MikroTik

I'll retake this request...

Can you share the config?
Code: Select all
/export file=anynameyoulike
Remove serial and any other private info and post between code tags by using the </> button.

I seem to remember a discussion about this exact problem a while ago (could be many moths ago) and @Normis acknowledged the bug. I'm pretty sure it was supposed to be fixed since then, but I've no idea in which version this was fixed (if at all). So if the problem happens on a recent v7, then this ...

Does this also happen when you set in cap the specific IP address for capsman controller ?

For the moment I wouldn't update the RoS (unless you are missing some other feature implemented in later versions) and definitely not the firmware of the LTE thingy, given the issues reported on the mentioned thread that seems objectively worse than the ones you are reporting.: Quite a bit of LTE i...

First upgrade to latest 7.15 branch and then see what happens.
You can also try 7.16rc, quite a lot of LTE issues have been addressed there. Or wait for 7.16 to become stable.

I didn't explain this principle as answer to your original question because this is not a rule one can rely on. Because MAC addresses can be set manually to arbitrary values (I tend to collect some old, possibly broken, ethernet devices ... and re-use their MAC addresses for BSSIDs of virtual wifi ...

Mikrotik HW is capable enough. The problem is there are way too many settings where you can goof up and then performance goes down the drain. That's the difference with cheapo devices which have a "good for most, set and forget but you can not change a lot" config. The strength and weaknes...

Valid question and I am curious too for the solution.

Have you already launched a ticket towards support ?
They should be able to tell how it needs to be done.

Interesting entry here from Guntis (MT Staff) (and subsequent posts about the same topic): https://forum.mikrotik.com/viewtopic.php?p=1091327#p1091327 Basically, new configs should be pushed automatically. It could be on your PC the new SSID is not directly visible (I also observed it already both o...

It might be better if you start a new topic AND provide A LOT more info on what exactly you are planning to do.

Other then that, a good start for reading/researching:
https://help.mikrotik.com/docs/display/ ... +Solutions

Both: are you sure after reboot the disk where the container is stored is still on the place where it needs to be ? (usually usb1) Some USB3 keys can after reboot only be accessed using USB2-protocol (a USB reset or delay when starting up the USB-interface solves it). If they start up as USB2, disk ...

Actually, you were referring to the fact ether2 cable should be removed from device

But I get what you wanted to say and your addition is (as usual) spot on.

Default config has the rest of ether ports (and wireless) bridged and set as LAN ... from which management access to device is possible. Hence the suggestion to isntall ether2 cable as well (but that one should be removed after device comissioning if location is accessible to non-authorized people ...

Wasn't something about this visible in log files ?

Reset them to caps mode before handing over the devices.
That's what I do.

Alternatives
- always have ether2 connected as well to cable
- connect to device default wifi and then reset to caps mode
- pre configure device before it is being installed.

L22 uses wave2 radio.

That's the other capsman via wifi menu on your ccr.
Both versions can co-exist on the same controller.

But if there is only 1 wace2 device, why bother ? Set it up directly and reassess when you have multiple AX devices in your network.

Did you reset those cap ax to caps mode ?
Because if not, that would explain why you can not reach them straight away.

For legacy capsman you do need wireless package on that ccr.

Again:
First choose.
Legacy capsman using old drivers or wave2 capsman with wave2 drivers ?

It DOES matter which cap device you use, as indicated above.

If you are unwilling to answer, then I am wasting my time here.

But ... but ...

ok, I'll accept because otherwise it may be considered contempt of court

Any input is appreciated
How can an hAP ax3 have WLAN interfaces? I expected wifi.
Well the config tells me it is an hAP ac3

Model number was also a clear indication

RBD53iG-5HacD2HnD = hAP AC3

4. Do NOT use quickset Small correction. 4. Do NOT use quickset unless you start from default config It can have its value for some users though I also admit it has been hugely neglected with the arrival of AX-devices (Or later versions of ROS ? Quite a bit of Quickset schemes which were present be...

You are using old-style capsman and expect it to work with new-style wifi drivers ? That's not going to happen. One wireless driver across the board, no mix. 2 options: 1- Move everything to wave2-world: Remove wireless package from CCR1036 and setup everything under wifi menu tree. 2- Stick to lega...

