MikroTik

woland

https://bst.cisco.com/bugsearch
Not a full bugtracker, but you can get some precious insights
.

woland

I agree: my APs have 2,5G ports, some of my PCs are starting to have 2,5G too, while I´m starting to outgrow the 8 Ports + 5ports combo I have (CSS610-8G-2S+IN + HEXpoe). There must be many others in a similar situation.

woland

Hi! You could try experimentig with SFP rate select (trying both low and high) and as already mentioned try to experiment with speed/autonegotiation: https://help.mikrotik.com/docs/spaces/ROS/pages/220233794/MikroTik+wired+interface+compatibility#MikroTikwiredinterfacecompatibility-SFP%2Binterfaceco...

woland

What an honour!

This was just added to the LTE Help page:
"Passthrough is not supported by all chipsets.
to check if your modem supports passthrough:
/interface/lte/show-capabilities [find]"

woland

Ah OK, thanks @antonsb! At least I´ll be able to check.
Would be nice of MT to document, which Modems (sold by MT) have the capability.

woland

How to get older versions of firmware for R11e-LTE6, to try to downgrade ? ... But I want to get V034, how to get that ? Sorry I don´t know, but you could try to install a testing version: /interface lte firmware-upgrade lte1 upgrade=yes update-channel=testing Maybe you should open a ticket with MT...

woland

Hi, I can´t help much, all I can say is what I would try is downgrading by using netinstall to around 7.15.3 or even to a lower version. I got one too and that is stable on an older ROS7 SW since last summer and it was also performing well on ROS6 before that. Unfortunately I can´t check right now w...

woland

Dumb question on DHCP, it should be working with a DHCP client as in the example from MT.
Reposted a simplified version of it, this went to the wrong topic, sry!
viewtopic.php?t=215936

woland

Hi! Can't find much info on LTE passthrough. Does anyone know please which chipsets support it? I'd like to use it over a VLAN interface on a wAP ac LTE6 kit? Does this device support it? Will it just fail silently? (it's a simplified repost of https://forum.mikrotik.com/viewtopic.php?t=215894, whic...

woland

In your previous posts I have noticed you often refer to Palo Alto Networks, OPNSense and other Enterprise/SMB firewalls, I think you may be forgetting that Mikrotik's primary market is not as an enterprise firewall, and that they have almost 30 years of history making RouterOS. RouterOS users have...

woland

Hi! I have a wAP ac LTE6 kit, which currently serves as my main router/firewall and LTE uplink. Now after it has been serving me perfectly for a few years,I would like to move the router/firewall role to a HAPax. (A GPON fiber has reached us, so I want to use both the LTE and the new connection.) Fo...

woland

Brilliant! Thanks Nathan!

woland

During this time I bought another PCIe router card and paid a MTCRE Mikrotik expert to help me configure the card. Since the card is not well known in the Mikrotik ecosystem, the consultancy costs rose to €450, which brought the total cost of the two cards + consultancy to well over €800. More than...

woland

That´s exactly my opinion as well, but I´d like to add: MT should add more and well documented examples to each topic.
There are many good examples on this forum, but they are hard to find.

woland

The chatbot is hallucinating in this case. It uses help.mikrotik.com/docs as base.

Please don´t let him halucinate for no reason!

))

woland

So my point is that who can tell me "Yes mikrotik is a crap on crowded enviroment if you want stable wifi" and i will just drop wifi line at all and start using omada, cisco, unify.. whatever.. But there is non who tells me that. Even Holvoetn try to figure aout how get it work, because h...

woland

Hi, They do work, with some exceptions. I would not stop using this channel for DNS/ISP/Webhoster. Some providers (usually the big ones like Cloudflare) however respond with messages which just direct you to some Webpage with a formular to fill in, some have an API. Some respond to emails within hou...

woland

Hi @gavopp! Sorry to disappoint you, but I can't really give you an advice how to make MT Wifi working great. I was trying mysefl many times and have spent countless hours changing all the little bits of config, you can play with on the CAPac, WAPac, CAPax, HAPax3, HAPac2, HAPac3 etc. I had 3 sites ...

woland

On 1G links, Dante does not require QoS. That is, until you don´t have other traffic competing with the streams. So you can also use any SWOS device with 1G ports, but don´t send Dante over 1G Trunks between switches without QoS.

woland

This is fascinating. And confusing. Doesn't every user regularly visit new sites? If I visit even a small handful of sites that I've never visited each week, and there were 20 such users on a network served by an ad-protected DNS system, that's 100 new sites/week. No idea how many of those will be ...

woland

Well, blacklisting needs some time and effort until all works well. In my experience if you invest some time in the first few days to check the logs and create some exceptions, then it becomes almost completely hassle free. I need to add a new exception maybe once a year (mostly for my kids dubious ...

woland

Hi, I´m not really knowledgeable about queues, so just a word of caution, as last weekend I managed to cut myself completely off from my RB5009 by trying to experiment with a queue setup. Use safe mode! My only way back was using a console provided by the sadly abandoned WOOBM USB stick. I almost ha...

woland

I always use 9.9.9.9 as my DNS Service as it provides me basic protections from the worst malicious domains, but it provides no ad blocking and no tuning options. False positives are very rare with it and also no additional CPU cycles consumed. I tried different block lists with my Unbound setup and...

woland

I believe this card could have been a hit, if MT gave it some more love: - Reset button accessible from the outside (not bare contacts) - External backup powering, or power by a supercap? - Some pins to control the PCs power - Maybe a serial port - Utopistic, but maybe KVM functionality? - Stable so...

woland

I own one of these, but it´s currently not in use. My use case would have been an OpenBSD machine, but due to lack of support (either from OpenBSD or from ROS side), I couldn´t use it. First OpenBSD compatibility was announced, then it disappeared from the MT materials. It works OK with Linux, but n...

woland

This is because of the thermal pads bleeding silicone oils through those holes. Not really an issue.

