MikroTik

You need to be correct with your references. The company’s investigation traced the campaign to a hacker-controlled botnet made up of hijacked internet devices, including Asus and MikroTik routers, DVRs, and web servers. It doesn't say Mikrotik (nor Asus) is one of the MAIN culprits. It doesn't say ...

Not good news.... I use 44 piece cap AC with qcom-ac (more VLAN and ~70 piece wifi client with 802.11r fast BSS transitions ( roaming), routeros 7.15.3 and 7.16rc1-5). After 7-10 days runs out the cap's memory. I am on 8+ days and RAM is declining indeed. I have not enabled graphing so I can't proo...

I get your point and I do agree default inactive interface is the best way, security-wise.
But it may be inconvenient for some to enable it again

Maybe reading a bit carefully won't hurt ... In some cases removing SIM from slot is not convenient ... then providing simple script to netinstall with command which disables lte1 interface is the way... Convenience is a factor which has a huge impact towards lowering security. Human factor BTW is ...

You can always install without SIM being present.
Result: no LTE.

Mission accomplished.

Please post config of wifi part.

Why do you put a 100Gb -> 4x25Gb breakout cable in a router with only 10Gb as max on SFP+ port ?
You read the specs for CRS504 but not for RB5009 ?

Use a simple DAC and it will connect at 10Gb, I would think.

Adding: this part from changelog 7.16 *) container - clear VETH address on container exit and mark interface as running only when VETH is in use; ...is not yet implemented in 7.17b2. It's not in the changelog so no surprise but it's one of the things which set me off initially when troubleshooting d...

Any hints in log? Missing exec. Only thing which shows in log after start and then immediately stop. At first sight (quickly logged in via wireguard during lunch break) disk is mounted correctly (it did cause problems in the past with some USB3 drives on Rb5009 but it seems it gets recognized ok no...

Were do I need to look then ? Any hints in log? Missing exec. Only thing which shows in log after start and then immediately stop. At first sight (quickly logged in via wireguard during lunch break) disk is mounted correctly (it did cause problems in the past with some USB3 drives on Rb5009 but it ...

If your containers stopped working after upgrade to 7.17, it might not be related to device mode at all.

I never said it was related to device mode.
However it is related to ROS 7.17beta... and that's what this thread is about, no ?

I will troubleshoot this evening.

Nothing should happen, on my ax3 everything is working. Do you have an issue ? It's not ok on my RB5009. None of my containers start (iperf, openspeedtest, pi-hole) and yesterday I noticed a couple of drops during Teams calls (never saw that happening before). Will troubleshoot later this evening.

Consider moving to Wireguard.
Purely CPU (= no HW offload) and yet WAY faster then all the rest (sometimes even faster then HW offloaded ipsec on same HW)

Instead of damaging hAP AX Lite, why not use L23UGSR-5HaxD2HaxD and start from there ?
It has connectors for attaching antenna to it.

Or do you need the ether ports as well ?

My CRS310-8G+2S+ simply refuses to upgrade from 7.12.2. The arm package is there, but it doesn't get picked up on reboot. Most likely space issues because moving from 7.12.x going higher, will probably also install wireless. On a switch ... :shock: (on the CRS devices I upgraded, I saw it each time...

I would think ... light pipes ?

And to close everything on a more light tone:

Mikrotik admin rules:

1) You do not use VLAN1
2) You DO NOT use VLAN1
3) You do not use Quickset
4) You do not use detect internet
5)...

65° is not "preoccupying", but it is right on the border of "temperatures I won't run my electronics at for long periods, if I can avoid it". Consumer grade equipment can run without any issues at 70C, industry grade goes to 85C or so. Military grade can surpass 120C. I would be...

You're mixing up two things...

I see references to AX devices yet wireless package.
So what are you exactly trying to do ?

*) wifi-qcom-ac - improved memory allocating process; I'm afraid this is not fixed yet. cAP AC, reboot after 2d22h due to kernel failure. PRTG monitoring shows increasing memory usage until reboot happens. Back to daily scheduled reboot for now 8) I already have an open ticket, will send autosupout...

You need full L2 and udp access.

Q:
2 versions of capsman with 1 ap each ? Why ???

Are you sure there is no time out because of radar detection ( DFS check) ?
Can take up to 15 minutes.

When testing using internal iperf server, I frequently see 700-ish on AX devices.

As a SW engineer you _should_ know clearly defined specs are paramount before starting any development. Otherwise you start but you will never know when it ends nor where it ends. So ... what exactly is required to be done ? 1 line is not enough. A small drawing of the network setup clearly indicati...

