MikroTik

jaclaz

Shouldn't be too different from:
viewtopic.php?t=163396

jaclaz

About docker on mipsbe I'vefound this topic, but doesn't report the way to obtain it:
viewtopic.php?t=187595

Well, that is what is generally referred to as "wishful thinking":
https://en.wikipedia.org/wiki/Wishful_thinking

jaclaz

I think a line must be drawn *somewhere*, between "same network" and "other network". If your PC has 192.168.88.253, i.e. belongs to network 192.168.88..0/24, and the bridge on the Mikrotik is /ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=\ 192....

jaclaz

Good, so kleshlki's example in post #28 or your reported adaptation in post #29 (minus typos/errors) are the right references "as they are".

jaclaz

I made a mistake in the last step — datapath configuration. I fixed it and it worked

It would be nice if you could describe exactly what the error(s) and the correction(s) were, so that this thread may become useful as a reference for similar issues.

jaclaz

The common reports about 60 GHz Is that you need clear line of view, even some fog or medium heavy rain can compromise the link, tree leaves are a no-no. A Cube in such a setup will likely continuosly fall back to the (much slower) 5 GHz. Besides the SXT SA5 AC, which I believe is intended for much ...

jaclaz

You can also use "/system/script export where name=XXXX" to get the "escaped form" of any script (and then cut-and-paste that as needed).

Good to know, thanks

.

jaclaz

When you have PPPoE up: 0 ADS 0.0.0.0/0 pppoe-out1 1<- this is (DHCP) and Active, ALL outbound traffic goes through this 1 S 0.0.0.0/0 192.168.8.1 2 -<- this is (Static) and NOT Active (because of higher distance=2), so it is irrelevant 2 A S 1.1.1.1/32 pppoe-out1 1<- this, (Static) is Active and be...

jaclaz

ROSv7 is too generic.
Different versions of 7.13, 7.14 and 7.15 (besides latest-latest 7.16) have been object of alternate reports of instabilities on Wi-Fi.
From what has been reported, 7.14.3 seems to be the safest bet or - at least - the better "base".

jaclaz

These: add dst-address=0.0.0.0 gateway=192.168.8.1 distance=2 add dst-address=1.1.1.1 gateway=pppoe-out1 distance=1 Should actually be, I believe: add dst-address=0.0.0.0/0 gateway=192.168.8.1 distance=2 add dst-address=1.1.1.1/32 gateway=pppoe-out1 distance=1 (but maybe the network is implied) But ...

jaclaz

At a quick glance I see two common settings missing (cannot say if you avoided them on purpose):
1) static MAC address to the bridge
2) categorizing ether8 as WAN

jaclaz

We're talking about a boat here, so few other factors make it bit harder of a problem. e.g. it's going to bake in sun, vibrate/move slightly (wind), and perhaps be in salty air. So even @normis's reasonable and fun suggestion to 3D print a case for a Chateau, requires a high-temp printer to use som...

jaclaz

@mkx
Well, I paid 1.80 for that same cable, so it costs us nothing - combined - we are still ahead, and we can even afford to pay the unjust and unfair duty the Sheriff of Nottingham just imposed on us.

jaclaz

There are AFAICU mainly two consequences of using VLAN1: 1) possible incompatibilities with other vendor devices 2) possible incompatibilities with Mikrotik internal usage of VLAN1 for *some settings*, i.e.: https://forum.mikrotik.com/viewtopic.php?t=206946#p1071170 I am pretty sure that expert, kno...

jaclaz

So you have no firewall filter rules that may interfere? I see now that you did declare the vrf's, my bad :oops: . I don't particularly appreciate your naming scheme, when/if you will need to use ether2@port1 you will see why, but this is irrelevant. I cannot see anything blatantly "wrong"...

jaclaz

Yep, as said RF shielding is tricky business, strange that you did not notice some differences. Well, at least we tried ... An alternative (that you won't like) could be modifying the hAP lite, add an external antenna connector and use an external flat (directional) one: https://forum.mikrotik.com/v...

jaclaz

Very likely completely unrelated to the issue you still need to solve, but using VLAN1 is what we highly specialized technicians

commonly call "looking for troubles".

JFYI:
viewtopic.php?t=208061&

jaclaz

Here are some related info:
viewtopic.php?t=32935
particularly:
viewtopic.php?t=32935#p161412

And this post is the one that (for me) is easier to remember, the concept of a mirror of a /32:
viewtopic.php?t=32935#p382118

jaclaz

Wouldn't this be similar to the "Simple Static Routing" here (minus the two different WANs instead of the single one on the wiki example):
https://wiki.mikrotik.com/wiki/Manual:S ... ic_Routing

jaclaz

In a still not perfect world, but better than this one, wifi-qcom-ac would have probably been still called wifi-qcom-ac, but wifi-qcom would probably have been called wifi-qcom-ax. You would have wifi ac devices, and need wifi-qcom- ac , you would have wifi ax devices, and need wifi-qcom- ax . In th...

jaclaz

If it is v7, you are seemingly missing the explicit declaration of the three rouiting tables.
It is better if you post your whole configuration (as opposed to the parts that you believe relevant) as the devil is in the details.

jaclaz

Plwase recheck your post. RT1 is 192.168.1. 1 , you wrote 192.168.1. 2 in a few places. Post the configuration of the RT1 too. I think it is better to go step by step, i.e. if PC1 connection to RT1 is not working the issue can be in three places, (besides PC1), SW2, SW1 and RT1, but if SRV2 connecti...

jaclaz

Yep, there was a photo posted some time ago, about picture on the box and actual contents, cannot find it right now, but this one will do:

jaclaz

That TP-LINK thingy is not a standard (which standard?, I love standards, there are so many of them :wink: ) PoE device. The PoE injector that comes with that is intended to be more than anything else an "extension cable" powered by the "normal" power supply that comes with the d...

jaclaz

Now we are waiting for the Stable version before officially using it into production.

