://forum.mikrotik.com/viewtopic.php?t=124812#p614891 The IPSEC overhead looks more complex than a simple number of bytes. It seems to be encryption protocol dependent also: https://packetpushers.net/ipsec...

bpwl

Interesting story, difficult setup choosen. Just some thoughts on wifi principles with directional antenna with high gain. 1. The transmit power in 5 GHz will be limited by the country/region regulation. That is the limit is for "radio power + antenna gain (19 dBi)", so the radio power wil...

bpwl

Routes to direct connected networks (the whole subnet of the assigned IP address of the interface) have a distance of 0, because they are just there at no distance, local to the interface. Dynamic, because that route is not defined in the config, but added because of the local IP address? Should als...

bpwl

Well, I did upgrade to the latest version 6.49.10 and with the rest of the story ... I seems like something went wrong with the upgrade of that device. Only option I see is doing a Netinstall then, as you do not get in that device at all (anymore) Some of the newer RouterOS versions are just too bi...

bpwl

WinBox does not need a valid IP configuration to function. Maybe this helps. Otherwise IP configuration should work after a configuration reset, if the default configuration is loaded. https://wiki.mikrotik.com/wiki/Manual:Reset Reset config by button press till LED starts flashing only, do not go t...

bpwl

1. Do NOT use ethernet port 1 for your PC, with the default config in the router. This is the default WAN port, and blocks everything incoming. 2. On the other ethernet ports and wifi you should get the proper IP address, and the default gateway should be set (check your PC network interface charact...

bpwl

However from the WLAN I cannot see neither my PC IP address (192.168.1.60) nor the IP address of the bridge (192.168.1.200) I understand the non-MT wifi is the AP. The CAP Lite is a station, connected via wifi to the AP 1. It looks like your non-MT WLAN is not allowing inter-client communication (l...

bpwl

Tried to use Openwrt in transparant bridge mode, relayd did not solve it, but even kmod_trelay, or other _mod_available at that time, did not work. I had the same DHCP problems as with station-pseudobridge in MT setup. DHCP lease stayed in "offered". https://openwrt.org/docs/guide-user/net...

bpwl

Do you see the SSID "default" (which appears to be your name for it Default is the name of the security profile, not the network name to look for. The network name is the SSID. SSID at this location, as told already: The wireless SSID is under Wireless - Wireless interfaces - WLAN1 interf...

bpwl

No password, or blanc/empty password. Leave it blanc in ROKU box as well. Only if ROKU box does not accept this , set a password in the router (WPA2 Preshared key field) with dynamic keys mode. Mode=none has no password or just an empty password. Should have worked with the ROKU box and empty passwo...

bpwl

Open that default security profile. Don't hide the passwords. (In Webfig the "Hide password" button is in the left column) You will see the Preshared keys. (wifi password) Here only WPA2 is enabled in my case. Your case, no password is set yet (mode=none) this is open wifi, no password req...

bpwl

Well, I did upgrade to the latest version 6.49.10 So you have the admin password of the MT router. You needed it for the upgrade! That's not what the ROKU needs (just learning what a "ROKU box" is, I'm not 77 yet, still plenty to learn) The ROKU wants internet access via wifi, so needs SS...

bpwl

Of course, but nobody would design for free on a forum.

But most will help for sure. What else are we doing here?

bpwl

https://www.techtarget.com/searchnetworking/definition/east-west-traffic If we do not know/understand your case, some imagination gets triggered here. It's getting wild. - east-west traffic control... really in scope? - collapsed core design ... really in scope ? Did all this in a multinational comp...

bpwl

If the WAN router can manage the 4 LAN's (DHCP per subnet, NAT to WAN, interLAN FW rules, ... etc). Then the 3 LR would just bridge the network. Actually acting as a switch Bridged connections bypass FW (NAT and filter) by default in MT. ISP internet router is often very limited or you get limited c...

bpwl

Thx @MKX for this clarifying information. With all the posts on the internet forums like https://superuser.com/questions/870450/can-802-1q-vlan-packets-be-passed-through-wi-fi-transparently , even here, "wifi interfaces are never tagged", started to worry, even as my MT experience was that...

bpwl

Maybe getting far off topic , as maybe nothing changed in ROS 7.12rc, or the change is between ROS6 and ROS7. But I do distribute multiple VLAN over MT legacy WLAN interfaces, eg. via CUBE-CUBE, SXTsa5 and SXTsq, and further downstream between hAP ac2 and other small MT AP, which are used as wifi-et...

bpwl

It's changing over time. At first "AP-bridge - station-bridge" was with the WLAN classic driver only, not with wifiwave2. Actually the "bridge" function (4-address mode) was triggered when the station asked for the bridge function via mode "station-bridge". (See AP wifi...

bpwl

I don't really get all this tagged/untagged discussion. The 802.11 frame header has no place for a VLAN ID, so, technically, wifi interfaces are never tagged. Well 802.11 standard frame has no space for a VLAN tag, and only has space for 3 MAC addresses. But MT with WLAN driver "AP bridge"...

