MikroTik

Simonej

Try to search for the master of scripts @rextended , like:
viewtopic.php?t=58031&sid=8d1062b3328a2 ... f9#p580566

Simonej

With SUP-155649 I was asking how “ reselect-interval ” ( https://help.mikrotik.com/docs/display/ROS/WiFi ) is working, but still no answer. Anyone has a clue? Still waiting for answer from support, infabo suggested reselect interval you define lower and upper bounds of interval. e.g. 30m / 1h. So e...

Simonej

*) dns - added support for mDNS proxy (CLI only);

OMG it is what I think is? mDNS repeater trough VLANs?

Simonej

With SUP-155649 I was asking how “reselect-interval” ( https://help.mikrotik.com/docs/display/ROS/WiFi ) is working, but still no answer.
Anyone has a clue?

Simonej

@robmaltsystems thanks for sharing your research, I also had my AP stuck with frequency 5500 due to DFS, sounds like a bug to me.

Simonej

Hi, I just managed to have 2x Audience with Caps man enabled, working better than expected!
Use wifi1&2 as standard AP mode (till 2 Wi-Fi networks you can have roaming enabled as CAPs and VLAN), wifi3 as AP + bridge.
If you need help I can share my config.

Simonej

This comment above should be pasted on every mDNS related topic.

Simonej

Still waiting on the NAT-PMP docs ...

https://help.mikrotik.com/docs/display/ROS/NAT-PMP
+
https://help.mikrotik.com/docs/display/ROS/Services
5350/udp NAT-PMP client
5351/udp NAT-PMP server

Simonej

Thanks for the interesting video, fully understandable with your English, writing a single sentence is always easier than a full live recording

Simonej

@Maggiore81, don't know if this fit your case but, I'm using a basic script to create ROS backups and I was scared too when read *) console - replace reserved characters in file and script names with underscores with v7.14beta4 { :local Identity [/system identity get name] /system backup save dont-e...

Simonej

I have issues with the backup script. I made an export then upload via FTP. 7.12.1 works, from 7.13 no. The script is described here: https://forum.mikrotik.com/viewtopic.php?p=1048251 I may be wrong but noticed that now terminal is replacing spaces with _ , MT likes us to discover “fun” changes be...

Simonej

Interesting... thanks for sharing!

OT: (from an old post)

If MikroTik didn't hide loopback interface for no good reason (we know it's there!)...

RouterOS version 7.14beta:
*) system - expose "lo" interface;

Simonej

Maybe management-protection=disabled ?
Other parameters that I found are causing troubles between old devices and new drivers; connect-group, connect-priority, disable-pmkid

Simonej

scripts that include the fetch command for telegram

user policy "ftp" is enabled?

Simonej

*) fetch - require "ftp" user policy;
is policy=ftp necessary in any script now to use Fetch (also when mode=http/s) or just when mode=ftp is used?

Simonej

We have a script that triggers on boot and fetches a few files from our provisioning servers (Basic auth and HTTPS).

fetch - require "ftp" user policy;

Simonej

Based on my tests, nothing is changed from when CAPsMANv2 was introduced, we can understand about the VLAN "passtrough" limitation, they should fix at least the interface naming change to allow us to create a script to fix the VLAN assignment or make the slaves provision profile to obtain ...

Simonej

Maybe create static interfaces instead of dynamic

Simonej

@BrateloSlava, there is no evidence on your post about Datapath and in case VLANs are involved with AC devices, only one Wi-Fi network is allow to use. My workaround consist in having the AP configured in standalone mode with interfaces assigned to the bridge, VLAN-ID + configuration.manager=capsman...

Simonej

- I believe @DanMos79 is asking for an alternative DIY wireless card compatible with WifiWave2 drivers for RB4011, if available in the market. - Just a confirmation, if I update from 7.12 to 7.13 an hAP ac2 with old Wireless driver, will have the new "wireless-7.13...-arm" package installe...

Simonej

I had an easy scheduled script every 30 days; /system package update check-for-updates once :if ([get status] = "New version is available") do={ - backup - then "install" instead of making things complicated and updating X days after release date, I'll be more concerned to not up...

Simonej

@yottabit this is little bit OT but, MT is pushing hard on Wifiwave2, like station-bridge was unexpected implementation, it's clear from a long time that legacy and new driver are incompatible (or they don't have enough resources to make it working). Based on my recent experience, wireless devices a...

Simonej

What's new in 7.12beta7 (2023-Sep-13 09:58):

*) wifiwave2 - added station-bridge interface mode (CLI only);

OMG!!!

