MikroTik

And you still did not specify what the actual problem is...

Correct observation

Why one bridge instead of one ?

...

If I wrote something wrong someone will correct me.

First line is not correct

Every device runs ROS, so every device can act as a router if that is your question. Not all Mikrotik devices, there are devices running SWOS or SWOS Lite. But the ones that do run ROS, all have a full-featured version of ROS, taking into account some HW restrictions. (e.g. don't load too many addi...

What ROS version are you using ?
I seem to recall there have been some fixes especially for this permission problem.

Two things ... you can perfectly keep using legacy wireless with those cap-ac devices. Al you need to do then is load wireless package on RB5009 (as of ROS 7.13) and you're good to go (just be aware the menu structure will be on another place. Not wifi but wireless/wifi, or something like that) If y...

Works already for quite a while so what is the problem ?

2024-12-09_13-30-08.jpg

Well... If you are using your ax2 as an AP then you should try to enable VLAN filtering on your bridge. Well... yes I did, however I removed it while trying to get the router to become an AP, once it starts doing its thing I will put that config back. VLAN filtering is not likely to be the issue wi...

Good catch !

Netinstall and starting again from default is seldom a wrong approach

Possibly an issue with the mount location ?

On RB5009 there is a confirmed issue with startup of some USB3 stick so I have to be really careful with my containers too after restart/ reboot.

I know.
And that usually means weak admin passwd.

Of course it's always possible that router was compromised from LAN side (some computer running malware) so if things happen again, check your LAN clients (or restrict access to router management to a dedicated management port). That would mean a real weak passwd was used or someone in the 'trust' ...

Well ... and the question is?

That was my first reaction too when I approved that post

OP
post your config as requested, provide a bit more detail on how things fit in the larger picture and we can work from there.

Use 0.0.0.0/0 as allowed addresses.
Everything will go down the tunnel then.

Just a minute.
It all depends on how the uplink is going to be... if LTE you are leaving the device wide open.

Bonding still requires multi stream or you will have zero effect.

Not when used indoors.
Only 1 minute DFS.

What is wrong with 52 or 60 ? You don't HAVE to use 80MHz channels. Sometimes it is even better to go smaller.

Problem with these high ranges is that quite a bit of client devices are not able to use them.
So be careful and check.

Once you are done we can proceed. Do not forget to update modem firmware as well. The device can be used as wifi repeater but I wonder why you use an LTE device for that ? How is it going to repeat the wifi signal ? Through local ethernet or via that LTE ? Maybe best to describe in more detail what ...

Also: scan the environment for each ap separately. You have the tools available in ROS, use them.

Choose a frequency which is not already used by others ( even your own AP if it is close enough) to avoid interference.

Depends on what you want to favor.
You can not ace each and every parameter. Not with the prices these things cost.

Then it may be time to put your config on the table.
Controller and 1 wap AX please.
Make sure to remove all private/public info.
And please post both configs between code quotes.

Errrmm ... you might as well look at the test results posted by Mikrotik then.
That's more or less what they do when conducting those tests.

First wireguard
Then winbox over the wireguard tunnel.

You accept the wireguard traffic.
And then you accept winbox coming via wireguard.

No marking / mangling needed.

Unmanaged switch ? Not for me, thank you.
I wanted a managed switch running ROS on arm

Serious
purely for home lab purposes. To replace old Hex.
And W?BIC.

Why ? Because I Can.

And AI is not able to solve that problem for you ? :o Put a log action on that drop rule and see which MAC addresses are being dropped. Chances are high it's not the one from DELL in your accept rule ... Are you sure there is nothing in between sender and your firewall changing src MAC address ? Are...

But, back to that thread.... It is lively, with an evolution, so it's a little hard to follow what the current/latest instructions and supporting files/apps are. I haven't tried that version Ammo posted there. As indicated, semaja's version works, I'm not touching it. Follow the steps in the first ...

But this is about: RB912UAG-2HPnD, without OUT

https://mikrotik.com/product/RB912UAG-2HPnD

That's still being listed as active.

What if you go back to last know working version( ROS5 ... uh, shivers ...) and then use upgrade path from within the system towards ROS6 and then towards ROS7 ? If there is truly a limit, that upgrade process should stop you. Netinstall most like doesn't. Last resort: ask support. File a ticket and...