Please be clear. Your first post says cAP XL. There is only cAP XL AC having "XL" in the name so we have to assume you are referring to that one. Then you say they use wifi-qcom (which is simply wrong for that device, it should use wifi-qcom-ac and then you have all the caveats I mentioned...

You can not have wireless package and working wifi interface on L009. You need to choose or move the wireless-capsman function to another device without AX radios. For AX devices (as of 7.13): Running both capsmans at the same time routeros + wireless Loses built-in cards See here: https://help.mikr...

Just to clear some things out ... Are we talking about cAP AX devices or cAP XL AC devices ? Former are pure AX devices and should work when put in caps mode. Latter are AC devices and need wifi-qcom-ac package to be used with wave-capsman (under wifi menu structure) AND there are quite a bit of cav...

Consider using ROSE package.
It's meant to be used for these cases.
https://help.mikrotik.com/docs/display/ROS/ROSE-storage

It might be a known issue.
Are you sure the disk has not been mounted as USB2 (and different label, e.g. disk2) ?
If so, USB reset should solve this issue.

Support is aware of the issue, it happens with some brands of USB disks.
No ETA yet on the solution.

MOD COMMENT: Please only post in English.
It makes it a lot easier for everyone to read your question, it makes it easier for you to get responses, it makes it easier for searching this place.
I added the translation (using Google translate).

AFAIK that's needed when using UDP.
Using TCP it should try for maximum.

EDIT: I stand corrected. Even for TCP you need set the limits.
Odd because it's not like that when using Tools/Bandwidth Test directly from Mikrotik device

I found a bug
System - RouterBOARD - Settings, reverse order of CPU frequencies
Снимок экрана 2024-09-06 222410.png

Actually ... it is sorted alphabetically.
So reverse would be wrong as well.

There are 2 most advised ways to recover from Quickset mishap:
1- reset to default and start over
2- reset to default and don't touch quickset ever again after using it once.

There is a 3th option for more seasoned users ... never use Quickset.

Did you also allow input for that port on your wAP R ?

See here: Openspeedtest on Docker on your router. https://forum.mikrotik.com/viewtopic.php?t=190891 As always: don't use it to test the router itself. Running this test does take away some resources so it will skew the results. ALways test thorugh a device, not using the device to be tested. But you...

Where's The Hood now ?

Where do you see this ? Exactly how did you get this output ? What ROS version ? I have 2 CRS326-24G-2S+ and none show this in the default script. # 2024-09-05 20:00:46 by RouterOS 7.15.1 # software id = J8K8-GJG5 # script: #| Welcome to RouterOS! #| 1) Set a strong router password in the System > U...

Nothing.

/interface bridge
add admin-mac=48:A9:8A:XX:YY:ZZ auto-mac=no comment=defconf frame-types=admit-only-vlan-tagged name=bridge vlan-filtering=yes

Once you set a port as trunk default can remain at 1, true, since the setting "Admit only VLAN tagged" overrules that anyhow. Access ports should be set to the pvid for the VLAN they are supposed to handle and "Only admit untagged ...". Nowhere else (besides trunk ports) I have p...

Because SWOS is not ROS.
Winbox is a ROS tool.

You can see it but you can not connect to it using winbox, only using web browser.

From The unofficial official VLAN bible: https://forum.mikrotik.com/viewtopic.php?t=143620 A word of caution if you are thinking of using VLAN 1 in your network design. Most vendors use VLAN 1 as the native VLAN for their hardware. MikroTik uses VLAN 0. If you try to create a VLAN 1 scenario with Mi...

And what traffic is being sent via lo ??
Can you use Tools/Torch to see what's going over that interface ?

Best not to add firewall rules without knowing where the traffic comes from or what it is being used for.

You didn't specify for which device this is but for most there should already be an input accept for 127.0.0.1 from default firewall (for capsman).
That also covers lo.

In case you removed that rule, I suggest you put it back.

Maybe there is a reason why I actively swap out Brother for HP printers with my client

(really, I do ...)

I understand what you're aiming for but it's not that uncommon. I have a router with a CSS610 switch connected via SFP+ at home and still most of my router ports are trunk ports (only 1 access port, the 2.5Gb one for direct connection to my PC in my office and ofcourse the ISP uplink). I am not the ...

Previously, before the guest network and VLAN configuration, printers connected without problems. So WPA3 can't be a problem. And yet ... try it. Plenty of problems with AX wifi which all of a sudden disappear when not using WPA3. If all other devices can connect on the new setting, there is no iss...

