MikroTik

ConnyMercier

Thanks @rextended for the quick Feedback, At least Mikrotik offers the wifi-qcom-ac Package on RouterOS V7.... So WIFI5 Devices can still use the Feature with the latest OS versions. Nevertheless, I will miss this Feature... It was a nice solution to provide a backup WAN Solutions for SOHO-Network v...

ConnyMercier

I am not quite sure i fully understand the Problem..... But Nevertheless, you can use something like this to save the Physical-CellID to a GLobal-Variable /interface/lte/monitor [find] one do={:global ActualCellID $"phy-cellid"} Using a Script, you can compare this to the expected your LOC...

ConnyMercier

I did some quick Tests in my LAB with the latest 7.18 Found an "easy" Solution, if the Frenquency-Parameter of the AP`s are Unique For Exemple AP1= 2437 AP2= 2462 If that is the Case, a Script on the WIFI-Client could simply change the Channel-Profile from AP1 to AP2 and/or vise-versa Mayb...

ConnyMercier

So I was curious and did some Test... With the new "WIFI" / "wifi-qcom" Setup, i was NOT able to configure a Device in STATION-Mode to connect to multiple Network, similar to the "old" Connect-List feature. I wasn`t able to find any addition Information on this Topic.. ...

ConnyMercier

Allo, Allo The HexS is a good Device and use it myself for a similar Setup with ~100Mbits internet. In my Setup, I use the SFP-Interface to directly connect to the Fiber(ISP) without the need for an additional Media-Converter and/or other ISP-Hardware. Furthermore, you can activate Capsmans on the H...

ConnyMercier

Align both units;
Configuration should be made using Webfig in a web browser or the WinBox configuration tool https://mt.lv/winbox;
For LHG 60G models, default IP: 192.168.88.1, and there is no password;
In the "QuickSet" menu set up the following: Choose your country, SSID, Password, etc

ConnyMercier

Many Solutions are possible for this... A Solution, could be to use the NetWatch-Tool in RouterOS to Monitor the Devices https://help.mikrotik.com/docs/spaces/ROS/pages/8323208/Netwatch and execute a LTE-Reset on "Down" Event /interface/lte/set disabled=yes [find] :delay 11; /interface/lte...

ConnyMercier

Whitin the small Configuration exemple, I can`t identify the Issue
Is it possible to upload the full Config ?
(/export file=anynameyouwish (minus device serial number, any public WANIP information, keys))

ConnyMercier

rko4all was a bit quicker than I was... I tried his Script and can concure, that it works 1. Just be carefull, that the Script will remove ALL existing :lol: 2. I am no Scripting Guru, but i would Optimize the following as I don`t think the "/32" is necessary while adding the new Route add...

ConnyMercier

There are many Solutions to the Problem... A Basic Solution ist to add a Comment, to identify the IP/Route for the Script For Exemple: /ip/route add distance=1 dst-address=62.62.62.62/32 gateway=192.168.1.1 comment="Script Controlled Route to S1.l2tpserver.com" /system scheduler add interv...

ConnyMercier

It doesn`t really change anything....

You will need to disable the Route's you set up in Step 7 "Redirect all internet traffic through WireGuard" of the Proton`s Guide
and execute Steps 2 (Routing-Table) and Step 4 (Mangel) from my post.

ConnyMercier

Sorry friend for the late response... But for some reason or another (most likely a Layer 8 issue), I had some problems recreating your Setup in my LAB... Nevertheless, I was able to achive the Result you desire Step 1: Wireguard Configured Wireguard Site-2-Site as recommended on Mikrotik Website (h...

ConnyMercier

can you provide an Export of your ROuter ?
(/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.))

ConnyMercier

Did you try disabling Auto-Negotiation on the Interface and manualy setting the speed(aka. Forced Mode)?

ConnyMercier

I don`t know if it ist Best Practice of Not,
But you can also have your "Main" Script excecute another Script

ConnyMercier

So if I understand it correctly, you want to Power the TP-Link EX230V via a PoE-Switch
and use the MikroTik RBPOE Passive PoE Injector as a PoE-Spliter ?

ConnyMercier

wouldn`t it be easiert to keep the VPN active, but create exeptions for specific device ,for exemple your TV that streams the OnDemand content? Alternatively, a better Solution could be to Identify the connections needed for your OnDemand-Services and create an alternate Route that doesn`t go trough...

ConnyMercier

There are many Solution... But if you don`t have the ressources to build something yourself, i see 2 Solutions 1. you can buy 19" Rackmount Adapters that offsets the Position of the "Rack" They come in 1 and 2 U height and in different lenght 2. Some Rack-Enclosure offer accessories t...

ConnyMercier

You might want to take a look at PPPoE to manage to manage clients connection / IP addressing , etc..
https://help.mikrotik.com/docs/spaces/R ... E-Overview

It's easy to setup and deploy...

ConnyMercier

The Mirkotik hAPac is not compatible with the newer WIFI / WiFi CAPsMAN
Additional Information can be found on Mikrotik Online Manual
https://help.mikrotik.com/docs/spaces/R ... iFiCAPsMAN

ConnyMercier

I did some quick tests in the LAB, but wasn`t able to reproduce the Issue....
Can you maybe provide the skin.json file ?

ConnyMercier

On the hAPac2,
you need to Configure "Wifi1" and "Wifi2" interfaces to use Capsman
under Configuration-> Manager and select "Capsman"

24-01-_2025_23-41-15.png

ConnyMercier

You don`t have to install any additional Packages on the hAPax3. You configure Capsman via the WIFI menu, see online documentation https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-WiFiCAPsMAN Having said that, you do need to install the wifi-qcom-ac on the hAPac2 to enable the &qu...

