MikroTik

We dont even know what is wrong. Whats the output of /interface/lte/monitor lte1 once Consider downgrading to ROS 7.17 before doing factory reset. This is BETA. the problem started not when i upgraded to the beta version, but just after when i upgraded the modem to 16121.1034.00.01.01.08 and i was ...

Or just a matter of not waiting long enough ?

Not to my knowledge.
Read-only.

There are ways to use some OID to write info back to the router or reboot the device using SNMP but the OID itself can not be changed.

Like this:

/export file=anynameyouwish ( minus router serial number, public WANIP information, keys etc.... )

Move file to PC and then post back here between code quotes.

CRS326 or CRS328, same CPU so doesn't make a difference. CRS318, slightly less. CCR1009... that's a beast ! Personally I prefer to run it on a router but I also have 1 installation where it runs on CRS326, another CRS328 (router is not MT, not under my control). You can even run it on one of the cAP...

Just so you know ... This is a user forum with users helping other users. Sometime MT staff pops in but certainly not all the time nor everywhere. So while I do understand your problem and your need to ventilate, you may get a lot of sympathy here but maybe not much resolution. Unless Normis or EdPa...

If the file was dropped on root directory (from screen shot it looks like it is in a subfolder), after reboot you should see something in log about failed install and possible reason.
Or success.

It depends.
Are your switches capable of handling the server traffic load or not ?

If not, then you got your answer there already.
If they are, it really doesn't matter but most will use switch.

If you're referring to a true LTE interface, that should use CGNAT and then your plan is useless. No way to come in directly on that interface. But you CAN first go out (e.g. using wireguard if you have another server where it can be configured, zerotier or even Mikrotik's own Back To Home) and then...

Don't be scared.
It's 90-95% the same as other wifi settings.

AFAIK, for the VLAN interface (and it's attached DHCP Client), VLAN filtering should be enabled. That's not what I understood. At least not for wifi-qcom (wifi-qcom-ac is something else). My APs don't have VLAN filtering active either. It would defeat the purpose of using VLANs on caps mode devices...

Might be helpful for others to show what the end result is and what modifications made things work

There is no setting "registry-ur".

There is when it auto-completes to "registry-url"

[xyz@RB5009] > container/config set <TAB>
layer-dir password ram-high registry-url tmpdir username

taking a copper Ethernet Gig fiber circuit Maybe it is my fault. But I don't understand a) what a copper Ethernet Gig fiber circuit is it fiber or copper as far as the device is concerned? Marketing talk. We have here in Belgium also an ISP using coax as medium but they call it FiberNet because it ...

Export config tot txt file, move away from device Check export for completeness Netinstall (yes, again) DON'T restore binary backup, it clearly has some errors in it and you are simply re-importing those. Apply config again block by block via terminal and copy-paste. In case of doubt, post the confi...

Upgraded RB460GX4 from 7.17 basic package and the result is full set of disabled additional packages. For RB433 only installed packages are still installed after upgrade and no additional list. EDIT: for RB450Gx4 I see that it's only a list of available packages. Not installed according to "In...

Lower speed too ?
I've seen it happen with some bank payment terminals for POS, 1 type I had to set the connecting port to 10Mbps (yes, 10 !) or it wouldn't stay stable.

Already tried setting that port to fixed speed (not using auto negotiation) ?

For roaming to work seamlessly, you need to use capsman (and then in security / FT tab, settings for FT Enabled and FT over DS should be active). If you do not have a capsman controller, there will be disconnects when clients move from AP A to AP B. Using mentioned settings, roaming can work between...

When this happens, best to create support ticket with autosupout.rif.

First take a look at block diagram. There you see AC2 is not capable of using 2.5Gb on external ethernet interfaces. Only normal Gb (= 1Gbps). The comment on that page you linked to is probably about a generic setting , not applicable to AC2 (but please indicate where you see it being mentioned ?). ...

It is usually wise to check block diagrams for such questions.

My personal choice is to avoid such providers, but other people may have no other choice. I did quite some research before settling on the provider I'm using now. Especially the fact they explicitly mentioned on their knowledge base you first had to do some config before being able to do anything, ...

Something should be present in log about storage space problems. It might be needed to netinstall that device. AC2 under ROS7 is known to become a bit "tight" on flash space, you may be just on the limit. Netinstall clears all internal residue from previous installations. Have a PROPER exp...