Exactly! I have opened my device out of curiosity. It has the same stains. Cosmetic issue only.

woland

Agree: finding a decent USB stick is a pain nowadays. I´m using NVME cases, but not SATA. Btw. in my experience some of the NVME cases are rubbish as well. Regarding RB5009 RAM: yes I´m aware that it has 1G RAM only, but for a DNS Filter or even some other common applications like Nginx , that shoul...

woland

it should work behind CGNAT. What error did you get when trying to access the URL? Can you switch back to CGNAT and post the URL? NB! there is a known issue with sharing just one file. Share a folder instead. Can´t reproduce, sorry! It works now over the LTE & CGNAT. I probably messed up sthg m...

woland

I love the new filesharing function, I tried to get it work on my Hap ax lite LTE6 and invested an hour. I could not access it. Then I realized it will never work behind CGNAT, whatever I will try.... Except maybe over BTH VPN. Switching to a connection with no CGNAT and using the shown "File D...

woland

10.1. W (802.3af, radio off, only main chip and LAN working) This is ridiculous. 10W for nothing. That is the price to pay if someone wants to go with the latest and fastest. That is why I went with an EAP673 and EAP660, and I measure a maximum of ~7W (if I can trust my HEXpoe), while all radios ar...

woland

But the question was about Filter, not about Sort. And there is already a Filter button, that lets you filter by any column, and by multiple columns. My idea is only about usability for filtering: pls. see the image from the post from @mszru. I appreciate that the filter function is implemented. I ...

woland

I think (THINK) that he want to be able to sort by (say) IP, and THEN by (for example) signal strength. A "multiple sort", if I understood it right.

If you mean myself, no my post was not about sorting, but about filtering. Exactly like in the picture as in the post of @mszru .

woland

What's with the Mikrotik Excel ??? Why ? It so ugly... Not modern at all...

Oh my, oh my! CLI & Fat Clients are also not modern, let´s get rid of them. MT should focus on WebGUI hosted on the cloud only!

woland

I don´t know, as we have no component level docs and I also don´t want to start figuring out by disassembling mine, but that MosFET might be a part of a power supply. So if some part after it has failed, the rest of the circuit might just not get supply.

woland

That UT4421G is a power MosFET, which can dissipate 2W, so it can get hot under normal conditions. So that´s not necessarily the component you want to replace. Check the components around for shorts/breaks & burn marks. Check also the electrolytic capacitors for leaks, burns or rupture, but they...

woland

I love Excel ( 😛 )

A bit off topic here, but I hate Excel.🤮 Still I have to use it and I find the filter function very useful.

woland

You can already filter by column, or you mean, you want it to "look" like excel? Thanks @Normis, yes, but in Excel you have many options with a roll down menu. A simple field in each column, where you could just enter a string and wildcards (or maybe a regex if the devs feel fancy) to mat...

woland

The feature I´m missing most are quick filter fields for every table, in every column...

woland

As I wrote above, it used to be available but apparently it was pulled. And I can understand why. Got that, thanks! Fortunately, here the fiber providers mostly provide the PON in a NTU box that converts fiber to RJ45 ethernet. You can connect your own router where you have to configure PPPoE over ...

woland

Back to the "MikroTik and PON" topic: there used to be a MikroTik PON SFP, but it is no longer listed. Probably because so often it did not work because of some mismatch in the requirements of the ISP and the MikroTik SFP. (back when it was available we could already see requests like &qu...

woland

I guess that OLT/ONT/ONU is often a semi-proprietary bundled solution, at least they needs to be certified together.

That would be really bad, I hope this is not the case, at least there are IEEE and ITU standards for the different PONs.

woland

But from PON owners' perspective, specially if they're simply infrastructure providers not service providers, they need to provide ONT which allows to connect router (most often provided by ISP). And it's easiest to provide full device, with case and power adapter. And they definitely don't care ab...

woland

and 4-strand cable is nothing) and ONTs for xPON are wax more compkex deviced than simple SM SFP module (even if it's a BiDi) and hence price of xPON ONT should be way higher than price of simple SFP module. Probably price is just a matter of scale for the ONT, but of course they are more complex. ...

woland

Yes and no... PON is more a replacement for Cable-TV networks. Phone landline has always been from customer-to-central exchange, and at least in my country all FTTH services is regular Gigabit Ethernet with BiDi SFPs. PON is way cheaper than individual links. Especially in rural areas, deploying PO...

woland

No other router is available at the same price.

True: An RB5009 comes with a USB3 port, more NAND storage, has roughly the same performance and costs much less.
Of course you only get a single 10G port.

woland

I tried to use UPS-es for small setups, but at some point I realized, that I have more issues with the UPS-es themselves, than with the equipment only protected by surge protectors. Especially cheaper devices (including APC) tend to break too often, but of course, as prices go higher, devices tend t...

woland

Yep, the voltage peaks cause the overvoltage protection components (mainly a big fat varistor and some spark gaps in the higher voltage circuits) to get conductive, that basically grounds the phases for a brief moment, so you will have no voltage for a moment. After the overvoltage was shorted to th...

woland

It might be: to my surprise CAPax & HAPax2 do share the same chips: QCN-5052 & QCN-5022 (my issues were with CAPax and also with AX211)

Thanks @mainTAP ! Can you pls add if you are using WPA3? Also do you see lots of other neighbors APs ?

woland

For me the 2ghz seems even worse than 5ghz :

Sry. but not very useful, pls. give some details: ROS Version ? Config? Chipset in client?

woland

I had lot´s of issues with that card, so I stopped using it a long time ago. There were What I was certainly able to do was to netinstall new versions a few times and as I remember there was some LEDs flashing. I read on the forum that people had issues with latest versions of ROS with this model. E...

woland

Great, some unnecessary CO2 emissions avoided!

Btw. if you plan on further repairs, get yourself a cheap Chinese rework station (for hot air soldering), then resoldering items gets much easier.

woland

I assume it was manufactured by Cyberteam in Poland. Nice, thanks for pointing it out - I will probably order one later.
Much better quality, much better warranty terms.