ConnyMercier

I concur with @jaclaz You can use a Script / Schedule to automatically set the PoE Status on startup. Script-Exemple to set PoE-Status for a specific Interface (for exemple ether5 to forced-on) /interface/ethernet/set ether5 poe-out=forced-on Script-Exemple to set PoE-Status for ALL Interfaces (for ...

ConnyMercier

Just to be clear, the Device doesn`t "randomly" fail, it runs out of storage space But yeah... it shouldn`t happen :D P.S: Mikrotik do have some Warnings.... Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure t...

ConnyMercier

There a many different ways to solve this....

The easiest Solution starting from the default config,
1. Remove ether5 from the default bridge
2. Create VLAN50 on ether1
3. Create a new Bridge
4. Assign both ether5 and eth1-vlan50 to the bridge

ConnyMercier

Do you really need the "24 Hours" ?? I am asking, because that is relatively complex to execute.... Alternatively, it could be quite easy to write a script that exports the Log entries of the DAY. In other words, a script that exports the Logs of the "Today 22.01.2025" instead of...

ConnyMercier

The Netwatch-Tool in RouterOS can be used to monitor an IP-Address A Basic script could look like this /tool netwatch add disabled=no down-script="/interface/ethernet/set ether2 disabled=no" host=192.168.1.1 http-codes="" test-script="" type=icmp up-script="/interf...

ConnyMercier

Mikrotik Devices with 16MB Storage are prone to running out of DISK space when updating to the latest version of RouterOS. Resulting in failed Updates or in some cases in the Device not booting anymore. This is especially true, if you have Data on the Device and/or optional Packages installed (e.g. ...

ConnyMercier

Good Evening, an easy solution, is to use the REST API to access the Data. https://help.mikrotik.com/docs/spaces/ROS/pages/47579162/REST+API I can`t really help you with the "Python" implementation, but you can easely test it via CMD in windows Wireless Connection Information curl -k -u &q...

ConnyMercier

1. You can try and recover the Device by loading the backup RouterBOOT
Mikrotiks Website (https://help.mikrotik.com/docs/spaces/U ... 0-8G+2S+IN)

2. Alternatively, if the Device Itself isn`t defektive sinply reinstall the System with NETinstall.

ConnyMercier

Sleep often helps :lol:

ConnyMercier

Glad i could help :D

Happy Coding !

ConnyMercier

I concur with @Larsa comment, that a Wired Solution should at least be considered.... Nowadays you can find businesses that can quickly and economically lay Power and/or Network cables with the help a specialised Cable Trenching Maschines. In your specific Stituation, a "Wired" Solution wo...

ConnyMercier

I don`t think we have enough Information to correctly identify the Problem...
Can you Provid eus with the Configuration of the Mikrotik-Device
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

ConnyMercier

If you are already able to manually sent mesages via MQTT, then you are already halfway there... I assume you use something like this ... /iot mqtt publish message="test-message" broker="broker" topic="my/test/topic" You can create a Schedule with something like this :l...

ConnyMercier

NAT relies on Connection tracking, this can sometime prevent the connection timing out.

otherwise, I don`t think we have enough Information to correctly identify the Problem...
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys etc.)

ConnyMercier

Not a Wireless expert, but I did some Tests in my Lab I used a Mirkotik Wireless-Wire between two Mikrotik hEX S that generate Traffic on the LINK. Changed the Distance between the Access-Points and monitored the LINK At a distance smaller then ~20cm, the connection was horrible (tx-packet-error-rat...

ConnyMercier

Just Checked it with the new 7.17 Stable release...
The Issues with the Logo ist still present :)

18-01-_2025_16-09-31.png

ConnyMercier

I sadly don`t have access to a mANTBox ax 15s
So I can not attempt and reproduce the Issue...

Nevertheless, I would do another attempt to RESET the Device

/system/reset-configuration no-defaults=yes skip-backup=yes

If the Issue persist, i would attempt a reinstall via NETInstall

ConnyMercier

RouterOS can display Notes on CLI-Login and/or WinBox-Login I did some Test with both RouterOS 7.16.2 and ROuterOS 7.17 In both WinBox 4 and Winbox 3.41 the "Mikrotik" ASCII banner wasn`t displayed for the Note displayed for the Winbox-Login. On the other hand, the "Mikrotik" ASC...

ConnyMercier

I don`t see an easy way to balance the LOAD in RouterOS Nevertheless, You could provide your multipoint AP`s that service the same Area use a different SSID (e.g. SSID1, SSID2, etc..) The Client-AP`s could be configured to use a "Connect-List" instead of a single Static one. In this Case f...

ConnyMercier

I concur with your findings, It`s a BUG....

I was able to reproduce the Error with the latest RouterOS 7.17 Stable installed on the Devices
and the Mikrotik-App version 1.4.4 installed on Andoid.

ConnyMercier

If you want to solve this Issue via the Router You can use the Netwatch-Feature in Router OS You can configure RouterOS to make a HTTP-Request to the NAS If the Server doesn`t repond, aka "DOWN" you can activate a script to redirect the Traffic. and if the Main Web-Server on the NAS is bac...

ConnyMercier

I was able to reproduce your Issues in my LAB In some Cases, the Device will switch from one AP to another and if both have the same SSID/Password but are connected to different networks, the Device will experience the Issues you described. Requesting a new IP-Address from the DHCP or restarting the...

ConnyMercier

Found some information on the Veeam-Forum, that depending on the Configuration
it tries to write a File on the SMB-Share... Wasn`t able to check it myself.

Does the credential you use to access the Files on the Microtik device habe write Privilege?

ConnyMercier

Good Evening Andreas, If i am not mistake, RouterOS doesn`t support SMB export out-of-the-box Nevertheless, if you have a device with a arm, arm64, x86 or tile architecture, you can install the ROSE-Package (https://help.mikrotik.com/docs/spaces/ROS/pages/259031065/ROSE-storage) that support SMB-Sha...