It's a bit misleading since the same screens are used for local and capsman controlled interfaces. The ones marked with L should be locally managed since MT themselves clearly mentioned capsman CAN NOT control local interfaces. What is indicated as manager on those 2 radios marked with L ? My guess ...

Adapt script to ROS7.
Not much else you can do about it...

It has been on and off for a good part of the year, indeed.

I already made it a habit to go to user control panel and then check subscriptions.

And just before the weekend ...

If on 2ghz, then distribute to devices in the room with 5ghz and of course the reverse. Obviously you are not familiar with the power of ROS and using virtual AP interfaces :shock: mAP and mAP Lite also only have 2GHz radio. They can be used for those cases just fine using virtual AP interfaces.

hAP AX lite LTE and if needed battery pack.
Covered for at least 10h straight ...

Nobody really needs 5GHz when out in the field (to be honest: I don't). Besides, that LTE connection can not fill that pipe, so why bother ?
400Mbps on 2.4GHz is already plenty.

Never use whatever beta when you can not afford breakdowns ...

Really ?

www.mikrotik.com
tab Support
Contact Support

Or send mail to support@mikrotik.com

First, contact support with supout.rif, if you haven't already.
Personally I had to contact them already a couple of times for LTE issues with beta SW and usually they are pretty responsive.

Also (but that's my controlling nature)
test results with nice round figures (ending on all 0's), are usually an indication it hasn't been tested at all.
These are no real test results as far as I can see. Too bad someone did not notice this before publishing them.

Those results do look very bad
As if they, somehow, only tested the 1Gbps MGMT port?

... and didn't pay attention that those test results are not what they were expected to be ?
I mean, why have 4x10Gb ports if the device is only capable of moving 2Gbps in total ?

The 1M € question ...

Rephrased:
Why do you think you need to move to capsman if it works now ?
What do you think (from watching all those YT videos) you can use to your benefit which you currently don't have with your current setup ?

powered by power supply or Poe?
PoE from a 4011.

Updated device FW as well to 7.16 ?
Already 2 users with POE issues which were solved after performing FW upgrade as well.

You can not downgrade below factory firmware version.
What does your device show using System / Routerboard ?

First thing which comes to mind:
Usage of untagged vlan 1.

Some brands accept it. Some don't.

Best to avoid vlan1 completely.

@pe1chl
Did you also upgrade FW on that device ?
I've seen a similar report, I think, which was solved when fw was upgraded.

As a side note: whenever you change something in firewall rules, clear connections table or restart. Or it might take a while before you see the effect. But wireless/wifi-qcom confusion is going to be the winner here. As of ROS7.13, you don't even need to load wifi-qcom driver anymore for capsman co...

There was a memory leak as well on cap ac when using wifi-qcom-ac drivers.
Testing since yesterday, no results yet ( before it would go OOM after almost 2 days).

On one side you are right, but on the other - if you asking something for years for a really huge enterprise - why not just create your own log proxy to convert it to whatever you want? I understand the request but I'm in this camp as well given the time passed. -Get version -Apply translation as n...

From what I understood, WOL uses UDP magic packet so it HAS to be on the same subnet or it gets blocked.

You could perhaps look into this thread where a possible workaround was suggested:
viewtopic.php?t=182266

You could ask sales@mikrotik.com but they usually don't provide a lot of info on their roadmap.
Maybe your distributor could have some more leverage to obtain this info ?

From what I understand he wants to have users using a wireguard server NOT on RB5009.
So a different server.

Hence port forward and be done with it.

I am also having this issue, and I'm seeing many threads about this same issue. Bold statement, where is the proof ? I haven't seen it being reported here that often. I don't read all threads but if there were many, I would probably have noticed. I'm pretty sure if there were so many threads, suppo...

You may want to read, review and digest this excellent post, considered to be the DE FACTO VLAN bible for ROS:
viewtopic.php?t=143620

Have you checked total output on all POE ports ?
Maximum is 27A at 26V OR 13.2A at 53V

How much current is being drawn by those Hikvision cameras ?
From spec of CRS354

Max out per port output (input 18-30 V) 1000 mA
Max out per port output (input 30-57 V) 570 mA

But that's not what I asked about. I do not want to terminate these Wireguard users on the RB5009 (see earlier post).

In that case apply simple port forward towards the server which will accept these wireguard users.
And be smart and use another port then the one you already have in use.

Is it normal for CAPSMAN not to show traffic from the CAPs? I've upgraded, things work but I only see traffic on the individual CAPs but not on CAPSMAN. If wifiwave2 capsman, that's already the case since start of wave2 capsman, many, MANY moons ago ... Or are you referring to legacy wireless capsm...