bpwl

Just routing.
Devices probably have this router as default gateway, so they will seek other subnets via 192.168.88.1
All interfaces are routable if forwarding is not dropped by the firewall.

bpwl

Answer: Why doesn't it allow me to change the country on the 5g wifi. Always go to Canada2 I have seen this before, some users will paint themselves in a corner. And I warned Mikrotik they had created a trap, by removing "antenna gain" correction factor from the WinBox GUI interface. This...

bpwl

"Canada2" ... indeed only when you need something very special there ... [admin@hAPac3] > interface wireless info country-info country: canada2 ranges: 2402-2472/b,g,gn20,gn40(30dBm) 5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)/indoor 5170-5250/a,an20,an40,ac20,ac40,ac80,ac160...

bpwl

Interesting, and somewhat as expected. Can be calculated: https://forum.mikrotik.com/viewtopic.php?f=7&t=165698#p912622 Except for the "auto" setting, which is undefined, you should check what you get, as different frequencies will give different power and throughput. MT ROS is not AI ...

bpwl

Aha, thanks @MKX.

From my house , with ROS Tools/traceroute towards 192.229.221.95, ... with protocol ICMP set shows single response (12), protocol UDP set shows the double response (12-13)

bpwl

It probably is the same machine that answered. The 10th line needed 10 hops before the TTL was reduced to zero (and that router reported the end of travel because TTL was used up) The 11th line (Traceroute with TTL=11) ended after 11 hops of the packet. That path was 1 hop longer. IP routes can be d...

bpwl

Think of how traceroute works. Next attempt will be with a TTL which is one higher. It could/will be the same answer again. The local traceroute should have seen it was already there with TTL=10. The path for TTL=11 could be one longer than the previous one (routes vary over time, as next hops can d...

bpwl

showing a "hidden network" in spectrum software "hidden network" or only visible in "freq usage"? Only in "freq usage" or in some radio spectrum tool, and not in scan or "Snooper", then is is not a 802.11 wifi signal or MT nstreme or nv2, but some o...

bpwl

Ok so how do I begin to narrow down the issue? I do not want to end up the same with the ax3. Normally you will not end up the same ... WLAN driver in Mikrotik is like a manual gearbox in a car, wifiwave2 and other brands are like automatic gearboxes. Optimal setting in most cases, Less control, bu...

bpwl

440Mbps is very very good for WLAN driver in hAP ac2. But further away, 180Mbps is very normal. But then again the rate will lower with distance, signal quality, interference etc. 15Mbps only, something is very bad around there, or the wireless is set up for 20MHz channel width, with a single stream...

bpwl

https://help.mikrotik.com/docs/display/ROS/WifiWave2 Wifiwave2 is only available on some devices. The AX devices and ... Due to storage, RAM, and architecture requirements, only the following products can replace their bundled wireless software package with wifiwave2: hAP ac³ (non-LTE) Audience and ...

bpwl

I know that, SSID is independent, but something in this config is not OK. Maybe used backup/restore between the 2 devices to copy the config, while one had wifiwave2 active, and the other not, instead of export/import? Who knows? Would "reset configuration" , as in a wifi interface correct...

bpwl

This config with "interface=*1" cannot work. Wrong config settings. Interface for bridge port is missing.

bpwl

Hmmmm WLAN1 and WLAN2 connected (port) to the bridge, but not available anymore as wifiwave2 is loaded, and wifi1 or wifi2 are not port to the bridge DHCP will not work then, clients will disconnect. As long as WLAN1 and WLAN2 are connected to the bridge ... only legacy wifi will work. Remove those...

bpwl

"add frequency=5180,5260,5500 name=ch-5g width=20/40/80mhz" and no country set will default to FCC region. But should not be a problem if the regualted frequencies are correct in ROS. Check with "interface/wifiwave2/radio/print detail" ? As in https://help.mikrotik.com/docs/displ...

bpwl

Ping ... is bidirectional transmission. The answer must find it's way back also. And that reverse path may be a problem here. Other setup is using the Mikrotik as regular client for the ISP router (including Home gateway setup with NAT (srcnat or masquerade to WAN/WLAN) and firewall, and DHCP server...

bpwl

Mikrotik HELP has been updated, and now with access, trunk and hybrid interface exemples

https://help.mikrotik.com/docs/display/ ... NFiltering

bpwl

Logical: auto negotiation may fail to allocated 1000Mbps at certain times. Loose wiring, oxydised contacts? 1000Mbps needs all wires to be OK, 100Mbps needs only 4. https://hardwaresecrets.com/how-gigabit-ethernet-works/ "Ethernet Cat 5/6 cables have eight wires (four pairs), but under 10BaseT ...

bpwl

If the other router is also a Mikrotik, don't use pseudobridge, but use "AP bridge" on one and "station bridge" on the other. Add WLAN and ethernet for the printer to the RouterOS bridge. The networks will now be fully bridged. 1.Pseudo bridge has known problems with DHCP - stays...