Simonej

SXT doesn’t have gain information on the product page. The inclusion of B28 is nice, but I suspect the unit still uses the original antennas which are next to useless for B28.
Still only have 100Mbps Ethernet ports.

https://mikrotik.com/product/sxt_lte6_2023

Simonej

I do not see why 7.11.2 is not mention in the title. "and more" what is that. As it is now, its hard to see what is the latest release while visiting the forum. Please add 7.11.2 to the title of the tread.

Sometimes MT staff listen user suggestions :)

Simonej

I didn't understood what you're trying to achieve... Tuning Watchdog seems to be enough for delay the reboot, or if you want fine-tuning with Netwatch you could check an host, when down with a script, checking another IP, if not reachable your AP will reboot, you can also add the :delay

Simonej

This is the script I use for quad9: { :do { /ip dns set servers=9.9.9.9,149.112.112.112 use-doh-server="https://dns.quad9.net/dns-query" /tool fetch url="https://support.quad9.net/hc/en-us/article_attachments/4618235579021/digicert-root-ca.pem" dst-path="digicert-root-ca.pem...

Simonej

Not sure if related but, this is what I have in Netwatch: :if ([/ping 1.1.1.1 count=1 interval=1 as-value]->"ttl") do={ :log ... } else={ :log ... .... } or :if ([/ping [/ip route get [find comment~"..."] gateway] count=1 interval=1 as-value]->"status"="timeout&quo...

Simonej

@MTStaff
could you please expain

*) wifiwave2 - changed default behavior for handling duplicate client MAC addresses, added settings for changing it (CLI only);

EDIT: is security.connect-group + connect-priority ?

Simonej

At the end when I tried to use config for NextDNS, my "Free HDD space" went to 0. These certificates occupied all my free space (1000KB, AC2, ROS 7.10.2 )!!! This is what I'm using to "clean" certificates for NextDNS: /tool fetch url="https://curl.se/ca/cacert.pem" dst...

Simonej

/interface wifiwave2 set [find] rrm=no wnm=no
or
/interface wifiwave2 steering set [find] rrm=no wnm=no

Simonej

Maybe this can help:

connect adapter to router, generate supout.rif file and send it to support@mikrotik.com with brief explanation. After that we can add it to RouterOS

viewtopic.php?p=1015420

Simonej

We'll update the documentation shortly.

Thanks, waiting for it.
Is always CAPsMAN + ft=yes required for a device to roam between APs?

Simonej

@FToms,
Code: Select all
/interface wifiwave2 configuration set  rrm=yes
is not working anymore, any info about the new "steering" options?
Code: Select all
/interface wifiwave2 steering add neighbor-group     rrm     wnm   

Simonej

@Guntis,

/interface wifiwave2 configuration set  rrm=yes

is not working anymore, any info about the new "steering" options?

/interface wifiwave2 steering add neighbor-group     rrm     wnm

Simonej

Once is detected speed 1G and once 100M with the same device.

Hi, I would not bother support for this if this happens when not using the device, I had the same behaviour on some PCs, it's ethernet going in low power mode, maybe check ErP setting in BIOS.

Simonej

We are probably trying to achieve the same goal... have FT over DS working

Simonej

There is no real advantage and probably is not suggested, it's just because APs are working with no issue (except for all the recent troubles that we are all fighting with) and I'm only interested in 802.11r (Roaming).
I'm collecting info from my tests that will be reported in a post.

Simonej

In my case are 2/3 APs configured as "stand-alone" with all the settings.
No need to distribute the provisioned configuration.

Simonej

Could you please share more information? Actually what I'm testing is: 1) on Router: /interface wifiwave2 capsman set ca-certificate=auto certificate=auto interfaces=(Bridge or Management VLAN) require-peer-certificate=no upgrade-policy=(none or suggest-same-version) enabled=yes 2) on APs: /interfa...

Simonej

Hi @Rox169, I'm testing something that may be useful for you (if works), CAPsMAN without provisioning, just for Fast Transition.
Still dealing with support waiting some answers.

At the moment goal not reached but could be ROS7.10...

Simonej

Related to the @holvoetn question, it would be nice to receive a clear statement about the Wi-Fi issues. About my specific case, I'm using AC devices updated to v7.10rc3 and still affected by those issues: - ...rejected, can't find PMKSA. - ...rejected, FT: PMKID in Reassoc Req did not match with th...

Simonej

Hello, is anyone having issues connecting iOS 16.5 devices to AC Wifiwave2 AP? Android phones are working.
I'm aware of troubles with MT AX WiFi but never had problems in the last few weeks using 7.8 and 7.9 (only AC APs).
Reboot is not helping.
Sending supout to support right now.

