MikroTik

nevolex

i would be interested to know that as well, and I am thinking of buying one too

nevolex

I had the same problem as yours while upgrading, albeit on a hAP ax lite LTE6. However, both share the same LTE modem, FG621-EA. Here's how you can upgrade yours manually to 16121.1034.00.01.01.04: 1. Download the firmware patchfile. /tool fetch https://upgrade.mikrotik.com/firmware/FG621-EA/16121....

nevolex

Hi everyone I am on lates test firmware but cannot upgrade the modem firmware, has anyone come across the same issue? [admin@mikrotik_chateau] > /interface lte firmware-upgrade number: 0 installed: 16121.1034.00.01.01.03 latest: 16121.1034.00.01.01.04 [admin@mikrotik_chateau] > /interface lte firmwa...

nevolex

Thanks for respoonse. Problem solved. Band steering (introduced in 7.11) is the problem. disabled it with cli and problems are gone
Where is that Band steering?

same question from me

nevolex

do we have any update from Mirktotik re adding mDNS support officially? I do believe they mentioned somewhere that DNS is getting complete rework done and mDNS will be part of it as well??

nevolex

I have the same issue, I can't believe this wouldn't support anything else but pap in openvpn configuration, will send an email to mikrotik to double check Cool. Let us know what they say. Sadly but true, they confirmed that ROS only supports PAP auth mode for Radius Authentication for OpenVPN

nevolex

I have the same issue, I can't believe this wouldn't support anything else but pap in openvpn configuration, will send an email to mikrotik to double check

nevolex

Hi Everyone, I have a Mikrotik OpenVPN server on my Mikrotik with Radius (via user manager) These are my vpn settings Usinterface ovpn-server server set auth=sha256 certificate=vpn-server cipher=aes256-cbc default-profile=vpn-profile enabled=yes protocol=udp redirect-gateway=def1 /ip address under V...

nevolex

the issue got resolved with:

/ip firewall nat
add action=masquerade chain=srcnat comment="Snat for OpenVPN" dst-address=0.0.0.0/0 out-interface=lan_bridge src-address=\
10.11.11.11-10.11.11.20

nevolex

Hi Everyone, I hope someone can advise\ put me to the right direction I have a mikrotik router seating behind my primary router Router 1 is 10.10.10.1, the Mikrotik Router is 10.10.10.2. I am planing to use MikroTik as a open vpn server for backup entry (in case my primary dialin vpn goes down) I ha...

nevolex

hi everyone, I read somewhere here that mDns forwarding will be available as part of DNS overhaul change in the future ROS, is that true?

thanks

nevolex

Hi everyone I just purchased the Chateau LTE6 ax and waiting for it to be delivered I know that is has 4 external antenna ports, can you please advise which one are used with LTE and which one are with wifi antennae? it seems to me that connectors 1 and 4. (far left and far right) are for wifi exter...

nevolex

Today, I've been able to get IGMP Proxy working with Chromecast cross vlans. I'll get my documentation together and post a new thread so its easily findable. Thank you to Nate for provided the basis of this solution. I don't understand quite how it works as the IGMP Proxy doesn't show much under th...

nevolex

hi guys,

I use user manager but noticed that there are many files related to the app, can they be deleted?

I am planning to continue using user manager

thank you

nevolex

Still no hardware acceleration for OpenVPN tunnel and IPQ-6010 processor (hAP ax3)

is that actually supported ?

nevolex

Hi guys I would like to move ipsec tunnel to mikrotik, it is connected to the primary router The reason being I don't like the primary router, so currently I use 2 networks that are reachable over the ipsec tunnel via the router 1 When I created a ipsec tunnel on the miktotik (secondary router) it's...

nevolex

To those people asking for mDNS, can you give examples where it will be useful? Rextended provided solutions for the given examples. Maybe there are more examples? Chromecasting and Casing (audio/ video / printer discovery )in general between the vlans, for example cast from the phone that is on th...

nevolex

I was able to fix the issue in Android and windows (had to re generate the cert with and it works fine with native android client )

nevolex

hi guys, can somebody please assist, ipsec does not work for me screenshot is from mikrotik logs are form the client itself Jan 24 11:47:11 00[DMN] +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Jan 24 11:47:11 00[DMN] Starting IKE service (strongSwan 5.9.3rc1, Android 13 - TP1A.22062...

nevolex

The AP IP should be in the clients list (Routers) of the Radius Server (User Manager) RADIUS (client) setup should be defined/configured in the AP, and point to the User Manager IP. Radius client/server can be tested with : https://forum.mikrotik.com/viewtopic.php?t=185562&hilit=radius+test#p76...

nevolex

hi everyone can somebody please assist, I have a main router with 1 subnet (not mikrotik and does not have radius server built in), it's connected to Wireless access point that I would like to use dot1x for authentications (wpa2 enterprise) I have a proxmox (hypervisor) connected to the router with ...

nevolex

Hi all,

I just bought a hAP ac³ non LTE verision and waiting on it to be delivered, it has a usb port and I have a pci-to-usb card (there is modem card R11e-LTE6 inside ), it works fine with my other mikrotik device that has a usb port

will it also work with the hAP ac³ ?

thanks

nevolex

Hi everyone I know to get macos/ios clients working on ipsec is a pain, it was hard enough with self assigned certificates but the struggle continues in ROS 7 with ipsec eap radius. and again it just works with windows/ android but on mac os I get authentication failure. I tried a random user, not e...

nevolex

Hi,

I am bit confused if I am using a CLI and not sure what the command look like i used to be able to use "'?"

how do I do it in Ros 7?