@user7780
Please use English as most will otherwise not be able to understand what you post.
Also for searching it's a nightmare when other languages are used.

I'm assuming there are ways to save and backup your good config if I want to test more stuff out? Yes. Binary backup (but can't really be transferred to other device). Simply restore and everything is back as it was. or export with show-sensitive on (not 100% complete export but most should be ther...

No it is not.
Big difference in usability.

The cAP ac does handle the wifi-qcom-ac pretty well (in my experience), though I red someone having out of memory problems (therefor a daily reboot was introduced). Haven't seen that problem myself (uptime over a couple of weeks). That would be me but that is using 7.16rc package. The issue has bee...

For better results, maybe disable WPA3, leave WPA2. I have much better experience with WPA2 on ax lineup.

For now, definitely better to skip WPA3, yes.

I only see config on RB5009.
Where is the config of one of the caps ?

You're correct (as usual

).

Shouldn't there also be
7. add ether5 on both routers to WAN interface list and remove from LAN (if present)

?

I'm more into testing and moving forward and I accept consequences of doing so. Most of my client production devices are steady on 7.15.1. I'm not even moving them to 7.15.3 since it's not needed for me. A couple though I use for testing (where I know it doesn't hurt too much) and at home I always u...

I'm not 100% sure anymore why I moved on to 7.16b/rc channel for that one device. Having been 2 weeks off in between can create that situation :lol: Now I think of it, I also have a wAP AC at home running 7.16rc, (same resources) no crashes there either. I have another AC2 running 7.15.1 and wave2, ...

There was a possibility that if you use an ARM router with wireless that has 128 MB of RAM and is using wifi-qcom-ac package, not wireless, then simply router could run out of RAM resources causing the router to reboot. One of the reasons why I configured about a month ago a daily auto-reboot on 1 ...

css610 host mac addresses per vlan? anytime soon?

CSS610 uses SWOS Lite.

If the provider blocks the tunnel, then the entire office is stuck. ... I just want to manage everything from one place without creating a big point of failure Your most important big point of failure is out of your control, so it seems. Besides, what will still work if the internet line is down ??...

The most logical answer: something is wrong in your setup. You saw that one coming, right ? :lol: Please post config of capsman controller and one of the caps. Terminal, /export file=anynameyouwish Move to text editor, remove any sensitive info (serial, public IP, passwds, ...) Post back here betwee...

Best way: VLANs combined with firewall rules.

The DE FACTO guide around here:
viewtopic.php?t=143620

Shouldn't ONLY the sfp1 port in your diagram be purple in color? Apart from the WAN port that is yellow, shouldn't the remaining ports have no color? Based on the legend, the purple port stands for a trunk port on the router; so it doesn't seem to make sense to have so many trunk ports on the route...

And where is the surprise ... ?
After all, it's Microsoft we're referring to here

I get Intel AX200 driver updates by Windows Update. Why the heck are you downloading drivers manually from Intel's website???? On more then one occasion I noticed Intel drivers where NOT updated by Windows Update. So don't count on it. I also have been chasing wifi issues not too long ago in the pa...

Same will happen using a fallback capsman controller ... or e.g. DFS channel detection.
You can never guarantee 100% wifi availability.

At this point - no. Actually, yes. You can use "capsman or local" for the access points manager. If capsman is available, it will be used. If not, AP will revert to local settings (which are can be pretty identical to capsman settings, so rather easy to copy over once). Other then that, a...

It's impossible to run V6 on AX3.
You can not go below factory version and for all AX devices that's V7 (here at home I see 7.5 on AX3).

Added argument: wifi drivers needed for AX3 only run on V7.

Simple explanation... As of 7.13 wireless is removed from base package in favor of wave 2 drivers. This IS clearly mentioned in release notes. Not a lot seem to care to read those. If you follow the normal upgrade procedure, this will be handled automatically in background. If you upgrade manually r...

You're welcome

I discovered that using a "normal" USB3-Memory-Stick in a RB5009 slows down the performance massive. When running my project in a chr-environment it is very much faster. Be careful (expecially with RB5009) when using USB3 as storage. For some USB devices it will after reboot come back up ...