2 tabs to the left.

Bridge / ports

You may want to review this excellent guide (and defacto bible regarding VLAN on ROS):
viewtopic.php?t=143620

Section related to access point.

You did not add wifi interfaces to bridge/port ?
They should be added as untagged, not the VLAN itf itself.

There has been a rather large period of beta and rc testing.

For some there are too much changes.
For some there are never enough changes.

It's never good for everyone everytime.

It seems you are correct, they didn't bring over all examples from the old wiki environment ... (to say it more accurate: I couldn't find them in the Help pages, only on old Wiki) See here: https://wiki.mikrotik.com/wiki/Manual:TOC Section wireless, right column with examples. There you can find the...

Best to ask support or sales.
MT staff does visit this forum from time to time but not that often and certainly not all posts.

support@...
sales@...

I was tempted for 5 seconds to simply delete this post but... 1 installing packages is dead simple, if done in the correct way. 2 setting up wifi should not be too hard if you follow help pages. Even default config already helps a lot ( although sub optimal). 3 maybe you need to look in the mirror ?...

Which part of that quote is not clear ?

Can be controlled per port independently.

Wireless will not work on AX line.

Dropping the ros file directly, was the odd way. If you followed upgrade path, it would have first upgraded to 7.13.2. And the next upgrade wireless would automatically have been split ( something which was prepared in the background with 7.13.x). Help pages still have all examples and settings for ...

Looks like you upgraded in an odd way then because normally that wireless package should have come nicely in the regular upgrade process.

But now you need to choose first:
legacy wireless - add wireless package
wave2 wifi - add wifi-qcom-ac

After upgrading my RB4011iGS+5HacQ2HnD from 7.15.1 to 7.16rc4 I noticed that apparently the default name of the wireless interfaces has been swapped. ... Is this an intentional change? I do not see it in the release notes. Of course keeping it like this could get confusing lateron, so maybe I shoul...

Most likely this one: add action=accept chain=input comment="CAPSMAN PORTS" port=5246,5247 \ protocol=udp It accepts capsman access from EVERYWHERE. Best to add in-interfacelist=LAN Then only LAN is allowed. But I agree, those firewall rules can benefit from a major overhaul ... quite some...

It's not clearly listed but given size and cost, I would think passive POE and nothing else.

Cap XL AC default comes with legacy wireless drivers. If you want to use wifi part of menu, that means wave2 drivers. So you need to remove wireless and load wifi-qcom-ac driver. Or stick with legacy wifi but then you need to use Wireless / Wireless part of the menu structure. Can you list which pac...

Use a proper UPS, perhaps ?

Usually, on PCs, RTC is in a separate chip.

Please post in English.
I have added a machine translated English version.

The whole forum is in English
Using 1 common language will help you get an answer a lot faster.
Also, search engines will be able to pick up your question (and responses) a lot easier in case others have the same issue.

Why is this marked as "Solved" ?

Firewall on PC is off ?

Correct. You can specify the frequency range yourself but if it's only DFS range and DFS is detected, it's radio silence when that happens ... A bit logical those are not used that much, everyone tries to avoid them. BTW heavily congested ? You obviously need to take into account your client devices...

If you do not specify it, it will be default untagged for the pvid linked to that port.
Best to specify it anyhow so it will show in export of config and gui-screens. Then you will most likely remember why you made that change

Ether5 is an access port so it should handle untagged frames coming in.
Your TV doesn't know a thing about VLAN.
So Ether5 needs to be untagged.

Normally for wifi-interfaces it should also be like this but the underlying wifi-driver may take care of that.

Only as a side note, ...(I simply cannot bear videos, but that's just me) ...

You're not alone.
I prefer a good old searchable manual anytime over whatever video which usually is a waste of time for the most part (to me).

OT: it really bugs me that Apple require an A17 chip to enable ChatGPT integration in iOS 18. It’s so very typical of Apple always finding new ways to push people to upgrade their hardware. The same company which added a deliberate slowing down of older HW and it still surprises you ? What do you t...

Nothing.

You call native MacOS and Linux client "nothing" ?

If that PC is recent Windows, check firewall settings.
Default Windows doesn't allow incoming ping.

My 0.02€ ... cAP AC is still being sold (just bought 8 for a new setup with a customer) and you can load wave2 drivers on them. I prefer the square package they come with over the round one. Fabulous decision from Mikrotik to have both in the box. cAP AX is more performant, absolutely no doubt there...