[admin@MikroTik] /routing> ?
expected command name (line 1 column 1)
[admin@MikroTik_] /routing>

thank you

nevolex

Hi,

will it be added to RouterOS v7 eventually?

Thank you

nevolex

If the audience is "just a WAP" in my config... So make a bridge and put the VLAN and wireless interface in it? I think I will just put the Audience back in it's box for now. Here is how you can do it, don't use vlan tags under wireless interfaces, i did not use them even with the old dri...

nevolex

I can't find VLAN tags.

I have my radios get stuck on selecting channel.

It's a BETA AT THIS POINT.

yeah seems like vlan tags cannot to assigned directly under the wireless interfaces now, use bridge config for them

nevolex

Hi everyone I upgraded the driver to WifiWave2 on my Audience, wireless is indeed much faster now, but I cannot find the option that I really need - "default-authenticate" Previously my 2.4GHZ wlan had "default-authenticate" unticked, so only allowed clients from the access lists...

nevolex

You need a dedicated identity for that user, referring to their individual certificate as remote-certificate , with match-by set to certificate and mode-config set to a mode-config row dedicated for that user, which in turn refers to a dedicated pool (or an individual IP address). Because, as you'v...

nevolex

HI everyone, I am using certificates to authenticate users: they belong to the same pool, same porfiles, peer etc /ip ipsec mode-config add address-pool=pool_ikev2_vpn name=IKEv2-cfg /ip ipsec policy group add name=ikev2-policies /ip ipsec profile add dh-group=modp3072,modp2048,modp1024 enc-algorith...

nevolex

Hi everyone, I have managed to get the certificate from another place, not from mikrotik itself (directly via let's encrypt), exported it to android as well (.crt part), on android I now get a different message -"radius timeout", what do I do wrong ? I have attached 3 files: config for ips...

nevolex

Does WPA2-Enterprise work with the new UM and radius for windows 10 WiFi clients in 7.1beta6? Best regards @bpwl @floaty Maybe maybe ....the Windows 10 problem is related to the special requirements for the certificates, as explained in the openSource FreeRadius https://wiki.freeradius.org/guide/ce...

nevolex

deleted this post as made some progress in the certificate import

nevolex

Check what is reported in logs (Event Viewer) on Windows side. Look for messages from RasClient. found them: CoId={341526BE-9736-0002-F63E-1C343697D701}: The user SYSTEM dialed a connection named testvpn which has failed. The error code returned on failure is 13801. from the Internet VPN Error 1380...

nevolex

You can enable extended debug logging under the System Logging menu. /system logging add topics=ipsec,!packet thanks again emils, yes I was looking at the debug logs before, just cannot find any obvious errors :( 21:28:37 ipsec,debug ===== received 1104 bytes from 10.10.0.33[500] to 121.99.xx.xxx[5...

nevolex

Looks like the client implementation (I suspect you use StrongSwan on Android), does not trust Lets Encrypt certificates by default. You need to import both Root and Intermediate CA's on your device for it to trust the server's certificate. https://letsencrypt.org/certificates/ thank you emils, i d...

nevolex

You need certificate configuration with eap-radius as well. You can use the newly added Let's Encrypt support (/certificate/enable-ssl-certificate) if your device has TCP/80 port access from the Internet. When the certificate is generated, simply set it under the user manager and IPsec configuratio...

nevolex

hi everyone, today for the 1st time I upgraded to ROS 7.1 Rc1 and decided to use new user manager with IpSec VPN (currently I use certificates ) I installed the new user manager, I but I think I am missing some options, do I go to radius section as well and enable it? My OLD VPN section: /ip ipsec m...

nevolex

I would like to request a separate wifiwave2 package for IPQ4018/IPQ4019 devices with 16MB of ROM. With such a package a lot of more users could test this it, send feedbacks and bug reports which will result in an earlier available bugfree stable release. +1 +1 here as well. I still have the option...

nevolex

Hi All,

I am thinking of setting webproxy to cache on sdcard that my mikrotik model supports, however, can that card be encrypted?