The fact your Vodafone SIM is working on both modems, proves there is no HW problem. So there must be a config problem using WINDTRE SIM on the new modem. You can try with latest 7.16rc version, there have been some LTE related improvements in there. If that also doesn't work, best to contact support.

Contextually similar to this thread ...
viewtopic.php?t=210594

If you use CAPsMAN, the main difference is the datapath config. AC3/2 don't support VLANID from datapath AX3/2 support VLANID from datapath I'm planned to replace all my AC devices with AX for easier config management. Small addition: If you keep using legacy wireless and legacy capsman, vlanid is ...

Oops, missed that part

Just an observation:
if your aim is to extend L2, why not use EOIP across wireguard ?
Connect both ends of the EOIP interface to their respective bridges and that should be more or less it (be careful with possible loops).

Somewhere in earlier versions it was changed that CPU frequency should be set to auto.
Then the message will disappear.

Good job !

Move bridge to WAN interface list.

At first sight I would say it can be done since the standard 19" rack mount kit can be adjusted. I took a (rough) measurement on the breaking places on my mounted RB5009 (mounted in a 19" frame) and it comes out at just shy of 25.5 cm, that's 10". If you want to be 100% sure, ask supp...

It's a good ap (for the installations I use it for) but it's freaking big !!

Easiest might be to create a second bridge and bundle all WAN ports to it (that would be ether1, 4 and 5 in your case).
Move DHCP client from ether1 to the new bridge.

@Monster88
Don't post the same question multiple times, please.
I merged the two threads already containing responses and removed one which was still empty.

Carry on ...

Again, basic IP (and again new info is being presented ...) /22 netmask starting from 10.0.8.0 results in IP range from 1.0.8.1 to 1.0.11.254 If you want to have 10.0.12.x and above included, you need to change your network topology (multiple subnets) or the netmask (wider range). E.g. /21 will resu...

The way Mikrotik DHCP server works, it will assign addresses from its pool top-down. Has nothing to do with the network numbering. It makes no difference if the pool starts bottom-up or is handed out top-down. It doesn't change anything on how an IP network functions. So once again, where is the act...

Basic IP

When you define an address using /22, 10.0.8.0 IS the network indicator for an address in the range 10.0.8.1 - 10.0.11.254.
This is 100% correct.

So what's the actual problem you have and why do you think you need to change this ?

My first approach would be to netinstall to latest ROS6. Then import config block by block via terminal, don't restore from backup because you will bring the problems right back in. It's a working assumption for most experienced users here that after upgrade to upgrade to upgrade ... some blobs can ...

I know it's not relevant right now but wAP AX versions should be coming.
But over half a year it was already said "soon" ...

Can we use RouterOS and a Mikrotik device to become a travel router, i.e.[/b] - set up a Wireguard client which will route everything through that tunnel - let a laptop connect through ethernet/wifi - can also connect to eg hotel wifi and let other wifi devices connect to the tunnel - drop/block th...

And why would we provide better info then ChatGPT ??
In all seriousness ...

You can place AX3 in 2 ways. Logically thinking: airflow on AX3 is most optimal when placing it horizontally since all openings are on the large sides. Warm air goes out on top, cooler air gets automatically sucked in on the bottom. If you place it vertically, it will still cool sufficiently, just a...

I understand but that's beyond my knowledge level ... I only can tell (from other data projects I work with where each day millions of data lines are retrieved) you should try to get your data as fast as possible, then process it afterwards. Hopefully someone will chime in providing more specific an...

But a rather powerful home router, wouldn't you say ?

I'm not sure you're getting my point ...

Instead of setting up 14 SSH connections for retrieving a single value on each connection, set up 1 SSH connection and get all 14 values in one go.
Should be faster.

Are you running the CAP's in default CAPS Mode? Are the CAP's connected to a hybrid port (where MGT VLAN is untagged)? Would you be willing to share your config? 1- Starting from default but some changes: 1.1 added mgmt VLAN to bridge 1.2 changed CAPS discovery interface to mgmt VLAN. 1.3 enabled R...

Assuming you have...what switch do you use, @holvoetn?

Mikrotik CSS610

I have a similar config at home and don't use VLAN1 AT ALL.
My caps look for capsman manager on that specific mgmt VLAN (which is not 1).

If you go VLAN, do it all the way.
Which means don't use VLAN=1 anywhere.