I used it to connect a printer. 100Mb connection so I'm sure the CPU will not have a problem with it.

Keep in mind old Hex is also something odd in router mode with 2 buses connecting to CPU (1/3/5 on one bus and 2/4 on another).
In switch mode, all 5 ports can be connected together.

I understand what you say but I am 200% sure the setup I had when applying that VPS instance in the cloud did not have a public IP address nor DHCP client. It's even in the instructions of the hosting provider I used (IS Hosting) that you first need to go via hosting console and you need to set the ...

No DHCP client on the version I used ? I was wrong though. It defaults to 192.168.88.1 which however is useless facing outwards. script: #| IP address 192.168.88.1/24 is on ether1 #| ether1 is enabled :global action # these commands are executed after installation or configuration reset :if ($action...

Default CHR doesn't have ip address, I believe.
You first need to go via hosting console to get in.
And that was ( for the provider I used) a really annoying complex password (but top points for security there !).

So first do your setup, then connect to Big Bad World.

Possible reason: Old capsman was able to use local or capsman forwarding. Last part is a tunnel where all traffic from cap was first tunneled to controller before being handled on controller. This bypasses your port security. New capsman only supports local forwarding. You can work around that situa...

Finally support hinting Detect Internet is no good

Can't check right now but I also believe it's access list nowadays.

It would actually be an issue if netisntall would have to be performed through any other port then WAN. What I do agree on is that any device connected to any port on the Routerboard is a potential thread. 1- indeed and that's why with the current process, it remains a non-issue. 2- True but that's...

You can not have AND ISP device AND your PC for netinstall connected at the same time to one single port.
Not without a switch or hub in between.
The fact you need to use ether1 for netinstall, forces you to disconnect whatever WAN device is connected to it.

Again: non-issue.

Wait a minute ... when you netinstall, what other device is connected to that WAN port in order to perform that netinstall ? Tip: not the Big Bad Web ... most likely your PC. Non-issue. Second part is most likely a result from new device mode settings since 7.17rc(whatever). Check that part to enabl...

What it means (after correcting that DHCP pool problem): your pool is completely using the subnet. But it should not be a problem. DHCP server is smart enough to first check if an IP address is already in use before handing it out. But you will not see it right away then. So, couple of options: Eith...

Did you recently upgrade that device manually ?
Check if wifi-qcom package is present.

No, it doesn't and that is the beauty and problem with ROS. There are situations where it might be needed to set something individually on a caps device in capsman mode, deviating from capsman settings. And it is possible do so with ROS. A blessing but also a huge pitfall ... If you set your device ...

erlinden: If you can tell me how to place an access point in the basement for my washer and dryer that doesn't involve destroying walls and drilling through 0.4m of reinforced concrete, I'm all ears... Not being erlinden but first thing which comes to mind: powerline. E,g,: https://www.devolo.globa...

Can you open that setting on cap, make it blank and then fold the setting closed ? It might be needed to disable caps mode first (I don't have any legacy capsman installation anymore, so I can not check) That should really make it "not set". And then capsman config should be applied. The t...

Why do you have these set on cap ?
Since they show, it means it deviates from default settings.

antenna-gain=0
country=no_country_set
frequency-mode=manual-txpower
ssid=MikroTik
station-roaming=enabled

Especially that country setting is something I would look into.

Post config for cap please.
It is possible to set things locally which will overwrite capsman settings.

Remember that "stable" in software releases means: "here you have a version that will remain for a while, we will not release a new version every week or two, so you can install this and won't have to update it immediately". The stability refers to the number of updates. It does...

It has been a problem all over the weekend.

For the devices not connecting, use ssid without wpa3.
Some might even need WPA.

Interesting... have to test that in my lab later next week.

I've used Devolo in the past, never had problems with it. But it has been at least 5 years since I don't use them anymore.
(long story short: solar panel convertor practically killed the powerline signal so had separate cat6 cable installed between the points where I used powerline before)

Or maybe - just maybe - there is the possibility that there could be something that needs to be changed in its configuration? If this latter could be the case, a good idea would be to post the current configuration for review (anonymizing the sensible data), instructions here: https://forum.mikroti...

Already filed a ticket to support to report the issue?

