MikroTik

It has been a problem all over the weekend.

For the devices not connecting, use ssid without wpa3.
Some might even need WPA.

Interesting... have to test that in my lab later next week.

I've used Devolo in the past, never had problems with it. But it has been at least 5 years since I don't use them anymore.
(long story short: solar panel convertor practically killed the powerline signal so had separate cat6 cable installed between the points where I used powerline before)

Or maybe - just maybe - there is the possibility that there could be something that needs to be changed in its configuration? If this latter could be the case, a good idea would be to post the current configuration for review (anonymizing the sensible data), instructions here: https://forum.mikroti...

Already filed a ticket to support to report the issue?

Surely you mean wifi-qcom-ac as driver for those caps ? From what I can see in the config of that cap (I assume the failing one ?), VLAN setup is not correct for qcom-ac driver. Difference between wifi-qcom and wifi-qcom-ac is that you need to do all the VLAN work on that AC device yourself. And tho...

From product page / brochure / ... it's not clear. When looking at SFP+ compatibility page, this device is listed but not clear either what speeds are supported. But on the section about optical transceivers, it does mention max speed 1G. So undecided. I'm inclined to think max is 1G but I could be ...

From product page: 100Mbps SFP support - this is our first device that supports 100BASE-LX/100BASE-SX/100BASE-BX fiber modules, as well as standard 1.25G SFP modules. So, no. 1.25Gbps max for connection speed BUT with a maximum data speed of 1Gbps and when you look at the block diagram, you'll see w...

There was nothing in between your post and mine, so that would make it directed to you, yes.

When using Winbox in the normal way (using IP address) it is common to get kicked out when changing VLAN settings.

Use Winbox MAC address or remove 1 port from your router off bridge and configure from there (setup small DHCP server on that port or again, use Winbox via MAC address).

Now I'm intrigued ... Most (all ?) of the AX wifi issues I see around here are about standalone devices. At home my AX APs are under capsman control. Not a single problem. Nada. I have one capsman setup with 18 AX APs with a customer: zero issues. For the rest no standalone AX devices in place. So I...

Wifi-qcom-ac is a bit different on VLAN part.
- explicitly set VLAN on interfaces on CAP (use create enabled on provisioning part)
- explicitly set VLAN on bridge on CAP
- don't use datapath VLAN setting for those CAPs (separate configuration)

Better to ask via support.
They don't always read all posts here.

Too light.

Light wise and weight wise

Point 1: tick 6 can be obtained when overlaying EOIP or alike over that wireguard connection.
Doesn't even have to be connected to brdige. It just needs to be active.

Adding: Important to distinguish perhaps since otherwise we get lost in semantics: software reboot does not necessarily result in power cycle of USB devices. USB power reset does make sure that modem is power cycled. During SW reboot it might be it stays powered on (one should monitor USB lines to s...

User manual for this camera says - PoE Power over Ethernet, IEEE 802.3af. So, no, it is not compatible with RB260GSP https://wiki.instar.com/dl/IN-8003HD/QuickInstallation-1080p-IN-8003HD.pdf PoE (nur für PoE-Version) IEEE 802.3af (+ Pin 4 und 5 / - Pin 7 und 8 ) So there is also a non-POE version....

hAP AX Lite LTE Ticks all your boxes. 2Ghz Wifi only but make no mistake, using the right client it can get to 400Mbps (which LTE can not provide). Used it for testing once on a 10.000mAh power bank, over 8 hours and still the battery wasn't empty. The only comment I have on it is the package. Those...

Adding to that comment from jaclaz and tangent: SWOS or ROS is not going to change anything regarding performance of the device. Main difference is what you can configure and how (hint: it's a LOT LESS using SWOS). It can handle around 40Gbps as a switch. It can handle just under 1Gbps as a router (...

Did you check the jumper settings ?

https://help.mikrotik.com/docs/spaces/U ... 434/RBM33G

Be careful, it might be easy to get trapped in a boot-loop this way ...

The issue with User-Manager and oversize UDP packet that I mentioned in post #236 https://forum.mikrotik.com/viewtopic.php?t=212754#p1115736 is still present in 7.17.rc6. Is anything mentioned about it in the release notes for that version ? I don't see it. Therefor it's logical the issue is still ...