Don't test ON the devices themselves. They are not really suited CPU wise to handle that load. Your results will be too low because the local CPU most likely will not follow. You are also testing via your ISP. You don't know what the impact is there. Use 2 PCs within your network, one on each side o...

Just thinking ...
since your setup is local LAN hence all trusted devices, doesn't it make more sense to use a single connection which remains open instead of setting up the connection each and every time ?
It should be a lot faster.

AX3 is level6.
So for less then 50% of an L6 license, you get the HW too.
You don't have to use the wifi part.

As long as it works, it's ok but suboptimal.

You can specify in Zerotier Instance which interface(s) should be used.
If you leave it to all, it tries all. So don't use all if you do not want it to use WG.

Clear certificates on controller.

Personally I don't use certificates for capsman.

Rats, I did check on the switch chip support but failed to see it couldn't handle VLAN offloading ... You could leave the default bridge/Vlan path and see if something can be done using switch chip features on that device. Not a standard approach but still possible. See here for some pointers: https...

For starters: nice drawing ! A lot of first posters never show something like it. It surely helps to get a better idea of what you want to do. Now that I'm actually getting my hands on it I can understand the various forum / reddit comments "RouterOS is quite powerful but quite difficult"....

Can you make a small drawing of your setup and what you want to achieve ?
Because I'm not sure I fully understand what you want to do.
High level I get the idea but which building blocks you want to involve where is fuzzy.

About this part: /interface bridge vlan add bridge=BR1 tagged=BR1 vlan-ids=100 add bridge=BR1 tagged=BR1 vlan-ids=200 add bridge=BR1 tagged=BR1 vlan-ids=99 Where are the interface ports being added to their respective VLAN as untagged members ? Shouldn't that be like this (I know, happens auto but I...

I've run into two issues so far: 1. Time sync on windows hosts isn't working. Had to set up NTP client and server on the router and manually configure windows hosts to target the router as their NTP server. 2. During SMB file transfers between VLANs/ports, router CPU usage peaks at 30% and transfer...

Because your wireguard interface is not accepted. Simple.

2 options:

add a specific rule to accept input via wireguard as interface
or
add wireguard to LAN interface list (most will do this since wireguard is VPN and conceptually, VPN should be the same trust level as LAN).

What's the problem then ?

Try with the wait loop as referenced in the link by jaclaz.
Just checked again, it should wait for max 115 seconds which is just below that hard limit of 2 minutes.
But do put that part as last part of your script (or as far back as possible).

What can I check ?

Log files as a start.

- In the context of "allow what's allowed, drop all the rest", adding addresses to address list for external parties trying to access your device via certain ports is waste of resources. If' it's not allowed, it get's dropped and be done with it. 6. so i just disable the block traffic fro...

Do you have to use wpa on wifi ? It's a rather slow security protocol. Try to avoid if you can and only use wpa2. You still use auto frequency selection. Can be next reboot performance becomes a lot worse. Try to see which frequency is the least used and set your frequency manually. Why do you set n...

Putting in CAP mode reconfigures device permanently.

Putting in CAP mode using reset sequence, that is ...
You can also use the mode button to make a script which toggles both modes.

Quick comments: - change WG port. This is the default from Help pages. Not that it will cause any trouble for anyone not knowing public key but better use 2 locks on the door then 1. - why the long lease times on DHCP server ? Just wondering. - Your ZT network ID is exposed in the export. I removed ...

Remove wireless
Add wifi-qcom
Reset to default.

If you use VLAN, your caps need to be able to use that same VLAN to reach CRS/capsman.

Yes !
On a smartphone search is not that easy...

I recently answered a similar post but can't find it back right now. Use fixed delay, can be up to 5 minutes ! Or check defconf script how they do it there. Waiting in a loop until lte itf is detected, then proceed or abort. But this should be the last part of your script since you need to take into...

Check this thread

No SwOS for CRS310-8G+2S+ ?
viewtopic.php?t=200859

I set a new admin password, then go to System > Reset Configuration > "Reset in CAPS Mode" And did you also tick 'Keep users' ? If not ... reset to default it is. Quite logical. Be careful with sticker passwd. O, 0 Upper I, lower L Even when MAC address shows striked zero, O can be zero, ...

just be wary, this is a USB-C 5V port, so it will not work with USB PD adapters, you need most likely a USB-A 5V adapter and A-to-C cable It sounds like this is not actually an USB-C port then and you should make that clear on the product page. All USB PD adapters can provide power to USB-C ports. ...