Surely you mean wifi-qcom-ac as driver for those caps ? From what I can see in the config of that cap (I assume the failing one ?), VLAN setup is not correct for qcom-ac driver. Difference between wifi-qcom and wifi-qcom-ac is that you need to do all the VLAN work on that AC device yourself. And tho...

From product page / brochure / ... it's not clear. When looking at SFP+ compatibility page, this device is listed but not clear either what speeds are supported. But on the section about optical transceivers, it does mention max speed 1G. So undecided. I'm inclined to think max is 1G but I could be ...

From product page: 100Mbps SFP support - this is our first device that supports 100BASE-LX/100BASE-SX/100BASE-BX fiber modules, as well as standard 1.25G SFP modules. So, no. 1.25Gbps max for connection speed BUT with a maximum data speed of 1Gbps and when you look at the block diagram, you'll see w...

There was nothing in between your post and mine, so that would make it directed to you, yes.

When using Winbox in the normal way (using IP address) it is common to get kicked out when changing VLAN settings.

Use Winbox MAC address or remove 1 port from your router off bridge and configure from there (setup small DHCP server on that port or again, use Winbox via MAC address).

Now I'm intrigued ... Most (all ?) of the AX wifi issues I see around here are about standalone devices. At home my AX APs are under capsman control. Not a single problem. Nada. I have one capsman setup with 18 AX APs with a customer: zero issues. For the rest no standalone AX devices in place. So I...

Wifi-qcom-ac is a bit different on VLAN part.
- explicitly set VLAN on interfaces on CAP (use create enabled on provisioning part)
- explicitly set VLAN on bridge on CAP
- don't use datapath VLAN setting for those CAPs (separate configuration)

Better to ask via support.
They don't always read all posts here.

Too light.

Light wise and weight wise

Point 1: tick 6 can be obtained when overlaying EOIP or alike over that wireguard connection.
Doesn't even have to be connected to brdige. It just needs to be active.

Adding: Important to distinguish perhaps since otherwise we get lost in semantics: software reboot does not necessarily result in power cycle of USB devices. USB power reset does make sure that modem is power cycled. During SW reboot it might be it stays powered on (one should monitor USB lines to s...

User manual for this camera says - PoE Power over Ethernet, IEEE 802.3af. So, no, it is not compatible with RB260GSP https://wiki.instar.com/dl/IN-8003HD/QuickInstallation-1080p-IN-8003HD.pdf PoE (nur für PoE-Version) IEEE 802.3af (+ Pin 4 und 5 / - Pin 7 und 8 ) So there is also a non-POE version....

hAP AX Lite LTE Ticks all your boxes. 2Ghz Wifi only but make no mistake, using the right client it can get to 400Mbps (which LTE can not provide). Used it for testing once on a 10.000mAh power bank, over 8 hours and still the battery wasn't empty. The only comment I have on it is the package. Those...

Adding to that comment from jaclaz and tangent: SWOS or ROS is not going to change anything regarding performance of the device. Main difference is what you can configure and how (hint: it's a LOT LESS using SWOS). It can handle around 40Gbps as a switch. It can handle just under 1Gbps as a router (...

Did you check the jumper settings ?

https://help.mikrotik.com/docs/spaces/U ... 434/RBM33G

Be careful, it might be easy to get trapped in a boot-loop this way ...

The issue with User-Manager and oversize UDP packet that I mentioned in post #236 https://forum.mikrotik.com/viewtopic.php?t=212754#p1115736 is still present in 7.17.rc6. Is anything mentioned about it in the release notes for that version ? I don't see it. Therefor it's logical the issue is still ...

Read this: https://help.mikrotik.com/docs/spaces/ROS/pages/62390319/L3+Hardware+Offloading#L3HardwareOffloading-Inter-VLANRouting Interesting part (emphasis added): Inter-VLAN Routing Since L3HW depends on L2HW, and L2HW is the one that does VLAN processing, Inter-VLAN hardware routing requires a ha...

How I understood:
If you want to benefit from HW offload where possible (for those devices where it is supported), using bridge for setting up VLANs is the default way already for quite some years.

For starters: 12V input for that camera is already not 802.3<xyz> compliant. So you may need a 12V POE splitter. Can't find installation manual for that camera right away so you may have to check there what it says. Since RB260 is default powered by 24V adapter, that's going to be the voltage applie...

I understand.

Best/safest way:
check how it is done in default config script (terminal: /system def print file=whatever, move file to PC and check contents).
Take over that approach.