You could have mentioned that load balancing setup to start with. Rule of thumb to assess performance: look at test results, routing and 25 filter rules. That gives you an idea of the ballpark figure your device should be able to handle as a regular router. For RB3011 it shows 453Mbps (give or take)...

Obviously you can leave everything to auto and use the controller to do its thing.
But it may result in a sub-optimal setup.
That's my personal view.

Mikrotik gives you the advantage to take all those things in your own hands and decide what frequency gets used where.

At least here in Italy most "mobile" POS (Point of Sale) card readers come with their own (GSM or LTE, cannot say) modem and SIM (cannot say if physical SIM or e-sim) ... In Belgium we can choose for most suppliers (Atos Worldine, Ingenico, ...). BUT ... with nowadays obsession on isolati...

My take: 1- Plan your channels, both on 2.4 and 5Ghz so they don't overlap. It helps to use drawings of building/floor. 2- try to avoid DFS channels _if possible_ 3- use provisioning rules so you KNOWN which channels get fixed assigned to which cap. You can also use regex expressions if you name you...

Been there, done that. Normal clipped fingernails are not sufficient either to guide it further. I use flat end of a paperclip, even tip of a ballpoint pen can be used (but then you got the ink all over the side of that SIM :lol: ) Slightly perplexed why only Wi-Fi 6 on 2.4GHz but the need is only f...

Use Tools / Profile to have at least an idea which service is causing the load.

Some services can be distributed to multiple cores, some are single-core.
It can also be a config issue (e.g. wrong VLAN setup where everything passes CPU instead of being HW offloaded).

No way. You need two radios = 2 different wifi interfaces to do that. As indicated by bpwl, perfectly possible using main radio and virtual AP as slave. I also have mAP and mAP Lite using such setup for years. Only "drawback" is that your main wifi needs to be connected before slave will ...

Upgrade to 7.15.3. There have been quite a bit of LTE fixes there.
I would try that first.

So many factors at play ... I assume it's one flat network, no VLANs involved ? HEX S might indeed be the limiting factor when doing LAN to LAN. You can easily test this when testing using 2 ports on HEX S itself, you should get close to 950Mb then. How do you test ? Using internal iperf3 server ? I...

Not realy sure what you mean with cap-mgmt connection. My main natwork is on primary VLAN (1) and CAPsMAN and CAPs communicate over this. I was already thinking it was going into this direction ... There is some internal joke between more seasoned users about some basic rules when using MT gear. It...

Did you enable all needed VLAN handling on that switch ?
You have to add at least the needed VLANs for wifi channels and cap-mgmt connection.

About that RB5009 config ... why multiple bridges ? For docker I understand but the rest ? You're complicating things quite a bit this way.

(I added some comments in my previous post, in case you missed it ...)

I mean export of cap device which is not showing... is that the AX device or also an AC device ? And .. if you have a mix of wifi-qcom-ac (AC) and wifi-qcom (AX) devices, there are some things to take into consideration. You surely already had a decent look here ? https://help.mikrotik.com/docs/disp...

Why do you have both capsman versions enabled on RB5009 ?
Are you sure the missing cap is not visible in the other controller environment ?
Are you sure ALL of your caps devices use wave2 drivers ?

It might also be best to have the export of the caps not showing.

I'll retake this request...

Can you share the config?
Code: Select all
/export file=anynameyoulike
Remove serial and any other private info and post between code tags by using the </> button.

I seem to remember a discussion about this exact problem a while ago (could be many moths ago) and @Normis acknowledged the bug. I'm pretty sure it was supposed to be fixed since then, but I've no idea in which version this was fixed (if at all). So if the problem happens on a recent v7, then this ...

Does this also happen when you set in cap the specific IP address for capsman controller ?

For the moment I wouldn't update the RoS (unless you are missing some other feature implemented in later versions) and definitely not the firmware of the LTE thingy, given the issues reported on the mentioned thread that seems objectively worse than the ones you are reporting.: Quite a bit of LTE i...

First upgrade to latest 7.15 branch and then see what happens.
You can also try 7.16rc, quite a lot of LTE issues have been addressed there. Or wait for 7.16 to become stable.

I didn't explain this principle as answer to your original question because this is not a rule one can rely on. Because MAC addresses can be set manually to arbitrary values (I tend to collect some old, possibly broken, ethernet devices ... and re-use their MAC addresses for BSSIDs of virtual wifi ...

Mikrotik HW is capable enough. The problem is there are way too many settings where you can goof up and then performance goes down the drain. That's the difference with cheapo devices which have a "good for most, set and forget but you can not change a lot" config. The strength and weaknes...

Valid question and I am curious too for the solution.