Simple queue based on subnet or address, I would say.

https://help.mikrotik.com/docs/display/ROS/Queues

Ah .. the good old saying

"In /dev/null nobody hears you scream"

I've been kind of trying to avoid using IPSEC as the traffic inside the tunnel is already encrypted.

How ? EOIP on its own doesn't encrypt anything.

However....in de web interface one cAP has "Wifi" and "Wireguard" greyed out. So there sure seems to be a slight difference. Do you have wifi-qcom package on that device ? It's needed as of 7.13. If it's not present, load that package, let it activate (reboot) and then reset the...

Your requirements are not really clear.
Sending mail ?
Receiving mail ?
Sending to ... ?
Receiving from ... ?

And how would you plan to do that with a router ?
Can't be done without specialized gear.

Besides, anyone opening a web browser can send/receive and nothing you can do about it ...

For intra-LAN traffic, no need to use anything else then EOIP on its own. When crossing WAN, one should really consider some encryption method. My personal preference is Wireguard since it's easier to setup for me. I have plenty of EOIP connections running over Wireguard using all sorts of devices (...

Good observation

For us, It is either we start replacing the existing MikroTik AC devices with their new outdoor AX units -- which will require ALL new switching infrastructure [no more 802af standard], or we swap out for other vendor. Or wait for true wAP AX which surely will use 802af (like cap AX does). But that...

Modem is included in this kit.

But ... this model is discontinued (which does not mean it will not work !).
Maybe you should also have a look at LHGG LTE6 kit ?
https://mikrotik.com/product/product_ge ... 3_16_41_07

Best to contact support, maybe they can provide a solution.
support@mikrotik.com

Save yourself and anyone else a bit of trouble and post your config ...
I just did. I posted just part of it to save time. If everything looks good. I will look elsewhere.

No, you did not.
Those are extracts from print statements. That's not config.

Use the instructions Larsa linked to.

Save yourself and anyone else a bit of trouble and post your config ...
You can't learn if you are chasing your own tail.

Worst case (if your really don't want to show your config), reset to default and start over.
Take step by step and see where it stops working. That's where you went wrong then.

A cable is still easier and more efficient from cost and energy point of view...

You can even run 10Gb/s over cable if you really want.
Try that with wireless

Already for quite a while...

Go to user control panel, tab subscriptions.
That's how I keep track of responses in subscribed threads now.

Edit: ah wait ... it starts working again ?
For how long ?

Check extra packages for the device you want to install it on.
It's in there.

I already created a sup ticket in the past.
It was acknowledged and supposed to be fixed in a new version but no ETA.

Use dynamic ports on bridge on cap
They will be added automatically.

That's a rather important piece of info you failed to mention the first time. You never even mentioned what device you have, which version it currently uses, ... Downgrade then if it worked before and make support ticket with all required info so it can be investigated. I understand you don't want t...

Be aware there is a bug on RB5009 (I see it frequently on my device but haven't seen it yet on AX3) where after reboot USB starts up as USB2, not USB3. Again reboot or performing USB reset fixes that. But if this happens, then your speed will drop dramatically. It will also result in drive to be ren...

Same suggestion as one post above you.
Post your config.

Some questions: - is 165.132.145.101 connected to the same network as your router or is it outside ? (WAN part) If inside, your dst-nat rule only allows incoming via sfp. If that PC is inside your network, it will never use that sfp-connection. - is traffic using port 2222 accepted to be forwarded o...

Slave config will always follow the physical part of master. That's normal. You can play on slave part with ssid, security, fast transition, ... but not channel nor band, those will be taken from master. As for your second question: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-CAPsMAN-CAPVLA...

First, use the correct documentation: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample: Second: if all your devices (cAP and controller) are AX2, there are no additional packages needed then what's needed to run the device standalone. Attention: packages have ...

Can you please post again latest config as well as the one of 2 peers ?

Mask the keys. Just make sure it's clear where they are supposed to be the same.

With some clever text manipulation (can even be done in Excel) you should be able to get all the lines populated for upload via terminal.

It does if you foresee rules for known MAC addresses and then drop for all the rest.
Just like in firewall rules...

Fixed.