ConnyMercier

The only thing I haven't tried is a different computer, otherwise I tried everything

It`s worth the try...
I had very inconsistant NetInstall experience with my Laptops, Work-PC's ect...
But I found a Fujisu Workstation with onboard Intel Network-Chip that works 100% of the time.

ConnyMercier

This isn`t a Problem with RouterOS / Mikrotik
Do it every now and then, mostly for testing / learning purposes
You can configure a bridge without FASTpath and enabled IPFirewall

Performance is the biggest Issue as everything needs go though the CPU

ConnyMercier

The AccessList "Trick" is the easiest Solution, or at least worth a try.

If the Devices have a low signal (e.g. signal-range=-120..-80)
No new connections and no existing connections will remain connected after
the set grace period (e.g. allow-signal-out-of-range=1s)

ConnyMercier

A few years back, i had a Telekom-SIM assigned to a Mikrotik-Device
Encountered some Issues, but was able to find an alternativ APN / LTE configuration that directly assigned the PublicIP.

ConnyMercier

I had a few Mikrotik device in my LAB with 16MB Storage, that had similar issues and would go into Boot-Loops. I used the Device with some "Extra packages" installed and Logging. After some Testing, I was able to Identify that the Device Storage was FULL. Furthermore, they also entered a B...

ConnyMercier

I am not quite sure i understand the Network / Problem...
But if the Mikrotik-Router is providing IP-Adresses to the Devices on your network
and some Device requires a specific one, simply change it to a Static entry with the needed IP.

ConnyMercier

What does the Device say under :

/system/health/print

ConnyMercier

Do you really need PoE aka. 802.3af ? Personally, I never had the change to Work with the Hikvision Thermal & Optical Bi-spectrum Network Cameras (model: DS-2TD2628-10/QA) But if the Datasheets i found on the Internet are correct, the Camera also allows to be powered with 24 VAC ± 25%: 0.8 A, Ma...

ConnyMercier

The frequent connection drops of ~ 5-10 Seconds cound be related with allow-signal-out-of-range=10s You already made some access-list entries, most likely to mitigate devices connecting to a week signal. But i don`t think it*s quite right.... I found some other Forum Post with some recommendations h...

ConnyMercier

Difficult to say, what the Issue could be with the limited Information But if your Mikrotik-Device encounters "link down" on several Interfaces simoustanly... Maybe a Miscounfiguration on the Device or Network... Do you see something in the Logfiles of the Device ? Did you try to systemati...

ConnyMercier

I would try to connect to the Device via Ether1
Else you will need to RESET the Device as instructed in the Manual or use NetInstall

ConnyMercier

You described using PING in your diagnosis, as you are roaming from one AP to another....
Did you PING a local Device or something on the Internet like 8.8.8.8?

Secondly, do you see something in the Logfiles of the Router as you are roaming from one AP to another ?

ConnyMercier

Good Evening, Yeah, at the moment your VOIP-Phone is directly connected to the FTTH-Network (Layer2). I don`t think that is the Normal-Way to go... In Theory, you should habe both your VOIP-Phone and Computer in your own Home-Network(s). With both VLAN10 and VLAN20 configured on the Router for Routi...

ConnyMercier

Good Evening, I haven`t had the pleasure to work with Samsung IOT-Devices yet.... But I had my fair share of IOT connectivity issues.... I don`t have a lot of Information on your System... If I had to diagnose the Issue, I would configure a cAPax as a basic AP. Same SSID and Password, but nothing el...

ConnyMercier

Good Evening, It shouldn`t be a Problem to communicate with the Asus Router from the RB750-Router and/or from the Local Network on Ether5. If i had to guess the Issue, i would check if "Masquerade" is enabled for the Asus-Network If that doesn`t help or need more help, please Post the Conf...

ConnyMercier

Quick Feedback regarding my BootLoop-Issue
After a few failed attempt, I was also able to use Netinstall to recover the Switch with the latest 7.14.2(Stable)

Everything works normally again!

ConnyMercier

I updated a Mikrotik CRS328-24P-4S+RM to the latest Stable-Version labeled "7.14.1 (stable) 2024-03-08 12:50:23" Since the Update, the Device is in a permanent Boot-Loop...... Since then, I tried Loading the backup RouterBOOT loader... Resetting the RouterOS configuration.... Starting the ...

ConnyMercier

Answer to Question 1: If your Mikrotik-Router has a direct connection to the Internet (no NAT), It is possible to connect to your device from anywhere via the MikroTik app. The default Config from Mikrotik , doesn`t allow this, because of Security concerns. But if you modify the Firewall, you can al...

ConnyMercier

RouterOS ist quite good for VPN, DynDNS, DHCP, Routing, Firewall and Co You have a lot of Hardware to chouse from, depending on your needs (interfaces, Performances, etc..) If you are not sure if Mikrotik /RouterOS is the right solution for you, you can try it out on a Virtual-Maschine for Free (htt...

ConnyMercier

I like "passive PoE detection" Feature, because it removes the Voltage, if the device gets disconnected For Exemple: Preventing us during a troubleshooting Session from blowing up our Laptops :D Until now, we haven`t experienced any of the Problems you mentioned on our Customer-Networks. M...

ConnyMercier

I concur with @millenium7, 802.3af/at standard PoE works every time and absolutely no risk of blowing up Network-device !!! BUT, I work with a lot of old & new industrial Network-Device that don`t support standard PoE IEEE 802.X. Mikrotik passive PoE detection is a WAY, WAY better solution, then...

ConnyMercier

Good Morning,

I don`t understand why it isn`t working .
I will have to do some test in my LAB tonight
and i will get back to you !