Thank you

nevolex

Indeed one has to filter access to router from certain subnets. But as I wrote the filter has to cover all router's interfaces, not only the "native" one ... and in this case the approach of "ultimate drop all rule" comes handy. This means that input chain contains a few rules a...

nevolex

Okay that was put politely LOL, so there is no security risk without the input chain rule and the only reason to shut it down with an input chain rule is paranoia LOL. Thanks guys but this is not just for comforting, lol, there is some risk associated with it as well, it's not just the pings it lea...

nevolex

Hi guys I would like to ask your opinion on this: I have 2 networks 10.10.0.0/24 - Main and 10.20.0.0/24 guest I am using firewall filters to block 10.10.0.0/24 from 10.20.0.0/24 and visa versa add action=drop chain=forward comment="drop all else coming from main to guest " dst-address-lis...

nevolex

Hi can somebody please share Mirktotik default firewall rules with the default order as they were after factory reset

thank you

nevolex

The problem we are missing a schematic overview with the different elements. But, you are talking about 2 IP's 10.20.0.2 and 10.20.0.3 which are IN the range of the Guest IP's themselves ? Sooo...when a Guest user (also having 10.20.0.x) connects to these IP's does it even pass by the device for wh...

nevolex

Can you try not to use /31 in your definition of the management IP's ? Try with 2 lines, each adding 1 IP into that ACL. Then, apart from the ACL, did you configure in your ip > services that ports 22,88,8291 are available but also limited from a certain range ? Or is it fully accessible on that le...

nevolex

Very confusing to read your firewall rules. Consider simplifying Use drop all else at the end of the input chain and forward chain and then you only need to add in the traffic you want to allow. Much more efficient. LAN to WAN is pretty much all you need. yes i will consider simplifying, however in...

nevolex

Hi guys, Please advise what I do wrong Main router RB4011 has ip of 10.10.0.1 (vlan 10 main network) and 10.20.0.1 (vlan 20 guest network) --> firewall rules work fine for this router (use input chain) guest ip addresses (10.20.0.x) cannot access it for 10.10.0.1 and 10.20.0.1 as well However MikroT...

nevolex

@joegoldman

are you using foxpass?

nevolex

Hi guys, I ma just curious is my configuration correct and safe i have 2 routers here: Primary circuit via rb4011 port one, Internet is on ISP VLAN 10 (PHYSICAL PORT 1 ) 4g back up is on RB33G ((PHYSICAL PORT 1 AS WELL) isp1 -- {port 1} rb4011 {port 10} <--trunk--> {port 1} RB33G --> isp 2 (via 4g) ...

nevolex

What are you trying to use the radius client for? Hotspot, PPP, Local Auth etc? Provide an /export (or at least /radius export and config of the service you want using it) so we can help. Personally I connect all our mikrotiks to a 'cloud hosted' Radius server in a different country for ppp auth wi...

nevolex

Hi everyone, is mirkortik compatible to be a client of an external Radius server? I just sing up with jumpcloud.com but cannot get mikrotik to athenticate to their radius server I have my local radius server and have no issues connecting to it tried to search on the internet but all the guides talk ...

nevolex

Hi,

is the a way when you open a web page to configure a router instead of quick config it would rather open in Web fig instead ?

thank you

nevolex

thank you I didn't realise it was tagged before, I saw in "advance configuration"

nevolex

I fixed that by moving WLAN interfaces to Tagged, but why are they tagged, aren't they treated like access interfaces?

wiwi.png

nevolex

Hi guys, I have been applying with my vlan filtering on mikrotik audience Internet is coming from another router on port 1 (trunk), port 2 is an access port I am not sure what I did wrong but wireless clients on wlan interfaces don't get a dhcp lease a client connected to port 2 (physical on audienc...

nevolex

You are welcome...DHCP server can be bound to the VLAN interface as you already did. unfortunately, as soon as Ienable vlan filtering on the bridge after I specified pvids the router can no longer be contacted I am not sure if that's the bug or something Once I was able to connect to it via l2 teln...

nevolex

If you want to have accessports (or hybrid ports) you have to set the vlan id on the bridge port while the trunk port should be left to default (with admit-only-vlan-tagged): trunk: /interface bridge port add bridge=bridge-LAN frame-types=admit-only-vlan-tagged ingress-filtering=yes interface=ether...

nevolex

HI everyone, I decided to play with my existing configuration using "legacy" 1 bridge per 1 vlan and changed that to vlan filtering and only one bridge for all. I did not use pvid (when I tried the router becomes unmanageable ) per bridge port as it looks like rb4011 does not support hardw...

nevolex

HI all, I have been searching for hours but cannot find a normal case for the RBM33G to buy that has holes for RPSMA instead of Nfemale Bulkhead ones like the CA433U Has any one seen one? This one below would be ideal but it's only available at taobao i cannot even register there 1615026698021.jpg t...

nevolex

Hi All I have 3 routers: Primary Rs4011, 2nd is Audience (used as an access point only) and the Ltap for 4g connection Primary has my main wan link terminated Audience is connected to the primary via a trunk port with 2 vlans: main and guest and then those vlans are assigned to ssid and the 3rd rout...

nevolex

Cleaned up the original script some (better tabs, removed not needed ;) # Script to download adblock list # https://www.micu.eu/adblock/adblock.php # :log warning "starting adblock update" :delay 2 :log warning "downloading adblock" :local hostScriptUrl "https://www.micu.eu...