Being someone who also had my fingers on a keyboard the first time in 1980 (VIC-20, oldtimers will surely remember it with its 3.5Kb of free RAM) when I was 12... I never played games (ok, not much :lol: ) I'm an auto-didact and I am blessed to learn pretty fast. I learned myself to do so. Same with...

You are aware there is now a native Mac Winbox client ?

Again theoretically... yes but you see what rabbit hole you're going to get into ? What if there is another device with overlapping IP address ? Again: is it only the PC of the USER requiring access ? In that case the issue might be a lot less. Simply (during that session) let all traffic go over VP...

You mean my settings in /interface/wifi/provisioning/export , but instead per AP and Radio MAC defined there? I guess, by setting which frequency you mean, so you don't have any overlapping, which could happen, if AP chooses on its own a frequency from list? Yes. If you let them choose, it might st...

Could be a config issue but I don't think so. These results are a pure consequence from having that ether1 port directly connected to CPU and not to switch chip. Keep in mind: this was a MANAGED SWITCH config so everything VLAN not being HW offloaded to switch, has to pass CPU. Again: I used the EXA...

If I did not make it clear enough that it wasn’t just a hEX refresh issue when I mentioned others having the same (or similar) issues with other routers, I don’t know what to say there…

No, no, you made that very clear

PC with intel AX211, so it supports 160Mhz-wide channels.
About 940-950Mbps using iperf3 to internal iperf container, which are normal values for a 1Gb link.
So the limit is the ethernet port, I guess.

You don't need anything else on RB5009 except for base ROS package, capsman is available and can be used. High level it looks ok with some remarks: You allow channels on 5Ghz which may result in overlaps/interference if you use 160MHz on your APs (e.g. 5180 and 5260, 5500 and 5580). You also let the...

Connecting 2 subnets with the same IP-range is asking for trouble. You WILL get conflicts. I'm not saying it can not be done (you still need to take care of overlapping addresses) but you will probably create a lot of other problems. Changing the home subnet is the best option in my view. One of the...

Biggest problem of these times ... AI making things up and most are unable to determine what's right or wrong and just think is has to be right. It LOOKS right but it is not, as you have seen. There is no proxy-property to be set in ROS7. It looks to me this is coming from ROS6 because The Dude (new...

Can you access the device using webfig (webbrowser) or Winbox ?

Are both 2Ghz and 5GHz radios not transmitting ?
When certain frequencies are being used for 5GHz it can take several minutes before it appears due to radar detection checks (even up to 15 minutes)

Actually, that's 2 separate gigabit ethernet ports. It may seem strange but you will rarely get there. That 2400Mbit/s is the physical data rate. Has little to do with the actual throughput (though higher data rate usually results in higher throughput). Rule of thumb: roughly 50% of data rate is wha...

FWIW ... from PC using wAP AX as AP and Hex Refresh in between towards RB5009 as router with iperf3 container ... I was able to get 900Mbps. Hex wasn't even sweating. But that's with Hex Refresh in managed switch mode (read: VLANs being used) NOT using ether1 as uplink ! In that same config using et...

Are you referring to caps radios becoming visible in capsman or the radios themselves becoming visible to clients ? The former should be rather quick. On my installations it is a matter of seconds after reboot. The latter can take up to 15 minutes if you use DFS frequencies (radar checks needs to be...

So the problem is clearly with Verizon ONT ... Just wondering: What port did you use for uplink to ISP device ? I suppose ether1 ? You are aware ether1 is handled completely different from the 4 other ether ports on that particular version of Hex ? (see block diagram) When you do speedtests maxing o...

Sure, why not ?

So, is something wrong with 7.17RC for RB5009 with Capsman? Or was I just very unlucky for some reason? I don't think it has anything to do with capsman. I had a complete crash on my RB5009 (needed to power cycle to get it back) and had to revert to 7.17b6. After trying to partition that device, it...

Are you saying that the hAP ax2 is more versitile than the hAP ax3? If so, how? Try to fit an AX3 in your backpack. Or simply move it around to another place. Those big ears make it a bit less handy for that. I'd love to hear what netinstalled "using container on AX3" means? Simple. Usb s...

For versatility I would also go for AX2 but ... it has no usb port.