At first sight your script looks correct.

Yes there is way to do that with startup script but maybe you first should check if latest version solves this problem (if those boards are not there yet).
I've seen something being mentioned in some of the latest release notes related to startup of LTE interface after boot, that's why I mention it.

AFAIK, it's an LTE antenna, and there is no Wi-Fi*. So if you want to make a PtP link OVER an LTE network, you can do that.

This.
There is no point to point using SXT LTE devices, you have to use LTE network.
And then you can work from there.

File a ticket with all your findings to support@mikrotik.com
The only way to get their attention.
They don't read all posts on this forum since this is a USER forum (users helping other users).

Good catch !

Any specific reason why you want to downgrade ?

And there we go again with "the need for speed"... If RB2011 is currently in use without problems, L009 will definitely be more then sufficient (unless of course a huge ISP upgrade is also in the planning). As for 5GHz, AX-2GHz can go to 400Mbps. Some 5GHz connections don't even get there ...

Could be some config hooks from post-7.13 are still hanging around.

What device are you downgrading ?
Already tried with netinstall (in order to be sure there is no backdoor config hanging around from whatever version) ? Make sure to export your current config first (and verify it is complete) !!

That's because in 7.12 all hooks are present to have an upgrade to 7.13 use "automagically" the correct packages for wifi or wireless.
Even so magically that on a simple switch wireless is also loaded when passing towards 7.13

You can, given restrictions as indicated above.
If it's a device with wifi radio, you need to take care adding the correct wireless/wifi package. That's where the biggest difference with respect to handling of packages is with that version.

L009 is designed as a drop-in replacement for RB2011... just saying.
And it has AX radio so 2 birds with 1 stone.

For further expansion with AX units you're on the safe path then.

If temperature starts climbing the moment you switch it on, there is little else you should do then return it for replacement since it's under warranty.

Observation:
with only 1 wireless device and 1 wifi-qcom device, why use capsman if both radios are incompatible for a single capsman environment ?

Set both up as standalone devices and that's it.

( thread cleaned up so it's back on topic, everyone behave please)

Ah yes, I knew I looked into it in the past

According to this Reddit post it should be possible.
https://www.reddit.com/r/mikrotik/comme ... ?rdt=51649

Without seeing how you exactly used the parameters, nobody can answer.

So please show the config part how you enabled netwatch. Preferably the config part, no screenshots please.

Repeat.

Adding:
when defining those IP pools, make sure the manually added addresses are NOT included, which currently is the case.

First: have you ever read this excellent guide on setting up VLAN ? It is considered the Bible around here: https://forum.mikrotik.com/viewtopic.php?t=143620 What 3 CRS109 ? How do they relate to this CRS328 ? Maybe we also need a network drawing ... First comments after seeing config: - pvid on bri...

You need to show full config, not only parts where you think it's wrong.

It is not working so there is a config mistake somewhere but probably not in the place you are showing.

I see these 2 settings for 2GHz channel:
.encryption=ccmp ... .management-encryption=cmac

Make sure they are both disabled.
Not open and blank, really disabled (folded in).

You probably did not perform the reset correctly. Out of the box, WAN is ether1, not SFP+ port. So do the reset again, correctly. Buttons and jumpers The RouterBOOT reset button has the following functions. Press the button and apply the power, then: Release the button when the green LED starts flas...

If we talk about Mikrotik ... why Hex Refresh and AC2 ?
Both limited in performance depending on what speeds you are planning to get (esp. Hex Refresh if you plan on using ether1 as WAN connection).
What speeds are you looking at ?

Why not AX2 ? Far more capable. Or do you need more ports ?

Can you post the wifi part of your config ?
Make sure passwords are obfuscated (change them so we know they are there but so we can not see what it is).

There is no problem with cAP AX. There is a problem with switches which you want to use in a way which they can not handle. Look at those switches as filters. They don't know about VLAN tags. Most likely they are simply discarding that info so when the packets arrive at cAP AX, there is no VLAN info...

Without seeing how you exactly used the parameters, nobody can answer.

So please show the config part how you enabled netwatch. Preferably the config part, no screenshots please.

( 2 threads merged because they contained exact same question)

Normis explained it somewhere not too long ago. Wap is intented to be mounted against wall ( or ceiling). So the omni directional part towards the back is supposed to be reflected back forward ( mostly). You can use it on desk stand but that doesn't change the fact it is supposed to be against somet...