JFYI, in Mikrotikish "stable" has a somehow different meaning than "production ready".
I think it is one of those language subtleties that are lost in translation.

jaclaz

@bpwl That seem like one of the few cases where a cAP might be more useful than a hAP if you mount it on a ceiling or high on a wall. @acrophobic Sure, if you have the possibility a sheet of aluminium some (say) 2 mm thick would be light enough and have the mechanical resistance to hold the two devi...

jaclaz

The / only means "start from root", if you prefer without it it is a "relative path", with it it is an "absolute path": The good thing about RoS (and not only) scripting is that everyone can (within limits) write anything the way he/she likes :) (including overcomplicat...

jaclaz

As said it would IMHO be advisable to add a /32 route for the destination and leave the general 0.0.0.0/0 gateway alone. The gateway set in your lggh devices is only used for (say) NTP or something else, unless you expect days long interruptions of the lte, the 2 wireless devices can live without in...

jaclaz

Thanks for all for the possible solution, i have another question, the ping or the netwatch functions use the system gateway for the instradation, i think that i have to set first it in the script otherwise i have a infinite loop, is correct? Sorry, I don't understand the question, can you try expa...

jaclaz

Wouldn't some tin foil between the two devices (RF shielding) have the same effect of having the devices a few meters apart?
It costs nothing to test, and if it works one could experiment with a very fine metal mesh (mosquito mesh) that could be simply glued/fixed to one side of the hAP Lite.

jaclaz

It is now a Generic matcher:
https://help.mikrotik.com/docs/display/ ... ricmatcher

And if you want to live dangerously, the new 7.16beta3 has an added option, substring matching, see also:
viewtopic.php?t=191884

jaclaz

That's a very interesting comment. As far as we know, most people use Webfig. And Linux/macOS users very much try to avoid Wine at all costs. So thank you, this brings more varied opinions in to the mix. As a side note, and if I may, the idea of optionally removing webfig from the low storage devic...

jaclaz

I don't really know, but there must be something else, you just proved that VLAN devices are at the same time Dynamic and NON-Dynamic, which doesn't sound right.

Schroedinger's VLAN devices?

jaclaz

Yep, the names are confusing (generally) and to add to it every make/brand use some, slightly or greatly, different naming for the same thing. I have no idea how the eero thingies work, but probably you don't need to do anything on the Mikrotik to have it working, at least from what I can understand...

jaclaz

YMMV, therefore I'm not going to write exact rules here. You have discovered a truly marvelous proof of this, which this margin is too narrow to contain? :wink: :lol: Seriously, if you can, do post the configuration that actually solved the problem, even if mileage of other members may vary, at lea...

jaclaz

I don't want to seem unfriendly or rude, but the proper answer to your question would be: Yes. http://jdebp.info/FGA/questions-with-yes-or-no-answers.html Please describe your overall network setup, then follow the instructions here: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 and pos...

jaclaz

The hap AC lite is $59 (official list price). The Ax lite at the same price is a steal, but it has only 2.4 GHz radio, if only 2.4 GHz is ok, no doubt, go for it. The hap AC costs more than the Ax2, $129. The issues with the hap AC (lite or not) are the architecture (MIPSBE) and the (too) little amo...

jaclaz

Let's list the usual settings when the device is set as a router, the ether1 is "self-standing" (not part of a bridge) has a DHCP client active (it gets its IP address from the ISP router to which is connected) a DHCP server is running on the bridge (to which all othe rinterfaces are added...

jaclaz

Yep, but in the context of Quickset choices, I think (from the already linked threads) that Quickset in "PTP bridge AP" will set mode=bridge anyway, i.e. the "PTP" in the description prevails and sets to have only one single connection, regardless of the license level, maybe one ...

jaclaz

Maybe neighbor Discovery Is disabled?
https://help.mikrotik.com/docs/display/ ... +discovery
Or MAC Winbox server?
https://help.mikrotik.com/docs/display/ROS/MAC+server

jaclaz

Well, there is some difference between: An error has occurred and something *like*: script "mynicescript" running on device with MAC 00:ww:xx:yy:zz caused a "device not responding" error on line 42 These pieces of info: 1) name of the script 2) on which device it is running 3) th...

jaclaz

The "Typical_AP.rsc" is the configuration for a CRS326-24G-2S+

(which I doubt is a typical AP

)

jaclaz

@rextended Let's assume that by pure chance there is not any Mikrotik device in the customer's network. Doing an IP-scan from windows is a perfectly legit operation, but IMHO the original post over-complicates it a bit. A window computer set to get IP address from DHCP should already get an APIPA ad...

jaclaz

A "normal"/common Netwatch script would do. Usually: The on-down script/commands would change the route to the alternate one The on-up script/commands would restore the previous route. In your case, instead of changing/enabling/disabling routes, you would change the gateway in the dhcp ser...

jaclaz

To be fair the fact that a given (wrong) practice has been in effect in v6 doesn't justify in any way insisting on it in v7. In other fields, when *something* results in a given number of (minor) accidents or a single serious one, that *something* is usually changed (hopefully for the better). The f...

jaclaz

I guess that what erlinden asked for as "logging" was meant as:

/log print

and copy and paste a few related lines of the log around the "probably loop" error you posted.

jaclaz

I think that with some clever scripting it is possible to change the gateway provided by the two DHCP servers, but the change in the two MIkrotiks DHCP settings will not be actually propagated until next DHCP request/negoitiation/lease. So, when the LTE goes down: 1) all clients in both buildings wi...

jaclaz

To be fair, the default (from factory) configurations of a paired couple is pretty much straightforward, and similar to the "standard" (as quickest would make them) ones, the only (relative) complication is the bonding together of the two 60 and 5 GHz radios. But the bonding is needed to a...