Just netinstalled 5 cap ac ( ros and wifi-qcom-ac) using container on AX3.
First time right on each occurrence.

Sure. Each slave radio needs to be attached to a master and will take over the physical properties but can have separate SSID and security. Each of those slave radios will be an interface on its own and then the VLAN game can be applied again. Just don't overdo it because each virtual SSID will ulti...

Good job !

From those 3, wap AX since it allows for 160MHz channels (if you can use it within your environment. I can

).

It does seem odd wireless package is loaded yet not being used ?

You could try to simply MANUALLY add the wifi interface (in case that interface really needs a long time before it becomes operational after startup). What happens then ?

I think I have seen a similar question recently and if I'm not mistaking, you need to use some sort of address remapping based on port.

Edit: I knew I saw it already before not too long ago

viewtopic.php?p=1108865#p1108865

What model of mikrotik routers do you have in Venezuela and Espana?

It's hidden in the wall of text

AC3 in Venezuela, already present.
Planned to buy AC2 for Spain.

100Mbps over 2.4GHz legacy wireless ? Yeah, one can dream. Make no mistake about my sentiments, however. That mAP is still a fabulous device for its price and flexibility ! I even prefer it over mAP Lite (I do keep that one in my backpack wherever I go). But I get what you mean. Everyone always refe...

For wireguard you only need one public IP, as long as that is present, there is no problem to setup a VPN tunnel which you then can cross from the other side, there are plenty of examples how this should be done, do you have by now also the idea that use of proper interpunction and line breaks is a ...

It is more an issue with its routing speed, that may be too slow for your requirements, it should be in the 150-200 Mbit range.

And how are you going to do that with only 100Mb ports ???

Yes, works just fine !

(IPSEC to Azure, Wireguard, EOIP, , DHCP for about 15 devices, routing, ISP connection of 50/20Mb...)
"only" 19d uptime because I did upgrade of that version, before it was 139d.

2024-12-04_10-22-02.jpg

Can go up to 15 minutes...

Manually is the safest way. Also observe defaults which may be present on the ac2 which may have been different on the older one. Go for the newer settings then. Don't copy MAC addresses for bridge or interfaces. They will be filled in by default. On itself it is not really a big deal, done it plent...

My experience so far is that wifi-qcom-ac is just not worth the trouble, it is way more unstable and there is no significant performance gain so if you don't absolutely need new CAPsMAN just stay with the older wireless package... I disagree. +1 on disagreeing. MAJOR difference in performance betwe...

Super, no issue there then !

As long as the second device gets sufficient power and it can " see" capsman controller network-wise, no problem. What i want to do is: capsman<----wired--->cap1<---wired--->cap2 Or it is daisy-chained (controller wired to cap wired to 2nd cap) in which case there should not be a problem ...

You got a point.
You can check for src_address!=192.168.88.0/27, dst_address=192.168.88.0/27

I doubt that USB-C connector can be used for anything else then powering the device. It's not even mentioned on block diagram (whereas for other devices where I know it works, it clearly is indicated as USB). I even seem to recall Normis (MT staff) mentioned it somewhere (would have to look for it)....

Best to fire ticket to support.
They are the only ones able to tell if and when it can be supported.

Just to check:
did anyone create a ticket to support about this ?
Otherwise chances are high they do not know about it ...

Not an expert either so my personal view. Functionally both are mostly the same. In some edge case (which I can not directly imagine) the second version will catch more so I guess it is the better option. On second option: why use 2 rules for hw-offload or not ? Since I have been looking into this m...

My initial comment to move that one rule to the top was based on the rest not being secure enough already. The only true way to solve this: Use outgoing vpn to some public accessible ip ( either your own or some cloud server) and use that as pivot point to get back in. And then you can close that op...

Whenever you change something in firewall, clear all connections or wait 10 minutes or reboot.

Move this rule as first on input chain

add action=accept chain=input comment=WinBox dst-port=8321 protocol=tcp

Open terminal
/export file=anynameyouwish
Move file to PC
Open file with text editor and remove serial number, passwds, public IP,...
Post contents between [code] [/code] quotes for easier readability.

That recommendation was repeated in post #11 and #12
I was going to post again in my view starting from default would be the ONLY sensible starting point but alas ... some are more interesting in patching holes instead of starting from a clean, known to be working config.