If you use
set cpu-frequency= and then TAB
what options do you get ?

Check security settings on the used ssid.
Some devices don't like it when WPA3 is possible even though they can not use it.
Remove WPA3 and see what happens then.

Alternative: create slave ssid only for those devices not using wpa3.

Hi, I have issue on my hap ac2(firmware v: 7.17rc3) when using wifi on only 5Ghz. When I load this interface its rebooting and after reboot on log I have this errors: router was rebooted without proper shutdown, probably kernel failure kernel failure in previous boot out of memory condition was det...

You are choking the tunnel, that's why.
There is nothing left for anything else.

Do speedtest with limit on bandwidth, leave at least 5% over for management connection ( too much but to be safe).
Then test again.

How I see it: You should be able to enable or disable a provisioning rule ( or switch rules). As long as there is no " catch all" rule active, radios should become silent when there is no provisioning rule active. But I think enabling/disabling the cap interface on controller might be easi...

Regarding bridge and datapath, I think that refers to local bridge of controller where cap interfaces are being attached to. But I do admit it is not crystal clear. bridge (bridge interface) Bridge interface to add interface to, as a bridge port. Virtual ('slave') interfaces are by default added to ...

Performance wise, AX3 wins every time vs L009.

Plenty of examples where it does not work. Here are some more: 10Gtek: ASF-10G2-T and ASF-10G-T, former works, latter doesn't https://forum.mikrotik.com/viewtopic.php?p=1106078&hilit=SFP#p1106078 FoxGate XPON SFP ONU 1001XP-SFP Works on Hex POE but not on L009 https://forum.mikrotik.com/viewtopi...

Fezzfest: un9edsda did provide an example of a module which does NOT work. So your facts are not entirely correct. The correct answer is and will always be: if it's not on the compatibility pages, it has not been tested and it's your own responsibility. It may work (and in some cases it will), it ma...

Most likely firewall rules.
Check that referenced thread again.

I would go with L009 in stead of hex refresh. A bit more future safe. But every time you add a device, you loose 2 ports on the complete setup for trunk. So better get a bit more ports from the beginning. So why not CSS318 ? A bit more expensive then L009, 16 ether ports, 2 SFP+ for future expansion...

I didn't say it was easy

Some comments: 1. The Mikrotik wiki: ... Wiki has been replaced by Help pages. https://help.mikrotik.com/docs/ And yes, it's a continuous work in progress. 2. Add small step-by-step procedures to ROS: Again, Help pages. Capsman is described in extensive detail, no ? https://help.mikrotik.com/docs/sp...

- Are there any NVRAM dumps?
Not as far as I know. ...

Binary backup is the closest possible (as opposed to export in txt format of config).
Can be used to restore on the exact same device or model (but be careful with MAC address duplication on your network since those will be copied as well)

Discussion on PPTP / L2TP moved to new thread:
viewtopic.php?t=213508

If you configure VLANs correctly then yes, switching should be done at 10Gbps rate. But what is your connection speed ? You must think of that, 340 Mbps in today world is nothing. I wouldn't put it that generic... For the customer I work for, we have NO (ZERO) ISP connections passing 200/200. Most ...

Mod message:
since the remaining purpose of this thread seems to be someone is brainstorming with himself, I decided to lock this thread.

Mod message:
Cleanup done of this thread to keep it a bit more on topic.
(apologies to other users who also saw posts being removed during this action)

/interface bridge vlan add bridge=bridge tagged=bridge vlan-ids=20 This includes the bridge interface in the VLAN 20 as a tagged member. RouterOS does this automatically if you create a tagged VLAN interface on top of another interface, so it's not strictly necessary. This is completely true but it...

Your router has been hacked.

Disconnect router from network
NETINSTALL asap.

On PC, you can also run IPCONFIG / ALL (if Windoooos) so you can check if DHCP settings are correct on that end.

Again, and do you plan to do that when there is no internet connection ? A backup connection is the only solution then. But I think I get what you mean... you are referring to "simple" config issues which break the connection ? What I do for the client sites I control ("only" 40 ...

Probably DHCP server is missing here for DHCP clients ?
Set it the same as gateway.

/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1

Just wondering ... how does that VPN work then without internet connectivity ?