nevolex

HI I am curious if there is anything that can be done about this script: it's a 3rd part adblock https://www.micu.eu/adblock/adblock_script.txt and what it does it puls the list from https://www.micu.eu/adblock/adblock.php the problem is I would like to whitelist a few google dns entries but I don't...

nevolex

You may have misunderstood me. The identity row, even if just a single one is attached to a peer, is always matched on either the remote ID or the certificate (depending on the setting of the match-by parameter). So if remote-id is set to ignore , the row will match on any ID_I received, and the on...

nevolex

I'd say match-by=certificate remote-certificate=the-one-of-the-client should do the trick with either remote-id=ignore or remote-id=auto . But it's just a guess, maybe auto is necessary, as in fact the header of the certificate is sent as the ID, as the log should show you. Maybe Apple does that di...

nevolex

As I've got no Mac/iPhone laying around, let alone with the OS version in question - can you post the window that opens if you click [Authentication Settings...] in the window you've already posted? Sindy, you are a legend!, if you didn't point it out I would not double-check that at it was chosen ...

nevolex

Anyone got this solved on IOS14 and ROS 6.47.8 ?

same issue

nevolex

exactly the same error and tried as in the manual but got the same error:

error identity not found for server

nevolex

The log from the Mikrotik shows that the Apple uses its private IP address as its identifier (ID_I), so the Mikrotik cannot find a corresponding row in /ip ipsec identity . But if I understand it right, this actually indicates that the Apple device doesn't consider its own certificate fit for its o...

nevolex

To see the digest-algorithm used, you have to display the certificate parameters using the command line, /certificate print detail where common-name~"vpn" . But when signing certificates, RouterOS normally uses SHA-256, which is from the SHA-2 suite, so it fits those requirements. As for ...

nevolex

Hi Everyone, I have been having issues with my vpn connection (ikev2), as also mentioned in a few topics here from other people, "it works everywhere else but on Apple devices..." Found this information: Requirements for trusted certificates in iOS 13 and macOS 10.15 All TLS server certifi...

nevolex

winbox - added support for wifiwave2;

do we still need an external driver for that, or is it now integrated into the ros?

nevolex

Even v2.9.x had at least 2.9.51, so don't let v6.x stop at v6.50 :D

LOL, oh well let 6.50.1 happen then!

nevolex

That's great guys, but maybe 6.50 can be the last 6.x ros and the development can be fully switched over to 7.x ?

thanks

nevolex

I have just tested it but I did not manage to obtain anything other than NXDOMAIN from the internal domain server. Sorry.

yes, same here couldn't figure it out yet how to actually split the domains per ports

nevolex

Do you guys know when the final version is out, shell we aim for the end on 2021?

nevolex

In the srv you don't put an IP but the domain name of the server serving both ports. srv site1.lan 32400 --> A siteserver.lan 10.10.10.10 srv site2.lan 20020 --> A siteserver.lan 10.10.10.10 thank you msatter, may you please elaborate on SRV I am having some issues setting them up still does it mea...

nevolex

Hi all, can somebody please help me to create 2 SRV records I have 2 web services running on 10.10.0.10:32400 and 10.10.0.10:20020 I would like them to be resolved at site1.lan for 10.10.0.10:32400 and site2.lan for 10.10.0.10:20020 do I create an A record for same address since the A dns record doe...

nevolex

HI all, I run a vpn server (IKEV2)on my Mikrotik it has 2 wan links, normal ISP with the standard pubic IP allowing port forwarding - all work fine the second wan is a 4g (in case the primary link fails) with common CGNAT these days, port forwarding doesn't work so vpn is out Is there a way to allow...

nevolex

Hi guys, can somebody please guide me on how to create a simple script with the date format as date/month/year for netwatch the one I have is :local CurDate [/system clock get date] :local CurTime [/system clock get time] :local HostName "Primary ISP link" :local HostIP "1.1.1.1"...

nevolex

Perhaps you can share your configuration? /export hide-sensitive flie=anythingyoulike (and place the outcome between [] ) thank you [admin@Mikrotik_Audience] > /export hide-sensitive # jan/07/2021 21:27:45 by RouterOS 6.48 # software id = M0L0-MR8G # # model = RBD25G-5HPacQD2HPnD # serial number = ...

nevolex

Hi everyone, I have a mikrotik audience and probably already got a very good permanence, considering the outdated wireless driver of ROS ;) Having 2 separate wifi 5 radios (1733Mbs and 866Mbs) I separated network/ channels completely and get a solid 250-300Mbs pers sec per client, maxing out at arou...

nevolex

Try this, Put those rule before the fastback rule /ip firewall filter add action=accept chain=forward connection-state=established,related src-address=172.16.25.0/24 add action=accept chain=forward connection-state=established,related dst-address=172.16.25.0/24 It work for me... Have a good day! Pa...