Potential memory leak detected on cAP AC using wifi-qcom-ac drivers, resulting in kernel panic due to out of memory.
Simple AP config, 2 SSIDs, not even using VLANs on that device.

SUP-161244 created.

From your two examples:
10.8.0.2/32 and 10.8.0.3/32 respectively.

It's quite well explained in the Wireguard documentation.
https://help.mikrotik.com/docs/display/ ... uardtunnel

Is that your "server" config ? I suspect your problem is here: add allowed-address=0.0.0.0/0 If you use that on all peers, your "server" will not know what needs to go where. If one peer is active, there is no confusion. If a second one comes in using the same settings, it's chao...

Not.
You need to select the correct country where you are using your device.

I would think Access List.

ROS 7.0beta3 ??
That's ... over 4 years old ? That version was released 2019-10-22.

Security step 1 already omitted.

A simple mAP might be a cheaper alternative.
Can easily be battery powered too.

It has 2 Fast Ethernet ports and it runs ROS.
You can even be devious and change settings based on assignments/progress using Wifi.

It does result in a lot less log messages on the server side.

Actually, security always comes with some level of inconvenience. It's up to the admin to decide what he/she values most: convenience or security. Accept inconvenience then or get rid of humans ... :shock: we all should be quite aware the human factor (and it's accompanying need for convenience) is ...

CHR already runs in VM environment, right ?
Put your Linux right next to it. No need to run it in Docker then.

Valid point !

Try removing the channel.frequency parameter from the wifi configuration named cfg5ax . If that does not help, where exactly does My 5G on AX cAP's appears for a few seconds and disappears again happen? On the WiFi tab, on the radios tab, or somewhere else? Most likely DFS frequency gets selected (...

Now you mention this, my explanation was completely backwards :shock: :? Oops ... In that case, tick "responder". That's what it does. It does not go out, it only listens. What it should be then: You should use this for the device which acts as arrival of the connection. Only if some devic...

Change frequency to the LEAST occupied one.
I can get close to 100Mb on 2.4GHz IF you make sure nobody else is on the used frequency (which is rarely the case using that band).

And set your country correct.

You should use this for the device which acts as initiator of the connection. Not if some device is only waiting for connections to come in (useless there). So roadwarrior situation: The mobile device should have it. The "server" not (yeah yeah, wireguard is all peers, I know ...) Site 2 s...

Minimum required amount for RAM on ROS7 is 64Mb.
Hap lite doesn't have that.

It may run on that device but you can expect quite a bit of problems.

I will probably get yelled at for wanting to reject the newest greatest and use the obsolete, but is it possible to use the old wireless packages with the Mantbox ax 15s?

Simple answer: no.
Drivers for AX radios are only in wave2 part. Not in old wireless package.

Why do I have this deja vu feeling?

Same poster, same question, same answers:
viewtopic.php?t=209273

I already had the feeling too I saw this recently with the same reluctance to accept the answer....

Export of config please, no screenshots.

Better approach: Just tested it using mAP Lite, this works better. Start from default. Add wireguard interface Once it's working /routing table add name=useWG fib /ip route add distance=1 dst-address=0.0.0.0/0 gateway=wireguard-inet table=useWG /routing rule add src-address=LANsubnet action=lookup t...

Your config looks rather simple.
Start again from factory setting and change it step by step.
Observe where it stops working.

I'm a bit puzzled too what the cause may be ...

Something is wrong in any case with that interface.
You can already see it because the name is italic.

If I simply add another WG interface on my router, it immediately comes in Running state and no italic name.

What ROS version are you using ?

so your saying, there is no ntp package for smips?

It's not in extra packages ZIP file so yes, it's not available.

And you have the same problem whatever ether port you connect to ?
You also had this problem right after starting config (factory config applied) ?

Because there is a problem with the interface where you want to apply that address to.
That needs to be fixed first.

Best to export your config, edit on PC and remove serial / WAN IP / public keys /...
Then post back in between [code] quotes for easier reading.

Are we necro posting, bpwl ?
Replying to a thread of almost 10 years old ...

Which version of winbox are you using ? Latest is 3.41.

Easy and RouterOS usually don't go in the same sentence :lol: The learning curve is quite steep but once you get how it works, it's amazing what you can do with these devices. I'm looking forward to use it with a 30GB/365-Days plan for only 40€/year. I used to have an SXT LTE in vacation house in So...