Check this recent thread with exact the same environment.
It was about a Python environment.

viewtopic.php?t=213024

It is even advisable to make a separate slave interface with settings only for those devices and make sure it's properly shielded from the rest of your network (firewall, vlan, ... whatever you like, as long as it is done).

Or a very recent change of default setting.

Doubtful IMHO.
There is a confirmed bug with container startup crashing the whole system.
That needs to be fixed or it will be a very eventful release.

If you are testing from PC1 wireless to PC2, you are not really passing Hex. It stays on that switch. What sort of switch is it ? Simple test since both ether4 and ether5 are on the same bridge: remove that switch from the mix. remove/disable bridge2 (to be sure HW offloading is fully active on the ...

Thank you for this diagram.

Where is the iperf server ?

Also, you did not mention in your initial post you have THREE WAN connections to ISP ?
Which device is using which WAN connection ?

Ether5/LAN2 is not being used for the moment ?

(moved post with config into this thread since you replied in another thread, from 2023) Please also add drawing how you test your iperf setup. From which device to which port on Hex, which port from Hex to which other device. Same with wireless AP, what port is it being connected to ? Quick comment...

Already several times it has been hinted to show your config although the info you provide, does not seem to indicate an issue with the wired part. Even if you add a non-MT AP into the mix, it is still a wired device for your Hex. However ...if from wired to wired you "only" get around 820...

Couple of quick comments
Disable detect internet. Really.
Adjust lease time of dhcp server. 10 minutes is really too short. 30m is default, I use 1hr or even 4hr.
Set in APN use default route.

For routing performance rule of thumb is 512 byte packets, 25 filter rules.
That should give you a rough idea about real-life performance.

If it works after you disconnect and reconnect the client and it works with your Mac, there is nothing wrong with the router, I would think.
It's your Windoooos client playing tricks on you

What wifi card is in that box ?
What version of Windows ?

How does it help? There will be still only 1Gb ports on Chateau.

Apologies, my response was directed to OP with RB5009.

Or put a 2.5Gb / 10Gb switch in the mix ?

Even with bonding you will never saturate 2 links if only 1 stream is passing.

I think with quickset you should be able to change those things.
And most likely two subnets using the same IP range will indeed be the problem.

(mod edit: post split from article to keep discussion separate. If needed/useful, can be merged again later) My take on things: 1- what is the question ? 2- what is the question ? 3- Tagged ports are indeed filtering based on VLAN ids. 4- Your base problem here might be that you are not aware a brid...

Already checked with support ?

High level
Q1: create VPN and using firewall rules and VPN interface in forward chain restrict access to only 1 destination device (allow to one dest, drop all the rest coming from that interface).

Q2: similar approach.

What VPN are you planning to add ?

With legacy wireless adding capsman layer makes things indeed more complex. Not that much with wave2 drivers (95% is exactly the same) but you are correct that for 1 AP it's not worth the extra effort. A small drawing with your intended setup adding how VLANs should flow might help. And of course co...

Most likely switch ACL rules.

Check this thread for more background info.
viewtopic.php?t=203589

Now plug in your laptop into ether9, change ipv4 settings to 192.168.65.2 and you should be in!!!

Don't think so.
Not on RB5009 with 8 ether ports

I could track it down and note that it has an issue related to datapath and vlan setup. In short, it only work when provision vlan is the same as mgmt vlan. Cap AX and wAP AX are identical as far as vlan setup is concerned. Only major difference is the swapping of radios, wifi1 and wifi2. Best to c...

Known issue. They are working on it.

You did use ether1 to connect your RB ?
Sometimes it helps to put a dumb switch in between.

Touché

I use IsHosting.
CHR VPS for 5 EUR /month with fixed ip4.
I am using it as wireguard gateway only for now.

Isn't that the purpose of Q-in-Q ?
https://help.mikrotik.com/docs/spaces/R ... LAN-Q-in-Q

Check Bridge STP priority as well if STP/RSTP/MSTP is used.
Core switch should have lowest priority.

See here for more info:
https://help.mikrotik.com/docs/spaces/R ... ionprocess

I have to search for it (again) but there was someone a couple of years ago who made a really nifty script which would do all the collecting and processing and send out info via mail per period you could specify yourself. Used it for SXT LTE6 setup in South of France to track data usage for vacation...

That sounds like a genuine bug.
Definitely something to report.

And ... good analysis !!