Yes my device was manufactured in Poland, can´t remember the manufacturer. Quality is great.

woland

My dream would be a 2.5G HEXPoE replacement with 802.3at with external power supply and passively cooled. This would be the perfect switch for many home setups.

woland

There are such devices available, I´m using a 4 port passive PoE inhjector + Surge Protector device. That works well for CAPac + WAPac. Unfortunately I don´t find that particular device, but here is an 8 port variant: https://interprojekt.pl/en/p/cyberteam-ada-poe-8p-rack.html Here is a 4 port: http...

woland

I appreciate your answer and your homepage @tangent! I´m completely clueless, why these issues affect someone, while others don´t have them. It might have something to do with the fact, that in my 2 setups there is interference from many other APs, as both are located in a courtyard on the 2nd floor...

woland

Thanks @infabo! I don´t see any difference worth mentioning, but I don´t have access to my config now. I have never seen that "too strong signal" entry. Maybe your clients are only using WPA2? The SA Query timeouts mostly happened to laptops further away from the AP, but not only. As for t...

woland

Strange, @infabo, maybe you are not running jitter/loss sensitive sessions and you did not look at the logs? Maybe you don´t have interference? Maybe there was something in my config? But if that was the case, why did others report similar issues like mine. Anyway: I´m not going to throw out my CAPa...

woland

I’m not quite sure how to interpret this, considering that streaming is indicated as both "completely fine" and "partly less fine" without any explanation. Besides, Palo Alto also supports SSL "middle-man" inspection (i.e., decrypting, analyzing, and then re-encrypting...

woland

@erlinden: Besides lots of improvements (though not working for you), MikroTik is constantly requesting their users to provide information. Yes, that´s true we have seen lot´s of improvements, except WPA3 is still unusable with many very common chipsets. There is a list we have created in the thread...

woland

Even on a PaloAlto, which is considered a very good (and certainly very expensive) NG Firewall, you can´t distinguish between shorts and normal videos. These are the current categories: youtube-posting youtube-tv youtube-livechat-posting youtube-livechat-viewing youtube-tv-streaming youtube-streamin...

woland

I updated my hw to use wpa3 and now should I disable it?
Probably a mistake that I updated again to hw mikrotik. . . .

You are not alone:
viewtopic.php?t=198736

Quite annoying: there was no improvement up to 7.17Beta4 or any meaningful reaction from MT....

woland

Hmm, I did avoid it, so as to not make the MT fanatics too angry. But since you don´t believe me otherwise: it´s a TP-Link Omada EAP673 with an OC200 controller (I might add some more APs in the future). They are both fed by a HEXPoE. Firewall/router is a an RB5009 here. I´ve decided to not jump on ...

woland

But generally I just connect and work. But not at home with my hAP ax2 where I'm usually no more than a few metres away and there's only maybe 10 devices connected. Stability is poor. I´m very sad, that I have to agree. Me and my family are using different laptops, from very cheap to very expensive...

woland

Thanks @infabo !
Unfortunately I always had both (CCMP & GCMP) enabled.

woland

Yes, you are hopefully right, the WAPac comes with different CPUs as well IPQ-4018 for my WAPac LTE6 and QCA9531 for the WAPac LTE kit. According to the test results, there is a 10x performance difference. I hope we will see sthg similar for the ax generation of WAPs as well.

woland

As an AP, bridging is more than adequate and the routing test results don't really matter much as difference isn't that significant anyway. It's only relevant if you're planning to use the AP as your main router. It sounds irrelevant, but in case you add LTE or hopefully in the future 5G, it will s...

woland

My replacement AP did not get delivered in time, so I thankfully tested the suggestion von @ivicask on 7.17b4. I tried testing with HW queue only and also with Codel. I did not notice any positive changes in behavior.
Too bad

woland

Talking about Unifi, it's a Java controller, some devices have been brillant (AC long range), some devices a real disaster (Nano HD, drops & disconnects never solved) I got no real experience with Unify, but my current Omada setup has replaced a previous CAPac & Capsman based installation h...

woland

Probably no use complaining, but it feels refreshing. After some horrible test results with 7.16.1, 7.17b2 last weekend. I was rolling back my CAPax to 7.14.3. Turns out that even then the results with the laptop of my son (RTL chipset) are still horrible. There are random interruptions, lot of jitt...

woland

Beautiful! I believe MT should consider making a video on this topic.
Huge marketing value: the only network equipment which can be connected by MIDI to your favorite bands stage setup.

woland

Huhh, not easy to catch and we are probably talking about multiple bugs. I never had issues with my previous laptop (gave that back, so Wifi chipset unknown) and my mobiles. Only my new laptop seems to be affected and my childs laptop. My previous laptop had Win10 my current one and also my childs l...

woland

Thanks for your inputs! So we have issues with WPA3 with the new WIFI AX Drivers at least with the following chipsets: Intel WiFi 6E AX201 Intel WiFi 6E AX210 Intel WiFi 6E AX211 Intel WiFi 7 BE200 Realtek 8822CE Unfortunately these are very common chipsets! I hope MT wakes up and gives us some hint...

woland

But you ain't replacing a keyboard or mixer with :beep anytime soon.

Hope I did not sound too serious. All of it was meant to be a joke only.
Now I´m even more amazed, that it´s actually somehow possible to hack a MIDi Keyboard to drive a speaker over MQTT on an MT switch!
Thanks @Amm0 !

woland

I always dreamed about replacing my huge and heavy keyboard, PA and boxes setup by a compact CRS309+laptop combo!