nevolex

seems to be working with these rules placed before fastrack in firewall

add action=accept chain=forward connection-state=established,related src-address=10.20.0.0/24
add action=accept chain=forward connection-state=established,related dst-address=10.20.0.0/24

nevolex

Hi guys, I just realised that fastrack and simple queues don't go along well It looks like with fastrack disabled a simple bandiwth queue works but I would like to keep fastack enabled. Is there a way to bypass 10.20.0.0/24 only from fastracking ? Perhaps can somebody please help me to figure out th...

nevolex

Hi guys @emils Updated my Audience to 6.48 and secondary wifi 5Ghz band is now not working at all (1733 Mbit/s one) I was using it as my primary network not as mesh Please see that some setting are now missing for the band 5500 (1733 wirelss network compare to regular 5ghz) Please fix https://ibb.co...

nevolex

Hi guys, Merry Christmas and a happy new year to every one of you I got my ikev2 vpn server setup and I just realised that I cannot use 2 sessions at the same time I am using 1 certificate on 2 devices: a windows pc and an android phone when one device is connected the other gets disconnected, they ...

nevolex

wifiwave2 experimental support -- thanks a lot Mikrotik for start your work on this, can't wait to see the final version integrated into winbox sometime next year!

nevolex

HI guys,

I just realised that non of my bridged ports are hadrware offloaded, even thought the option is ticked, can somebody please explain why?

thank you

nevolex

If your interface lists are correct, i.e. actual WAN interface is definitely not in LAN interface list, then current rules are enough.

yes my list of wan interfaces only have the wan interfaces

thank you for your help

nevolex

Existing rule #6 already drops everything from WAN, if it was not allowed before.

does it mean i don't need those specific rules?

nevolex

HI guys, I would like my router to respond to DNS queries, I know I have to bock requests from wan, however can you please advise what rules i need and where to move them, thank you [admin@MikroTik_RB4011] /ip firewall filter> print Flags: X - disabled, I - invalid, D - dynamic 0 D ;;; special dummy...

nevolex

getting vpn slowing working on all devices across the network, however having issues getting it working on mac os :( getting a few errors and a user message "unexpected error occurred " here are some logs: \f0\fs24 \cf0 default 11:02:24.980781+1300 nesessionmanager NESMIKEv2VPNSession[Prim...

nevolex

Are you using a newer Android whose embedded VPN client can use IKEv2 or do you use StrongSwan? StrongSwan attempts to establish an SA to 0.0.0.0/0, and once RouterOS restricts it to the first subnet on the split-include list, it doesn't try again and sends traffic to other destinations outside the...

nevolex

Hi all, I have set up my ikev2 (using certificates) vpn connection and it works fine on windows, however, on the android phone, I can connect to vpn fine and lan resources are accessible however nothing on the Internet works (timed out) can somebody please advise what the problem can be? thank you [...

nevolex

You forgot two things, to place [ code] and [ /code] tags around the configuration export in your previous post, and to describe the topology. So a guess: you are connected via a VPN, and from a client of that VPN , you can connect using Winbox/WebFig to other routers in 10.10.0.0/24, but not to th...

nevolex

It sounds as if the IPsec policy was intercepting the traffic between the "toolbox" (whatever it is) and the router. In another words, no better advice without seeing the configuration and the topology. haha sorry I was meant to say winbox not toolbox thank you i can connect to 10.10.0.2 ...

nevolex

Hi everyone I am on the latest ros 6.47.7 and just discovered that I cannot connect to the router via toolbox when connected to vpn ikev2 I have 4 routers and I can connect to 3 of them out of 4, the 4th one is the one running vpn server all the ips are accessible on my network, even the ip of the r...

nevolex

how do I fix it? You can use the dhcp-client parameters and inside is the script's who can do some additional works. Key work can do the Routing Filter who can change the Dynamic interface parameter's like /routing filter ... set-scope= . Example: https://forum.mikrotik.com/viewtopic.php?f=2&t=...

nevolex

HI guys, I have 2 routers a main one and the lte one Lte works as a passthrough, so I get ISP's ip directly in the routing table on the main router So I have 2 default routes via primary/ secondary However, the problem is with the administrative distance, I know the default route has to be setup sta...

nevolex

Hi guys, first of all wanted to say thank you for the great support on this form I have been having over a few months :) I have 2 mirkorik devices connected via trunk and I am passing 2 vlans vlan10 and 20 There is DHCP server on the router 1 for both vlans and the router 2 is just s client I am pla...

nevolex

Looking into your configurations, the hAP ac² is there only as a port & wireless extender of the 4011, so whatever is connected to it by wire or wirelessly gets the 4011's IP address as the default gateway. I.e. the hAP ac² doesn't route any traffic, so it doesn't need any route at all (unless ...

nevolex

DId you try to use LTE Passthrough (via VLAN, for example) to setup IP address directly on main router?

thank you, does it mean i need to build a dchp server on the second router and the main router to be the client?

nevolex

Publish the configurations of both machines (see my automatic signature regarding anonymisation), rest assured that there is a way, you can always use VLANs and/or policy routing. Even if the hAP ac is a DNS client, it need not ask for a default route via DHCP. thank you [admin@MikroTik_RB4011] > /...