My view:
Then you did not reset to default config.
You can also do this from Winbox/webfig, you know ? System / reset configuration.
Uncheck Caps mode
check Keep users.
Uncheck No Default config
Check Do not backup

hmmm... 24 is not a nice binary number like 16 or 32 (110000 vs 10000/100000). Using a subnet mask is out then. You can add those addresses in an address list and use that one in your firewall rule, I would think ? Address list SERVER_RANGE (or whatever), add all addresses from 192.168.88.1 to 192.1...

Why the question asking the question? Typically the LTS is acutally the most stable version available, who doesnt want that (rhetorical question)! However, I have moved off vers6 on my main router recently to ver 7.16, as an LTS for ver7 seems unlikely. :-) yep sir, you’re correct. more stable than...

Personal view: To be honest, the way MT handles their versions, LTS-label is not really worth a lot to me. Some may value it as being super stable (based on what ??) but there will always be bugs in it which are sorted out in subsequent non-LTS versions. Which is the more stable then ? LTS or the ne...

There is no LTS version yet for ROS7 and since Hex Refresh came out of factory with 7.15.3 (I have one right here on my desk), you can not go lower.

But I have the same remark: why the question for LTS ?

Observation:
user passwd the same as user name ? Then it could just as well be kept blank. Gives the same level of security.

Prepare everything in Excel or whatever and then use text functions to create the script. Or any other text processing tool of your preference. I once had to move over about 100 DHCP leases based on Mac address from Win DHCP server to RB5009 and used that approach via Excel. Export from MS Windows D...

@gjmelena
And your point is ?? It's not really clear from your post.

PS I always use create enabled on capsman provisioning, simply to avoid numbers creeping up whenever a reboot/reconnect happens for whatever reason.

Or change ISP ?
A party blocking VPN is not worth to receive your money.

Yes, the second device is wired to the capsman. Now you are contradicting yourself :D Either it is directly connected and then there is no issue. Or it is daisy-chained (controller wired to cap wired to 2nd cap) in which case there should not be a problem either if that first cap is in full bridged...

Please implemnt column vertical divider lines as it's much easier to read data and recognize where one info ends and a new one starts.

Agree.

On Windows 11 you can't really see it unless you start hovering over the area with your mouse. Inefficient.

Stickers already exist:

https://merch.mikrotik.com/products/sticker-sheet-2
https://merch.mikrotik.com/products/sticker-sheet

Configure 2GHz radio and leave 5GHz as it is ...

Vlan and qcom-ac using capsman is ... special.
With ax it is really easy.

No, you do not have to use VLAN.

If you setup devices separately, you can use this approach on each.
https://tangentsoft.com/mikrotik/wiki?n ... ns%20VLANs

But to be honest, once you get how vlans work, they make things easier.

And the solution is ?
Might help others having the same issue as you...

First, please have a look at the
Code: Select all
code
tag. That makes it easier to read configs.

Fixed.

1- Your choice. See later. 2- wifi is using qcom drivers. Wireless is using MT own developed drivers. With arrival of AX line, MT decided to use qcom drivers. qcom-ac was also made to get wave2 compatibility for older HW having compatible chipsets. 3- Who knows ? :D 4- It just has been redone with w...

It doesn't harm, true.

But if everything is already handled before, it doesn't make sense. That's all.

Not sure where to start, quite a bit of things which are off. You may want to start reading this excellent tutorial on setting up VLAN: https://forum.mikrotik.com/viewtopic.php?t=143620 Where is the firewall ? Where is DHCP server for the rest of your network ? Where is address assignments for route...

Simple explanation. The rule doesn't get hit. As a test, disable the forward, invalid rule. See what happens. It's not because a rule doesn't count it is not working. It simply means all the rest before, catches everything before it gets there. But in default firewall, that specific combination is n...

And now all notifications from the past weeks are coming through

And where is the virtual wifi in that config ??

If you add it again, don't forget to attach it to bridge.

Netinstall
Start from default
Learn.

Yes, for managing wave2 radios it is already there.

That container thing I saw as well.
Luckily it was pretty straightforward to bring them back to life.

As long as the second device gets sufficient power and it can " see" capsman controller network-wise, no problem.

IF , and that's intentionally in capitals, AC3 uses wifi-qcom-ac drivers.
Then wave2 capsman will work on hex.