ConnyMercier

I think your Link is 1000Mbits. In the Picture you posted, you can see the Parameter "Link Partner Advertising" And 2.5Gbits is missing I looked a bit in the Forum, mikrotik doesn`t have manual 2.5 and 5Gbits at the moment. You can play with Auto-Negotiate and Advertising on both device Un...

ConnyMercier

Everything seams to be O.K !

Good Luck =)

ConnyMercier

The Adapter (SFP+/Ethernet) may be the problem.
Auto-Negotiation doesn`t always work.
You may want to check what speed they negotiate or set it manually .

ConnyMercier

In the Config you send me , the SFP+ interface is disabled.

set [ find default-name=sfp-sfpplus1 ] disabled=yes

Maybe you are connected via a 1Gbits Interface... This would explain the Speed =)

ConnyMercier

Guten Tag, Sorry for the delay , had other problems to take care of =) Try implementing FastTrack in your Firewall. This will relieve your CPU-Workload and give you more Thuput , especially between LAN`s. (https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack) If you need help implementing the rules, j...

ConnyMercier

1. RouterOS Config If possible, please POST the Config of the RB5009 (/export hide-sensitive file=anynameyouwish) 2. Test-Parameters Can you also Post your iPerf-Test parameter P.S: The 7479.1 Mbit/s only works for Transfer of 1518 byte I recommend using 2557.1 Mbps as a real world Reference Value.

ConnyMercier

I used different solutions in the past... Solution 1: Custom Adapter We build for a customer a custom Holder based on the Mikrotik QMP https://mikrotik.com/product/QMP-LHG I you don`t have the tools or Workshop to jerry-rig you own Adapter. Maybe the Mikrotik QMP can be easily modified for the WireC...

ConnyMercier

You will need to configure your device as a Wireless repeater.

https://help.mikrotik.com/docs/display/ ... e-Repeater

ConnyMercier

If RouterOS Ver.6 is installed , you should be able to install and run The Dude-Server

*Dude-Server isn`t availeble at the moment for Ver.7

ConnyMercier

If possible, please POST the Config of both Device
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

You will not be able to install the Dude-Server on any MIPSBE-Device.

If you want to Test and / or play with the Dude, i suggest you use someting like the hEX S or CHR

ConnyMercier

"Detect" will only work if Neighbor Discovery Protocol is active. Depending on the Config, this may only be active from a specific Interface / VLAN. If your computer (Winbox) isn`t able to see or detect the device, Try connecting to it via the MAC-Address . This is easy because all Mikroti...

ConnyMercier

Check the Advertise-Speeds on the Interface
Make sure 2.5G is advertise....
For diagnostic purposes maybe only advertise 2.5G and remove everything else.

2022-01-03_02-01-43.jpg

ConnyMercier

You could theoretically segregate the Network physically This methode is sometimes used in very very Small Networks and/or if you don`t want to use VLAN Config-Exemple : Use the RB4011 SFP+ & UniFi 48 Port-Switch for Staff Network Use the RB4011 ether 1-5 & UniFi 16 Port-Switch for Guest Net...

ConnyMercier

A couple of years back (~2018), I bought a wAP LTE
It also had a "Automotive-Connector" with the description
The upper two (AUX) are reserved for future use

2022, The Future hasn`t arrived yet =)

viewtopic.php?t=126294

ConnyMercier

Try this,

/ip firewall connection print count-only interval=1 where dst-address~":1701" || src-address~":1701"

ConnyMercier

Queston 1: how to remove first line output, in this case "geoip.hotstar.com.edgekey.net" from output my script. Answer: :foreach i in=[/ip firewall address-list find where list=geo-ip-hotstar] do={ :if ([typeof [toip [/ip firewall address-list get $i address]]] = "ip") do={ #Ite...

ConnyMercier

Can you elaborate more on how you use the command,
and maybe provide the Script or Scheduler you use it in ?

I quickly tested the command in a script without error on both 6.49.1 and 7.1.1

ConnyMercier

So i did some more Test....
I don`t understand exactly why, but if you delete Fasttrack and Restart the Router it may work

enter this in a CLI and then Reboot

/ip firewall filter remove [find action=fasttrack-connection]

ConnyMercier

@sindy , your are right !
I still testet both DNS-Server .... they work fine !

I am out of deas....
Imported the Config in a Lab-Router
It is also double NATed

My Laptop and Cellphone are able to connect to Discord and
both the Android-App AND the Website (discord.com) trigger the Filter-Rules

ConnyMercier

Thanks @Sindy for the Backup =)

Could the DNS-Servers be the Problem?

ConnyMercier

So the only cable connected to the Mikrotik is ether1 ? And can you try adding these Firewall Rule, And tell me if the Rules get Traffic , when you are surfing the Web and accessing www.discord.com Thanks! /ip firewall filter add action=passthrough chain=forward comment="TEMP Internet Traffic-C...

ConnyMercier

Q1: Do your device behind the Router have internet?
Q2: What Network-Cable are connected to your Router and where do they go ?

ConnyMercier

That is weird ....
In the Export the DHCP-Client isn`t disabled

/ip dhcp-client
add comment=defconf interface=ether1

ConnyMercier

For some reason or another, the DHCP-Client is still active .....
Can you please reenter this in a CLI

/ip dhcp-client disable [find interface=ether1]

ConnyMercier

ConnyMercier

Can you please Post the latest Config ?
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

If you enter this in a CLI, it should rectify your Setup

/ip address set [find address="192.168.66.1/24"] interface=bridge
/ip address set [find address="192.168.88.32/8"] address="192.168.88.32/24"
/ip dhcp-client disable [find interface=ether1]

ConnyMercier

It depends...... Yes, Mikrotik / RouterOS has a Firewall and it`s quite good. For a lot of SME-Environment, the default Mikrotik-Firewall is enough. It always depends on the application and your requirements And of course , don`t expect a 200$ Router to have the same as a High-End 2000$ Firewall wit...