nevolex

as I said earlier the problem is, that your hap also has the rb4011 defined as the primary gateway: 0 ADS 0.0.0.0/0 10.10.0.1 1 so if isp1 is down, rb4011 uses the hap as gateway, but the hap is using rb4011 as gateway -> loop and nothing works. thank you mooks, so basically there is nothing can be...

nevolex

as I said earlier the problem is, that your hap also has the rb4011 defined as the primary gateway: 0 ADS 0.0.0.0/0 10.10.0.1 1 so if isp1 is down, rb4011 uses the hap as gateway, but the hap is using rb4011 as gateway -> loop and nothing works. thank you mooks, so basically there is nothing can be...

nevolex

The case is really unclear in terms whether both routers should be able to use the 4011's WAN while it works, and hAP ac's (LTE) WAN whenever it doesn't, or whether the hAP ac is there only to provide the LTE WAN for the 4011. Can you clarify this basic question? sorry for being unclear guys, the o...

nevolex

Hi mooks, I am trying to set up failover in a way that if the wan dies on the primary, traffic will be failovered to the secondary, however i cannot use ping the gatway as on the second routeк the gateway is the ip of the routeк one. So even if the wan dies the routes won't switch as the router one ...

nevolex

Hi Chupaka and other guys, can you please help to figure ou how I can make lte faiolver to work in my case I am trying to do a failover but stuck as the lte modem on a different router Main router 1 wan, 2 dhcp servers vlan 10 and vlan 20 [admin@MikroTik_RB4011] /ip route> pri Flags: X - disabled, A...

nevolex

Hi guys, I am trying to do a failover but stuck as the lte modem on a different router Main router 1 wan, 2 dhcp servers vlan 10 and vlan 20 [admin@MikroTik_RB4011] /ip route> pri Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhol...

nevolex

the issue has been resolved by resetting the device and recovering the config.....what...

nevolex

Hi guys, I have a strange issue: I have 3 routes: main router (4011) has dns and dhcp settings one audience, work as access point one more router as wireless bridge after upgrade to 6.47.2 on the audience I cannot check for further updates anymore - "dns is not resolved" error the funny th...

nevolex

Found what the problem was, made a typo, too man vlans hahaha

add interface=wlan20_guest_5.0GHz+ name=vlan20_guest_5.0GHz+ vlan-id=10
/interface bridge port

nevolex

I assinged an ethernet port on the rb4011 to vlan20 for testing and the ip ws issues immidiatelly, so I guess the issue can be on the audience?

nevolex

Hi Guys can you please help me to understand what i did wrong I have an rb4011 and audience 2 vlans: 10 and 20 and there is a trunk between port 9 on rb4011 and port 1, pssing both vlans 2 dhcps servers running on rb4011 one for each vlan Then these vlans are assigned to ssids Clients on ssids assig...

nevolex

Hi Guys I am curious what can i do in this case I am using tagged networks 10 for main lan/ 20 for the guest lan they assigned to virtual wlans 2 virtual aps - 10 for main lan/ 20 for guest accordingly it all works however, there is also real ap, sort of wlan1 and it has a default ssid mikrotik, I d...

nevolex

do you guys know if band steering will be awalible in ros 7?

Thanks

nevolex

it is cntr + c

nevolex

i guess i can edit it in cli but how do i save ?

nevolex

HI guys, can somebody please help to set the default setting back on the router under system-logging-action default action is "remote" but I cannot set the source ip back to 0.0.0.0 it has to be a valid address, however intially that ip was set perhps it can be defaulted in the cli? thanks

nevolex

HI I got a r4011

would it be able to power the "wAP ac LTE6 kit"

the r4011 has only one passive poe out port

Thank you

nevolex

I see that this device has a mini-pcie slot

https://fccid.io/TV7D25-5HPQ2HP/Interna ... 296069.pdf

Regards.

It seems like it has been removed from the motherboard on the non lte modem

nevolex

You have to specify the region as well, otherwise you might get a suggestion for one which is perfect in all aspects except from supporting the bands used in your country. thank you, these are the bands used in the country: The Vodafone NZ mobile network operates on the following frequencies: 2G - ...

nevolex

I have the same issue as Nevolex. Windows 10, 64 bit laptop. Zoom in helps but I have to repeat it every time. One more level of zoom in would be great too.

do you have "open in new window" ticked? it seems to be a bug

nevolex

No, session is saved, next time you connect to the router zoom is restored from saved session.

It seems to be a bug I opened a new topic -->

winbox "zoom in" option bug

thanks

nevolex

Hi I have just noticed the bug in the latest verson of winbox Zooming doesn't work correclty You can zoom in but when the session is closed and reopened again, the last zooming setting will be reset It works correclty when "open in new window" option is unticked but when it is ticked the z...

nevolex

HI guys,

can anyone please recommend a fully working and managed usb lte modem?