bpwl

winbox shows me an empty configuration Happend to me when I had a (very) slow connection. (Did set the wifi TX rate to 30Kbps by accident in a test setup, and had that problem.) Looks like WinBox is showing the config windows immediatly, and then has to wait for the content to show. (With 30Kbps it...

bpwl

Sure Wireguard is Ok.
And some ROS 7 test versions (not the RC) have BTH enabled in IP/Cloud. Back To Home is an very easy setup for a Wireguard tunnel.

bpwl

But my ISP blocks all access In that case how can you setup a PPTP VPN tunnel towards the Mikrotik router? Anyway every Mikrotik router has a potential public DDNS entry as <serialnumber>.sn.mynetname.net. See under IP/Cloud menu, and enable DDNS. For other DDNS options check with e.g."dyndns....

bpwl

Not sure if this is 100% correct, but the way I see this .... 1. VLAN interface, is an interface in RouterOS , traffic can be handled (eg. routed) at RouterOS L3. The VLAN interface does tag VLAN ingress and untag VLAN egress traffic. A VLAN interface can be defined on the bridge or other master int...

bpwl

Indeed in LOG and in Status page. The WLAN driver then also has state= "detecting radar" , not "running AP". Increased CAC time in the band 5600-5650MHz from 60s to 10 minutes. Be aware of the C and e frequencies! "Skip DFS channels= 10min CAC" if auto freq is used. If ...

bpwl

EDIT: content deleted. Was off-topic. Not UK specific.

bpwl

ax device ... so it is wifiwave2 The "AP bridge" setting is for the legacy WLAN driver. Ax can not use the legacy (WLAN) driver. But with latest ROS7 the "AP" in wifiwave2 is some equivalent to "AP bridge" of the legacy driver. 'Some' equivalent, as they are not the sam...

bpwl

Using default firewall? Make sure the standard "allow DSTNAT" is active add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN # and then have something like /ip firewall nat add acti...

bpwl

I don't understand the network setup, too many possibilities here. "The router" is used too many times, which router is connected to what router, and which one is connected to the ISP? ISP then Schneider then Mikrotik , with PPP VPN in Mikrotik ???? 192.168.88.254 suggests other way around.

bpwl

So what are the best practices in terms of storing logs, rotating them, etc, so that the setup is stable and doesn't fill up the local disk?

LOG to disk storage (or USB stick) can be limited by design, just like using a circular buffer.
.

Klembord-2.jpg

.

Klembord-3.jpg

bpwl

Simple rule: an ethernet interface that is a port on a bridge is reduced to a "slave interface" only. E.G. : It can not have DHCP server defined on it. DHCP client, IP address, and other things should be defined on the bridge. Those are not forbidden on the ethernet interface but not recom...

bpwl

a way to combine VLAN 13 and untagged traffic on a bridged physical interface where I have my AP connected. Is it possible to switch the untagged traffic on L2 and route all VLAN13 traffic while these are on the same interface? Can someone explain this straight-forward setup to me? Well trying to c...

bpwl

Hidden feature, that micro-USB port can also be used to provide power to another device.

Just power, or is it USB OTG (USB controller) ?

bpwl

European version is discontinued, and no direct link on the MT harware pages: https://mikrotik.com/product/pwr_line_eu Used in combination with mAP Lite, mAP, hAP lite, hAP lite TC, and the other end of the powerline can also be combined device Mikrotik PL6411-2nD (again only US version on MT site) ...

bpwl

Indeed depends. No experience with large numbers with wifiwave2 driver. But on WLAN driver (not possible on ax3) 30 active clients is no problem. The theoretical limit there is 2007 connected. Many devices are just connected (like smartphones, tablets, smartwatches, Iot devices) without actually tra...

bpwl

Timing or power(up) problem with the 4 TB hdd?
What happens after "System/Routerboard/ usb power-reset" ?

bpwl

Has no one encountered this?

Yes have seen that after using multiple USB drives.
They can be removed via System/Disks, and will not re-appear in Files after reboot.
At least this is possible in ROS 7 (may not be the case in ROS6)

bpwl

If you want a readable and usable copy in a file to download ... use "export" command with a filename in the terminal.

bpwl

Maybe first make clear what you want. Is it one network 192.168.0.0/24 for both he MAP1 and te MAP2? Or is the desired network with 2 networks 192.168.88.0/24 for MAP1 and 192.168.20.0/24 for MAP2. I assume the first case is wanted. All clients are member of one subnet 192.168.0.0/24, the subnet of ...

bpwl

But now MACVLAN may be helpfull. https://help.mikrotik.com/docs/display/ROS/MACVLAN

MACVLAN is very new ... ROS 7.12rc1 ... 2023-Oct-05

bpwl

Just to add another question will VRRP work on VLAN interfaces

Yes.
But I have seen exemples in this forum with VRRP on VLAN, viewtopic.php?p=1001060 but also VLAN's on VRRP.
The later probably to make all VLAN fail over at the same time ???? Lost the link to that one.

bpwl

And I don't know how to tell the MT to get two IP addresses from one single cable going from ISP This was difficult, as you need 2 MAC addresses for the ISP. Playing with VRRP was a trick to get a second MAC address on an interface. (Or use 2 ethernet interfaces, as MT suggests) But now MACVLAN may...