If AC3 still uses legacy wireless, you need to load wireless package as well on Hex but storage space might become very restricted.

That would be my take as well.
Given the inexperience of the user, no offense intented, it's best to start from default with a netinstalled device.

Looks like someone emptied that firewall.
I hope you haven't got it connected to a WAN interface ?

Well, that planned netinstall came earlier then expected.
Wanted to partition my device for future mishaps. Completely bricked.

Luckily I had an export from 3 days ago. Biggest problem was getting netinstall to work (after some attempts with Windows. I used container on AX3, first time right).

Write to support@mikrotik.com

Same advise ...

As of 7.13 wireless or wifi-qcom, depending on your device, is a separate package.

I have a couple of mAP devices running just fine with ROS7 incl wireguard and IPSEC tunnels.

And still you don't answer all questions... ether4 on RB5009 to the swith. ether10 and ether12 from the switch to CAP devices. Which incoming port on the switch ? From your switch config I see there is a trunk specified for ether1 and 12 for VLANs 20 and 30. /interface bridge vlan add bridge=bridge ...

You did not specify which is the port from your RB5009 going to the switch ?
Which port on the switch does it come in ?

Which ports on switch are feeding CAP devices ?

Also, it is generally advised NOT to use VLAN1. Use VLAN all the way or don't use it all.

You do not specify which router, which switch, which APs (capsman behavior w.r.t. VLAN is quite different when talking about legacy wireless or wave2 wifi) You do not specify how things are connected. And you do not show your config, what you already tried. So I doubt anyone can have a clue, without...

Errmm ... that's an article from 2014 ?!

... something weird happened in 7.17RC...

Really ?
viewtopic.php?p=1111415#p1111415

Has been a while since I used "old" capsman but I assume it still works more or less the same with the wave2 version. When updating, it's started all at once. And since all package files then need to come from your controller, it may feel like it takes more time since you may create a bott...

I've seen LTE interface disappear due to FW crash on modem (FW bug on AX Lite LTE with FG621-EA modem, some versions ago). You could recreate it but it vanishes again shortly after creating (when the crash happens again). But this should show in logs. It might be possible you have to go back to ROS ...

To make it simple;

Requirements
Container package is compatible with arm arm64 and x86 architectures. Using of remote-image (similar to docker pull) functionality requires a lot of free space in main memory, 16MB SPI flash boards may use pre-build images on USB or other disk media.

Use external devices more suited for this type of action (and those usually come with a HEAVY price tag).
Not L7 filters on Mikrotik.

Are you expecting us to make your config ?
You may as well ask ChatGPT, who knows what comes out given the limited info you provided.

First show what you already did yourself and you need to describe in a lot more detail what's needed where.

For starters ... why create 2 VLANs yet overlapping subnets ? Use 192.168.0.0/24 for first vlan Use 192.168.1.0/24 for second vlan Much easier. You may want to read this nice tutorial: https://forum.mikrotik.com/viewtopic.php?t=143620 Secondly: supout should NEVER be posted here. Only communicated t...

Even for 5GHz I use 20MHz in that setup. All cAP AX and AX3 devices. Stable as a house AND more options to stay on below-DFS channels (scanners in use there don't support higher channels so I had to cut down channel width to create more possibilities to avoid overlaps). That one higher channel is fo...

Moved to beginner basics

You do know that was a response to a 6-year old thread ??

Add route for subnet using gateway where it needs to go to.

So ... routing.

Correct.

Nice link :lol: Want to emphasize again that even after 2 years some users (yeah, me included) have a much higher success rate using Linux for netinstall. Recently I even started using a container option on AX3 (am going to move it to Hex Refresh which I recently added to home lab setup). Another op...

Or some cheap VPS in the cloud and install CHR on it, then use that one as pivot point for all Wireguard connections ? Shouldn't be too expensive ? Anav always claims it's about 7$ / month but I don't know what supplier provides it. The IP address doesn't need to be static per se. You can also use a...

If your device is passing the requirements, you can also use Mikrotik's Back To Home.
It's meant for those cases where one side is behind CGNAT.

Just checked the details of the ticket again ... The problem was that with 7.17b4, after changing device mode to advanced, routerboard settings could be changed without first changing that setting (it was "yes" without doing anything). It seems that part has been "corrected" (7.1...