ConnyMercier

Do you need help to rectify the Config?

ConnyMercier

Your Config is....let say Unique =) Problem 1: You have created a Bridge and assigned your Interfaces to the LAN. But for some reason you have assigned IP-Address and in turn DHCP-Server to a "Slave" Interface. This can create Problems Wrong: /ip address add address=192.168.66.1/24 comment...

ConnyMercier

No Problem !

The CCR1009-7G-1C-1S+ is a great Router.
I use them all the time , never had a Problem with them =)

ConnyMercier

Is it possible to Post your Config ?
(/export hide-sensitive file=anynameyouwish)

I am not able to reproduce your Problem in my LAB
As soon as I add your Firewall-Rule, the Address-List gets populated,
as soon as i open the Browser and enter discord.com

ConnyMercier

How do you test your Rules ?
Did you try opening a Web-Browser and entering www.discord.com?

ConnyMercier

Answer to Question 1: Yes you can use PoE-Input and AC-Input simultaneously to provide Power to your Device. Be aware the CCR1009-7G-1C-1S+ need up to 39 Watts. So be sure to choose the proper Power-Supply 12V@3.34A 24V@1.7A 48V@0.84A ** I personnaly would use 24V or higher To keep to AMP`s under 2A...

ConnyMercier

jan/02/2022 14:53:16 by RouterOS 7.1.1 # model = RBD25G-5HPacQD2HPnD ip firewall filter add chain=forward action=add-dst-to-address-list protocol=tcp address-list=discord_ips address-list-timeout=30d dst-port=443 log=yes log-prefix="%%IPLIST-I-" tls-host=*discord.com* comment="Dynamic...

ConnyMercier

I did some quick test ....
It seams the "place-before" argument isn`t ALWAYS working in 7.1.1

probably just a bug...

ConnyMercier

@smyers119, That strange the Mikrotik Website, says something else

2021-12-31_18-38-41.jpg

I don`t know if i can edit the Voltage, but my CRS328 provides 26V & 52V
That would mean,
High-Voltage = 52 V * 450 mA = 23.4 Watts
Low-Voltage = 26 V * 1000 mA = 26 Watts

ConnyMercier

Thank you for the Feedback! I have been keeping an eye on my Audiance.. In normal use i don`t exceed 17 Watts of power. Maybe you have more Clients, longer Cables or a more demanding Config/Setup Mikrotik say the Audiance can need up to 27 Watts :( Even the CRS328-24P-4S+RM can`t provide that kind o...

ConnyMercier

My Test with a Mikrotik-Audiance, concure your Results, After a Reboot, the Scheduler was active and executing Scripts , approximatly 13 seconds before any of the Interfaces where Up-and-Running in RouterOS. I did some Quick test (i am no Scripting-Guru) You can use a Loop to wait for the Interface ...

ConnyMercier

RouterOS ver 7 or higher :global c3 "PC4SEARCH" :foreach i in=[/ip/dhcp-server/lease/find where comment~$c3] do={:put ([/ip/dhcp-server/lease/get $i address])} RouterOS ver 6 :global c3 "PC4SEARCH" :foreach i in=[/ip dhcp-server lease find where comment~$c3] do={:put ([/ip dhcp-s...

ConnyMercier

If you want to Test and/or play with this feature yourself .

You can quite easily use the Mikrotik Bandwidth-Tool to generate Traffic,
to a second Mikrotik-Device or even a Windows-Computer.

This makes it easy to Trigger the Traffic-Monitor

ConnyMercier

I did some quick test,

The Traffic-Monitor can be set to trigger "above" or "below" a certain Threshold.
If you set "Always" it will trigger on both events ( "above" or "below")

ConnyMercier

I don`t have any experience with the Dude-Server , so i can`t help you But here is a Basic Script to print the number of active Ports. # Active Interface Count :local AIC 0 :foreach i in=[interface ethernet find where running=yes] do={:set $AIC ($AIC + 1)} :put message="Active Interface = $AIC&...

ConnyMercier

Almost !!! Very small mistake in the Bridge VLAN-Filtering Here is you mistake: You need to add the bridge-Interface as "Tagged" If you want the Mikrotik-Device to be able to Talk with the VLAN Simply replace or edit this part : /interface bridge vlan add bridge=BR0 tagged=ether1,ether2 un...

ConnyMercier

Mikrotik isn`t known to have the fastest Wireless-Network If "Speed" on a single Devices is important to you, the quick and easy Solution is to upgrade to RouterOS 7.1.1 On the hAP ac³, it is possible to install the WifiWave2 -Package, that offers a new wireless driver, supporting 802.11ac...

ConnyMercier

If you need to protect your device againts electrical Surges over ethernet-Ports, you will need to buy some Ethernet Surge Protectors (It`s recommended to use a surge protector on both ends) Many solutions out there.. Mikrotik offers some Solutions : https://mikrotik.com/product/rbgesp https://mikro...

ConnyMercier

Thanks for the Feedback!

I also updated to the RouterOS 7.1.1
wifiwave2 ist quite stable and performance is awsome

ConnyMercier

My preliminary findings, shows not only an increase in Performance (aka. Speeds) but with RouterOS 7.1.1 an addition in Network Stability (less disconnects , etc..) I experienced an improvement of around 20 to 30% in Speeds (Mbps) But some guys on the Forum have claim up to 50% perfromance increase....

ConnyMercier

The default Mikrotik config will Log event of following "Typics": critical , error , warning and info You can edit what (Rules) and how (Actions) something is to be logged via the Logging-Menu (See attachement) In the Exemple you have provided, the Event was tagged as a "Firewall"...