bpwl

As you know: Syntax allows for multiple ports and multiple VLAN ids like: add bridge=bridge tagged=bridge untagged=ether2,ether3,ether4 vlan-ids=10 add bridge=bridge1 tagged=ether1 untagged=ether2,ether3 vlan-ids=20,30 'export' will resemble input (but may be different order) print has it's own form...

bpwl

Not familiar with ONVIF .... just started reading ... https://www.pelco.com/blog/onvif-guide . Does this assign or force for IP addresses??? aagh yes ... page 12 ... https://files.pelco.com/camera-configuration-tool-user-guide-en_2023-06-01-154703_wxvp.pdf DHCP is automatically disabled for the came...

bpwl

Well, good description of the setup, but still very difficult to know (guess) what is happening. Just some thoughts. - static IP addresses (leases) in DHCP do not work if that client device, or another device in the network, already has that IP address (My usual mistake, give a device some fixed IP ...

bpwl

I have a question, the bridge protocol mode should be set to none on both ac's ? Or on the 2nd one only ? Don't know if this is any good as advice, but in such very simple networks I tend to disable the STP protocol (set to "none"), as I don't see the need for loop protection, and STP pro...

bpwl

Didn't see a potential cause.
Maybe also check this: viewtopic.php?t=86880
Fast-path? Switch?

And minor unrelated detail : private-subnet 192.168.0.0/24
Should be 192.168.0.0/16 AFAIK.
https://en.wikipedia.org/wiki/Reserved_ ... esses#IPv4

bpwl

no any queue setting But there are default interface queue's active. TAB "Interface Queues" under Queues in MT Help: All RouterBOARDS have default queue type "only-hardware-queue" with "kind=none". "only-hardware-queue" leaves interface with only hardware tra...

bpwl

no any queue setting But there are default interface queue's active. TAB "Interface Queues" under Queues in MT Help: All RouterBOARDS have default queue type "only-hardware-queue" with "kind=none". "only-hardware-queue" leaves interface with only hardware tra...

bpwl

Yes it is very flexible , because it is a combination of many things (switch, router, NATing gateway, Firewall, VPN, etc etc) And RouterOS lets one just combine things to create some complex setup. For younger network people this can be very confusing to still see the things as independent OSI layer...

bpwl

- ethernet connections loose packets (bad checksum, collision, etc) - routers drop packets if queue gets full - TCP uses missing packets for congestion control (different algoritms possible: Reno, cubic, compound, ...) - TCP will ask for retransmit of missing packet - some queue's drop packets (e.g....

bpwl

You do not need VLAN bridge if the VLAN are only routed. Create VLAN interfaces for every VLAN (they may exist on one (ethernet) interface without a bridge). The same VLANid on different interfaces are separate/independent VLANs (If the ethernet interface is a port on a bridge, the VLAN must be defi...

bpwl

In the case where the "1st ac2 - 2nd ac2" link is not always up and running (e.g. DFS wait time, false radar detect, unstable link) , then clients should not connect to the 2.4GHz of the 2nd ac2 for Internet access. To manage this, one could use tool/netwatch in the 2nd ac2 , and alter the...

bpwl

Yes, would have a look at it. Not sure if it is seen there. Could be some running state thing (RSTP, DHCP lease, identical (copied) MAC addresses, bridge port status, learning not on auto, loop (false) detected ... .) When I wait a while (more then 30 seconds I guess) or I manually reconnect all wor...

bpwl

This looks like a correct setup. Very surprised the initial connection via 2nd ac2 does not work. As this is just one network as one L2 broadcast domain. The 1st hAP ac2 is the gateway to Internet, and is the DHCP server and probably the DNS server. The 4 WLAN interfaces are just bridged together. T...

bpwl

Don't set VLAN on Bridge :D That was just my simple start case ... work as a "dump switch". A "dump switch" is unaware of VLAN, and just passes them along. Of course once you master the VLAN settings as a VLAN aware bridge, it is very good to use it. You can better control the f...

bpwl

"bridge" - "station bridge" The word Bridge is used so often in RouterOS, it is very confusing. In the router acting as AP the wifi should be in mode "AP bridge". If wifi is set in mode "Bridge", it will only accept 1 (one) client device. This is used in Rout...

bpwl

If you used simple or interface queues, you will see lots of packet drops and retransmits, which are usual for TCP to tell server/CPE to lower the rate. TCP congestion avoidance [Reno, new Reno, Cubic, Compound, ...) and queue rates, and Access List TX/RX rates, are not, and are not related to wifi...

bpwl

Be aware of the min and max limits on the number and type of characters in SSID and PSK passwords. These min/max limits and types are more restrictive with Mikrotik than with other brands. Stick to the brands limitations. Happens everywhere: Use a password with a "+" at the end of the pass...

bpwl

On wireless; "indoor" means 150 feet (46 meters) while outdoor means 300 feet. then you set "any" in "Installation". I see indoor/outdoor/any under 'installation'. Then there is indoors/dynamic for the 'Advanced Distance' AFAIK and experienced, the installation "a...