Read this: https://help.mikrotik.com/docs/spaces/ROS/pages/62390319/L3+Hardware+Offloading#L3HardwareOffloading-Inter-VLANRouting Interesting part (emphasis added): Inter-VLAN Routing Since L3HW depends on L2HW, and L2HW is the one that does VLAN processing, Inter-VLAN hardware routing requires a ha...

How I understood:
If you want to benefit from HW offload where possible (for those devices where it is supported), using bridge for setting up VLANs is the default way already for quite some years.

For starters: 12V input for that camera is already not 802.3<xyz> compliant. So you may need a 12V POE splitter. Can't find installation manual for that camera right away so you may have to check there what it says. Since RB260 is default powered by 24V adapter, that's going to be the voltage applie...

I understand.

Best/safest way:
check how it is done in default config script (terminal: /system def print file=whatever, move file to PC and check contents).
Take over that approach.

At first sight your script looks correct.

Yes there is way to do that with startup script but maybe you first should check if latest version solves this problem (if those boards are not there yet).
I've seen something being mentioned in some of the latest release notes related to startup of LTE interface after boot, that's why I mention it.

AFAIK, it's an LTE antenna, and there is no Wi-Fi*. So if you want to make a PtP link OVER an LTE network, you can do that.

This.
There is no point to point using SXT LTE devices, you have to use LTE network.
And then you can work from there.

File a ticket with all your findings to support@mikrotik.com
The only way to get their attention.
They don't read all posts on this forum since this is a USER forum (users helping other users).

Good catch !

Any specific reason why you want to downgrade ?

And there we go again with "the need for speed"... If RB2011 is currently in use without problems, L009 will definitely be more then sufficient (unless of course a huge ISP upgrade is also in the planning). As for 5GHz, AX-2GHz can go to 400Mbps. Some 5GHz connections don't even get there ...

Could be some config hooks from post-7.13 are still hanging around.

What device are you downgrading ?
Already tried with netinstall (in order to be sure there is no backdoor config hanging around from whatever version) ? Make sure to export your current config first (and verify it is complete) !!

That's because in 7.12 all hooks are present to have an upgrade to 7.13 use "automagically" the correct packages for wifi or wireless.
Even so magically that on a simple switch wireless is also loaded when passing towards 7.13

You can, given restrictions as indicated above.
If it's a device with wifi radio, you need to take care adding the correct wireless/wifi package. That's where the biggest difference with respect to handling of packages is with that version.

L009 is designed as a drop-in replacement for RB2011... just saying.
And it has AX radio so 2 birds with 1 stone.

For further expansion with AX units you're on the safe path then.

If temperature starts climbing the moment you switch it on, there is little else you should do then return it for replacement since it's under warranty.

Observation:
with only 1 wireless device and 1 wifi-qcom device, why use capsman if both radios are incompatible for a single capsman environment ?

Set both up as standalone devices and that's it.

( thread cleaned up so it's back on topic, everyone behave please)

Ah yes, I knew I looked into it in the past

According to this Reddit post it should be possible.
https://www.reddit.com/r/mikrotik/comme ... ?rdt=51649

Without seeing how you exactly used the parameters, nobody can answer.

So please show the config part how you enabled netwatch. Preferably the config part, no screenshots please.

Repeat.

Adding:
when defining those IP pools, make sure the manually added addresses are NOT included, which currently is the case.

First: have you ever read this excellent guide on setting up VLAN ? It is considered the Bible around here: https://forum.mikrotik.com/viewtopic.php?t=143620 What 3 CRS109 ? How do they relate to this CRS328 ? Maybe we also need a network drawing ... First comments after seeing config: - pvid on bri...

You need to show full config, not only parts where you think it's wrong.

It is not working so there is a config mistake somewhere but probably not in the place you are showing.

I see these 2 settings for 2GHz channel:
.encryption=ccmp ... .management-encryption=cmac

Make sure they are both disabled.
Not open and blank, really disabled (folded in).

You probably did not perform the reset correctly. Out of the box, WAN is ether1, not SFP+ port. So do the reset again, correctly. Buttons and jumpers The RouterBOOT reset button has the following functions. Press the button and apply the power, then: Release the button when the green LED starts flas...