)))
Ps. Feature request: MIDI Drivers for MT!

woland

Thanks @MrRobotdev, so until now we have:
Intel WiFi 6E AX211
Realtek 8822CE

Those are affected, if WPA3 is used.
Any other chipsets?

woland

Thanks @dmfr! But to me it looks like not all RTL88xx are affected, as @pdrsks wrote, that his 8852BE works flawlessly.
Still good to know the issues are complicated at does not only affect MT.

woland

Hi! I got 2 HEXs boxes I use one as a switch and another as a Dude host. I had no stability issues with them for ages. So if I were you, an I would have lot of time to spend, I would check AliExpress for that power MosFET IC (UT4421G) and also for the capacitors. Order them and replace them. They co...

woland

Well replacing the WLAN adapter in my company issued laptop is not the way I want to go. My Intel card is working perfectly well with every other AP I tried. Also some Lenovos simply refuse WLAN adapters which they don´t get shipped with (don´t ask me why, dumbness of Lenovos policies?). Also I have...

woland

wonder if there are any 98DX or other marvell chips in use by MT are able to do this (did not read all whitepapers - maybe someone knows someone who might have some insight 🤷‍♂️ ) https://forum.mikrotik.com/viewtopic.php?t=211511 Unfortunately, L3HW doesn't support VRF yet. The hardware (switch chi...

woland

Agree with @MrRobotdev, but could you just post your WiFi Adapter type? Most Lenovos come in lots of different variants with possibly different WLAN chipsets. My Lenovo YogaPro 9 can be added to the list. It has the latest drivers installed and has no issues with TPLink Omada, Unify, Cisco APs using...

woland

In device manager, go to network adapters, properties, advanced properties and in MIMO power save mode select No SMPS. With this, all my disconnections dissapeared, I hope this also works for someone else. Nice input, thanks I´ll try disabling SMPS. The link Infabo provided clearly shows , that thi...

woland

I´d love to see a new MAPLite in a similar format, with more flash. Speed is not that important, but it should have a USB port which would have the double purpose of powering the device and at the same time this would be a USB attached Ethernet port. So you have just one wire between the router and ...

woland

With my new Laptop and after upgrading my CAPax to 7.16, WIFI became unusable. It´s probably my new chipset being Intel 6E AX211. Signal is perfect, but lots of SA Query Timeouts. I read the forum quite often, so I know I would probably need to go back to WPA2. But it´s 2024 and I don´t understand w...

woland

Hi! Thanks MT, having a native app for Linux is great news and it looks really good. f I could have three wishes, those would be: Add filter fields to all listing headers , so that we could filter in any row Add the possibility to copy the list or a part of the list as text into a buffer Finally the...

woland

Thanks! It still doesn´t work, and I tried to check everything. I believe there are no principal differences between my config and your example. I have upgraded my HAPax3 from 7.14.2 to 7.15.2 now, but it did not help either. Still only e2 and e3 are connected, and packets are not bridged in between...

woland

Wow, @anav, that was fast! :D Many thanks! I did not provide WAPac config as that´s not what I´m concerned about, that part works. I first want to resolve my problem as above. But now I got a nice portion of configs I will try to understand. It´ll take a bit longer for me to understand as it was tak...

woland

Hi @anav ! Thanks for your answer! No I´m not saying it was convenient to configure LTE+everything on the WAPac, but it was working well for over 3 years. In fact I don´t know how many hours I spent until I figured out everything and I definitely got desperate many times as this was my first MT setu...

woland

Thanks @jaclaz ! No that´s my error. I´ve corrected it, but it didn´t solve the problem: /interface bridge add frame-types=admit-only-vlan-tagged name=br0 vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] name=e1 set [ find default-name=ether2 ] name=e2 set [ find default-name=...

woland

Here is my very basic config, just the 2 VLANs and things like romon enabled, DHCP client on VLAN2= vl2lan enabled, to make the setup easier. Nothing works, the router and my PC gets no IP. I can´t even access the router via e3 . # 2024-03-30 18:36:50 by RouterOS 7.14.2 # software id = xxxxabc123 # ...

woland

Hi, I´m trying to add a new HAPax3 to my network. In the network I have a WAPac-R, which serves as the Internet LTE uplink, router, firewall, dns and everything else. There is a switch connected over a trunk and a few CAPacs. This part works well, but the WAPac comes to it´s limits, as it acts as a ...

woland

DPDK is normally used in highly specialized high-end “appliances”. [/quote] Hmm, in the 90's preemptive multitasking was normally used in highly specialized high-end mainframes.... But you might be right I can´t really judge. However there are other projects trying to speed up networking: VPP: http...

woland

What about the promised at launch FreeBSD support? Yes I second that! I´m missing it very much too. I also like the ideas from @brad0x52 very much. The current card feels very much half baked, but with a little love this could be made into a super connectivity wonder. What about adding a header to ...

woland

I have a single CAPax in a flat with walls out of reinforced concrete and a lot of interference through the windows. I have replaced a TP Link Archer C7 (ac) , which had nice coverage, but CAPax works way better. First I had many issues with it, but since 7.13 the problems began to disappear. 7.14.3...

woland

Both needed! Just thinking about stuff which was recently added or still badly missed by some, like : HW QoS, WIFI improvements (better performance w. new drivers, WPA3, Roaming, etc...), IPv6 fast track (or sthg like VectorPacketProcessing), MPLS HW, device controler (more than CapsMan) .... Of cou...

woland

@Anav: good questions, I can't answer all of them, but for myself the most important question is: why are the answers to these question (and further details) not to be found on help.mikrotik.com?? At least the answer to your question c: [admin@kk-r1-rb5009] /ip/address> print Flags: D - DYNAMIC Colu...

woland

And here it is: [admin@kk-r1-rb5009] /ip/firewall/filter> print dynamic Flags: X - disabled, I - invalid; D - dynamic 0 D ;;; back-to-home-vpn chain=input action=accept protocol=udp dst-port=28949 Update: now I start to understand how this works, it adds also this, so I have NAT for my 192.168.216.x...

woland

Hi! Also to note there was no input chain rule allowing your wireguard Quote from https://help.mikrotik.com/docs/display/ROS/Back+To+Home "NOTHING has to be configured in RouterOS to use Back to Home." I was also surprized at first, but I believe RoS sets some kind of hidden FW rule to all...

woland

Thanks for your wonderful service @TomJNorthIdaho!

btest.png

Location: Budapest/Hungary
Provider Telekom, over Cable, Docsis 3

woland

Quote from their homepage:
"No one does Voodoo, like we do."