jaclaz

Since the replacement with a similar device didn't change result (I doubt that two devices can be defective in exactly the same manner), it is actually possible the the RB750GR3 "filters" some activity on the network that ultimately causes the flapping issue. I would exclude that a commonT...

jaclaz

Good :) , so you can temporarily go for 7.12. But did the new batch come with already 7.14.1? If yes it must be new-new, 7.14.1 came out at the end of march 2024 . Unless you cannot manage to use 7.12 - since it is in production - I would wait for a non-beta version with the feature fixed before upg...

jaclaz

So you think the switch is damaged? It was connected to eth5 for months without any problem. That or *something else* on the network that the unmanaged switch allows through but the 750GR3 intercepts/blocks, hard to say. How many ports has the TP-LINK switch? Try changing them around, it is entirel...

jaclaz

Yes, but I still miss something :? . In a normal situation (both ADSL and LTE up) is : 1) both buildings A and B access internet via LTE and ADSL is only a backup or 2) building A goes through ADSL and building B goes through LTE Or - in other words - does only building B need to switch from LTE to ...

jaclaz

I tried to manually install loaded missing ARM package but it doesn't install anything.

Isn't it MIPSBE? (not ARM):
https://mikrotik.com/product/RBwAPG-5HacT2HnD

jaclaz

We have here, as a reference, the normal cube Pro pairs complete setup (from factory): https://forum.mikrotik.com/viewtopic.php?t=205042#p1059476 One end is mode=bridge and the other is mode=station-bridge, then there is the bonding between the 60 and the 5 GHz interface. And yes, the Quickset does ...

jaclaz

I am not sure to understand your setup/what you want to obtain. Normally (with both internet connections working) clients in building A go through internet access A and clients in building B go through internet access B (lte)? And when the lte connection is down you want cliients in building B to sw...

jaclaz

Possibly simpler is to highlight the modes to better understand the basic incompatibilty: What I purchased for the SFP connector is described as: "1.25G 850nm Multi mode SFP LC Transceiver Fiber Module 550 Meters 1000Base-SX LC MMF for Cisco GLC-SX-MMD/SX-MM/SFP-GE-S,Fortinet,Ubiquiti UniFi UF-...

jaclaz

Only as a side note: The default rules that come with Mikrotik SOHO devices have two features that your ones miss: 1) they are marked in comment as "defconf" which is useful when/if you want to change some of them 2) they have a comment summing up what the rule does As well, the generic ad...

jaclaz

You'll have to go through this thread (which is the officially unofficial Mikrotik guide for VLAN by Pcunite):
viewtopic.php?t=143620

jaclaz

Thanks for taking your time and explaining it. As far as I can tell by the images. The 5.1k ohm is pulldown resisors, right? It looks like you soldered them to ground. If so, I have something to do tonight. :) No, I didn't solder them (user gwynbleidd reported doing that). Yes, they are pull down r...

jaclaz

i have fixed the dhcp-client config, changing masquarade to out ether1 makes it no longer work But if you have ether1 in a bridge, likely you have to add the masquerade to the bridge and not to ether1 (which is slave)? Or it means that you need interface-list=LAN because this way you are masqueradi...

jaclaz

It is a known issue. The Ax lite (LTE6 or not) uses a USB-C connector AND 5V BUT it is not a USB-C compliant device. It does NOT negotiate with a USB-C power supply the voltage (which is OK, as it needs 5V) nor the amperage (there is a special provision in USB-C specs to allow 3A on 5V passively, ot...

jaclaz

Personally I believe that once something is working, the more "narrow" you can make the related rules/settings, the better, so, yes, I would check if the setup works with the masquerade rule attached to the single port you are interested to as opposed to an interface list. i,e, try; add ac...

jaclaz

In this guide topic here:
viewtopic.php?t=143620

jaclaz

By default ether1 is WAN on most Mikrotik devices, it is possible that you did not change its categorization to LAN? If this is the case, likely you have some firewall rules that block the connection. Follow the instructions in this post: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 an...

jaclaz

You will need to use one of these methods: https://forum.mikrotik.com/viewtopic.php?t=185514 https://forum.mikrotik.com/viewtopic.php?t=185514#p929556 The script in itself (or the command added to the scheduler script) should amount to: delay 10s /interface vpls disable [find] delay 5s /interface vp...

jaclaz

It sounds like a timing issue when rebooting.
The fact that it happens only some times (and possibly only on some routers) makes it difficult to avoid completely.
Probably the workaround would be a script set to run (say) after 3 minutes after boot that disables and re-enables the VPLS interface.

jaclaz

If the routers work as they should I would leave them alone. You are using 297 out of 970752 on the one and 113 out of 1015808 on the other. The max-entries depend on the amount of free RAM on the specific machine, it is calculated automatically and it is a read-only property: https://help.mikrotik....

jaclaz

See:
viewtopic.php?t=193667#p984874

Any Dynamic DNS may fail, anyway, and past performance may not necessarily be an accurate forecast of the future reliability.