bpwl

Confusing all the time. You have a Mikrotik Chateau (RBD53G-5HacD2HnD-TC&EG12-EA), which by the way is a Mikrotik and a Wireless AP (with also LTE connection) Then you speak about a Wireless AP (another? name it or number it), and about a Mikrotik (which one, the Chateau is a Mikrotik, the Wirel...

bpwl

50 hops ... that's far away. Might hit the 1000ms time-out setting.
Also happens when there is a loop somewhere ... even my 28 was already a very very long path

bpwl

Ahem .... Traceroute in Winbox, is actually Traceroute of the RouterOS with start and output in WinBox. Could also be started from "Terminal", or Webfig And it seems that the RouterOS by default gives up early. After 5 timeouts? Or limit number of Hops? https://forum.mikrotik.com/viewtopic...

bpwl

Too easy to find instructions. 1. Fill in the wireless interface WLANx in Wireless, TAB "Wireless". Mode is "AP bridge" fill in (same or different SSID but same security profile as the WLAN that is already operational) Frequency mode and Country the same as the other wireless int...

bpwl

see https://forum.mikrotik.com/viewtopic.php?t=182276#p908543 Part of a very interesting series in the forum ... https://forum.mikrotik.com/viewtopic.php?t=182373 There are many youtube demo's for Mikrotik, like: https://www.youtube.com/playlist?list=PLCvN_Pl1BlxihMM3xcwThV2Q-EjSKYQRf, which is a pa...

bpwl

It is expected that the ISP router replies to a PING (ICMP). The content of the reply could be "unreachable". The Mikrotik understands this answer, and flags the tested host as down (the pinged host as unreachable). This is not what we want to test with a check-gateway . The check-gateway ...

bpwl

:-). You might learn that networking is a complete different discipline in IT, different from application development and even systems operation. Be ready to learn and explore new things. But what you ask for can certainly be done. Having 2 separate networks (in WAN and wifi) can be the first step. ...

bpwl

by using traceroute tool I get loss packet 100% Depends on what you understand by 100% loss. You show an exemple where the first 13 hops are all reponding properly. From the 14th hop there is no answer anymore . Either those routers are configured to not answer (very common setup on the internet) o...

bpwl

I want to enable the wireless interface in 2011 as an access point. I've configured the radio in "ap bridge" mode, WPA2 security profile, and can log it from a smartphone. I've added IP/Address 192.168.14.254/24 interface wlan1 I've added a DHCP server according to a template used on ethe...

bpwl

Quickset has only a very very limited set of configurations. See https://help.mikrotik.com/docs/display/ROS/Quick+Set , HomeAP, HomeAPDual and WISP AP are configurations for a classic home access point, where the ISP connection (internet) is on ethernet port1, and the other ethernet ports and wifi (...

bpwl

OK OK I only said "Also have a close look" . This is not the final solution, but the type of rules to be used. A bit closer to the final solution ... (not tested, mistakes are always possible, to be tested and debugged) out interface ether5 or destination address 192.168.100.0/24 could be ...

bpwl

I see 3 network controlling devices 1. Owned Wifi router with WAN access, and ethernet, wifi LAN 2. Owned RB750R2 non-wifi router 3. Smart home controller (as black box, no management access) , but is a DHCP server. Network features here are unclear (ethernet , wifi?) There should be no problem to c...

bpwl

graphing and critical logging on disk turned on.

Could you move some of these to a USB memory stick? Idem for backup and other things we like to save in flash.

bpwl

in simple words before i used usual router with NATing my "secret" network. This can still be done, it is a limited way of hiding that network, as hide behind NAT. In the default config there is already a masquerade rule for things going out via the WAN list interface Now we want that ALL...

bpwl

The received signal in this status screen looks OK. But I expect the (too) weak received signal to be on the ISP side! Wifi connection needs to work bidirectional to function. The SXTsq 2.4 Lite has an antenna gain of 10dBi The signal coming from the ISP AP will be amplified with 10 dB (antenna gain...

bpwl

I have a confusion you can't imagine. I know the feeling, digesting a lot of new concepts can give sleepless nights. Tackle the VLAN concept in MT just slice by slice. It's hard for everyone, even experts in MT, as I see these discussions: https://forum.mikrotik.com/viewtopic.php?t=131079 Go for yo...

bpwl

YES. Maybe start with this: https://forum.mikrotik.com/viewtopic.php?t=143620 There are multiple solutions with Mikrotik. All VLANs could coexist as separate VLAN on the same bridge. Using multiple bridges (even one per VLAN) used to be one of the older config methods to connect VLAN with non-VLAN i...

bpwl

Excellent article @anav. ! VERY interesting. I don't want to push for Placeholder content, but maybe you are interested in a Dual VRRP lab setup exemple I stumbled upon in this forum, and also enjoyed reading. https://forum.mikrotik.com/viewtopic.php?t=196649 But there is still a lot to explore on V...

bpwl

In fact I was using one password for all MAC addresses now I modify it Using access list with entries for MAC address and per MAC WIFI passwords I hope this solve my problem Should help ... I need to know where to "Log the internet connects" That is not an easy one with Mikrotik. In MT it...

bpwl

IPoE ... learning something new today.