I fully agree.

woland

Hmmm,...the alternative would be to declair those devices "End of Live" or "End of Support"... but would this be the better solution instead of supporting old devices with the newest ROS with concerns? One of the best aspects of having MT hardware is it´s longevity! This is what...

woland

Would 2.5G ports benefit a large number of users? Would 2.5G ports significantly increase cost? I personally don't have a use for 2.5G ports right now but if a lot of users need it I wouldn't mind paying up to an extra $10-15. What I know is, that my cAPax and other PoE APs with Wifi6 have 2.5G por...

woland

I agree, but please also replace the 1G ports by 2.5G ports!

))

woland

Hi! This has worked very well for me in similar situations: Before you start wasting energy and creating some complicated setups for doing that. Apply Teflon (PTFE) spray on the affected surfaces. Snow or anything else won´t stick and it remains there for years. Before applying PTFE, you should clea...

woland

Hi! Using a single CAP AX here, no CAPSMAN. 2 SSIDs on both radios into different VLANs. Upgraded from 7.12.2 directly to 7.14.2. Which went surprisingly well (previous attempt to 7.14.0 resulted in netinstall to 7.12.2). Performance is great, now even the farthest corner of my flat is perfectly cov...

woland

What's new in 7.15beta6 (2024-Mar-08 08:23):
*) sfp - improved system stability for CR2004-1G-2XS-PCIe (introduced in v7.14);

woland

Hi! I was experimenting with such a card, but my plan was to use it with FreeBSD, which has never worked. I did test however after my failed attempts with Proxmox, but that was sthg like a year ago, so with maybe ROS 7.4-7.8. It worked on Proxmox without any issue, however I did not really needed in...

woland

Yeah, if it works, it´s easy. But sometimes it just doesn´t.
The issue is: I don´t know exactly why it does not work sometimes. I have to play around and waste time. That is frustrating.

woland

Same experience here: some chinese SFP 10GT just don´t work, but some others are much better& cheaper than the MT SFP 10GTs. I would add, that wherever I can I use DACs or optical MM 10G interfaces. They are cheaper , use less power and make less troubles than 10G-T. I have the same combo CRS305...

woland

Hi, maybe this: https://www.servethehome.com/the-everything-fanless-home-server-firewall-router-and-nas-appliance-qotom-qnap-teamgroup/ I did not test any however! Thanks to Chinese manufacturers, there are many more, you can find good reviews on STH. Especially the N305 CPU based ones look interest...

woland

I agree, it´s not. But this is not my problem. I did many netinstalls and most have worked. What I don´t like is: why isn´t netinstall always working? Why did my windows netinstall start only partially ? (I have seen the process and when I tried to start it again, it told me, that there is an instan...

woland

It really takes too long....

woland

Hi! It was a netinstall issue after all. Yesterday I tried to netinstall the CRS305 via 3 different PCs. 2 of them Linux, one Windows. I have no clue why netinstall-cli or netinstall with Wine did not work on Linux, it has worked many times previously. Yesterday after starting netinstall on Windows,...

woland

Hi, after upgrading my beloved CRS305 from 7.13.3 to 7.14 I can´t connect to it any more. There were no additional packages on the switch and the config was also quite simple (just a few VLANS & basic management access) -When powering on, the sequence is: -The power led is on, then all interface...

woland

I have an CRS309-1G-8S+ and I also have some 10Gtek 10G DACs and some other random 10GBaseT modules. I have never experienced this issue, but I was always running ROS and not SwOS. This switch has so many great features and a relatively powerful CPU, you should give ROS a try.

woland

A heads up @moodnasser and others: Besides the voltage, temperature, capacitance there is the tan(delta) also called Dissipation Factor, which is often not (never?) specified in the descriptions on Aliexpress. This factor shows is an indicator of the losses on the capacitance. This is especially imp...

woland

Sorry, off topic, but in support of @Rextended and @Anav: they have invested incredible amounts of time and energy into this forum. Yes their tone is sometimes harsh, but the value they have created for MT should be very much appreciated by MT! The reason why I havent given up on MT devices is these...

woland

I am using HEXPoE for a bunch of Omada EAP670 APs and an OC200 controller. Of course I had to replace the original PSU by the 48V PSU. (MT 48POW) The devices are 802.3at and not af, but af support should work. So no, the HEXPoe is a great piece of HW. Of course the datasheet must be considered: Max ...

woland

I am. Therefore your statement is false.
Me too. 😁

I do OSPF on my router for fun, at home, but I still dont have anything except a static default route on my CAPs...
And I believe statistics with 99.9% still isn´t wrong if we include you both.

woland

Agree, it should be possible to store packages on any external storage, BUT this is not enough as it does not help for WAPacs or CAPacs, which have no SD slots/USB. On my WAPac r3 with 7.14b7 only ~400 KiB are left from 15.3MB. :( So still need some more modularization. For example: probably 99.9% o...

woland

https://www.virustotal.com/gui/ip-addre ... /community
Known, reported for scanning and trying a Zyxel exploit... There are millions of similar compromised IPs scanning.
Enjoy: https://cybermap.kaspersky.com/

woland

Hi! I hope someone from MT is aware of this issue. I´d like to add, that my WAPac (ARM Version, RBwAPG-5HacD2HnD, r3) is also affected. After upgrading to 7.14b4 516 KiB are left from 15.3MB . Only routeros and wifi-qcom-ac are installed. Everything is working until now, but I don´t know for how lon...

woland

Yeah, I was all high hopes about the 7.13, and it worked, but it simply did not like my sons laptop. Still considering to maybe try 7.14b4, I just have read the relnotes. Only after downloading the backup! :) Anyway I have a working WIFI now and my sons will be back soon, so I might wait with the ne...

woland

I have downloaded the PCAP from br0, and opened it with Wireshark, but of course there is nothing special in there. I guess my only two options are to open a ticket with MT support or to wait for the next 7.13.1/7.14rc28 release then. Special thanks to @holvoethn responses to my extensive posts! Sti...

woland

Here comes some more fun: The uplink trunk interface on the CAPax does not see the ICMP replies until around rule No. 79, where I disable the 5G interface! With no 5GHz Wifi, pings are answered. /tool sniffer set file-limit=10000KiB file-name=capax filter-interface=e1uplink \ filter-ip-protocol=icmp...