If we talk about Mikrotik ... why Hex Refresh and AC2 ?
Both limited in performance depending on what speeds you are planning to get (esp. Hex Refresh if you plan on using ether1 as WAN connection).
What speeds are you looking at ?

Why not AX2 ? Far more capable. Or do you need more ports ?

Can you post the wifi part of your config ?
Make sure passwords are obfuscated (change them so we know they are there but so we can not see what it is).

There is no problem with cAP AX. There is a problem with switches which you want to use in a way which they can not handle. Look at those switches as filters. They don't know about VLAN tags. Most likely they are simply discarding that info so when the packets arrive at cAP AX, there is no VLAN info...

Without seeing how you exactly used the parameters, nobody can answer.

So please show the config part how you enabled netwatch. Preferably the config part, no screenshots please.

( 2 threads merged because they contained exact same question)

Normis explained it somewhere not too long ago. Wap is intented to be mounted against wall ( or ceiling). So the omni directional part towards the back is supposed to be reflected back forward ( mostly). You can use it on desk stand but that doesn't change the fact it is supposed to be against somet...

If you use
set cpu-frequency= and then TAB
what options do you get ?

Check security settings on the used ssid.
Some devices don't like it when WPA3 is possible even though they can not use it.
Remove WPA3 and see what happens then.

Alternative: create slave ssid only for those devices not using wpa3.

Hi, I have issue on my hap ac2(firmware v: 7.17rc3) when using wifi on only 5Ghz. When I load this interface its rebooting and after reboot on log I have this errors: router was rebooted without proper shutdown, probably kernel failure kernel failure in previous boot out of memory condition was det...

You are choking the tunnel, that's why.
There is nothing left for anything else.

Do speedtest with limit on bandwidth, leave at least 5% over for management connection ( too much but to be safe).
Then test again.

How I see it: You should be able to enable or disable a provisioning rule ( or switch rules). As long as there is no " catch all" rule active, radios should become silent when there is no provisioning rule active. But I think enabling/disabling the cap interface on controller might be easi...

Regarding bridge and datapath, I think that refers to local bridge of controller where cap interfaces are being attached to. But I do admit it is not crystal clear. bridge (bridge interface) Bridge interface to add interface to, as a bridge port. Virtual ('slave') interfaces are by default added to ...

Performance wise, AX3 wins every time vs L009.

Plenty of examples where it does not work. Here are some more: 10Gtek: ASF-10G2-T and ASF-10G-T, former works, latter doesn't https://forum.mikrotik.com/viewtopic.php?p=1106078&hilit=SFP#p1106078 FoxGate XPON SFP ONU 1001XP-SFP Works on Hex POE but not on L009 https://forum.mikrotik.com/viewtopi...

Fezzfest: un9edsda did provide an example of a module which does NOT work. So your facts are not entirely correct. The correct answer is and will always be: if it's not on the compatibility pages, it has not been tested and it's your own responsibility. It may work (and in some cases it will), it ma...

Most likely firewall rules.
Check that referenced thread again.

I would go with L009 in stead of hex refresh. A bit more future safe. But every time you add a device, you loose 2 ports on the complete setup for trunk. So better get a bit more ports from the beginning. So why not CSS318 ? A bit more expensive then L009, 16 ether ports, 2 SFP+ for future expansion...

I didn't say it was easy

Some comments: 1. The Mikrotik wiki: ... Wiki has been replaced by Help pages. https://help.mikrotik.com/docs/ And yes, it's a continuous work in progress. 2. Add small step-by-step procedures to ROS: Again, Help pages. Capsman is described in extensive detail, no ? https://help.mikrotik.com/docs/sp...

- Are there any NVRAM dumps?
Not as far as I know. ...

Binary backup is the closest possible (as opposed to export in txt format of config).
Can be used to restore on the exact same device or model (but be careful with MAC address duplication on your network since those will be copied as well)

Discussion on PPTP / L2TP moved to new thread:
viewtopic.php?t=213508

If you configure VLANs correctly then yes, switching should be done at 10Gbps rate. But what is your connection speed ? You must think of that, 340 Mbps in today world is nothing. I wouldn't put it that generic... For the customer I work for, we have NO (ZERO) ISP connections passing 200/200. Most ...