Have you already launched a ticket towards support ?
They should be able to tell how it needs to be done.

Interesting entry here from Guntis (MT Staff) (and subsequent posts about the same topic): https://forum.mikrotik.com/viewtopic.php?p=1091327#p1091327 Basically, new configs should be pushed automatically. It could be on your PC the new SSID is not directly visible (I also observed it already both o...

It might be better if you start a new topic AND provide A LOT more info on what exactly you are planning to do.

Other then that, a good start for reading/researching:
https://help.mikrotik.com/docs/display/ ... +Solutions

Both: are you sure after reboot the disk where the container is stored is still on the place where it needs to be ? (usually usb1) Some USB3 keys can after reboot only be accessed using USB2-protocol (a USB reset or delay when starting up the USB-interface solves it). If they start up as USB2, disk ...

Actually, you were referring to the fact ether2 cable should be removed from device

But I get what you wanted to say and your addition is (as usual) spot on.

Default config has the rest of ether ports (and wireless) bridged and set as LAN ... from which management access to device is possible. Hence the suggestion to isntall ether2 cable as well (but that one should be removed after device comissioning if location is accessible to non-authorized people ...

Wasn't something about this visible in log files ?

Reset them to caps mode before handing over the devices.
That's what I do.

Alternatives
- always have ether2 connected as well to cable
- connect to device default wifi and then reset to caps mode
- pre configure device before it is being installed.

L22 uses wave2 radio.

That's the other capsman via wifi menu on your ccr.
Both versions can co-exist on the same controller.

But if there is only 1 wace2 device, why bother ? Set it up directly and reassess when you have multiple AX devices in your network.

Did you reset those cap ax to caps mode ?
Because if not, that would explain why you can not reach them straight away.

For legacy capsman you do need wireless package on that ccr.

Again:
First choose.
Legacy capsman using old drivers or wave2 capsman with wave2 drivers ?

It DOES matter which cap device you use, as indicated above.

If you are unwilling to answer, then I am wasting my time here.

But ... but ...

ok, I'll accept because otherwise it may be considered contempt of court

Any input is appreciated
How can an hAP ax3 have WLAN interfaces? I expected wifi.
Well the config tells me it is an hAP ac3

Model number was also a clear indication

RBD53iG-5HacD2HnD = hAP AC3

4. Do NOT use quickset Small correction. 4. Do NOT use quickset unless you start from default config It can have its value for some users though I also admit it has been hugely neglected with the arrival of AX-devices (Or later versions of ROS ? Quite a bit of Quickset schemes which were present be...

You are using old-style capsman and expect it to work with new-style wifi drivers ? That's not going to happen. One wireless driver across the board, no mix. 2 options: 1- Move everything to wave2-world: Remove wireless package from CCR1036 and setup everything under wifi menu tree. 2- Stick to lega...

Please be clear. Your first post says cAP XL. There is only cAP XL AC having "XL" in the name so we have to assume you are referring to that one. Then you say they use wifi-qcom (which is simply wrong for that device, it should use wifi-qcom-ac and then you have all the caveats I mentioned...

You can not have wireless package and working wifi interface on L009. You need to choose or move the wireless-capsman function to another device without AX radios. For AX devices (as of 7.13): Running both capsmans at the same time routeros + wireless Loses built-in cards See here: https://help.mikr...

Just to clear some things out ... Are we talking about cAP AX devices or cAP XL AC devices ? Former are pure AX devices and should work when put in caps mode. Latter are AC devices and need wifi-qcom-ac package to be used with wave-capsman (under wifi menu structure) AND there are quite a bit of cav...

Consider using ROSE package.
It's meant to be used for these cases.
https://help.mikrotik.com/docs/display/ROS/ROSE-storage

It might be a known issue.
Are you sure the disk has not been mounted as USB2 (and different label, e.g. disk2) ?
If so, USB reset should solve this issue.

Support is aware of the issue, it happens with some brands of USB disks.
No ETA yet on the solution.

MOD COMMENT: Please only post in English.
It makes it a lot easier for everyone to read your question, it makes it easier for you to get responses, it makes it easier for searching this place.
I added the translation (using Google translate).

AFAIK that's needed when using UDP.
Using TCP it should try for maximum.

EDIT: I stand corrected. Even for TCP you need set the limits.
Odd because it's not like that when using Tools/Bandwidth Test directly from Mikrotik device

I found a bug
System - RouterBOARD - Settings, reverse order of CPU frequencies
Снимок экрана 2024-09-06 222410.png

Actually ... it is sorted alphabetically.
So reverse would be wrong as well.