Decisions, decisions, always decisions ...

jaclaz

About the log, open a new terrminal Windows in Winbox, in it input /log print This way you can select and copy. About the configuration, the upgrade should have not deleted It completely, maybe when you ran It without the drivers something got corrupted. Follow the instructions here and post the con...

jaclaz

Besides the convenience (or non convenience) of having your router up a pole outside :wink: , the SXT LTE6 is not a very fast device, so (it depends on the fiber connection you have) it may be a bottleneck. At what speed you have your fiber connection? If faster than 100 Mbps or so the SXT will be t...

jaclaz

The Mikrotik DDNS service should be available to people using MIkrotik hardware or a CHR license, see this as an example:
https://foisfabio.it/index.php/2022/12/ ... -gratuito/

jaclaz

No need for wifi in the basement? Or outside, in the courts or park? Anyway as access point, in Mikrotik catalog you can currently choose between the Cap Ax:and the Cap Ax: https://mikrotik.com/product/cap_ax Maybe and maybe soon, there will be a new device that may be suitable, the Wap Ax. In metri...

jaclaz

It's strange. You have a DAc (Dynamic, Active, connected) route (generated automatically by the router, hence with distance 0): DAc 100.64.0.0/10 ether8-StartLink 0 And seemingly no other ones interfering, so the destination 100.64.0.1 should be reachable. The one you added to the DHCP client with d...

jaclaz

Routing rules are usually "better", but mangle marks allow more granularity, so if you can obtain the expected result with routing rules, they should be preferred.

jaclaz

I would not update to 7 yet.
It is not a bad idea, but the procedure is not exactly simple, and if I were you I would wait until you have become more familiar with the devices and their configuration/management.

jaclaz

60 GHz needs direct line of sight, no ifs, no buts.
If you have that, go for it, but if you have even a japanese style paper wall between the two devices 60 GHz won't work properly.
Devices like the Cube Pro have a backup at 5 GHz because fog or relatively heavy rain can break the 60 GHz connection.

jaclaz

I see now, so in the referenced post the new and old AP are to be intended as same AP but new and old bands.

jaclaz

Having dst-address the same as the gateway add disabled=no distance=1 dst-address=100.64.0.1/32 gateway=100.64.0.1 \ pref-src="" routing-table=main scope=10 suppress-hw-offload=no \ target-scope=10 which is in route print: 2 As 100.64.0.1/32 100.64.0.1 1 doesn't look right to me :? , maybe...

jaclaz

Very often the issue is with the APN. Make sure what the MEO APN should be, "internet" is probably a generic one. In some cases you need to explicitly set: use-network-apn=no https://help.mikrotik.com/docs/display/RKB/Chateau+LTE12+APN+problem https://forum.mikrotik.com/viewtopic.php?t=161...

jaclaz

Easy bet. It is already known this is the root of the issue. That's why people commonly tinker around with connect-priority.

I thought that was related to issues when roaming with two or more different AP's?
viewtopic.php?p=1093107#p1093107

jaclaz

Another observation. Normally, the SSID for 2.4GHz and 5GHz are identical. However, for this test, I added "5G" on the end of the SSID so I could force it onto one band or another. When the SSIDs are different, the SA Query timeout errors never occur. Even though the RX signal is poor, it...

jaclaz

And don't hold your breathe while waiting for a new product to appear, it may take longer than you can live without breathing

Corollary:
Do you think that's air you're breathing now? /size]

jaclaz

Sorry, but ROSE is clearly not enterprise feature ...

https://help.mikrotik.com/docs/display/ROS/ROSE-storage

ROSE (RouterOS Enterprise) package adds

... and the 2024 award for the most inaccurate package name goes to ...

jaclaz

I wonder why the Ax2 is always represented as standing ... :? AFAIK it needs to be standing because of better heat dissipation, but it is possible that the internal antennas are designed to work with the device standing and having it flat on the table reduces their efficiency (or you have a lot of s...

jaclaz

... unless you first set a secure password (meaning requiring sensible password complexity ...

JFYI:
https://neal.fun/password-game/

jaclaz

Also made sure the antennas were tightly screwed to the board and aiming at 45 degrees like this. You have strange degrees where you live. :lol: Here the angles in the photo would be between 60 and 72. (they would fit either an hexagon or a pentagon placed on top of your Ax3) https://t4.ftcdn.net/j...

jaclaz

Well., post your current configuration:
viewtopic.php?t=203686#p1051720
and describe what you want to achieve.
Post also an output of:

/ip route print

jaclaz

When you make a cake, decoration is the last thing. :wink: Postpone access lists to later, once you will have the basics working. The Capsman is running, on the AC2, right? Have you followed the tutorial on the Wiki? https://wiki.mikrotik.com/wiki/Manual:Simple_CAPsMAN_setup Alternatively, did you r...

jaclaz

Sorry I did not understand the comment directed at me. Can you clarify the point you are making? Unfortunately MikroTik is popular with two very very different groups. Home users that plug and play (or mobile operator that just gives them a router). and professional installers. We have to make both...

jaclaz

It is not like I cited the CRA (which is not yet in effect) casually. Annex 1, Article 1, paragraph 3 (a) is exactly about this: (a) be delivered with a secure by default configuration, including the possibility to reset the product to its original state; This is what MIkrotik is IMHO already doing....

jaclaz

Just in case here is my personal translation table: https://forum.mikrotik.com/viewtopic.php?t=208346#p1080389 And I concur that the issues are unlikely to be connected to hardware (it is not like Mikrotik has own proprietary chips or circuits) and AFAICU now they are using not anymore their proprie...

jaclaz

Hmmm, Normis seemingly stated the opposite:
viewtopic.php?p=1090870
Maybe there is confusion in the terms used?

jaclaz

Do you know the scene from Spaceballs movie?

Yep.
We're at now now.

... as a non native speaker ...

... which makes a nice round two of us.

jaclaz

To be fair: you said "now" like it is something new.

Well, I wrote now meaning now, as in now, would already have been better?