Thanks a lot

nevolex

HI

It is possible to upgrade a standard mirktoik audience to a LTE version by purchasing a mikrtoik lte card?

thank you

nevolex

LTE with built in SIM slot will not work, as the slot only supports PCIe type cards, not USB type cards, so you are limited to WiFi cards here (that RouterOS supports, of course)

So Normis, this card listed above GLYN MINI PCIE XE910 won't work with the r4011?

nevolex

Hi guys

I got a MikroTik RB4011 (no wireless version) it has a mini pci slot too.

Can this slot be used for antying but a 2.4 wifi mikotik wireless card?

thanks

nevolex

It can be a bug in the latest version of winbox but the sessions are not saved (tested saving manually too)

Can somebody please test as well, so it not just me

thanks

nevolex

Settings->Zoom-in

yes it works fine but I have to do it every time

nevolex

I hope the release will be end of this year?

nevolex

Hi I got a laptop with full hd screen

display scaling is 150%

however as you can see it is tiny, I can zoom to max then it's perfect but the setting is not saved

https://ibb.co/ypjThZd

can that be fixed please?

nevolex

Hi guys,

can somebody please advise how to reboot the router monthly, I know some would put 1d 00:0:00 in the schedule for daily reboots but how to do a monthly one?

Thanks a lot

Alex

nevolex

Hi guys I got a Mikrotik router and a QNAP NAs Nas has 1 SFP+ 10Gb port that works fine with Mikrotik SFP port and I wanted to add additional 1Gb copper link as a backup link Obviously It has to be some sort of STP configuration I set: Past cost 5 for SFP Past cost 10 for Copper Unfortunately, they ...

nevolex

Amazing what a fresh kernel, hi wireguard!

Thanks guys

nevolex

Thank you all, here is my current config: [admin@MikroTik_Audience] > export compact hide-sensitive # jun/03/2020 10:47:48 by RouterOS 6.46.6 # software id = M0L0-MR8G # # model = RBD25G-5HPacQD2HPnD # serial number = B6BE:xx:xx:xx /interface bridge add arp=reply-only name=bridge-guest add name=brid...

nevolex

Hi guys I am pretty happy with my Mikrotik Audience, but the download speeds are 2x slower than upload. I get around 300-350Mbs upload and about 150Mbs download The channels are not crowded. The coverage is good between 45-55 dBm , I am using only one AC band (1733Mbs) Can somebody please advise wha...

nevolex

Would that rule work? /ip firewall nat add action=dst-nat chain=dstnat dst-port=33445 in-interface-list=WAN protocol=udp to-addresses=10.0.0.6 to-ports=33445 Add it just before or just after any already existing rules in chain=dstnat - it is for a particular port, so it is unlikely to get shadowed ...

nevolex

Would that rule work?

/ip firewall nat
add action=dst-nat chain=dstnat dst-port=33445 in-interface-list=WAN protocol=udp to-addresses=10.0.0.6 to-ports=33445

nevolex

Hi all. I have an Open Vpn server (on a raspberry pi in my lan) It has an ip of 10.0.0.6 and port 33445 Can somebody please advise how to do port forwarding to that port 33445 (UDP only) External port is also 33445 (I have a static public IP) These are my current rules: /ip firewall filter add actio...

nevolex

I have added those 2 lines, however, it didn't do any difference, in the firewall window (Winbox), I don't see any additional rules, then what I had before Sorry, the match protocol=icmp doesn't work this way. You have to do it the following way: /ip firewall filter add place-before=[find chain=inp...

nevolex

thought additional rules will be created automatically if it's done via Winbox ? Nope. Can somebody please advise /ip firewall filter add place-before=[find chain=input protocol=icmp] chain=input protocol=udp dst-port=500,4500 in-interface-list=WAN action=accept add place-before=[find chain=input p...

nevolex

Hi guys, I created a L2TP connection in Winbox, my LAN clients can connect to it just fine, however, I cannot connect to VPN over Wan I guess it will be the firewall rules, I thought additional rules will be created automatically if it's done via Winbox ? These are my current rules: /ip firewall fil...

nevolex

HI Sindy, thank you for being so helpful, I did specify my router as dns server, allowed remote connections in DNS I am using these default rules would that be enough to drop any dns requests from wan?: /ip firewall filter add action=accept chain=input comment="defconf: accept established,relat...

nevolex

Is it a bug or work as intended? It may be both but the latter is more likely. If allow-remote-requests under /ip dns is set to no , the DNS server doesn't respond to any DNS queries coming from outside the router, including from the LAN clients. It is only safe to change this setting to yes if you...

nevolex

I got it resolved by adding a vlan interface (my internet is on vlan10) Under Interface List" Add: vlan10 ISP subinterface to "WAN", because in NAT Policies, the interfaces have now been combined to LAN and WAN in newer firmware However I have an issue with DNS, when I go to DNS setti...

nevolex

Hi guys, I just purchased a RB4011iGS and having issues connect the hosts to the internet The connection type that my IPS is using is IPoE Vlan10 I used a quicky setup and created a DHCP server, NAT, Public IP is "Automatic". Created a VLAN interface, assigned it to DCHP Client Everything ...

nevolex

Ah, right, something like this?