Mod message:
since the remaining purpose of this thread seems to be someone is brainstorming with himself, I decided to lock this thread.

Mod message:
Cleanup done of this thread to keep it a bit more on topic.
(apologies to other users who also saw posts being removed during this action)

/interface bridge vlan add bridge=bridge tagged=bridge vlan-ids=20 This includes the bridge interface in the VLAN 20 as a tagged member. RouterOS does this automatically if you create a tagged VLAN interface on top of another interface, so it's not strictly necessary. This is completely true but it...

Your router has been hacked.

Disconnect router from network
NETINSTALL asap.

On PC, you can also run IPCONFIG / ALL (if Windoooos) so you can check if DHCP settings are correct on that end.

Again, and do you plan to do that when there is no internet connection ? A backup connection is the only solution then. But I think I get what you mean... you are referring to "simple" config issues which break the connection ? What I do for the client sites I control ("only" 40 ...

Probably DHCP server is missing here for DHCP clients ?
Set it the same as gateway.

/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1

Just wondering ... how does that VPN work then without internet connectivity ?

Check this recent thread with exact the same environment.
It was about a Python environment.

viewtopic.php?t=213024

It is even advisable to make a separate slave interface with settings only for those devices and make sure it's properly shielded from the rest of your network (firewall, vlan, ... whatever you like, as long as it is done).

Or a very recent change of default setting.

Doubtful IMHO.
There is a confirmed bug with container startup crashing the whole system.
That needs to be fixed or it will be a very eventful release.

If you are testing from PC1 wireless to PC2, you are not really passing Hex. It stays on that switch. What sort of switch is it ? Simple test since both ether4 and ether5 are on the same bridge: remove that switch from the mix. remove/disable bridge2 (to be sure HW offloading is fully active on the ...

Thank you for this diagram.

Where is the iperf server ?

Also, you did not mention in your initial post you have THREE WAN connections to ISP ?
Which device is using which WAN connection ?

Ether5/LAN2 is not being used for the moment ?

(moved post with config into this thread since you replied in another thread, from 2023) Please also add drawing how you test your iperf setup. From which device to which port on Hex, which port from Hex to which other device. Same with wireless AP, what port is it being connected to ? Quick comment...

Already several times it has been hinted to show your config although the info you provide, does not seem to indicate an issue with the wired part. Even if you add a non-MT AP into the mix, it is still a wired device for your Hex. However ...if from wired to wired you "only" get around 820...

Couple of quick comments
Disable detect internet. Really.
Adjust lease time of dhcp server. 10 minutes is really too short. 30m is default, I use 1hr or even 4hr.
Set in APN use default route.

For routing performance rule of thumb is 512 byte packets, 25 filter rules.
That should give you a rough idea about real-life performance.

If it works after you disconnect and reconnect the client and it works with your Mac, there is nothing wrong with the router, I would think.
It's your Windoooos client playing tricks on you

What wifi card is in that box ?
What version of Windows ?

How does it help? There will be still only 1Gb ports on Chateau.

Apologies, my response was directed to OP with RB5009.

Or put a 2.5Gb / 10Gb switch in the mix ?

Even with bonding you will never saturate 2 links if only 1 stream is passing.

I think with quickset you should be able to change those things.
And most likely two subnets using the same IP range will indeed be the problem.

(mod edit: post split from article to keep discussion separate. If needed/useful, can be merged again later) My take on things: 1- what is the question ? 2- what is the question ? 3- Tagged ports are indeed filtering based on VLAN ids. 4- Your base problem here might be that you are not aware a brid...

Already checked with support ?

High level
Q1: create VPN and using firewall rules and VPN interface in forward chain restrict access to only 1 destination device (allow to one dest, drop all the rest coming from that interface).

Q2: similar approach.

What VPN are you planning to add ?

With legacy wireless adding capsman layer makes things indeed more complex. Not that much with wave2 drivers (95% is exactly the same) but you are correct that for 1 AP it's not worth the extra effort. A small drawing with your intended setup adding how VLANs should flow might help. And of course co...

Most likely switch ACL rules.