Simonej

@nannou9, if you are affected by the same problem I have, bridge hardware offload on devices with 2 switch chips, you need to disable HW offloading then reboot. On RB4011 series SFP+ port is always working. I was fooled by MSTP but not related. Just received confirmation that v7.10 beta "will&q...

Simonej

Just a reminder, v7.9 is still affected with the bug from v7.8 on Bridge Hardware Offloading on devices with multiple switch chips (like RB4011 series). https://forum.mikrotik.com/viewtopic.php?p=989794#p989794 Ticket is closed and fix should be released in the next version. in the meantime Support ...

Simonej

Don't know if this is the same case, but I too have received a lot of similar logs.
Are you using v7.9? It should have improved the situation.

Simonej

Send this link to support...............
viewtopic.php?t=194993#p993491

@rextended is this related to the WiFi error that happens on Audience with wifiwave2 confirmed also by @mkx?
I already sent your post months ago to support (was a different post maybe from v7.4).

Simonej

In my case, the SFP port is working well due to not being connected to the switch. Coming from v7.7, everything was fine. Make a few reboots and good luck! Issue confirmed by Support, SUP-110494; ...it seems to be related to bridge HW offloading for devices with multiple switch chips, and it seems ...

Simonej

from v7.8 changelog: *) bridge - improved HW offloading logic; as reported few posts before, I was fooled by the change of protocol-mode from MSTP to None, this worked but it was a strange behaviour. Already lost some days of headache on this, ended enabling IGMP-Snoppimg on bridge (not related with...

Simonej

Lucky you @pe1chl, it's verified on two different devices with similar config., dealing with support for assistance, hope it's my fault, had an entire company blocked due to this issue.

Simonej

@Lojza007 with RB4011 I'm having a similar issue, in my case is related to Hardware Offload and is "partially solved" with hw=no on the Bridge Ports or completely disabling it. Another test suggested is to disable ports on Switch 2. In my case, the SFP port is working well due to not being...

Simonej

Is anyone having problems with devices unable to get the local IP using RB4011 (RTL8367) from v7.8?
With v7.7 everything worked well, no config changes after the update to v.7.8, solved disabling Bridge Hardware Offload.
Already wrote to support and spent a couple of days also doing Netinstall.

Simonej

@osc86, sae-pwe=hash-to-element | hunting-and-pecking always had problems with this.

Simonej

I have problem with:
board-name: RB1100AHx4...

Are you using Spanning Tree protocol on the bridge?

Simonej

Thanks @sirbryan for clarification, waiting for support to know if mine is a bug.
Are you using MSTP on your devices? Or RSTP?

Using the extracted config to test with other devices and are working as expected.

Simonej

Nice catch @un9edsda! I can be wrong, the link is for "...set up VLAN filtering (by using the /interface ethernet switch menu)", I used different approach and from what I remember bridge was offloaded, ports also. It's curious how the first device worked for a long time and why disabling M...

Simonej

Is anyone having problems with protocol-mode=mstp in RB4011 devices?
viewtopic.php?p=989794

Simonej

Right, I'll post more details later, in the meantime network diagram is very basic; 1) RB4011 Wi-Fi version with 3 VLANs -> TP-Link switch connected to ethernet4 (Access port). This device worked for more than a year with updates from 7.1 to 7.7 . 2) RB4011 with 4 VLANS, unable to get IP on ethernet...

Simonej

Hello, opening this topic to share a recent experience and read any opinion before opening an unuseful ticket to support. Before starting, I'm not an advanced user and the use cases for those devices are between home and small office, pretty basic config with a couple of VLANs configured following t...

Simonej

iPhone 12 with iOS 16.3.1 cannot connect to WiFi if wpa3-psk is enabled. Which MT device? Try to forget and reconnect to the network. PS: @MikroTik Staff, Audience devices with Wifiwave2 package are affected, from around v7.4, by an error at every reboot; system,error,critical RBD25G-5HPacQD2HPnD: ...

Simonej

*) wifiwave2 - fixed 4-way handshake with TKIP;

This means thath WiFiWave2 devices are capable to be used as repeater in Station mode?

Simonej

I have an Audience with similar config, which version of ROS are you using? Try to use only WPA2 and ROS7.6 This is my WiFi config from Audience used at home: ## LAN Wi-Fi ROS7.6 ### /interface wifiwave2 security add authentication-types=wpa3-psk encryption=ccmp ft=yes group-encryption=ccmp name=&qu...