ConnyMercier

you are welcome and Happy Holidays!

ConnyMercier

Good idea...

Happy Holiday and Guten Rutsch =)

ConnyMercier

@gabacho4

Thank you for trying to help...

FYI :

Watts = Voltage x Amps
PoE+ has a Voltage between 42,5–57V

ConnyMercier

Thanks DAD !

=)

ConnyMercier

Hmmmmm.....
Did you try connecting to the Device via IP-Address AND via MAC-Address?

ConnyMercier

Laptop was able to connect to the Router via the same Wireless-Connection?

lol @holvoetn was quicker =)

ConnyMercier

Yes , that`s the mistake =)

ConnyMercier

Mikrotik has two Android App`s
"Mikrotik Home" and "Mikrotik Pro"

Try the "Mikrotik Pro" app

ConnyMercier

This is how you need to modify your original config for Network "LAN" to be unttagged. The trick is to assign everything to the "bridge1" interface and not a a "bridge1_vlan1" Step 1: Create Bridge /interface bridge add name=bridge1 Step 2: Create and Assign VLAN /inter...

ConnyMercier

Connie you outdid yourself. No Problem, I had some spare time! i'm glad to help =) LAN uses VLAN1 Its usually "Best Practice" not to mix Untagged and Tagged Networks... Network without tags aka VLAN 1 , will make it more difficult to learn/understand VLANs. But it is possible... Reading m...

ConnyMercier

Solution 1: You can configure both device with the same SSID and Password. The Client will then be able to connect to both AP`s. Solution 2: If you don`t want to manage your Wireless-AP`s separately.. You can use the Capsman-Feature of Mikrotik to manage them centrally. https://wiki.mikrotik.com/wik...

ConnyMercier

However, nothing answers also on 192.168.0.1 Because your Router wasn`t assigned the 192.168.0.1 IP-Address... You have an Error in your Config: /ip address add address=192.168.88.1/24 comment=defconf interface=local network=192.168.88.0 add address= 192.168.0.0/24 interface=guest network=192.168.0.0

ConnyMercier

Step 0: Management Port It`s quite common to lock yourself out, while configuring a Bridge with VLAN-Filtering. So I recommend connection via a PORT, that isn`t being assigned to the bridge and isn`t Block by Firewall and Co. Step 1: Create Bridge /interface bridge add name=bridge1 Step 2: Create a...

ConnyMercier

Do you need more help?

Do you know how to configure the bridge & VLAN-Filtering..
or do you need a step-by-Step guide?

ConnyMercier

The Quick and dirty explanation ist ,

You will need to create a bridge and assign all LAN-Interfaces to it.
Create and Assign VLAN`s to bridge insteed of ether-Ports

You can use Bridge VLAN-Filtering to limit the VLAN`s to specific Port and/or create Trunk-Ports

ConnyMercier

Good Question.... NEVER , do i improperly shutdown a device, that is "Live" in the Data-Center. I always log in and execute a proper Shutdown. Even if our experience has shown, that nothing bad will happen! I simply , don`t want to tempt fate =) But for non critical devices , i do it all t...

ConnyMercier

You need to break down the issue into three seperate problem. Problem 1: Target Voltage/Current You need to know the Power requirement of your device. Voltage is easy, because you only have 12V.. Current is a bit more tricky... It depends HOW you use the hAP ac³ I think you should consider ~ 18 Watt...

ConnyMercier

But i have to admit, it is somewhat confusing ...

25-12-_2021_14-40-36.jpg

ConnyMercier

I think amazon mean: it uses a OS for Routers
RouterOS isn`t the same thing as Mikrotik RouterOS

Mikrotik RouterOS runs only on Mikrotik device or hostet on x86 Hardware

ConnyMercier

If you need a USB over TCP Solution today ...

I highly recommend W&T -> https://www.wut.de/e-53www-15-inus-000.php
Use there Product all the time in 24/7 environment and they have PoE-Powering options

They are not cheap, but they are very good quality!

ConnyMercier

Don`t forget Porsche and Volkswagen =)

ConnyMercier

You need to remove filter-Rule #4 defconf:fasttrack
(aka. Blue symbole )

ConnyMercier

easy Script to remove all Fasttrack rules :

/ip firewall filter remove [find where action=fasttrack-connection]

ConnyMercier

Remove all "fasttrack connection" filter rule under /ip firewall filter
Restart the router and the "buildin" rules will be gone

ConnyMercier

Something like this ?
Sadly i think "DHCP" is for both Server and Client...

2021-12-22_20-41-56.jpg

ConnyMercier

Export / Import of the config should work without a problem.

Don`t worry !

ConnyMercier

Your house needs a key to enter.
Your car needs a key to use.

I used to live in Canada, i never had to lock my doors , haus or car

Maybe if your Router is in Canada you don`t need a password =P

ConnyMercier

2021-12-22_20-05-09.jpg

You need to take a look under "Packages" to install / activate PPP
After that it should be availeble in the winbox menu,

ConnyMercier

a CRS328 with 2.5Gbps would be awesome

not only for Wifi6-AP`s
more and more Computers have mainboards with 2.5Gbps
For a lot of graphic designer (Adobe and co.) or engineers (Solidworks, Autodesk, etc..)
working off of network resources, it would be a big improvement

ConnyMercier

English please , so everybody can understand and help !

ConnyMercier

Did you rule out a DNS-Problem ?

What happends when you use 10.5.51.1 insteed of ntp.day.ir..

ConnyMercier

I wasn't able to find the root issue, why only the Vodafon-WAN is slower. Did you monitor CPU usage on your device ? Maybe you are achieving the performance limits of your Router? Extra ! Extra ! while looking at your config, saw a posible miss configuration, Firewall: You don`t have any Firewall-Ru...