Check this thread for more background info.
viewtopic.php?t=203589

Now plug in your laptop into ether9, change ipv4 settings to 192.168.65.2 and you should be in!!!

Don't think so.
Not on RB5009 with 8 ether ports

I could track it down and note that it has an issue related to datapath and vlan setup. In short, it only work when provision vlan is the same as mgmt vlan. Cap AX and wAP AX are identical as far as vlan setup is concerned. Only major difference is the swapping of radios, wifi1 and wifi2. Best to c...

Known issue. They are working on it.

You did use ether1 to connect your RB ?
Sometimes it helps to put a dumb switch in between.

Touché

I use IsHosting.
CHR VPS for 5 EUR /month with fixed ip4.
I am using it as wireguard gateway only for now.

Isn't that the purpose of Q-in-Q ?
https://help.mikrotik.com/docs/spaces/R ... LAN-Q-in-Q

Check Bridge STP priority as well if STP/RSTP/MSTP is used.
Core switch should have lowest priority.

See here for more info:
https://help.mikrotik.com/docs/spaces/R ... ionprocess

I have to search for it (again) but there was someone a couple of years ago who made a really nifty script which would do all the collecting and processing and send out info via mail per period you could specify yourself. Used it for SXT LTE6 setup in South of France to track data usage for vacation...

That sounds like a genuine bug.
Definitely something to report.

And ... good analysis !!

What's the idea behind "subsettings" part of config ? To apply it to Jasmine Home ? Doesn't work that way. You apply through provisioning a master config (and if needed slave config) to a radio. All info for that config needs to be in that master config (either directly, either via sub-sec...

The Mikrotik V6 firmware still has a traffic accounting menu, meaning the Mikrotik V7 firmware has been renamed to Kid Control.

That's what I said, didn't I ?

Can kid control monitor client device IP address traffic

Yes.

We've all been there

Some formatting issue on the CAP Name or some naming convention which has not been documented or ... ??

I am seeing the same with all my APs under capsman (7.16.2: AX Lite, wAP AX and AX2).
Also in Winbox GUI it shows.

If it bothers you, make ticket to support so they can investigate root cause.

It has been renamed to IP / Kid Control.

Problem is similar with AX Lite. 64bit processor, 32-bit OS. Main reason they gave is that the device does not have enough memory to justify use of 64-bit. Using 64-bit means larger memory usage of OS itself (64-bit instead of 32-bit pointers) which is then wasted on that device. As far as running R...

While perhaps the older ac chipset cannot directly handle VLAN in hardware... It is a nice try, but the UBNT accesspoints I use at work use the same QCA9984 chip as is used in older MikroTik AC hardware, but it fully supports VLAN assignment per client... and I don't think that would be a software ...

You're not the first and surely will not be the last.

Obviously you need to move that rule to the top of NAT rules ...
And make sure connection track table is empty or reset MT device (or wait).

Maybe this ?

/ip firewall nat
add action=src-nat chain=srcnat dst-address=10.0.1.0/24 out-interface=ether1 to-addresses=10.0.2.1

Reverse for the other side.

CRS = switch. It has routing capabilities but not much. You're most likely looking for CCR then. And then prices go up up up. E.g. CCR2004-16G-2S+ 16 Gb ethernet ports, 2SFP+ cages, PLENTY of power. No Wifi. No passive cooling. There is even a version with 12x SFP+ cages and 2x 25G SFP cages. Does t...

Even better to not allow anything from WAN except VPN and established,related,etc.
Oh wait ... that's done by default firewall rules ...

You're correct, I missed that line.

It has been a while since I played with it but AFAIK default hotspot should have some firewall rules to prevent access between clients. Right before that rule which blocks access, you should add a rule to allow access to that specific printer. To be 100% sure, make sure it has a fixed IP lease so yo...

Have a look at this Help page:
https://help.mikrotik.com/docs/spaces/R ... h+examples

So you have a VPN tunnel between Mikrotik A and Mikrotik B ? Which one ? Answers based on not seeing your config: What interface list is that VPN tunnel in ? I assume nothing. 2 short options: explicitly allow traffic via firewall coming from that tunnel on both Mikrotik devices or add VPN interface...