/ip dhcp-server network server=my_dhcp address=10.0.0.18/32 netmask=24 gateway=10.0.0.2

nevolex

sorry just to confirm as I am very new to Mikrotik. Would that work:

/ip dhcp-server server my_dhcp network 10.0.0.18/32 gateway 10.0.0.2

Where the specific client is 10.0.0.18, second gateway 10.0.0.2

Thank you

nevolex

Thanks Jotne and Sindy!

nevolex

Hi everyone,

is it possible to override a dchp gateway for 1 client.

Let's say a getaway for my network is 192.168.1.1, can I change it for 1 client only for 192.168.1.2 (I have another gateway with such ip on the network )?

Thank you all

Alex

nevolex

Hi all,

I haven't tested it yet, but is there any setting in Ros to enable Poe in or will it work by default?

Haven't received an injector yet to test it

Thank you

nevolex

Hi everyone, I have 2 Mikrotik devices, for some reason, Winbox only saves one password at a time, so when I try to connect to the second device the password is incorrect so I need to reenter one. Once Winbox knows the pass for the second device I cannot connect to the 1st one as the pass in incorre...

nevolex

Thank you for explanation

what I ended up doing is removing all the ports from the bridge and adding them individually, so I can control the ports one by one and not as in only one "all" interface

I adjust the cost path and all worked as expected

nevolex

ap bridge --> station bridge

I created a bridge and then in ports clicked on "+" and added "all" all interfaces have been added at once

nevolex

yes, but the ports are dynamic, I cannot adjust cost path for any dynamic port in the bridge.

Sorry if I am very new to mikrotik, just been having it for a few days:)

nevolex

It's bridged, so 2 simultanious connections won't work at the same time. Bridge spanning tree will decide which one to temporarly disconnect. (based on port STP path-cost) thank you bpwl, however I do I change the priority? you are right, 2.4 is the root, 5 is alternate, but both are greyed out? Th...

nevolex

hi all, I have the main access point (Audience) and it is connected to hap 2 ac wirelessly (station-bridge mode), so hap 2 can provide connectivity to the wired-only devices I am connected to both networks 2.4 and 5, unfortunately, 2.4 network is always prefered, is there a way the hap 2 can use the...

nevolex

Hi guys I know it has been a very requested feature, has anyone heard anything from Mikrotik yet, shell we hope for ROS 7? I use "no authenticate" and access lists to manually allow some devices to stay in 2.4 WLAN however I guess in big networks it is not a good idea, even in my environme...

nevolex

Hi guys, I have a Mikrotik Audience, set up in such way: It is connected to a non mikrotik router, all interfaces (physical wireless and physical nonwireless are bridged in bridge 1) There is DHCP client and bridge 1 is assigned to it (network 10.0.0.0/24) There are 3 wireless networks of physical w...

nevolex

Hi all,

I'm planning to buy one, it is meant to be standing on the desk, however, if I put it closer to the ceiling (leave it on the small shelf made for it) will that improve the coverage in general or there is no point?

Thank you

nevolex

Hi guys, I am planning to buy a RB4011iGS+RM it has a Max power consumption without attachments of 18 W and an Audience it has a Max power consumption without attachments of 28 W I would like to use one power brick for both devices, connecting it to the RB4011iGS and using POE out for the Audience. ...

nevolex

Thank you, I was meant to say that the frequencies of the 3rd band are slightly different, not in terms of channels but rather GHz :) 5.18 - 5.3 GHz for clients for by default 5.5 - 5.85 GHz for meshing by default 5.5 - 5.85 GHz is it a standard band or some sort of proprietory for Mikrotik audience...

nevolex

Thank you for your advice, in terms of frequencies for the 3rd band which I slightly higher than standard 5Ghz, would the clients be able to see that network?

nevolex

Hi guys,

I am planning to replace my Aruba Instant-On with Audience. It is a 3band Ap, however, can the 3rd 1733 Mbit/s band be assigned to clients or it is only for mesh between Aps?

Thank you

nevolex

Hi millenium7, thank you so much for your advice, it was indeed the access point which doesn't allow multiple DHCP request to be assigned to clients. I tested with the other 2 access points and got no issues at all. It is an Aruba instant On, sort of semi-enterprise one, not sure what I can do about...

nevolex

Hi, At this moment the only device that is connected to mikrotik is a PC. I can manually assign an IP to the connected pc and it will work. However what about the devices that don't support that. This is so strange that such a simple thing that a $20 dollar extender can do is so difficult to impleme...

nevolex

Hi guys I'm very new to Mikrotik (bought my first one yesterday) and intend to use is as Wireless Bridge to the main router to provide connectivity to a few clients which don't have wifi capabilities. Main Router ))))~~~((((( Mikrotik Router ------->PC Mikrotik is connected to the main router WIFI v...

nevolex

HI guys, I'm having the same issue, my Mikrotik is connected to the main router via wifi (wireless bridge (pseudobridge mode). Wlan and all ethernet ports are moved to the bridge. I do see a lease in the client section of the ros for the brdige, there is internet available for the router - I can pin...

Search found 171 matches