Or should I have gone all the way to adding "since the dawn of times" or "AFAICR"?

jaclaz

I don't know where you live, but I never ever received a credit/bank card shipped with PIN code in same envelope ever in my whole life. Exactly, as I said, the PIN cannot be shipped in the same envelope as the card, to avoid the possibility that if the card is stolen "in transit" it can b...

jaclaz

If you check the Annex I, article 1, paragraph 3 of the mentioned CRA it can be read (in a restrictive way) to the effect that shipping a router with a password is not a sufficient measure to prevent unauthorized access to it. :shock: Not unlike what happens now with credit/debit cards (the PIN cann...

jaclaz

Welcome to the world of (Mikrotik) wi-fi mysteries. A cap Ax is designed to be mounted on a ceiling (though it is also possible to mount it vertically on a wall, though in this latter case it will likely perform worse). The board is full of reports about the cap Ax being either very good or a terrib...

jaclaz

I haven't actually read the EU law regarding the passwords, but if every other vendor did it by forcing a password change, instead of random passwords per device, then I am inclined to believe that 'random passwords' wasn't a requirement by law. Possibly because it is not at all clear which specifi...

jaclaz

Then I need to get the POE Power into the device. 4 cameras take 0.5 amps each. Seems like there are lots of POE power supplies available. What should I use for this? 0.5 amps? :shock: Maybe they use 0.5A@12V or 0.5A@24V. Most PoE cameras are nowadays 802.3af, which usually work @48V, and to be af ...

jaclaz

Then the issue is related to VLAN settings. No idea about those, I can only observe that you are not using the exacts settings anav suggested (cannot say if those would make a difference). You have the routes as DAC, so you don't need to add them as static. Maybe you can go through this: https://for...

jaclaz

conditions are IMHO AND combined. ssid-regex+passphrase must match both. Dunno what's wrong with their logic. Maybe passphrase is not a filtering parameter. So the only remaining filter param is ssid-regexp and first rule wins. Yes, passphrase is not listed among the "filtering parameters"...

jaclaz

By posting only partial configuration you are making much more difficult to follow your settings. Please post the whole configuration. This: /ip firewall address-list add address=10.0.0.10 list=ZugriffAufDrucker /ip firewall filter add action=accept chain=forward dst-address=10.0.101.250 src-address...

jaclaz

After I tried this solution, the router became a brick. No internet, no vpn, on access to the router via 192.168.88.1 ip address. It is improbable, those settings are only related to outbound traffic and wi-fi, it is more likely that *something else* caused the issue. Anyway, you should be able to ...

jaclaz

"The rules are checked in the order they appear in the list. Only management actions specified in the first matching rule are applied to each connection." Maybe the relevant statement is a few lines after that: Just make sure that the specific client doesn't get matched by a more generic ...

jaclaz

Well, whatever/whomever produced the snippet you posted did not understand the question, let alone provide a meaningful answer. (actually it is wrong even as an answer to another question). Once removed the abstraction level of the variables, it amounts to fiddling with IP addresses of a local port,...

jaclaz

I connect the patch cord to the laptop connector. If you don't have *anything* plugged into a wall socket, then you have no power. Your device is a cap Ac, it is - at least by name - an Access Point, not a Router, hence the initial perplexity. It can only be powered via PoE: https://mikrotik.com/pr...

jaclaz

Let's start form the basics. 1) Which exact device model is it? 2)How are you powering it? From what you write it seems like the device has not power at all. The device needs power, they normally have a DC jack socket, a few can be powered from PoE (Power over Ethernet), but of course in this case y...

jaclaz

Yep.

this remains valid anyway:

Always drive defensively. Expect the unexpected.

jaclaz

@Njumaen AFAIK size of packets is unrelated. The opinion on the forum is that the data from tests Mikrotik publishes are largely inaccurate in the sense that they represent some peculiar lab/test conditions. What has been observed is that coincidentally the value for routing, 25 firewall rules, 512 ...

jaclaz

After all, most exploits are done over network without physical access to device being compromised. Yes, and - again - the insecurity is mainly the fact that *somehow* there is access to the device files from the outside, the Meris that has been cited was a bug that allowed to download the database...

jaclaz

I asked if it is good solution to have DNS server on the MikroTik router or it is better that any client receive the ISP dns. Well, initially you only provided statements, only later you asked the questions, which however, without context, can only be answered as "it depends". The DNS ser...

jaclaz

Still the RB3011 can route in theory at 452.6 Mbps 512 byte packets with 25 firewall rules https://mikrotik.com/product/RB3011UiAS-RM#fndtn-testresults as opposed to 986.3 Mbps of the hap ac2 https://mikrotik.com/product/hap_ac2#fndtn-testresults If OP's WAN is already at 500 mbps, the RB3011 is cur...

jaclaz

If I get this right, you are looking for some sort of failover (more than load balancing) among three target IP's?

You only connect to 1 IP (IP#1) and you expect the Mikrotik to forward/route your connection to any of three other IP's (IP#2, IP#3, IP#4) depending on the availability?

jaclaz

I don't understand your setup. You first add an interface to a bridge (with only one port?) and then you add an IP address to the interface (and not to the bridge). Try removing the IP address from the ether2 and add it to the bridge: /ip address add address=192.168.14.250/24 interface=bridge1 Then ...

jaclaz

It's free?

From the project page:

License

RouterFleet is released under the MIT License. Feel free to explore, modify, and distribute the software as per the license agreement.

https://github.com/eduardogsilva/router ... in/LICENSE

jaclaz

hashtag #nocamelcase

https://en.wikipedia.org/wiki/Camel_case

jaclaz

This doesn't happen with a Zyxcel 12v 4a adapter. Yep. Your device specs: DC jack input Voltage 12-28 V Max power consumption 23 W Max power consumption without attachments 17 W would require no less than 17/12=1.42A@12V or 17/24=0.71A@24V or - better - 23/12=1.92A@12V or 23/24=0.96A@24V Still, if ...

jaclaz

gianry, you evidently have not noticed that the previous replies contain (some) sarcasm. You did not provide a configuration, only a (non-understandable) snippet/screenshot and a very partial description of the settings you used. If you want some sensible replies you should post your configuration: ...

jaclaz

However it is working now!!! Good. :) Can someone explain the difference between my initial config and this? Your connection/route to 10.0.0.1/32 became ADC, the A is active (as before) but it is not anymore static, it is DC (Dynamic and Connected) and has a distance of 0 which means that the route...

jaclaz

Why is that route distance 2?
It should not matter since you have no other routes for 0.0.0.0/0, still it should normally have distance 1.
You should probably specify out-interface=ether1 in your /ip firewall nat masquerade rule. but that is also - I believe - not relevant.

jaclaz

So that Shelly uses digest and fetch supports it directly, good to know.