ConnyMercier

Yes, very nice Question indeed.... I always assumed any number of vWLAN had performance degradation. So for small Networks with the need of multiple Wireless-Networks, I usually use the Access-List to assign them to the Network For exemple: Guest : VLAN100 via default TAG (wireless interface) Camera...

ConnyMercier

Forum wasn`t available for most of the day on Sunday
Forum-Post from the morning aren't there anymore

ConnyMercier

Yes it is possible....

You can set a default VLAN-Tag for all connected device,
on the Wireless-Interfaces on your Mikrotik-Device.
(Exemple: vlan-id=123 vlan-mode=use-tag)

If you need Help with your Setup
Please Post Config of the 951Ui
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

would that achieve the objective of having each subnet using a separate ISP link? The Segregation of Traffic over two separate ISP link, as "nothing" to do with VRRP. You can configure your VRRP-Routers as you would any Router. Mangel & Tag Traffic, use QoS, Firewall, PCC, etc.... In ...

ConnyMercier

You need to configure 2 VRRP 1 for the 192.168.0.0/24 Network 1 for the 172.16.0.0/20 Network With the Paramter "Priority" you can set where the VRRP run's per default In oder words / Exemple: RB3011 VRRP (192.168.0.0/24) Priority=200 RB3011 VRRP (172.16.0.0/20) Priority=100 RB450 VRRP (19...

ConnyMercier

How is the wetter on Mars ? :D like @anav already sayed, Firewall isn`t optimal. The Quick solution to solve your Problem, would be to use an Address-List to Block known Attackers. Something like this : Step 1: Create and populate Address-List /ip firewall address-list add address=78.128.113.66 list...

ConnyMercier

If possible, please POST the Config of your Device
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

The Short Answer is YES.

The Device can be powered with 12-57 V and need ~8w of Power.
But you need Battery-Protection : To protect againt over drainage / over-discharge.
And you need LHGG-Protection : To protect againt improper shutdown

ConnyMercier

* I can ping IPs but not names on my existing (parent) segment (10.0.0.0/24 - see below for setup) by IP (Linux says: temporary failure in name resolution). Same results from the RB terminal. You need to enter the DNS-Server of the Parent Network in your Routers DNS-Configuration. In your momentary...

ConnyMercier

Short of hacking your own Router, there isn`t really a Solution.

ConnyMercier

Anyway, I think keeping an HTTP access (on an unusual port), can be a safe measure, if HTTPS ever fails. Take my advice or leave it: I personnaly would try and use some sort of Whitelist (IP or DynDNS), or even something like PortKnocking to limit the "Surface area" that your Router has o...

ConnyMercier

Good Evening, I took a look at your config... The Configuration of both Cap and Capsman isn't very "clean" If the Problem persist, i would advise to go thru your config and cleaning it up. My main concern are: 1. DHCP-Servers Both Cap and Capsman have active DHCP-Servers and I assume the M...

ConnyMercier

If you don`t have access to the Device,
Reset the RB433 via the Reset-Button

It isn`t hard to do, look in the Manual for instruction for more Info
(https://i.mt.lv/cdn/product_files/rb433GL-qg_181013.pdf)

ConnyMercier

I don`t mind creating one for the Mikrotik Comunity.
What kind of Case did you have in mind?
10.5 " Rackmount, 19" Rackmount , Big, Compact, in the form of a CAT =) ?!?

ConnyMercier

Please Export and Post your Config for both Capsman and CAP
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

If you need more help with your Setup
Please Export your actual Config:
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

1. Queues If you are unable to Control the devices on your Network, then Queues are usually the only ways to manage Bandwidth / QoS. This allows you to, for exemple 1. prioritise the PS4-Traffic (like you normally would for exemple VOIP) 2. reserve Bandwidth for PS4-Traffic 3. Limit Non-PS4 Traffic,...

ConnyMercier

Good Morning, 1. PoE-Overload I did some Test yesterday... I wasn`t able to reproduce the PoE-Overload on any of my Mikrotik PoE-Output devices. The Mikrotik website states a Max power consumption of 21Watts (30W for LTE version) During my quick tests , i wasn*t able to exceed 14.5 Watts. I would tr...

ConnyMercier

The Firewall-Rules don`t necessarily conflict with each other, but ... 1. Info When the Mikrotik communicates with other Devices on a Network If usually gets a Answer! But if you don`t allow this, communication becomes impossible. For Exemple : Requesting an IP from a DHCP-Server, Making a DNS-Reque...

ConnyMercier

Did you already try with a different / shorter Cable?

ConnyMercier

ah you mean CRS328-24P-4S+RM ?

I dind`t find the CRS328-24G-4S-RM...
I thought is was an older Model
with 24G (24 gigabit non PoE )

ConnyMercier

Like CRS326-24G-2S+RM but with 4 instead of 2 SFP+ slots. This would be a solution if CRS326-24S+2Q+RM is too big. How about the : CRS328-24P-4S+RM Are there any plans for products with following features? Like CRS326-24G-2S+RM but with 8 GE ports instead of 24. This would be a solution if CRS326-2...

ConnyMercier

I got almost 20% more thruput after updating to 7.1+ Wave2 =) How do you Power your Audiance ? You need a 802.3at Type 2 PoE (PoE+) I power my Audiance via a CRS328-24P-4S I did some Quick Power test (CAT-6a Cable ~20m 51V) Laptop and phone during Low-Traffic ~ 6W of Power is needed, Laptop and phon...

ConnyMercier

Good Morning, Did you configure the wlan1-Interface ? I edited my Step-by-Step Guide to include this now ... (edited Step 8 and 9 for the Audiance) If it is not working, maybe there is still a small mistake somewhere.. Simply post the config of the Mikrotik device and we will Check-It (/export hide-...