There are 2 most advised ways to recover from Quickset mishap:
1- reset to default and start over
2- reset to default and don't touch quickset ever again after using it once.

There is a 3th option for more seasoned users ... never use Quickset.

Did you also allow input for that port on your wAP R ?

See here: Openspeedtest on Docker on your router. https://forum.mikrotik.com/viewtopic.php?t=190891 As always: don't use it to test the router itself. Running this test does take away some resources so it will skew the results. ALways test thorugh a device, not using the device to be tested. But you...

Where's The Hood now ?

Where do you see this ? Exactly how did you get this output ? What ROS version ? I have 2 CRS326-24G-2S+ and none show this in the default script. # 2024-09-05 20:00:46 by RouterOS 7.15.1 # software id = J8K8-GJG5 # script: #| Welcome to RouterOS! #| 1) Set a strong router password in the System > U...

Nothing.

/interface bridge
add admin-mac=48:A9:8A:XX:YY:ZZ auto-mac=no comment=defconf frame-types=admit-only-vlan-tagged name=bridge vlan-filtering=yes

Once you set a port as trunk default can remain at 1, true, since the setting "Admit only VLAN tagged" overrules that anyhow. Access ports should be set to the pvid for the VLAN they are supposed to handle and "Only admit untagged ...". Nowhere else (besides trunk ports) I have p...

Because SWOS is not ROS.
Winbox is a ROS tool.

You can see it but you can not connect to it using winbox, only using web browser.

From The unofficial official VLAN bible: https://forum.mikrotik.com/viewtopic.php?t=143620 A word of caution if you are thinking of using VLAN 1 in your network design. Most vendors use VLAN 1 as the native VLAN for their hardware. MikroTik uses VLAN 0. If you try to create a VLAN 1 scenario with Mi...

And what traffic is being sent via lo ??
Can you use Tools/Torch to see what's going over that interface ?

Best not to add firewall rules without knowing where the traffic comes from or what it is being used for.

You didn't specify for which device this is but for most there should already be an input accept for 127.0.0.1 from default firewall (for capsman).
That also covers lo.

In case you removed that rule, I suggest you put it back.

Maybe there is a reason why I actively swap out Brother for HP printers with my client

(really, I do ...)

I understand what you're aiming for but it's not that uncommon. I have a router with a CSS610 switch connected via SFP+ at home and still most of my router ports are trunk ports (only 1 access port, the 2.5Gb one for direct connection to my PC in my office and ofcourse the ISP uplink). I am not the ...

Previously, before the guest network and VLAN configuration, printers connected without problems. So WPA3 can't be a problem. And yet ... try it. Plenty of problems with AX wifi which all of a sudden disappear when not using WPA3. If all other devices can connect on the new setting, there is no iss...

@user7780
Please use English as most will otherwise not be able to understand what you post.
Also for searching it's a nightmare when other languages are used.

I'm assuming there are ways to save and backup your good config if I want to test more stuff out? Yes. Binary backup (but can't really be transferred to other device). Simply restore and everything is back as it was. or export with show-sensitive on (not 100% complete export but most should be ther...

No it is not.
Big difference in usability.

The cAP ac does handle the wifi-qcom-ac pretty well (in my experience), though I red someone having out of memory problems (therefor a daily reboot was introduced). Haven't seen that problem myself (uptime over a couple of weeks). That would be me but that is using 7.16rc package. The issue has bee...

For better results, maybe disable WPA3, leave WPA2. I have much better experience with WPA2 on ax lineup.

For now, definitely better to skip WPA3, yes.

I only see config on RB5009.
Where is the config of one of the caps ?

You're correct (as usual

).

Shouldn't there also be
7. add ether5 on both routers to WAN interface list and remove from LAN (if present)

?

I'm more into testing and moving forward and I accept consequences of doing so. Most of my client production devices are steady on 7.15.1. I'm not even moving them to 7.15.3 since it's not needed for me. A couple though I use for testing (where I know it doesn't hurt too much) and at home I always u...

I'm not 100% sure anymore why I moved on to 7.16b/rc channel for that one device. Having been 2 weeks off in between can create that situation :lol: Now I think of it, I also have a wAP AC at home running 7.16rc, (same resources) no crashes there either. I have another AC2 running 7.15.1 and wave2, ...

There was a possibility that if you use an ARM router with wireless that has 128 MB of RAM and is using wifi-qcom-ac package, not wireless, then simply router could run out of RAM resources causing the router to reboot. One of the reasons why I configured about a month ago a daily auto-reboot on 1 ...

css610 host mac addresses per vlan? anytime soon?