What's the idea behind "subsettings" part of config ? To apply it to Jasmine Home ? Doesn't work that way. You apply through provisioning a master config (and if needed slave config) to a radio. All info for that config needs to be in that master config (either directly, either via sub-sec...

The Mikrotik V6 firmware still has a traffic accounting menu, meaning the Mikrotik V7 firmware has been renamed to Kid Control.

That's what I said, didn't I ?

Can kid control monitor client device IP address traffic

Yes.

We've all been there

Some formatting issue on the CAP Name or some naming convention which has not been documented or ... ??

I am seeing the same with all my APs under capsman (7.16.2: AX Lite, wAP AX and AX2).
Also in Winbox GUI it shows.

If it bothers you, make ticket to support so they can investigate root cause.

It has been renamed to IP / Kid Control.

Problem is similar with AX Lite. 64bit processor, 32-bit OS. Main reason they gave is that the device does not have enough memory to justify use of 64-bit. Using 64-bit means larger memory usage of OS itself (64-bit instead of 32-bit pointers) which is then wasted on that device. As far as running R...

While perhaps the older ac chipset cannot directly handle VLAN in hardware... It is a nice try, but the UBNT accesspoints I use at work use the same QCA9984 chip as is used in older MikroTik AC hardware, but it fully supports VLAN assignment per client... and I don't think that would be a software ...

You're not the first and surely will not be the last.

Obviously you need to move that rule to the top of NAT rules ...
And make sure connection track table is empty or reset MT device (or wait).

Maybe this ?

/ip firewall nat
add action=src-nat chain=srcnat dst-address=10.0.1.0/24 out-interface=ether1 to-addresses=10.0.2.1

Reverse for the other side.

CRS = switch. It has routing capabilities but not much. You're most likely looking for CCR then. And then prices go up up up. E.g. CCR2004-16G-2S+ 16 Gb ethernet ports, 2SFP+ cages, PLENTY of power. No Wifi. No passive cooling. There is even a version with 12x SFP+ cages and 2x 25G SFP cages. Does t...

Even better to not allow anything from WAN except VPN and established,related,etc.
Oh wait ... that's done by default firewall rules ...

You're correct, I missed that line.

It has been a while since I played with it but AFAIK default hotspot should have some firewall rules to prevent access between clients. Right before that rule which blocks access, you should add a rule to allow access to that specific printer. To be 100% sure, make sure it has a fixed IP lease so yo...

Have a look at this Help page:
https://help.mikrotik.com/docs/spaces/R ... h+examples

So you have a VPN tunnel between Mikrotik A and Mikrotik B ? Which one ? Answers based on not seeing your config: What interface list is that VPN tunnel in ? I assume nothing. 2 short options: explicitly allow traffic via firewall coming from that tunnel on both Mikrotik devices or add VPN interface...

Going through brick, glass and roof and still getting 216Mb is not too shabby, if you ask me ...

Only thing I found annoying is for some reason mode is changed after every reboot from station bridge to station...

That shouldn't happen.
Which ROS version ?

MikroTik isn't really in 2.5G yet. Yes there are some devices with a single 2.5G port and an SFP that can do 2.5G, but what you really would want is a device like the 5009 but with several 2.5G (UTP) ports. And probably some switches too. And then for the router probably with wireless as well. They...

If understand correctly, I need to configure each AP as a static VLAN device. Will the config hold long term? Meaning, if there will be update, will it crash? Yes. Yes. Normally not :lol: (depends on how MT will proceed with memory requirements for ROS7 and wifi-qcom-ac package because on those AC-...

I read that for the router RB5009UG+S+i you can't use a direct attached copper spf+ cable. I can't find any documentation. I wish to connect this to a mikrotic CRS317-1G-16S+RM switch which can use DAC. Can someone shed some light on what cable I should use? Brad And where did you read that ? Mikro...

Every version of rb5009 has SFP+ port but there is NO version of RB5009 with wifi.
Basic chip used on that platform doesn't support wifi.

It is what it is.

Now you are changing requirements... you said you needed replacement.
RB2011 doesn't have any 2.5Gb ports.

There are no routers with at least 2x 2.5Gb ports AND wifi, not even when considering using 1 SFP+ as 2.5Gb port.
You need 2 devices then.

You mean RB5009 WITH Wifi ? I hope that version never comes...

Drop-in replacement for 2011 is L009, there is version with or without wifi.
And it's fanless.