Simonej

Interesting, thanks again for sharing the detailed explanation.
In my personal case I have an RB4011 with couple of VLANs configured as standard bridge-way and an wAP LTE (without wireless active) as second WAN using the second example switch-way without bridge.

Simonej

Understood, thanks!
I was fooled by the fact that hAP has only 1 or 2 ports and it worked for me without any bridge, but not sure it was offloaded.

Simonej

Could agree with your statement, currently using DNS Static for printers, Chromecast etc... but for example mobile phones are not able to the printer using ip or name.

Simonej

Hello, I'm in the process of configure two VLANs on a wAP AC, if I understood how VLAN should work in MikroTIk; - New devices with Hardware Offloaded Bridge VLAN Filtering -> https://help.mikrotik.com/docs/display/ROS/Basic+VLAN+switching#BasicVLANswitching-CRS3xx,CRS5xxseriesswitches,CCR2116,CCR221...

Simonej

Hello, in the meantime we wait for the highly desired mDNS repeater/reflector, has someone tried any container package and is able to give some advice for the easiest one? Those are the ones found: - https://hub.docker.com/r/yuxzhu/mdns-reflector - https://hub.docker.com/r/ydkn/avahi - https://hub.d...

Simonej

Hello, I want to report that with WifiWave2 /interface wifiwave2 add...configuration.client-isolation=yes is not working anymore

Simonej

Branding is just a package https://help.mikrotik.com/docs/display/ROS/Branding, this is what @normis suggested:

Netinstall without keeping config will wipe the device to factory settings and remove any OEM labels

Have fun!

Simonej

Thanks for sharing, so interesting!

Simonej

Very well explained, thanks @sindy. My use case is the first one you mentioned, Wireguard "server" providing the "client" access to internet. I'll test again using your suggestion and report. @Simonej, can you see the difference between the two types of packets mentioned above? N...

Simonej

Agree @anav, I don't expect anything, will probably be a waste of time but it's just for learning and testing.

PS: hope everything is going well after the hurricane, wish for the best to all canadians

Simonej

Dear users, trying to use NoTrack following the suggestions from @msatter and @sindy for WireGuard in Road Warrior mode, read several times and did multiple tests, no success. This is the firewall config part relevant: /interface wireguard add listen-port=13231 name=WireGuard private-key="...&q...

Simonej

@own3r1138 there's so much interesting to learn in the MikroTik world that I pasted the wrong link without giving you all the credit.

Simonej

Any hint is really appreciated, I'll post a corrected version based on your suggestions.
By the way, was tested several times before posting.

Simonej

Agree, it's an adapted version from ilium007's code. Feel free to delete the post if not useful.
As you correct, I have no knowledge, just trying to learn

Simonej

Hello, tried to search for a script to update HTTPS Let's Encrypt certificate and the only one suitable is from ilium007 , here is an adapted version: :local MyDDNS "my.dd.ns"; :local WANinterface "WAN"; :local RouterAddress "192.168.88.1"; :local ServiceWWW [/ip servic...

Simonej

Not an expert as @rextended is, but let me give you my point; as you I'm using external DNS service for my router, and I want to make sure some stupid devices are not using other services, redirect DNS requests from LAN devices to port 53 it's easy using NAT firewall rules; - DoT, drop dst-port=853 ...

Simonej

THANK YOU!
Just as confirmation, is this example (sorry not very precise) correct?

Simonej

Not an expert, have a single peer in Wireguard, the only way in my case was to use action=accept , this was not working: /ip firewall raw add action=notrack chain=prerouting in-interface-list=VPN ... /ip firewall filter add action=accept chain=input connection-state=established,related,untracked plu...

Simonej

Hello, tried to search but the answer was not clear;
for a router with a single bridge and multiple VLANs (vlan-filtering=yes) is MSTP useful? Or RSTP is enough?
A switch with VLAN will be added in the future, this should have the same setting on the bridge?

Thanks

Simonej

If anyone is having problem connecting devices with WPA3, try

/interface/wifiwave2/security/set (yourWiFiprofile) sae-pwe=hunting-and-pecking

also, GCMP encryption should work with WPA3-Personal? Unable to connect any device.

Simonej

If anyone is having problem connecting devices with WPA3, try

/interface/wifiwave2/security/set (yourWiFiprofile) sae-pwe=hunting-and-pecking

also, GCMP encryption should work with WPA3-Personal? Unable to connect any device.

Simonej

*) route - added option to join static IGMP and MLD groups (available in "/routing/gmp" menu);

Hello, this could be useful as multicast repeater?
Trying to avoid Avahi as container but getting crazy from more than a year due to the Chromecast and printer on a different VLAN.