CSS610 uses SWOS Lite.

If the provider blocks the tunnel, then the entire office is stuck. ... I just want to manage everything from one place without creating a big point of failure Your most important big point of failure is out of your control, so it seems. Besides, what will still work if the internet line is down ??...

The most logical answer: something is wrong in your setup. You saw that one coming, right ? :lol: Please post config of capsman controller and one of the caps. Terminal, /export file=anynameyouwish Move to text editor, remove any sensitive info (serial, public IP, passwds, ...) Post back here betwee...

Best way: VLANs combined with firewall rules.

The DE FACTO guide around here:
viewtopic.php?t=143620

Shouldn't ONLY the sfp1 port in your diagram be purple in color? Apart from the WAN port that is yellow, shouldn't the remaining ports have no color? Based on the legend, the purple port stands for a trunk port on the router; so it doesn't seem to make sense to have so many trunk ports on the route...

And where is the surprise ... ?
After all, it's Microsoft we're referring to here

I get Intel AX200 driver updates by Windows Update. Why the heck are you downloading drivers manually from Intel's website???? On more then one occasion I noticed Intel drivers where NOT updated by Windows Update. So don't count on it. I also have been chasing wifi issues not too long ago in the pa...

Same will happen using a fallback capsman controller ... or e.g. DFS channel detection.
You can never guarantee 100% wifi availability.

At this point - no. Actually, yes. You can use "capsman or local" for the access points manager. If capsman is available, it will be used. If not, AP will revert to local settings (which are can be pretty identical to capsman settings, so rather easy to copy over once). Other then that, a...

It's impossible to run V6 on AX3.
You can not go below factory version and for all AX devices that's V7 (here at home I see 7.5 on AX3).

Added argument: wifi drivers needed for AX3 only run on V7.

Simple explanation... As of 7.13 wireless is removed from base package in favor of wave 2 drivers. This IS clearly mentioned in release notes. Not a lot seem to care to read those. If you follow the normal upgrade procedure, this will be handled automatically in background. If you upgrade manually r...

You're welcome

I discovered that using a "normal" USB3-Memory-Stick in a RB5009 slows down the performance massive. When running my project in a chr-environment it is very much faster. Be careful (expecially with RB5009) when using USB3 as storage. For some USB devices it will after reboot come back up ...

The fact your Vodafone SIM is working on both modems, proves there is no HW problem. So there must be a config problem using WINDTRE SIM on the new modem. You can try with latest 7.16rc version, there have been some LTE related improvements in there. If that also doesn't work, best to contact support.

Contextually similar to this thread ...
viewtopic.php?t=210594

If you use CAPsMAN, the main difference is the datapath config. AC3/2 don't support VLANID from datapath AX3/2 support VLANID from datapath I'm planned to replace all my AC devices with AX for easier config management. Small addition: If you keep using legacy wireless and legacy capsman, vlanid is ...

Oops, missed that part

Just an observation:
if your aim is to extend L2, why not use EOIP across wireguard ?
Connect both ends of the EOIP interface to their respective bridges and that should be more or less it (be careful with possible loops).

Somewhere in earlier versions it was changed that CPU frequency should be set to auto.
Then the message will disappear.

Good job !

Move bridge to WAN interface list.

At first sight I would say it can be done since the standard 19" rack mount kit can be adjusted. I took a (rough) measurement on the breaking places on my mounted RB5009 (mounted in a 19" frame) and it comes out at just shy of 25.5 cm, that's 10". If you want to be 100% sure, ask supp...

It's a good ap (for the installations I use it for) but it's freaking big !!

Easiest might be to create a second bridge and bundle all WAN ports to it (that would be ether1, 4 and 5 in your case).
Move DHCP client from ether1 to the new bridge.

@Monster88
Don't post the same question multiple times, please.
I merged the two threads already containing responses and removed one which was still empty.

Carry on ...

Again, basic IP (and again new info is being presented ...) /22 netmask starting from 10.0.8.0 results in IP range from 1.0.8.1 to 1.0.11.254 If you want to have 10.0.12.x and above included, you need to change your network topology (multiple subnets) or the netmask (wider range). E.g. /21 will resu...

The way Mikrotik DHCP server works, it will assign addresses from its pool top-down. Has nothing to do with the network numbering. It makes no difference if the pool starts bottom-up or is handed out top-down. It doesn't change anything on how an IP network functions. So once again, where is the act...

Basic IP

When you define an address using /22, 10.0.8.0 IS the network indicator for an address in the range 10.0.8.1 - 10.0.11.254.
This is 100% correct.