On routerboard, there is an important thing to be taken into account... upgrade or autoupgrade FW to latest version. There have been quite a bit of fixes lately where this upgrade was needed for some corrections to work afterwards. E.g. *) ethernet - improved linking after reboot for hAP ax lite dev...

I could do the corner, but I'd be surprised if it make much difference. Line of sight will be better for most of the area so it will make a difference. 2 APs, let alone table mounted, would fail the WAF (wife acceptance factor) immediately. In fact, it is likely that the AP on the outside of the wa...

Since this version has some specific changes related to certificates for capsman, it might be needed to clear certificates on capsman controller.

Just one more question - how can I disable TKIP as encryption method and the legacy standards - a/b/g and leave only n/ac/ax? Currently I haven't checked any of the cyphers and I guess that all of them are acceptable. As for legacy standards, in legacy wireless drivers this was possible to specify....

Personal view:
the fact 7.16.2 is being made, makes me think/hope it might take a bit longer before 7.17 becomes stable since all bug fixes here, are also available in 7.17 chain.
And that might be a good thing so more issues can be ironed out for 7.17.

@EdPa, While I fully understand the rationale for this message in my view the problem here is not the message itself but the fact it currently looks too much like an error (which it is not for a lot of cases, certainly not when no cable or active connection is present). There is also a partially dou...

(thread moved) Why not use the corner then ? 2024-11-27_07-36-23.jpg Added options: (as much as I prefer not to, sometimes it can be of use) Can you use powerline adapters in order to be able to place 2 APs in diagonal corners (left bottom and right top) ? If so, I'd go with wAP AX, table mounted. V...

You do not need wireless (unless that RB5009 acts as capsman controller for legacy wifi APs).
If you only have AX or Qcom-AC APs, remove wireless from RB5009.

As of 7.13 support is default available in base ROS package to act as capsman controller for wave2 devices.

Return to default config.

Then use Webfig or Winbox to simply disable wifi interfaces (don't delete, use disable

).

You are surprised no valid frequency is selected with a config line like this ? set [ find default-name=wifi1 ] channel.band=5ghz-ax .frequency=2300-7300 Steps to be taken 1- start from default config 2- use proper country setting 3- scan your environment, see which channels are free or least used 4...

I have capsman setup with cAP AX devices in warehouse environment where I set the channel width to 20Mhz. No need for more speed with warehouse scanners. I prefer stability there. At home however (really interference-free environment "thanks to" modern building methods, not even GSM signal...

Without RIF file, we can't fix issues that only some people have observed. For your convenience I upgraded again to 7.17rc1. Result: 2024-11-26_20-26-16.jpg Nice empty windows. Supout could not be created (dead hang and frequent disconnect from Winbox). Downgrading resulted in dead device. I had to...

some post moved to new place.
viewtopic.php?t=212859

Continue the complaining there please.

I see the same behavior in Winbox4 or Webfig on RB5009 (7.17b6) and Hex Refresh (7.17rc1) for ports with no cable in it.
So big possibility it's just that and nothing else.

Or you want my config as well ?

Sweet, now I don't have to try :lol: And yet I did ... tiny teeny container run from usb1 and it seems to work. 2024-11-26 17:09:33 container,info,debug layer sha256:4c3160818a1f052453d094c490acbae70caa44bbed5fe8ea47be90c560c515fc downloaded 2024-11-26 17:09:33 container,info,debug import successfu...

Now you're using a canon to kill a mosquito ...
Config export is not needed here if it is a mere representation issue.

Sweet, now I don't have to try

[1] For the love of God, they're not going to release a stable version on Black Friday like they did sometimes in the past... It's already a hectic day in the life of every network operator... Another little surprise as a software update wouldn't be pleasant. And ?? You're not letting updates pass ...

Okido, glad you found it yourself.
Usually one will remember it a lot better then next time

It might help if you show us export of your config and a bit more info on what you are trying to do (which port trunk/access and which vlan). Terminal export file=anynameyouwish Move file to PC Edit file, remote serial, obfuscate remaining sensitive info Post back between [ code] [/ code] quotes for...

Checkout this VLAN tutorial, the part about switch:

viewtopic.php?t=143620

It's not "all ports". Some are active. What client are you using to represent this info ? Which ROS version ? Is something plugged in on those ports ? If not, that may be the reason together with the new style info is being represented in Winbox4/Webfig (7.17beta/rc) I am seeing this too w...