It remains strange that curl with -anyauth didn't work/didn't provide this info, but all is well that ends well

.

jaclaz

Should be related to the built-in ssh server:
https://help.mikrotik.com/docs/display/ROS/SSH
try disabling ssh in services:
https://help.mikrotik.com/docs/display/ROS/Services

jaclaz

Post again the /ip route print output.

Maybe you can ask the VPS server provider if they have a known to be working Mikrotik setup.

The only other thing I can think of is adding a 10.0.0.x IP address to ether1.

Let's wait if some of the more experienced members have a solution.

jaclaz

Try with the -v (verbose) switch, possibly there will be more details. Checking the capture of the browser, it mentions "algorithm=SHA-256," the Shelly1 and 1plus, from what I read should be using basic auth, later devices do actually use a different method of authentication: https://shell...

jaclaz

Basically it means 10.0.0.1 on interface ether1, or 10.0.0.1 reachable through interface ether1. There are two "modifiers" for gateway addresses: https://wiki.mikrotik.com/wiki/Manual:IP/Route gateway (IP | interface | IP%interface | IP@table[, IP | string, [..]]; Default: "") Ar...

jaclaz

In a Windows command prompt, curl does not work with the Shelly authentication enabled. It works fine with the Shelly authentication disabled. Post the exact CURL command you are using. No error provided when it fails? Under Windows, try running. curl -v -u "user" http://192.168.0.144/.. ...

jaclaz

The "no route to host" is normal, as that route (#0 in the screenshot) is "S" but not "A".

No idea what the problem is, but - for what it costs - I would try a route with gateway=10.0.0.1%ether1

jaclaz

Post the output of:

/ip route print

jaclaz

Try it on a PC (with curl installed/running), then - if it works - you need a script for "basic auth", see my previous edited post.

jaclaz

The user:password actually works from a browser. Very likely because the browser itself manages to encrypt/encode/hash/whatever the username/password before sending it to the Shelly. https://reqbin.com/req/c-fkj7kdqi/curl-request-with-credentials Try with curl: curl http://192.168.0.144 --user &quo...

jaclaz

It seems like you say. https://www.intel.com/content/www/us/en/support/articles/000005714/wireless/legacy-intel-wireless-products.html All wireless products with 802.11n support MIMO. https://info.support.huawei.com/info-finder/encyclopedia/en/MIMO.html Mainstream home wireless routers in the market...

jaclaz

Those are the 2.4 GHz antennas, compare with the picture here:
viewtopic.php?p=1087853&hilit=antenna#p1087603

jaclaz

There may be some settings that need to be changed/tuned, but it shouldn't reboot by itself. The configuration you posted indicates: # managed by CAPsMAN that wifi settings are managed by capsman, but us this the case? (i.e. do you really have anothe Mikrotik device that is controlling this one?) Po...

jaclaz

Wait a minute, the d53g is this one:
https://mikrotik.com/product/chateau_5g
it is an AC device, it should use the wifi-qcom-ac package, not the wifi-qcom, which is for AX devices.
It is confusing, but read carefully:

https://help.mikrotik.com/docs/display/ROS/Packages

jaclaz

The article says: While the vulnerability was patched after its detection back in 2018, it’s still being exploited in compromised devices that do not use the patched RouterOS versions, or that use the default usernames and passwords. The last part of the sentence is "captain obvious" speak...

jaclaz

But, if I recall correctly, the 250,000 of Meris were connected to a router os bug/vulnerability, not to 250,000 compromised passwords.

jaclaz

This is strange.
A package like qcom should be installabile in any moment (i.e. also after the installation of the main routeros package).
Maybe you can try a new netinstall, making available both the routeros and qcom package.

jaclaz

But now, with the appropriate qcom package installed, the wifi is running, right?

jaclaz

Good

.
Yet another happy bunny in the basket

https://msfn.org/board/topic/128727-can ... ent=828512

You are welcome.

jaclaz

You probably got the wrong package, Mikrotik has a strange way to name them Ax=wifi-qcom https://help.mikrotik.com/docs/display/ROS/Packages wifi-qcom (arm, arm64) Mandatory driver package for 802.11ax interfaces. Introduced in 7.13. Wifi CAPsMAN support comes with the system package. Wireless is fo...

jaclaz

The hex s should be very low power (6 W without attachments): https://mikrotik.com/product/hex_s which would be 0.25A@24V or less than half what the RB3011: https://mikrotik.com/product/RB3011UiAS-RM should be capable of providing (0.60A@24V). Which exact model is the WiFI AP that doesn't work? Is i...

jaclaz

So, you have the (dynamic) routes alright. It should work, unless there is something else in firewall (or somewhere else) blocking the connection. As mentioned in the linked to thread/post by mkx. You can try disabling (temporarily) all the firewall rules. But which devices are at IP's 192.168.0.30 ...

jaclaz

"Having a look" does not mean "base design on" nor "here, Mikrotik, take my money and give me one of those". The OP has seemingly not the *need* to replace his currently working (even if not optimally) setup, and since that device does not exist (yet) and there isn't ev...

jaclaz

But given the situation, as I am closer to 60 than 50, I am pulling my hair regarding these stickers that probably are designed by some 18 year old. No way I can read them without strong light and a magnifying glass. The good news :) are that at nearly 60 you still have hairs to pull. The bad news ...