So what's the actual problem you have and why do you think you need to change this ?

My first approach would be to netinstall to latest ROS6. Then import config block by block via terminal, don't restore from backup because you will bring the problems right back in. It's a working assumption for most experienced users here that after upgrade to upgrade to upgrade ... some blobs can ...

I know it's not relevant right now but wAP AX versions should be coming.
But over half a year it was already said "soon" ...

Can we use RouterOS and a Mikrotik device to become a travel router, i.e.[/b] - set up a Wireguard client which will route everything through that tunnel - let a laptop connect through ethernet/wifi - can also connect to eg hotel wifi and let other wifi devices connect to the tunnel - drop/block th...

And why would we provide better info then ChatGPT ??
In all seriousness ...

You can place AX3 in 2 ways. Logically thinking: airflow on AX3 is most optimal when placing it horizontally since all openings are on the large sides. Warm air goes out on top, cooler air gets automatically sucked in on the bottom. If you place it vertically, it will still cool sufficiently, just a...

I understand but that's beyond my knowledge level ... I only can tell (from other data projects I work with where each day millions of data lines are retrieved) you should try to get your data as fast as possible, then process it afterwards. Hopefully someone will chime in providing more specific an...

But a rather powerful home router, wouldn't you say ?

I'm not sure you're getting my point ...

Instead of setting up 14 SSH connections for retrieving a single value on each connection, set up 1 SSH connection and get all 14 values in one go.
Should be faster.

Are you running the CAP's in default CAPS Mode? Are the CAP's connected to a hybrid port (where MGT VLAN is untagged)? Would you be willing to share your config? 1- Starting from default but some changes: 1.1 added mgmt VLAN to bridge 1.2 changed CAPS discovery interface to mgmt VLAN. 1.3 enabled R...

Assuming you have...what switch do you use, @holvoetn?

Mikrotik CSS610

I have a similar config at home and don't use VLAN1 AT ALL.
My caps look for capsman manager on that specific mgmt VLAN (which is not 1).

If you go VLAN, do it all the way.
Which means don't use VLAN=1 anywhere.

Don't test ON the devices themselves. They are not really suited CPU wise to handle that load. Your results will be too low because the local CPU most likely will not follow. You are also testing via your ISP. You don't know what the impact is there. Use 2 PCs within your network, one on each side o...

Just thinking ...
since your setup is local LAN hence all trusted devices, doesn't it make more sense to use a single connection which remains open instead of setting up the connection each and every time ?
It should be a lot faster.

AX3 is level6.
So for less then 50% of an L6 license, you get the HW too.
You don't have to use the wifi part.

As long as it works, it's ok but suboptimal.

You can specify in Zerotier Instance which interface(s) should be used.
If you leave it to all, it tries all. So don't use all if you do not want it to use WG.

Clear certificates on controller.

Personally I don't use certificates for capsman.

Rats, I did check on the switch chip support but failed to see it couldn't handle VLAN offloading ... You could leave the default bridge/Vlan path and see if something can be done using switch chip features on that device. Not a standard approach but still possible. See here for some pointers: https...

For starters: nice drawing ! A lot of first posters never show something like it. It surely helps to get a better idea of what you want to do. Now that I'm actually getting my hands on it I can understand the various forum / reddit comments "RouterOS is quite powerful but quite difficult"....

Can you make a small drawing of your setup and what you want to achieve ?
Because I'm not sure I fully understand what you want to do.
High level I get the idea but which building blocks you want to involve where is fuzzy.

About this part: /interface bridge vlan add bridge=BR1 tagged=BR1 vlan-ids=100 add bridge=BR1 tagged=BR1 vlan-ids=200 add bridge=BR1 tagged=BR1 vlan-ids=99 Where are the interface ports being added to their respective VLAN as untagged members ? Shouldn't that be like this (I know, happens auto but I...

I've run into two issues so far: 1. Time sync on windows hosts isn't working. Had to set up NTP client and server on the router and manually configure windows hosts to target the router as their NTP server. 2. During SMB file transfers between VLANs/ports, router CPU usage peaks at 30% and transfer...

Because your wireguard interface is not accepted. Simple.

2 options:

add a specific rule to accept input via wireguard as interface
or
add wireguard to LAN interface list (most will do this since wireguard is VPN and conceptually, VPN should be the same trust level as LAN).

What's the problem then ?

Try with the wait loop as referenced in the link by jaclaz.
Just checked again, it should wait for max 115 seconds which is just below that hard limit of 2 minutes.
But do put that part as last part of your script (or as far back as possible).

What can I check ?

Log files as a start.

Search found 6489 matches