This might help/clarify your setup. https://networkengineering.stackexchang ... ly-is-ipoe

bpwl

It's difficult for an outsider of an installation to judge if something is "sensitive" or not.

bpwl

Can I improve the speed between routers? FYI only. Forgot to just give some practical steps. (Explaining the reason for the lower speed is one thing, avoiding the slower rate is another) The way to improve the rate after the 2nd MT (repeater) is avoiding the "repeater" send action on the ...

bpwl

master-interface=wlan2 name=wlan3 Repeater mode on the same wireless radio (wlan2) , will at least reduce the throughput to 1/2. (receive, send) for every packet. WLAN interfaces are known to be inefficient at high speeds. (Their AMPDU aggregation is limited to 3895 bytes per MPDU, and A-MPDU to 26...

bpwl

LTE hotspot device such as a USB LTE dongle? Huawei 3372 worked for me https://wiki.mikrotik.com/wiki/Manual:Peripherals A separate wireless hotspot device (non-usb connected) ? You would need to connect via wifi as station, if there is no ethernet interface, and then start a new network on the Mik...

bpwl

I switch to Wireless AP and connect to Mikrotik successfully. It gets an IP from Mikrotik. Guesing guessing , I assume you connected the Wireless AP with it's WAN port (having a DHCP client on that interface) so that this Wireless AP gets an IP address from the router/modem (as an ethernet client o...

bpwl

Just thinking .... How does the intruder get the password? Change the RouterOS password. Finding the MAC address is not difficult. It is broadcasted all the time. (Use MT WLAN Sniffer or Snooper to see all of them around ) Is this just one password for all MAC addresses? Using access list with entri...

bpwl

Thx @massinia for the feedback. Very interesting observation, as I had many experiments on this , and some combinations failed, and I never found why.
We expect RSTP to have the same effect as STP.

bpwl

cannot be used as a pseudobridge station Does happen in some cases, with some AP implementations My workaround then is use "station" (no station bridge, or station-pseudobridge) The WLAN1 is in the WAN interface list, has DHCP client, and on the hAP have a local LAN (with DHCP server etc)...

bpwl

I unpacked it immediately and did some setup. Suddenly, the network is gone, and I refreshed my routerOS page it is no longer able to access. Sometimes the effects of a change are only seen later, because the current connection is still valid, and some paths are cached. (Ip route cache, 5 minutes d...

bpwl

We probably will have to sniff the wifi packets to find out what the "new" station-bridge mode is. Is it full 4-address mode coming from the AP, or is it a better "station-pseudobridge" implementation? There are different implementations of repeaters, but I have no desciptions in...

bpwl

I see "Country A" in the drawing, maybe this is of some interest ... viewtopic.php?t=79019#p969022

bpwl

Traffic to local addresses on the hAP are normally filtered by the "input" chain, not by the "forward" chain in the firewall. (Test with Traceroute to the other-interface's IP address of the hAP only shows one hop, it is not forwarded) 212.3, 212.4 and 2.3 are on the same hAP, su...

bpwl

You already have L2TP, this can work as a fully bridged connection without the need for EoIP, and while maintaining the full 1500 byte MTU.
The BCP for PPTP is also available as BCP for L2TP: https://wiki.mikrotik.com/wiki/Manual:B ... _bridging)
Don't disable RSTP as STP protocol.

bpwl

Why this: https://www.youtube.com/watch?v=1ZJ-pM89N7o work on ac3, but there is no way to set up on new L900? Why? Because this Youtube shows something irrational, and completly outdated. (Like using some Windows for Workgroups driver installation procedure in Windows 11, to have SMB file sharing) ...

bpwl

By lack of documentation on "User Manager" and the Mikrotik attributes ... a little experiment. Created a "volume" limit in User Manager, but this time also added "rate" limits. This limitation was linked to the username for wifi PEAP login, and was also linked to the M...

bpwl

Rate limit probably needs Hotspot, as even Mikrotik Indonesia says, but how to have Hotspot Login, based on the wifi login [ eg RSSO : RADIUS single signon, as mentioned before ] Volume limit is handled at the wifi AP. Rate limit with RADIUS (User Manager V5) ... found it ... rate limit (max, burst...

bpwl

turning off auto-negotiate on the WAN port and setting it to 100FDX. This 100Mb ethernet fixed HDX/FDX can be a real problem, if not matched properly. It happens quite often, with dramatic speed reduction. HDX/HDX = ok FDX/FDX = ok HDX/auto = ok auto/auto = ok FDX/auto = problem if fixed FDX does n...

bpwl

After I reboot, the default route appears automatically again

Probably a chosen DHCP client action, when you accept the dynamic IP address from your ISP.