jaclaz

Don you think that HGO antenna's will help to focus the signal in the way I need with a proper orientation (probably the classic 45°)? That has to be seen. The HGO cannot be oriented, it is "straight". You will need a similar antenna, but with the possibility to be set at some angles, or ...

jaclaz

Let's divide the thing in two: 1) succeed in pinging from one network to the other (and viceversa) 2) limit communications to between only two devices, one on each network Your scheme and description is about ether4 (192.168.0.x) and ether5 (192.168.10.x). The snippet of configuration you posted is ...

jaclaz

Follow the instructions here:
viewtopic.php?t=203686#p1051720
and post your configuration.

jaclaz

There is a procedure (lights/flickering/timing/etc. may vary a little bit with models) detailed here: https://help.mikrotik.com/docs/display/ROS/Reset+Button Depending on the date the device was manufactured once the device is reset the credentials will be either: older devices: user:admin password:...

jaclaz

But am I correct in assuming that we should have connected the router to a laptop/pc with ethernet then enter the config page to enable WiFi? As you say, it is an assumption. Obviously how a device will behave depends on its configuration. In the case of a brand-new, still in the box, device, its b...

jaclaz

The answer is, yes it supports a PoE cameras on the eth2 but both PoE (router input and camera input) should be AT mode, AF mode is not supported. So be sure all 4 pairs of cable are connected Excuse me, can you clarify? 802.3at is a sort of superset of 802.3af (in the sense that a 802.3at PSE can ...

jaclaz

I think the world is divided between those that report how they self-locked themselves out of a Mikrotik quite a few times when experimenting/learning and those that don't. The latter ones are liars :wink: . On a device like the RB2011 where number of ports should not be a problem, a good idea is to...

jaclaz

SInce you have no wireless requirements, you can go "virtual" and use GNS3 with CHR, it is very handy to make tests and understand the syntax of ROS and also experiment with "crazy" setups, even if once you have a configuration working it needs to be tested on the real device/net...

jaclaz

Cannot sat specifically about the ac2, but newish Mikrotik routers come with a user admin and a "random" password preset. The password is (un-[1]) readable both on a sticker on the device and on a label attached to the instructions. AFAIK the reset should get back to those values. [1] prin...

jaclaz

It's not like there are many devices with the requested features:
1. Ax
2. Dual band 2.4 and 5 GHz
3. Omnidirectional or however neithet sector nor directional

In practice only the netmetal ax:

https://mikrotik.com/product/netmetal_ax
(+ HGO antennas)

jaclaz

https://i.chzbgr.com/full/6623623680/hB259C047/what-has-been-seen-cannot-be-unseen Wayback Machine to the rescue 8) : The 908118 is the post number, the thread is 182601: http://web.archive.org/web/20230524024549/https://forum.mikrotik.com/viewtopic.php?t=182601 http://web.archive.org/web/202401150...

jaclaz

Just in case anyone is looking for a quick way to get divorced

:
https://it.aliexpress.com/item/1005007207725543.html

jaclaz

I find this very perplexing, I cannot believe that the good Mikrotik guys are intentionally lying, reporting in changelog a new feature that doesn't actually exist/work and even (as always mis-) document it on the help page. I don't know if anyone has filed a ticket at support, but I think you shoul...

jaclaz

ip scan?

https://help.mikrotik.com/docs/display/ROS/IP+Scan

arp table may not contain all devices connected AFAICT.

jaclaz

Which confirms that the tests with interface= work, while any with the src-address= fail. Someone more expert may be able to explain WHY this happens. In any case the "interface=" should be intended as "out-interface=" (or at least this explains nicely why interface=bridge does n...

jaclaz

Nothing important, but since you have ether1 added to the bridge, the default DHCP client on it is invalid, you should disable it to avoid the red message:

/ip dhcp-client
# DHCP client can not run on slave or passthrough interface!
add comment=defconf interface=ether1

jaclaz

You should freddle the gruntbug, or maybe try foonting the turlingdromes.

Or - possibly better - follow the instructions here:
viewtopic.php?t=203686#p1051720
and post your complete configuration and a description of your network topology and of the issue you are having.

jaclaz

The laptop is running windows 11. Which may be (or not) part of the problem. For *some reasons* netinstall can be finnicky, there are mainly two issues: 1) *whatever* running on the laptop 2) timing problem The #2 can usually be solved putting a dumb switch between the laptop and the device, #1 is ...

jaclaz

See here:
viewtopic.php?t=153582

jaclaz

Something like what is discussed here?
viewtopic.php?t=114153

jaclaz

Proof?:

https://www.reddit.com/r/mikrotik/comme ... _but_isnt/

https://www.reddit.com/r/mikrotik/comme ... s_in_a_10/

https://imgur.com/a/rb5009-10-rack-ears-hNUuCqo

jaclaz

There are two (actually three) CAPSMANs. All of them are called CAPSMAN, in order to easily understand the differences among them. The first one is not used anymore, forget about it. Two remain. One is called sometimes "CAPSMAN", "OLD CAPSMAN" "CAPSMAN v1", "legacy...

jaclaz

@jonglauser I am losing you. If you have a configuration that is working when set the first time and upon reboot (provided that the configuration is not "lost" anymore) it doesn't work anymore, it means that a part of the configuration does not take immediate effect until a reboot is made ...

jaclaz

If you were asked the exact same question, what would you say?