Going through brick, glass and roof and still getting 216Mb is not too shabby, if you ask me ...

Only thing I found annoying is for some reason mode is changed after every reboot from station bridge to station...

That shouldn't happen.
Which ROS version ?

MikroTik isn't really in 2.5G yet. Yes there are some devices with a single 2.5G port and an SFP that can do 2.5G, but what you really would want is a device like the 5009 but with several 2.5G (UTP) ports. And probably some switches too. And then for the router probably with wireless as well. They...

If understand correctly, I need to configure each AP as a static VLAN device. Will the config hold long term? Meaning, if there will be update, will it crash? Yes. Yes. Normally not :lol: (depends on how MT will proceed with memory requirements for ROS7 and wifi-qcom-ac package because on those AC-...

I read that for the router RB5009UG+S+i you can't use a direct attached copper spf+ cable. I can't find any documentation. I wish to connect this to a mikrotic CRS317-1G-16S+RM switch which can use DAC. Can someone shed some light on what cable I should use? Brad And where did you read that ? Mikro...

Every version of rb5009 has SFP+ port but there is NO version of RB5009 with wifi.
Basic chip used on that platform doesn't support wifi.

It is what it is.

Now you are changing requirements... you said you needed replacement.
RB2011 doesn't have any 2.5Gb ports.

There are no routers with at least 2x 2.5Gb ports AND wifi, not even when considering using 1 SFP+ as 2.5Gb port.
You need 2 devices then.

You mean RB5009 WITH Wifi ? I hope that version never comes...

Drop-in replacement for 2011 is L009, there is version with or without wifi.
And it's fanless.

OK, what's the trick for adding my country - the United States? I tried editing the example wifi /interface wifi configuration section. I tried United States and it doesn't like the space. I tried 'United States' and it doesn't like the '. I tried UnitedStates (no space) and it says no such country...

Therefore as Halvoetn suggested check/disable DHCP client on hAP. The DHCP client has to be enabled for the WAN port otherwise no internet connection. I've not had chance to dig deeper into this but I will. I never said to disable ALL DHCP client. Just the unneeded one(s). Look, it doesn't take 5 m...

If I look at the BSSID of the wifi channel I am currently connected to with my laptop, it's the MAC address of the CAPSMAN wifi interface on the controller. Not the MAC address of the AP radio. If you set those interfaces to create enabled, you should be able to set that MAC the same as it was befor...

Using AX material, there is little to nothing to be done on the caps. So yes, capsman does make it easy. About wifi-qcom-ac, normally this was NOT foreseen but MT made it available for AC HW capable using that driver. They didn't have to. But they did. It does come with some quirks, yes. But you sti...

The DE FACTO guide on setting up VLAN for ROS

viewtopic.php?t=143620

Oh yes.
RB5009Pr

Should be 802.3 af/at compliant.

I think my grip is forum is beating up OP, when Mikrotik's log message is shitty — these "executing script from XXX failed" should identify what script is at issue... I get what you mean but when multiple persons ask you to see config and you persist on not showing it, what sensible perso...

I was already thinking that as well but I don't have a cAP AX lying around here.
Although given wAP AX and cAP AX are both 802.3af/at devices, I am going to (carefully) assume it's just that forced on setting which should make it work.

OP can easily test it.

Help pages:

https://help.mikrotik.com/docs/spaces/R ... 59120/WiFi

Log files do show something is running, no ?
And that part is defined ... in your config.

The negotiation part does not fly when connected to L009.
But it works when you "skip that part", hence forced on.

With "auto on" it gives an error message (on my setup it does).

Just tried with wAP AX (which is even further down in power requirements but normally also 802.3af/at only): it will power on using L009 but you have to set POE on ether8 to forced on. Not auto on.

Which is why we need at least some info on what script is running and how.

Otherwise we are all simply guessing.

Why 2 bridges on RB5009 ?
Why 2 bridges on Netmetal ?

There is most likely your problem.

Could someone help me?
If needed I can paste here the entire configuration

You know what to do then ... both sides, please.

who has marded this post solved?

You did.
I "unsolved" it.

And still you are not responding to our request to provide necessary info ...
Screenshots usually don't help.

Possibly BSSID has changed even though your SSID is the same.