OK, already tried putting 7.15.1 on that new device ?
What happens then ?

Because if that works, there might be a bug ...

Which hap are you talking about ? Because normal hAP is MIPSBE, not SMIPS. hAP LITE perhaps ? That one uses smips architecture. What's the exact board model ? NTP server is part of NTP package BUT that package is not available for SMIPS. What other functions besides ntp do you need ? ROS7 is not rec...

Same HW so same switch. But 2 different devices. Semantics perhaps yet important distinction. When doing text compare between configs the only differences are: - that manually added route - ether47 not being added to bridge on old config (possible but doubt it) - IP address is different (but that's ...

Depends on the traffic requirements you have for that LTE link and how good/bad reception is in the area where you want to use it.

A simple AX Lite LTE may already be enough (I use it as road warrior device so not stationary installed, always have it with me in my backpack).

Check IP route
It's different between old and new.
(as in: it's present in new config and it's not in old so there it is default whereas in new it's not default, it has been added)

Check usb part what is being listed there as devices.
Does USB reset bring back the stick ?

If this persists, best to create supout.rif when it disappears again and create ticket with support.

You can also try another USB stick first. Not all brands are equal.

Best to upload your config between [code] quotes.
I don't seem to get the info via that link.

Have you checked on the device or in the box if there is a sticker with default admin passwd ? Already quite some time Mikrotik changed the default admin/<blank> entry to a device-specific passwd, available on sticker or label. It could be your previous device did not have this implemented yet and t...

But this can't work properly, because the ECM routes are ... well ... equal... On DHCP client for ether1 set default distance to something higher. I usually set at least 5 or 10 so my manual routes can be set to a lower distance. For equal destinations, lower distances get preference if they are re...

Your mAP Lite connects to wireguard using ether1.
Your PC connects to your mAP Lite using local DHCP/network/..., yes ?

Treat that wireguard connection as any other ISP connection for everything coming from bridge.

First, a nit: you'll want to remove the "&p" bit from the end of the bookmarks you have, as Fossil's latest anti-bot defenses consider this a "complicated" URL, forcing a redirect to a "honeypot" page meant to trap bots, keeping them from running up the CPU usage o...

Agreed, that the maplite will need two wifi connections, probaby 2ghz to the hotel and 5ghz to the customer laptop for example. Small problem: there is no 5GHz on mAP Lite. You need 2 wireless connections then, one slave of the other. First one to connect to whatever network you want to connect to....

If I'm not much mistaken, RBwAPG-60ad wireless wire kit ...

Ah, missed that one.
You're correct to ask more info.

RouterOS can be quite daunting at first, that's a fact. Learning curve is quite steep, we've all been there (and still learning). As for your problem: Default your device will act as router with its own subnet. Devices connecting to it should have internet access but you can not see them from your n...

Delay will take care of that.
No need to complicate things....

What's the difference between checking in a loop until one minute has passed or simply waiting 1 minute ?
What do you think is easier ?
The result is the same....

It's not because something can be done that you should do it. Already to start it's crazy to install CHR in VM on Qnap. Yes, you can do it. Is it sensible to do so ? Not so much. Performance wise it's (to say it politely) not so smart. And then you want to dive a virtualization level deeper using do...

Make script - on startup
First line: delay 60
And then your line.

what is the problem ?? A misunderstanding of the feature, that's what's wrong, I think. Lock On First - Allows to learn source MAC address from the first received frame, this property should be used together with Port Lock. Learning of the first MAC address will reset every time an interface status...

The better solution ?
Don't put CHR in VM on QNAP.

I think some others already hinted into that direction...

You can use access list to setup passwd per device.

Old thread, I don't know if it is also applicable to AX-line of devices:
viewtopic.php?t=94842

Docker on CHR in VM on Qnap NAS ??
OK ... why not...

https://tangentsoft.com/mikrotik/wiki?n ... re+Not+VMs
(section: CHR Complications)

Are you sure the master is receiving those requests at all ?
No incoming firewall rules blocking some things ?

EOIP it is then ...

But I would regard this as a missed business opportunity.

I don't get it...

You're the isp.
You do control cap and capsman but not the router in between ?

It's not because you don't see it, nothing is/was selected.
An export would have made that clear.

But good you found the problem

Search found 6398 matches