woland

Thanks! Yes, actually my rb5009 is doing all the filtering and hangs on a 10G Trunk as a router on a stick. Well all the firewalling on the CAPax is just additional security measures, as I read on the forums a few years ago. (I guess I just worked in IT for too long.) But that should not be the culp...

woland

Hi,
many thanks!
Here it goes:

capax.rsc

Peter

woland

I still prefer to make sure MAC addresses are unique. OK, I see your point, but I can´t find how to set the bridge mac different from the vlan mac? If I change the bridge MAC , the vl9 MAC changes too: 6 R br0 bridge 1500 1568 48:A9:8A:BA:1F:CA 7 R vl9 vlan 1500 1564 48:A9:8A:BA:1F:CA I suppose her...

woland

Thanks @holvoetn! I have set the unique MACs now, also changed the admin MAC of the bridge: [admin@kk-ap1] /interface> print brief Flags: R - RUNNING; S - SLAVE Columns: NAME, TYPE, ACTUAL-MTU, L2MTU, MAX-L2MTU, MAC-ADDRESS # NAME TYPE ACTUAL-MTU L2MTU MAX-L2MTU MAC-ADDRESS 0 RS e1 ether 1500 1568 9...

woland

Since you have an explicit forward accept rule for list "lfwd" followed by drop on forward, possibly this part ? The missing interfaces ? Thanks, Holvoetn! I don´t think it's relevant, as that list is just used in the IP firewall. The packets are not routed, but only bridged to their VLAN...

woland

this is a mission critical network
[...]
Of course I have no backup of the config.
*cough*

Unfortunately you are right, Sir!

woland

I'm running a similar setup (RB5009+CAPax). I love the RB5009, but don´t expect to run 2,5G Internet + 10G to your NAS. 4-5G throughput is more realistic with some useful firewall, QoS etc, Also if you are considering MT WIFI: it is currently improving, but you have to expect to spend many hours tin...

woland

Hi! Just replaced my old AP by a CAPax and it ran for a few months flawlessly, until I tried an update to 7.13. The wifi had issues with some devices (mainly some cheap Windows laptops with some RTL wifi chipsets) so I decided to roll back to 7.12.1, as this is a mission critical network beeing in t...

woland

I suggest not ignoring this textbox, so that you don´t waste as much time as I did with my Hex PoE first :): https://help.mikrotik.com/docs/display/ROS/Basic+VLAN+switching#:~:text=On%C2%A0QCA8337,is%20assigned%20to. "On QCA8337 and Atheros8327 switch chips, a default vlan-header=leave-as-is pr...

woland

On one side it will make sure current owners of wap AC have no real incentive anymore to move towards AX. Potential missed sales. On the other hand, since wAP AX is not yet available, it does bridge a gap until the new device is available (are they buying time, perhaps ?). Hi! Partly agree, but as ...

woland

Hi, yes you can, with switch port isolation, there is even a PVLAN chapter in the MT Wiki: https://help.mikrotik.com/docs/display/ROS/Switch+Chip+Features#:~:text=overcome%20this%20limitation.-,Private%20VLAN,-In%20some%20scenarios But PVLAN is a dirty hack, do yourself a favor, use separate vlans a...

woland

https://mikrotik.com/product/s_ao0005

Thats an AOC. A DAC is Copper.
I also frequently make this error. :)

woland

"Default VLAN ID to assign to client devices connecting to this interface (only relevant to interfaces in AP mode). When a client is assigned a VLAN ID, traffic coming from the client is automatically tagged with the ID and only packets tagged with with this ID are forwarded to the client. Defa...

woland

+1 makes life easier + other vendors have it already

woland

Hmmm, I did not read every post in that thread, but after a quick look: THAT thread is about the benefits of ISIS and there the network engineers do discuss benefits of implementing ISIS. I still never said anything about OSPF being better or ISIS being inferior. In this thread the goal is to discus...

woland

OSPF is a PITA. is-is isn't. OSPF requires operational and configuration overhead when you have 1000 layer 3 devices in a network, to maintain the configuration automation template etc, across IPv4 and IPv6. I did not say, that OSPF is in any way better than ISIS. It is still a fact, that in enterp...

woland

[What makes you think MikroTik listens to customer demand from enterprise? They care more about SOHO market like storage features, bring the home/IoT type features etc. Sorry sir: strictly home user of Mikrotik here! I had my share of enterprise networks, but none of that had anything to do with MT...

woland

If XDP/DPDK is used then x86 is the best choice. XDP does not depend on any special HW: https://www.iovisor.org/technology/xdp All new routerboards have ARM. (OK, there is maybe something I miss, but most of them have ARM.) DPDK: Designed to run on Arm, PowerPC and x86 processors, DPDK runs mostly ...

woland

It says here there is stateful filtering for VPP: https://s3-docs.fd.io/vpp/23.10/usecases/acls.html I don´t know what the general preference is, but what I've experenced is the successor of pfSense: TNSR, which is a damn powerful firewall and it´s based on VPP: https://www.netgate.com/resources/art...

woland

@DarkNate: Replace XDP by VPP and keep DPDK, please! Or use all of them!

)

VyOs just transitioned from XDP to VPP and many other projects use it, to support >10G speeds.
https://wiki.fd.io/view/VPP/What_is_VPP%3F

Still, something should have already be done by MT about IPv6 performance!

woland

I think you should really consider an Omada for great WiFi, but I would say there is no need for a >600$ one like the AXE11000. Omada EAP670 is only AX5400, but that is more than sufficient for a home setup and costs around 150$. It has 2.5G PoE LAN. You can save some bucks with a EAP610 for AX1800,...

woland

I am using multimode 10G and 1G as well with MT equipment with different cheap or old transceivers. It works perfectly with most SFPs. That would eliminate any potential difference (grunding) issues. Though I would try the newest stable or beta ROS or another DAC cable. Don´t forget to update Router...

woland

@mkx No I don´t mean it´s incomprehensible, I mean it´s a lot to process, lot of exceptions. So creating some more recepies and overviews saves time and frustration. Also expands the userbase in the direction of John Does or in the direction of people who generaly don´t want to spend too much time o...