PS great contribution here from mkx related to this topic:
viewtopic.php?t=210898

And no encryption cyphers selected ?

Can you export wifi part of config ? (leave out passwd etc).
It will show there.

What security settings are you using ?
Quite a bit of IoT devices (and that includes quite a bit of SMART TVs) only accept WPA2 and nothing else.

what is this file.? i have private data that i don't want to publish please tell me what this error is related some bug and error in script that system sched wants to run? or some one from outside wants to inject a script in my os? Some comments ... 1- this is a USER forum. Users helping other user...

In most cases, 1 bridge is all you need. If you are planning on having those AX devices connect to a legacy capsman controller (previous generation), that will NOT work. Are you ? It might be better to follow erlinden's advice and provide a schematic representation of your network also clarifying wh...

I dont know how PM here works.

It doesn't.

Check user manual for reset sequence.
Watching led sequence is more important then counting seconds

Worse case: netinstall.

Ssh / ftp / smb / ... you can even mail them to yourself.
Plenty of options.

Depending on needs for further routing, vlan, discovery, romon, ... EOIP might be better since it will create a virtual interface for which you can do exactly the same as any ethernet interface.
But IPIP should do as well if you only need IP-related functions.

Pay attention to which public key you place where and make sure each peer has a unique address.

If that doesn't help, indeed post config for review.
All peers.

A bit too much for my liking.

At least using Wireguard I know you can selectively specify which subnet should go over VPN and which not.
I suppose OpenVPN can do the same ?

Personal preference is WG, though

It's more resource friendly and faster and less chatter to keep the connection.

DuckDNS should be able to do it.
I already used it in the past just for that.

Plenty of script examples available

It depends.

Maybe you need to clarify in a lot more detail what you are planning to do ?
A logical workaround would be to use VPN on only those devices, then you control what comes via that VPN and what not.

With the arrival of vendor drivers for wave2, that option went away.

Wireless legacy drivers were completely made in house, so much more control over what could be done.

It's not a good idea to actively block clients using access list.
Some clients might avoid such an AP completely.

Unless that's your aim, then I wonder why you keep using the same SSID for that frequency ?

Oh
My
God
....

It shows who has everything to say in your household.

You can have both capsman versions on the same controller.
You can not have seamless roaming between both controllers.

It is what it is.

Check your routes.

And then the router will ... route.

Should be default there if you have ROS 7.13 or higher, under wifi menu.

Uh ??

What ROS version ?
There was a change in ROS 7.14 where "no country" results in "Latvia".

Already contacted support about it ?

They don't read all posts here since this is a user forum.

You shouldn't even set datapath at all on CAPs side.

There are some limitations when using wifi-qcom-ac driver, mainly VLANs can not be dynamically asigned. 802.11ac chipsets do not support this type of VLAN tagging , but they can be configured as VLAN access ports in bridge settings. = you shouldn't use vlan-id in datapath on AC device. Adding: use ...

... My home lab network is relatively simple: hAP ax2, two Windows Server 2022 domain controllers, couple of dev servers and my workstation. Simple ?? :shock: Check for DHCP client on that device. Or sniff the network using wireshark to see which devices are sending out request for DHCP leases (and...

How long did it take for wap AX to come out ?

Let's assume they are working on it.

RB5009 even has a 3th powering option on the side.

Also, POE version of RB5009 can be powered using POE on ALL 8 ether ports.

Do you have any informations that RB5009UPr+S+IN can be tricky when using 2.5Gbit port for ISP and transfer goes above 1Gbit and also SPF+ i utilized to connect to CRS326-24G-2S+RM SPF+, I have read that there are some problems that router can make lags or some kind of problems?. Not that I am awar...

Yes.
Surely your default subnet is not going to be 192.168.88.0/24, is it ?

That's a logical consequence from daisy-chaining those switches one after the other. Only the part which is behind the switch which breaks down, will go down. If it's the first one, everything goes down. If it's the last one, only 24 clients will go down. If it's the RB5009 going down, everything is...

Anyway, I think I'm going to test in my office if it is possible to add the wifiwave2 driver to the AC2s and link them with the L009UiGS-2HaxD with the same driver. I'm not sure if it will work, but we have to try it. It will work. I have several AC devices runing wifi-qcom-ac package without probl...