Not necessarily something I plan to do but just a pitfall to keep in mind when things are not going as foreseen when you used that method before.

you can use /interface/wifi/radio provision to provision you local radios according to your provisioning rules. Thats it. Also documented. https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-RadioProvisioning Woah ! I wasn't aware of that option. Nice ! But there is a caveat That be...

Nope, didn't have the time to do so ( and to be honest, totally forgot).
I had to get my network back up because I had to start working.

I may try again this evening.

Upgraded home-RB5009 from 7.17beta6 to rc1, containers, capsman, ... Winbox3.41 - lots of dialogs with empty info at first (Files, Wireless Registration, Capsman Remote Cap, DHCP Lease, ...). Only after sometimes minutes the info came through. - some containers started, some not. No reason visible w...

When using VLAN on Mikrotik devices, it is generally advised here to NOT use VLAN 1.
Some devices from other brands can do funny things with pvid=1 making the whole thing break down when it passes Tik gear.

Can you provide a simple drawing (can be on paper) about your understanding of mesh network and what it should look like in total ?
And why the need for a mesh network ?

Yes you can.
When using ROS version 7.13 or higher, load wireless package as well and you have both environments.

First comments: 1- remove serial from export of config ! 2- One of the least smart things one can do is rename interfaces. Really ! You're making it harder for yourself and others to review config files. Especially so if you are encountering issues and hunting for problem causes. 3- What packages ar...

I have both wifi-qcom and wifi-qcom- ac.

Your ac3 is running wireless or wifi-qcom-ac ?
The former doesn't have WPA3 but I ask to be sure.

Unlikely.

I have a bunch of IoT devices REFUSING to connect to 2GHz when WPA3 is added to the mix.
I have a separate SSID ONLY using WPA2 (nothing else security-wise) and then they're happy.

Start by simply blocking ALL incoming traffic, then see what happens.

Regarding unmanaged switch, especially when it does not handle VLAN tagged frames correctly: one thing I have already done in the past to circumvent such an issue is using EOIP link between router and AP to virtually bypass unmanaged switch. EOIP link is then used as trunk for VLAN traffic. Ofcourse...

You posted your question in the tutorial thread about Using VLAN in RouterOS but it seems you haven't read it...

So again:
viewtopic.php?t=143620

Correct once again

1. Hardware Check -Power Supply: Ensure the mAP Lite is receiving adequate power. If you’re using a USB adapter, try a different adapter with at least 1A output. -LED Behavior: Compare the LED activity to show power and other interfaces. If power supply is not sufficient, the thing will not power o...

Hey @muaazteladia, welcome to the forum! Great to see more knowledgeable and dedicated people joining us. Have a nice weekend!

Errm. NOT !
Couple of things in that response which are blatantly wrong if you know your stuff.

Did you write this, or was it generated by ChatGPT ?

Its sounds very GPT like....

To be honest ... I've seen other posts where I had the exact same feeling.

The wAP Ax Is a very new device, so there are not reports on how It behaves. It is standing on my desk here since a little over 2 weeks, under capsman control via RB5009. It behaves really stable (ZERO drops that I can tell on my PC, using Azure Remote Desktop which is VERY sensitive to drops) and ...

- 60db is a pretty good signal already.

If you really want to improve that situation ...
( drum roll)

add a cat6 cable.
Or powerline.
Or Moca.

You get where I am going to by now

RB5009 does have IPSEC HW acceleration.
For quite a while already.

It's not a mute point if one of both ends is a Tik... as was indicated ?

Shht ! Don't jinx it !!

Your point 3 is where I beg to differ.

I tested connections between 2 Tiks using HW offload.

RB5009 to RB5009
Hex Refresh to RB5009
AXLite to RB5009

WG won each time.

AC or AX band selection are physical settings always driven by master radio. If you set radio to AX, AC clients should connect just fine. Same with 2GHz AX radio and N clients. I have plenty of IoT clients only using N connecting to 2GHz AX radio. Just make sure your security settings are OK. Usuall...

Should be fine.
WAP AX can use 160MHz wide channel so there should not be that much difference ( provided your environment allows you to use it. Read: relatively interference free).