woland

What is wrong with people? MikroTik has a clear, up-to-date, concise documentation piece on basic VLAN configuration for ALL their hardware, how the hell do you get confused with this? https://help.mikrotik.com/docs/display/ ... +switching Let me cite you some sentences with warning signs from the ...

woland

I think MT products are great, but oh boy did I struggle with VLANs on my different MT HW Boxes! It´s no big science, but it is easy to get confused: on your HEX PoE you need completely different config than on your CRS309. Then I have some CAP ACs which again have slightly different needs. My netwo...

woland

Thanks for correcting me ca6ko! Looks like I shouldnt assume something by just looking at it. However, why would connecting to it an external antenna be such a bad idea? If you connect the external antenna by a proper connector, the switch disconnects the internal antenna. As long as you have a prop...

woland

Sorry but actually DSL technology is obsolete. It certainly is not the future, but it is in heavy use in many parts of the world. Not obsolete at all in the EU! :) for my part: I had to go back half a year ago from coax to dsl at home, cause fiber is not available and cable is too overcrowded dsl_c...

woland

https://en.wikipedia.org/wiki/Hirose_U.FL

woland

In my view, the biggest selling point for a new mAP should be a single USB-C connection, which serves as power supply and which is also showing up as a network interface on my laptop. As I use my current mAPlites mainly as mobile devices, capable of extending the range of bad WLAN networks. LTE is n...

woland

I totally agree in one point: using heavily shielded cable makes your life hard. I did not realize it for quite long, but it´s mostly unnecessary at home and you can pull and terminate unshielded cable so much more easily. For corrosion caused by currents: yes that´s a common problem. Epecially for ...

woland

I always thought shielding was to minimize interference sind those copper wires are basically just long antennas.

The real world is mostly more complicated, than we would think at first...
Still shielding is used mainly to minimize interference.

woland

Not really! :) For a direct lightning hit, forget it (also your Cat8 cable will just explode and your AP will burn nicely as well) . In case you have proper lightning protection and potential equalization in your home and the lightning did not hit your AP directly, shielding helps to _some_ extent e...

woland

My main switch at home is a CRS309, but I also use a CRS305 my startegy is to always try to avoid 10G RJ45 ports. First choice is a DAC cable (cheap, low power, but short runs only), second choice is using MM SFPs with fibre. (bit more expensive, but not much, less power than RJ 45 SFP+) . I only us...

woland

yeah well, I've just switched back to a Fortigate 60F from my RB5009 and I'm not looking back.

eur
Yeah, that´s a nice device, but that would cost any end user around 1k EUR with just the basic license.
The RB5009 comes for 25% of that price! Also the 60F has only 1 Gbps ports.

woland

It is exotic in the market for MikroTik devices. Ok, maybe not so much now as it was a couple of years ago, but still most MikroTik users demand OpenVPN or Wireguard, not IPsec. Well, apologies, OpenWRT again :) : https://openwrt.org/docs/guide-user/services/vpn/strongswan/site2site#route-based_vpn...

woland

Openwrt is a free OS, which you may install on many devices produced by many vendors. No one earns money selling it, so it can´t compete with ROS. https://openwrt.org/license Also it´s target userbase is quite different from the ROS users. Apart from all that: I don´t really see any harm for MT in d...

woland

Hi, don´t know exactly why, but the same happens to me if I want Dude to use the admin user.
I read on this forum somewhere to use another user.
I have added another user and the log entries disappeared.

woland

@Larsa: sry, I did not try it yet, I have seen the strange terminology and it made me curious. I think it is the same as the thing called in RFCs EIM NAT (Endpoint-Independent Mapping). AFAIK this is relevant for UDP NAT Traversal (STUN) for SIP (RTP, voice calls). Here is more info: https://wiki.un...

woland

@Larsa: Endpoint-Independent NAT: https://help.mikrotik.com/docs/pages/vi ... pendentNAT

woland

Thanks holvoetn, I have upgraded the firmware every time & I have already done a full reset with no default config- I will do 2 more things: -try running the device on PoE and on the current ROS7 -a netinstall to ros 6 again Then I get my multimeter and soldering iron... If still no success, onl...

woland

Thanks anyway RyanNet! My HAPac3 was tested with 7.9,7.10.2,7.11, but still not throwing it away yet...

woland

Hi! Unfortunately doesn´t seem like a PSU Problem. HAPac3 has shown the same issue with a different PSU.

I will try with the PoE as soon as I get my hands on a PoE adapter or PoE capable device.

woland

Hi, don´t think Metarouter is a good idea today. Latest info I could find: https://wiki.mikrotik.com/wiki/Manual:Metarouter It doesn´t even mention ARM devices, and MT went rather for containers. I tried Metarouter on ROS6 on MIPSBE (HEXpoe), but it was never stable. A somewhat relevant recent threa...

woland

Failing power supplies may test bad without load, ... Thanks Tangent, good idea! I will load the PS for testing. I had in fact already had a bad PSU from MT, which gave the correct voltage w/o the load, but voltage dropped dramatically when loaded. The MT supplied PSUs seem to be quite good, though...

woland

will do! thanks!

woland

thanks! The power supply is the correct one, that´s sure. But I will check the output or I might find another similar one& report back, if that helped. (I wish it will!)

woland

Hi! I got a HAPac3 which stayed unused for more than a year, but it was working OK on ROS 6.x. I got it out from my cupboard a few weeks ago and netinstalled it with ROS 7.9. No config on it, apart from a management IP on a port. It rebooted itself every 3-5mins with a message about kernel failure i...

woland

I have a few HEXs boxes (2 pieces :D), and they are great and versatile and they use very low power. I love them, but they don´t have the performance to be used as the primary router on my 400/200 Mbit Internet connection with CAKE queuing and with a lots of firewall rules. Also they are missing co...

woland

Hi,

no I don´t think that would be enough, try at least a HAP ax2 but rather ax3.