Klembord-2.jpg

Alternative to "no", in "Advanced" this default route distance can be set higher. (= lower priority)

bpwl

But how ? Used in 802.11k ? Or will MT finally add QBSS fields in the beacons? "The QBSS (QOS enhanced basic service set) information element is an 802.11e construct that enables an access point to communicate its channel usage" Missing QBSS with MT. Yet another potential reason why the MT...

bpwl

My main problem with MIKROTIK WIRELESS is the "giving up in crowded environments". When Mikrotik (WLAN driver) is in competition with other brands ( or with MT on wifiwave2), then MT has a handicap of 3dB. That is if the EIRP level is the power limiting factor (EIRP is very low in Europe ...

bpwl

Well, CAPsMAN is required for successful roaming according to the docs - https://help.mikrotik.com/docs/display/ROS/WifiWave2: For a client device to successfully roam between 2 APs, the APs need to be managed by the same instance of RouterOS. For information on how to centrally manage multiple APs...

bpwl

User manager session count (50 for level 5) is a limitation when using "EAP/Enterprise wifi security" If it is a network with multiple AP, and just one User Manager for all, the 50 (actually you only get 49) is limiting. This means 48 wifi devices (you need another extra session for roamin...

bpwl

Every legal person (family) has their own login username/password. This is mandatory in France if you offer public wifi. You must be able to point to the responsible person, or you are responsible for what has been done via your wifi connection. The ISP does the same, but cannot differentiate betwee...

bpwl

Yep, that's the one I use. I removed the wifiwave2 drivers for extra storage/memory. (hAP ax3 is in a cabinet, not used for wifi). It is not really needed to remove the drivers because User Manager is a light application. I added USB storage for the User Manager database. The RB1100Dx4 https://mikro...

bpwl

That's why I use a MT device with initial license level 6 (cheaper than license) .... for User Manager. https://mikrotik.com/products/matrix License level 6 can also be ordered for other devices. Cost +- $250 . https://help.mikrotik.com/docs/display/ROS/RouterOS+license+keys User Manager limit is nu...

bpwl

No problem here. Swapped 2 weeks ago some RADIUS server by ROS7 User Manager as new Radius server for wifi authentication WPA2 Enterprise (PEAP/MSCHAPv2) The AP's are still on ROS6 , the users have one account but have multiple devices, and are free to connect on any of the AP's. Multiple uses of th...

bpwl

I have not seen that problem : Android/wIndows versus iPhone. It is correct that nothing needs to be specified in an iPhone. For Android and Windows, the options/methods must be correct. If any error is made, then "forget the known network" is mandatory or at least recommended , to be able...

bpwl

Access to Userman V5 (RouterOS 7) management is not via a dedicated URL for management, but just an URL for the user , at "/um". User and password here is one of the User Manager users.

Management is via RouterOS main menu.

bpwl

4-address mode is not standard in 801.11. each manufacturer that offers it has implemented their own hacks to negotiate and support it, That why I'm not sure using a tunnel isn't such a bad option. It does let you treat wireless same as wired, vs using Wi-Fi specific WDS-like things. The bigger iss...

bpwl

In new Android devices, for example, you need to install the CA certificate or else it won't connect. When will it hit me ? I'm on Android version 12 SKQ1.211019.001. No problem so far. AP EAP in security profile, is set on "passthrough" and "don't verify certificate" and TLS-ce...

bpwl

No certificate .... that was exactly my problem also! https://forum.mikrotik.com/viewtopic.php?t=185562&hilit=userman#p765296 And I also only used PEAP and MSCHAPv2, not EAP-TLS. Creating the certificate for Userman was the solution. Code/exemple is in the MT HELP: https://help.mikrotik.com/docs...

bpwl

Difficult to say, but did you add the IP address of the AP in "Routers" in user manager, with the same 'shared secret' as the 'secret' in the RADIUS server setting of that AP.
With CAPsMAN the AP above is expected to be the CAPSMAN controller. (no CAPSMAN experience here).

bpwl

Just curious. What is in address list ES?
Can you get there (via VPN, port forwarder, proxy, ... etc.)?

bpwl

(Sorry , didn't see #51, before I already transmitted this) And yes "MT cell lock" according to MT support still allows other cells to be measured and reported as candidates. That is a potential MT "cell lock" mechanism implementation. But ... as I have enough MT devices to test ...

bpwl

Well extending the storage with something like SSD drive would be very welcome. It's like the old Android problem. You needed to jailbreak the Android OS , and format it as EXT4, to mount and use the microSD as internal storage. Otherwise the microSD was not very usefull.(Only part of the APP could ...

bpwl

AFAIK the way to save and restore a "RouterOS + config" copy is by using partitions "Partitioning is supported on ARM, ARM64, MIPS, TILE, and PowerPC RouterBOARD type devices." (if there is enough room in storage, some have 128MB even 1GB) see: https://mikrotik.com/products/matri...

bpwl

Random MAC (private administered MAC) seems to be stable in IOS, Adroid and Windows, when connecting to the same SSID. How stable, how long (24h?) ? I don't know. Users are connecting with username/password in EAP (enterprise security) anyway. So random MAC is not a problem as long as all limits are...