ConnyMercier

Ok... This is how i solved it in the LAB(Step-by-Step) Step 1: Create Bridge /interface bridge add comment="Office A" name=bridge1 add comment="Office B" name=bridge2 add comment="Printer" name=bridge3 Step 2: Assign IP-Addresses /ip address add address=192.168.1.200/24...

ConnyMercier

Sorry Anav...
I somehow skipped your #4 post while scrolling...

Didn`t want to make things more complicated ! =)

ConnyMercier

Step-by-Step Guide Step 0: Secure your Router -> Password for "admin" -> Firewall -> limit sevices -> ect... Step 1: Create Bridge /interface bridge add name=bridge1 vlan-filtering=yes Step 2: Create VLAN-Interfaces /interface vlan add comment="Shared Resources" interface=bridge1...

ConnyMercier

Step-by-Step RB4011 This is a Guide how I would configure the Device If i had to Set it up from scratch. Step 0: Securing your Router -> Give your user "admin" a password -> Firewall -> limit Services -> etc.... Step 1: Create Bridge /interface bridge add name=bridge1 Step 2: Assign Interf...

ConnyMercier

Step-by-Step Audiance This is a Guide how I would configure the Device If i had to Set it up from scratch. Step 0: Securing your Router -> Give your user "admin" a password -> Firewall -> limit Services -> etc.... Step 1: Create Bridge /interface bridge add name=bridge1 Step 2: Assign IP-A...

ConnyMercier

So i installed ubuntu on a RPI4 Installed and configured vsftpd Created a file with some random Text named testfile.txt Mikrotik RouterOS 6.49.1 /tool fetch address="ubuntu" src-path="/testfile.txt" user=ubuntu mode=ftp password="123456789" dst-path="/home/ubuntu/D...

ConnyMercier

O.K !

ConnyMercier

Short Answer: YES!

But in both RouterOS ver.6 and ver.7,
some Options/ Feature are only available over CLI.

ConnyMercier

What are you trying to PING, the ROUTER ?
or something in the Internet ?

Did you think of NAT ?
If not try this :

/ip firewall nat
add action=masquerade chain=srcnat

If you need more Help, please POST your Config
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

Could you please POST your Config,
so we can better understand how your device is configured ?
(/export hide-sensitive file=anynameyouwish)

Thanks !

ConnyMercier

Are you running SwitchOS or RouterOS on your Devices? I know RouterOS ver.7+ Supports MLAG. SWOsS i don't know ! To answer your original Question: No , you don't have to use identical Models. Even in the Wiki, they don't use identical models for their Exemple =) (https://help.mikrotik.com/docs/displ...

ConnyMercier

Having multiple Network on a Router with the same IP-Range, is always going to be a PAIN in the A**! Is it really necessary? If yes, may i also know why ? (just curious) I think it's possible to "mark" via Mangle so the Router/Swtich knows from which "Bridge" a Request came from....

ConnyMercier

Question 2: SSH as being immune to timing issues ? I never had a Problem with Mikrotik and timing. Even when the Device think it`s still 1970 =) Question 3: Suggest using some other tools (Wireguard, OVPN, ...)? In the context of a Productive and/or Business Environment , i think it is "Best Pr...

ConnyMercier

Did you Post the Full Export ?
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

If you can Update via Winbox...
Yes

Or do you mean something else ?

ConnyMercier

RB5009 (ca. 2557.1 mbps Routing capacity) is a great device... Sadly it doesn`t have any Wireless-Interfaces (yet) .... So it isn`t a direct replacement for your hAPac... If you want a "all-in-one" device maybe the RB4011iGS+5HacQ2HnD-IN (2,560.8 mbps) or even the Audiance (912.6mbps)could...

ConnyMercier

So i took a look at your Config, and maybe it is possible to tickel a bit more Performance out of the Device.. But it won`t be much....(a couple a mbits ) Like i posted earlier , The device itself can only handel around 300 mbits without Fast Path And your device also handels other services like Cap...

ConnyMercier

If you expect / want more than 318 mbits
You will need to buy a more powerfull device !

Could you Export the full Configuration ?
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

My suggestions : Setup Audiance : I would configure the Audience as your Main Router. Use one of the wlan-Interfaces to connect to the ISP-Router as "station". Configure the needed Services on it like DHCP-Server, DNS, Firewall, NAT, etc... Bridge all remaining Interfaces together for your...

ConnyMercier

It isn`t a Perfect Solution,
But at least Mikrotik allowes you to upgrade back to the 6.48.6 (Long-term) or 6.49.2 (Stable).

Maybe there will be a Solution in the Future !

ConnyMercier

How does the Script assign IP-Address and Co...?
Is there a Logic* behind it or a File ?

Logic = if vlan100 then IP= 10.1.100.1

ConnyMercier

Hmmm.. very similar to these Threads/ Posts :

viewtopic.php?t=181038#p896720
viewtopic.php?p=882867#p882867

ConnyMercier

Many Hypervisors can be used,
- ESX
- Hyper-V
- Qemu
- Xen
- VirtualBox
- ect...

Look at the Wiki for Instruction :

https://help.mikrotik.com/docs/pages/vi ... d=18350234

ConnyMercier

Good Evening Kris,

I wasn't able to reproduce the Error...
I was able to connect to the "unsecure" Network and get an IP-Address

Could you maybe Export the Configuration again ?
(/export hide-sensitive file=anynameyouwish)

ConnyMercier

That`s a good question ... Posible Reason 1: The Bridge-Interface has a default PVID-Parameter. A dynamic VLAN-Filtering Rule is created, if no Static rule is defined for this vlan-ID. Posible Reason 2: You only need to add the bridge, if the Device itself need to communicate with the VLAN. So for a...

Search found 790 matches