Sorry, looks like I'm in need of new glasses, we are discussing 100Mbps and not 1G.
Forget all I wrote! (except the missing features, but those were mentioned by others)

woland

I am thinking Mikrotik is moving forward to "detach" true L3HW from (software) fasttrack. That's what happened with IPv6. Whatever the benefits once provided, fasttrack sounds like a massive kernel hack... which would not be easy to maintain forever for every device/RouterOS release/kerne...

woland

My Knot came with a DIN Rail mount accessory, I guess it would be easy for MT to provide something like that for some switches. But to cable those ports, would be a nightmare. The ports are on the "wrong" surface!

woland

Hi, I have just started experimenting with a Knot LR8 and I belive that it needs 2 separate Antennas. At least I haven´t found any clues, why would it not be the case. Btw. if using Lora for a larger area, I would suggest replacing one of the HGO-LTE-Ws by a "868_Omni_antenna" instead. Act...

woland

Sorry, but I have just lost the not working USB Stick. I could not find out what the reason was .
I have tried 2 more USB3 Sticks, one being 16G and another one being 64G and both worked with 7.9rc5.
There seems to be no general issue with USB on HAPac3.

Regards

woland

Mi folyik itt Gyöngyösön?!

Hát a Gyöngyös-patak!

woland

bought 15 CSS610-8G-2S+IN without noticing the swos lite thingy ( never heard of it anyway ) and now im forced to use them as dummy switches cuz they dont belong elsewhere Don´t agree: -you might just have read the docs before buying it -the SwOS is minimalistic, but still enables me to use vlans a...

woland

That was MS. Now Google tried it too, without too much success.

woland

Thank you very much @normis!

Looks like MT listens to it´s customers, which I highly appreciate!

woland

Hi, I got my first device with a default psw set: a HAP ax lite. I must say, the default psw is a pain in the a... It´s printed with maybe 2,5mm character height? I had to take a photo and enlarge it to have any chance reading. I am no WISP and don´t have to install hundreds of devices, but MT pleas...

woland

Hi, here are my 2cents: the ETSI regulations are not the (only) reason, they are more about IoT. I think it´s rather the GDPR (Data Protection), which is manadatory in the EU. https://op.europa.eu/en/web/eu-law-in-force/bibliographic-details/-/elif-publication/3e485e15-11bd-11e6-ba9a-01aa75ed71a1 Th...

woland

@optio: thanks!
I don´t think it should be necessary after repartitioning and reformatting (except ROS FS/disk support has some strange bug), but I´ll give it a try if nothing else helps

woland

@mkx: thanks, nice tipp! I will check this, as soon as I get my hands on those devices again (at least a week) , and post here if I can figure out something.

woland

On Linux everything works fine. On ROS, whatever I do with these sticks, they are seen, but they can´t be formatted and don´t appear as a subfolder in the File browser. (I am quite certain I did everything correctly, as the 8G stick did format on ROS and is in use now in the HAP) I bought a bunch of...

woland

thanks optio! So it´s at least not the size, good to know! It´s also not the MBR, as I have tried removing that.
Maybe there is just some peculiarity with this vendor or this particular product.

woland

Hi, are there any known specific requirements, which USB sticks can be used for external storage? I have not found anything in the documentation. I have tried in my HAPac3 some 8G USB3 Sticks, and all worked. Then I tried a couple of 32G USB3 Sticks (all the same model) and none of them were working...

woland

Hi, thanks, mkx! I always kept myself to the general guidance. So I have always left out one SFP+ slot, between the 10GCu SFPs.
Even then my modules got hot enough to have warning messages about overheating SFPs in the logs.
So I did not wait for the summer to come...

woland

Hi, I had up to >90C° SFP+ temperatures in my CRS309-1G-8S+ on different 10G Cu modules. The worst culprits were the MT S+RJ10 modules. I have mostly replaced them by cheap DAC cables, which produce no noticeable heat. The ones I still need, I have equipped with small heatsinks from 3 sides. Between...

woland

Those PWRLine EU devices were great in combination with mAPs for quickly and temporarily solving connection problems. I can take two mAPs on travels, connecting one as a client on a spot with good WIFI access and the other one to somewhere else as an AP. I am still using this setup on the go, to ext...

woland

Hi! I have a CCR2004-1G-2XS-PCIe connected to a Mellanox ConnextX-3 by a cheap 2m DAC cable and that works fine. However I wouldn´t use the 1G to connect to a trunk. While you can perfectly do that and that would work without any restrictions, it´s nice to have a dedicated port. So you don´t cut you...

woland

Surely ikev2 configuration is not using IPSec hardware acceleration. I don´t think that´s right, as IKEv2 is just used for the key exchange. So only the asymmetric part could be affected, but there is no acceleration for that anyway. For AES CBC 256 there is HW acceleration regardless if IKEv1 or I...

woland

Look at the IPSec results:
https://mikrotik.com/product/hex_s#fndtn-testresults

You are also doing some filtering and you on the box, so I think this is what you can get out of a HEXs.

woland

Sorry, but the last netinstall was 7.4, or 7.5 (I can´t remember...) and it can´t be the way to netinstall every new stable version, to eliminate problems we didn´t have with the previous version. Unfortunately I even had to netinstall my RB5009, which is ROS7 only, after upgrading from ROS7.6 to R...

woland

Hi, MS supports certificate auth for p2s connections and the docs are great: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-cert-linux OP means p2s and not for s2s. Anyway unfortunately I don´t see the reason why OPs config would not work. Probably something about the c...

woland

Thanks for clarifying this, mkx! In my experience, the HExs is capable of wirespeed bridging from the SFP to other ports on the switch. On ROS6 I have tested that, of course there was some CPU load and it did not do anything else like routing or filtering. I have no experience with the same setup on...

woland

Hi, in my (relatively short, but intense :) )experience HEX S & HEX PoE are great for switching. Every installation of me has a HEX PoE as the uplink+power for my APs. Both the HEXs and HEXpoe can reach almost wirespeed on the SFP port as well if I am only doing bridging. With ROS 6.4x they can ...

woland

Just guessing, but I think they had a limited number of ICs, so they have decided to put those they had into the bigger box.

woland

I am not aware of any update/plans. This card is not compatible with BSD unforunately.
BR

Search found 404 matches