bpwl

Already manually removed lora-7.10.2 and iot-7.10.2 . Upgrade to 7.11rc3 done and OK. Will add the new IOT again later. This time there normally is no LoRa package, as the change log it is now part of IOT. But there is a smaller LoRa one in the 7.11rc3 extra packages ZIP file. The update logic got ...

bpwl

Already manually removed lora-7.10.2 and iot-7.10.2 . Upgrade to 7.11rc3 done and OK. Will add the new IOT again later. This time there normally is no LoRa package, as the change log it is now part of IOT. But there is a smaller LoRa one in the 7.11rc3 extra packages ZIP file. The update logic got c...

bpwl

hAP ac3 , upgrade from ROS 7.10.2 stable, to 7.11rc3 ... failed "can not install lora-7.11rc3: iot-7.11rc3 is not installed, but is required" Installed packages: (none was upgraded) [admin@hAPac3] /system/package> print Flags: X - DISABLED Columns: NAME, VERSION # NAME VERSION 0 iot 7.10.2...

bpwl

Translated PDF document is OK! Can be downloaded via that WeTransfer link (for a few days), but uploading such a 4MB PDF file as attachment seems not possible.

bpwl

And CQI as indicator? 8 is somewhat the lowest I find for a usable connection. It goes up to 15 (= max, excellent). See exemple https://forum.mikrotik.com/viewtopic.php?t=197753#p1016143 Cell 134040591 is strong (even strongest) -79dB RSRP, SINR is even 12 dB , still a very bad connection in practic...

bpwl

Even for FTP PASV (passive mode) the firewall in front of the FTP server and the FTP server must be setup for the same dedicated PASV high port numbers. Firewall rules must allow inbound connections, and do the forwarding on ports 21 and those higher PASV port numbers. With FTP active mode the clien...

bpwl

Yes it is complex, with in-band (passive) or out of band control for FTP, if the firewall has no "FTP helper" then passive mode must be used. http://www2.ic.uff.br/~michael/kr1999/2-application/2_03-ftp.htm In the past (e.g. 2008) the browsers, like Internet Explorer, allowed for the "...

bpwl

To my mind (please correct me if I am wrong), band lock (=band masking) is a sub-function of cell lock Not for my understanding. For me they are absolutly not the same, the mechanisms are totally different. I can't help there is no definition for this: where one speaks about band masking, the other...

bpwl

I see cell locking and band masking as two very different things. According to the MT help : https://help.mikrotik.com/docs/display/ROS/LTE , cell locking behaves like this: 1. Cell lock information will not be saved after a reboot or modem reset. 2. AT+QNWLOCK command can lock the cell and frequenc...

bpwl

Well it is a mystery. I think we have no access to those counters. Experience: - user is denied access (wifi PEAP/Enterprise logon) when the limit is exceeded (kicked off) and cannot reconnect until the counter is reset. - that counter is not visible AFAIK. and therefor it is not under control, as t...

bpwl

LTE connection is always in for surprises in some countries. Last week one ISP had a problem. 8.8.8.8 was not reachable , but 8.8.4.4 was. Half of the internet was reachable on that link with 8.8.4.4 check. Load balancing swapped to the SXT which uses 8.8.4.4 by the recursive route check, but that S...

bpwl

You effectively disable (braking) modem handover capability according to a network request. Don't expect this ... the request to switch to the masked band should not come ... with band masking . Maybe it does come when "cell locking" is used, depending on what the modem tells the tower. I...

bpwl

Those off-topic discussiosn are mostly exemples of the homework OP has to do himself. No one else can do the tedious work of bringing the whole puzzle together, because there is a lot to be verified and tested. Test results will vary over day-time and week-weekend days. Can even be weather dependent...

bpwl

Walls in crépi ( :-) ) and roofing tiles are typical for that souhtern region. Certainly we did try FREE. On paper en technically it is the best by far, outperforming SFR, Bouygues and Orange. However there is more to check. Problem is the volume quota, and the offered subscriptions. Their best chan...

bpwl

Txs. (Somebody else did the physical install :D . @rrdeli). I just tried to use the better cell connections. CQI 15 is great, CQI 8 is really at the limit of usable or not. Highest RSRP is not always the best choice. And provider SFR is in backbone trouble quite often. And even with CQI 15, the numb...

bpwl

Just my 2 cents: My 2 years of experience in one spot (Alpes de Haute Provence in France). ... Don't give up, get the information and test different setups. France has a lot of detailed information on their 4G and 5G networks, which is updated regularly. And it does change over time! (Mostly new ran...

bpwl

Auto-login to the Hotspot is a quite common request, and many have created some solutions: https://loginslink.com/mikrotik-hotspot-automatic-login But I need a Hotspot login with the same RADIUS/PEAP username. I have put the "username" in the UserManager attribute "Mikrotik-Wireless-C...

bpwl

Starting my experiments on User Manager v5 (ROS 7) and setting some limits. Intention is to limit the volume use, to some fair use limit, for the permanent members of the club, and their tenants. Not using a Hotspot, but the wifi PEAP/Enterprise authentication as an authentication that does not requ...

bpwl