OK, what's the trick for adding my country - the United States? I tried editing the example wifi /interface wifi configuration section. I tried United States and it doesn't like the space. I tried 'United States' and it doesn't like the '. I tried UnitedStates (no space) and it says no such country...

Therefore as Halvoetn suggested check/disable DHCP client on hAP. The DHCP client has to be enabled for the WAN port otherwise no internet connection. I've not had chance to dig deeper into this but I will. I never said to disable ALL DHCP client. Just the unneeded one(s). Look, it doesn't take 5 m...

If I look at the BSSID of the wifi channel I am currently connected to with my laptop, it's the MAC address of the CAPSMAN wifi interface on the controller. Not the MAC address of the AP radio. If you set those interfaces to create enabled, you should be able to set that MAC the same as it was befor...

Using AX material, there is little to nothing to be done on the caps. So yes, capsman does make it easy. About wifi-qcom-ac, normally this was NOT foreseen but MT made it available for AC HW capable using that driver. They didn't have to. But they did. It does come with some quirks, yes. But you sti...

The DE FACTO guide on setting up VLAN for ROS

viewtopic.php?t=143620

Oh yes.
RB5009Pr

Should be 802.3 af/at compliant.

I think my grip is forum is beating up OP, when Mikrotik's log message is shitty — these "executing script from XXX failed" should identify what script is at issue... I get what you mean but when multiple persons ask you to see config and you persist on not showing it, what sensible perso...

I was already thinking that as well but I don't have a cAP AX lying around here.
Although given wAP AX and cAP AX are both 802.3af/at devices, I am going to (carefully) assume it's just that forced on setting which should make it work.

OP can easily test it.

Help pages:

https://help.mikrotik.com/docs/spaces/R ... 59120/WiFi

Log files do show something is running, no ?
And that part is defined ... in your config.

The negotiation part does not fly when connected to L009.
But it works when you "skip that part", hence forced on.

With "auto on" it gives an error message (on my setup it does).

Just tried with wAP AX (which is even further down in power requirements but normally also 802.3af/at only): it will power on using L009 but you have to set POE on ether8 to forced on. Not auto on.

Which is why we need at least some info on what script is running and how.

Otherwise we are all simply guessing.

Why 2 bridges on RB5009 ?
Why 2 bridges on Netmetal ?

There is most likely your problem.

Could someone help me?
If needed I can paste here the entire configuration

You know what to do then ... both sides, please.

who has marded this post solved?

You did.
I "unsolved" it.

And still you are not responding to our request to provide necessary info ...
Screenshots usually don't help.

Possibly BSSID has changed even though your SSID is the same.

PS great contribution here from mkx related to this topic:
viewtopic.php?t=210898

And no encryption cyphers selected ?

Can you export wifi part of config ? (leave out passwd etc).
It will show there.

What security settings are you using ?
Quite a bit of IoT devices (and that includes quite a bit of SMART TVs) only accept WPA2 and nothing else.

what is this file.? i have private data that i don't want to publish please tell me what this error is related some bug and error in script that system sched wants to run? or some one from outside wants to inject a script in my os? Some comments ... 1- this is a USER forum. Users helping other user...

In most cases, 1 bridge is all you need. If you are planning on having those AX devices connect to a legacy capsman controller (previous generation), that will NOT work. Are you ? It might be better to follow erlinden's advice and provide a schematic representation of your network also clarifying wh...

I dont know how PM here works.

It doesn't.

Check user manual for reset sequence.
Watching led sequence is more important then counting seconds

Worse case: netinstall.

Ssh / ftp / smb / ... you can even mail them to yourself.
Plenty of options.

Depending on needs for further routing, vlan, discovery, romon, ... EOIP might be better since it will create a virtual interface for which you can do exactly the same as any ethernet interface.
But IPIP should do as well if you only need IP-related functions.

Pay attention to which public key you place where and make sure each peer has a unique address.

If that doesn't help, indeed post config for review.
All peers.

A bit too much for my liking.

At least using Wireguard I know you can selectively specify which subnet should go over VPN and which not.
I suppose OpenVPN can do the same ?

Personal preference is WG, though

It's more resource friendly and faster and less chatter to keep the connection.

DuckDNS should be able to do it.
I already used it in the past just for that.

Plenty of script examples available

Search found 7238 matches