Unify and wAP AX both use 1gb ether ports, so that's probably going to be your limiting factor anyhow.

You will never win that battle...
If e.g. they start using VPN, you will not see anything about their actions.

Wild idea: how about applying queues so their bandwidth is limited to normal browsing and mail traffic ?

Without config, nobody can tell.

PS L009 doesn't run ROS6.

Why do you set AX device to 2GHz-N ?
Leave it blank, it will choose on it's own what it should be.

Most IoT devices (in my experience) are only accepting WPA2 at most. Nothing else.

In 95% of cases: 1 bridge for whatever you want to throw at it. As for VLAN: you may want to check this excellent tutorial: https://forum.mikrotik.com/viewtopic.php?t=143620 Use the wifi interface in your bridge settings. If the radio on your RB4011 is being listed as dynamic, it means you have it c...

Some members here never took an exam yet are far more knowledgeable then those being listed as consultant...

My 0.02€...

Make sure it is properly reset.
Out of the box it should broadcast an SSID.
That's where you need to connect to for further config since default ether will be considered WAN and blocked for entry by firewall.

Don't set vlan on datapath.
Use interface as with other ports via bridge.

Wireless capsman menu might be there but doesn't do anything anymore if you use wifi-qcom-ac driver.

Do not setup local radio under capsman.
Treat it as a local radio with vlan etc.

That's the page for AC3.
You can tell seeing arm version instead of arm64.

Different thing.

Page for AX3 is correct.

And the only correct driver for AX3 is wifi-qcom.
NOT wifi-qcom-ac.

Repeat...

When testing Tik to Tik with both devices capable of HW offloading IPSEC, WG is still faster.

Since one side is Tik, performance will always be dictated by the slowest one.

Wireguard will be faster given same underlying HW.

Do the test yourself.
I already did. Hence my conclusion.

Interesting ... 7.11.3 may contain a bug then for that part.

But in the mean time we're already at 7.16.1.

Once you define a port properly as trunk, pvid setting doesn't matter anymore.

Drop IPSEC.
It will also be SW based on CHR side and therefor even be slower then WG.

When testing Tik to Tik with both devices capable of HW offloading IPSEC, WG is still faster.

My view ...

I had a strange behaviour after updating my both CHR CAPsMAN (AX) from 7.17beta6 to 7.17RC1. Both devices lost their CAPsMAN config. All entries were emty (wifi -> Config, Channel, Security, datapath aso.) Next I tried to re-import the settings from an RSC-file, but the import hangs while importing...

I cleaned it up as you said and understood a little more. However, I think that the edit "add bridge=brLAN ingress-filtering=yes frame-types= admit-only-vlan-tagged interface=ether4" fixed the fact that I could see the other IPs coming from Ubiquiti and now I cannot which is perfect. I be...

I am going to assume you are using the other ports as untagged for ... vlan 1 ? Something does show on your screenshot indicating it. Rule (somewhere between 1 and 3) for Mikrotik admin: Avoid vlan 1. If you use vlan on Mikrotik, use it all the way. Set proper tagged/ untagged ports with correct vla...

My mistake. It should be there. It's not listed in pheripherals section but others.

What's the point if there is no temperature sensor ?

3. I am not sure if this is LEGAL. your slave WLAN for wireguard has a different BAND from the master. Is this allowed, I know the frequency and such is copied over......... I believe the virtual WLAN can have ONLY its own SSID, and security setting and can be assigned to a different subnet/vlan. T...

First enable changing of routerboard settings in device mode.
This will require a reboot.

Then you can change the setting.

Best to contact support with your specific requests.

support@mikrotik.com

Same issue for me... Mokrotik support any feedback? is frame routing supported by chateau 5G???

Ask support via support@mikrotik.com to be sure.
This is a user forum, they don't read everything on this place.

FWIW I had AX3 and now wAP AX on my desk. Since I have that wAP AX I use my laptop only via wifi. Zero disconnects. And using Azure Remote Desktop when working from home I would know immediately ... that environment is HIGHLY allergic to disconnects, even for a split second. (Using AX3 I also have u...

No screenshots please !
Export of config.
And a clear description of what your problem is and what you want to achieve.

Got 5 or 6 of those installed with customer.
They are very good.

One can dream....

Search found 6992 matches