This is VERY odd indeed ?!

And did you try simply using the mips package as it indicates ?
Because what strikes me as equally odd, is that same QCA9533 CPU is used in mAP Lite and cAP Lite and those ARE mips devices. Not SMIPS.

In that case you have another option but you should thoroughly test it ... hAP AC2 can also make use of wifiwave2 drivers (wifi-qcom-ac) IF you're not doing other things on that device (plain switch, pure AP, nothing more). Problem with AC2 is that it has a quite limited storage and using wifi-qcom-...

I am going to assume all your other access points are using legacy wireless (read: not AX). And there is your problem now. See this Help page: https://help.mikrotik.com/docs/spaces/ROS/pages/1409138/Wireless and this: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi For AX radios capsm...

Yes. And the beauty ? On CRS326 you do not have to do anything except for changing IP address.

Sure.
That's how it default starts.
You only need to look at the IP address, rest of config default starts as a pure switch (because ... that's what it is !).

Topic locked since the exact same question is already being handled in another thread.

Add-ons: not really or not in the way you may see it. But you can install containers. So if it works in a container, it may work. Not full-fledged docker but usable. Provided you have enough storage, memory, ... My personal view: a router is not my primary target devide to run such things. I also to...

Having just purchased all material for a small shop, bit of router functions and 4 APs which needed to be POE powered. Some printers, some PCs. About 10 connections in total. Give it some spare for near future and I should need 16 ports. I was initially thinking towards RB5009Pr but that would reall...

It seems to be working now, checking from Greece. BTW, free service means "Best effort" SLA... If critical systems depend on connectivity other means should be used for DDNS, usually with a fee.

Correct attitude !

viewtopic.php?t=213191

Threads merged.

Nice job

Sure it's not Gmail capping that connection ?
150Gb is HUUUUGE !

https://support.google.com/a/answer/1071518?hl=en

- In case I do need to verify via SSH, can I use typical tools like PuTTY? I think PuTTY works with OpenSSL and if RouterOS doesn't support that, then I don't know...
All that should work, although been years since I tried PuTTY.

PuTTY works just fine.

First things first ... ROS is so powerful because you can almost do anything with it. And here is the drawback, because you can almost do anything with it, a lot of people get lost. Mesh is there from older legacy wireless HW. It's not applicable anymore to AX HW. Cap is there from older HW with leg...

Check on client peer side if Persistent Keepalive is set (typical: set it to 25s = 00:00:25).

This solved the issue with CAPsMAN provisioning, but now DHCP server don't give IP addresses to devices connected to WiFi trough the CAP devices. External radios or local radios ? What's this ? /ip dhcp-server network add address=0.0.0.0/24 gateway=0.0.0.0 netmask=24 I think that shouldn't be there...

Wouldn't it be sensible then to present your config for review ?

Interesting read: Rules of the Mikrotik Club: 1) You do not use VLAN1 2) You DO NOT use VLAN1 3) You remove default user admin and set a strong password before connecting to the internet. 4) You do not use Quickset. 5) You do not use detect internet. 6)... Now #6 might be added as either: 6) You set...

I have plenty of WG tunnels between MT gear and other stuff (Linux, Windows, Android, ...). It works. It is not impossible nor difficult if you use the correct settings. Having only TX and no RX is normal. Wireguard always tries to send. Only when you see something coming back, then you know it work...

wine doesnt works native implementation will be nice Why not ? It should work. https://pimylifeup.com/raspberry-pi-wine/#:~:text=Installing%20Wine%20on%20to%20your,aren't%20compiled%20for%20ARM. Again: ask support. This is a USER forum. MT staff sometimes frequents this place but not always and cer...

Same problem here.

WIN 11 23H2 22631.4460

After 3th attempt, it succeeded and restarted with new version.

Same problem here.

WIN 11 23H2 22631.4460

Command used looks correct to me (as in: it's the same I have in my notes). But ... you should not forget to ALSO send wireless package. Wireless drivers are not in the base ROS package anymore as of 7.13. So the wireless package (or wifi-qcom or wifi-qcom-ac depending on device) needs to be send as...

Search found 7196 matches