Simonej

Came here searching for the same question...

Simonej

@Panbambaryla not an expert but make sure in Bridge -> Ports -> VLAN, Frame Types is not "admit only VLAN tagged"

Simonej

Really interesting, thanks for sharing!
This has to be installed to an external device like Raspberry Pi or container?

Simonej

After some tests, without reinvent the wheel, the https://help.mikrotik.com/docs/display/ ... v4RAWRules Building Advanced Firewall is an appropriate solution.
Limit ICMP or block IP can cause some problems with Wireguard.

Simonej

All clear @sindy, appreciated the detailed answer as always! SNMP from a static IP is not an option in this case, it's just a rudimental solution for home device, ping or any check will be operated from casual location or mobile phone. Was looking for a rule that can limit the pings to the router li...

Simonej

Hello, using RouterOS from a few years without any critical problem, recently had some issues and I was thinking for an easy way to make sure that the router in online; MikroTiks's Building Advanced Firewall guide is suggesting to accept ICMP, this way it's possible to ping the public IP or DDNS. /i...

Simonej

Thanks @anserk, was reading all topic, your post https://forum.mikrotik.com/viewtopic.php?p=939421#p939048 is very intresting. Following your suggestions I ran some non-professional tests; INTERNET QUEUE | QUEUE TREE | CAKE | BRDIGE -> WAN | 500M | 7,5% CPU queue /queue type add cake-ack-filter=filt...

Simonej

Hello, trying to learn more about QoS on Mikrotik, the goal is to avoid any VoIP issue and have greater browsing experience. Starting from the presentation by Penny Tone https://mum.mikrotik.com/presentations/US16/presentation_3004_1462512668.pdf , the awesome pcunite's guide https://forum.mikrotik....

Simonej

An huge THANKS from all the readers, your contribution is precious.
Wish you all the best.

PS: Always used $update url=[$checkurl as indicated, not other ways.

Simonej

Hello @msatter, still trying to understand your and @rextended suggestions for $checkurl (already tried several times without success, I feel soo dump...), may I ask why you removed

viewtopic.php?t=152632#p937836

content?
Thank you

Simonej

Can't help, still fighting with [$checkur url=https://... but I also had the same error with Greensnow, you can find my updated list viewtopic.php?p=936764#p936764

Simonej

https://forum.mikrotik.com/viewtopic.php?t=152632#p937136 Apologies for asking again, looking to integrate your suggestions for redirect, without success. In terminal with :put ([$checkurl "https://snort.org/downloads/ip-block-list"]) I was able to read the correct url, any hint on how to...

Simonej

@kevinds you're right... "all" Blocklist.de contains everything... 8) @rextended is your solution easily implementable in msatter version? https://forum.mikrotik.com/viewtopic.php?t=152632#p935938 Tried to integrate reading your post https://forum.mikrotik.com/viewtopic.php?p=930372#p93045...

Simonej

@kevinds just an error on the log (for Darklist.de and Greensnow.co), there are more useful informations? I removed the other variables here but are present on the code :) Adding more lists just for learning purposes, which one is duplicated? @msatter you had the answer for "Snort" list, i...

Simonej

Apologies for another dumb question, looking and found some great IP lists, Darklist.de, Greensnow.co and Snort are returning an error, any idea why? Here are the ones found; $update url=https://feodotracker.abuse.ch/downloads/ipblocklist.txt description/listname="Abuse.ch Feodo Tracker" d...

Simonej

Dear MT fans, following the great advice from @Chupaka and MikroTik help, ( https://help.mikrotik.com/docs/pages/viewpage.action?pageId=28606504 ), I added to the firewall some protections, here as example: /ip firewall filter / mangle add action=jump chain=input comment="Jump Input to Chain&qu...

Simonej

THANK YOU msatter for your AWESOME contribution!

Simonej

@hecatae ww2 works on 7.3rc1. but still no go for samsung phones on WPA3 & Android 12 WPA3 on Android 12 (Google phone) is a long time problem, I never succed a connection with my phones, WPA3 was a Google bug, solved this winter, still not working with MT devices, the only way is to use only W...

Simonej

AWESOME @msatter !
It's working with

delimiter=("\n")

seems to be mandatory also on your updated version of the script, correct?

Simonej

Hello!
Could be a good idea to integrate TOR Exits?
https://check.torproject.org/torbulkexitlist
https://www.dan.me.uk/torlist/
https://www.dan.me.uk/torlist/?exit

Tried to integrate with $update with no success, address were 1,2,3,4,5,6....

Search found 104 matches