I don't know, try asking on the Mikrotik forum.

jaclaz

Good, now try adding an IP address to the bridge, let's say 192.168.88.10/24. Then try connecting the PC to one of the other ports of the device, (you will need to set your PC connection to VLAN 10 I believe). Anyway experiment on which ports and with which VLAN id you can connect. Once you have suc...

jaclaz

You don't have any firewall filter rules, so it cannot be that blocking your connection. Remove ether5 also from: /interface bridge vlan add bridge=bridge1 tagged=ether2,ether3,ether4,ether5 vlan-ids=2 add bridge=bridge1 untagged=ether2,ether3,ether4,ether5 vlan-ids=10 add bridge=bridge1 tagged=ethe...

jaclaz

It is not like you started from fresh and only added a VRF configuration, the configuration you posted has (among other things) a wireguard connection, a macvlan, a number of src-nat and dst-nat settings, custom firewall rules and there are clear signs of having been configured and re-configured sev...

jaclaz

It is not that (for whatever reason) you have enabled "safe mode"? (accidental pressing of F4 or similar?) https://help.mikrotik.com/docs/display/ROS/Configuration+Management#ConfigurationManagement-SafeMode It is also possible that some of the changes you make appear to be working, but wh...

jaclaz

The problem is that it starts with 10.0.8.0, it won't allocate addresses up to 10.0.13.254 if the network is /22. What I need is to have addresses from 10.0.10.2 to 10.0.13.254. You cannot. Check here: https://www.calculator.net/ip-subnet-calculator.html?cclass=any&csubnet=22&cip=10.0.10.1&...

jaclaz

Yes. The issue (or non issue) is that usually (cannot say specifically the 1100, but I see no reason why it should be different) Mikrotik devices *like* higher voltage, i.e. when connected on different connectors with (say) 24V and 48V they will draw power from the 48V one. Since the internal (dual)...

jaclaz

Search on the forum for "SA Query timeout" there are a few threads reporting similar symptoms, and various settings to try, though AFAIK not a definite explanation and remedy.

jaclaz

This is MikroTik forum, you can not advertise other competitor brands. If you want provide a solution, must still inside MikroTik products. You mean like hinting on an Alfa Romeo forum that a given BMW model drives better? It might be frown upon by other members but I doubt that it is against the f...

jaclaz

The masquerading seems to work OK... I am not sure to follow you, actually I am pretty sure I am not following you. I meant what happens in the log when running specifically the commands: /ping 8.8.8.8 vrf=vrf_starlink /ping 8.8.8.8 vrf=vrf_orange /ping 8.8.8.8 vrf=main /ping 8.8.8.8 src-address=19...

jaclaz

If you think I can change anything from this configuration, please let me know... Well, if you provide your actual configuration (no, "it is the same as the one in this video" doesn't count) surely some experienced members will have a look at it. Follow the instructions here: https://foru...

jaclaz

You should install a "lightning arrestor" and ground that one(s) (besides the pole - if any).
Example only:
https://www.l-com.com/rf-surge-protecto ... -m-dc-6ghz

And yes, ground is ground, so you can (actually should) mount on the same steel.

jaclaz

I understand, but if I import block by block, won't I just bring the problem back again? Can't the exported file be cleaned up somehow? I currently have a solution to the problem that is relatively quick, but going through all the steps you mentioned seems like it will take a lot of time. No, the p...

jaclaz

Well, if it comes on a VLAN (and this would be among the data your ISP gave you for connection) you need to "translate" it in the Mikrotik, assigning the WAN (usually ether1) port the appropriate vlan-id, *like*: https://forum.mikrotik.com/viewtopic.php?t=205934#p1064214 Depending on the s...

jaclaz

It greatly depends on cable. Ordinary cables may loose 1-4db/m :shock: A good, very low attenuation, antenna extension cable could be in the order of magnitude of 0.3/0.4/0.5 db/m (at 2.4 GHz, expect 50% more on 5 GHz). These - generally speaking - are more stiff, and have issues if bent too "t...

jaclaz

I see

, you are right on the convenience border between using or not using capsman:
viewtopic.php?t=204733#p1057385

jaclaz

You have a DHCP client on ether1 that cannot work because ether1 is part of (slave to) the bridge. Ros is trying to tell you that. The one on bridge is running, you should know whether you have *need* for the devices to use it or not. Very likely not, as the two devices should form a sort of "w...

jaclaz

Let's quote it: Route Selection There can be multiple routes with the same destination received from various routing protocols and from static configurations but only one (best) destination can be used for packet forwarding. To determine the best path, RIB runs a Route Selection algorithm that picks...

jaclaz

Maybe is the one obtained by DHCP client on ether1 (or ether2) in the 192.168.1.0 range (i.e. the one "nearest" to the gateway). I am not sure to follow you on why you are using two DHCP clients (that must be in the same network range of 192.168.1.0 as the two servers). Isn't there a risk ...

jaclaz

No idea, but are you using CAP/CAPSMAN for a single access point?

jaclaz

Side notes: Why is hardware offload disabled on ether1 of the "transmitter"? /interface bridge port add bridge=bridge1 interface=wlan2 add bridge=bridge1 hw=no interface=ether1 add bridge=bridge1 interface=wlan1 Try setting it hw=yes. You have a DHCP server attempting to run on a slave int...

jaclaz

Antenna gain dBi for 2.4 GHz 12 ... Antenna gain dBi for 5 GHz 15 So, not really. But low reception at 50 meters is definitely not normal, the mantbox Ax 15 s is (should be) capable of km links. A couple of (good?) questions are: 1) what does your friend mean by "low" reception? 2) and wh...

jaclaz

If you take (temporarily) the Hex out of the equation and you connect a PC to one of the two ISP devices do you have internet or not? Most ISP dsl devices are not modems [1], they are modem/routers. A good hint Is the number of ports they have, a modem usually has two ports, a modem/router usually h...

jaclaz

Here:
https://mikrotik.com/support

jaclaz

My best solution, at least so far, is to downgrade the routers back to RouterOS 6 Yep, I would actually reverse the prospective: why did you upgrade (now) to 7.14.1? If you have some setup working nicely why do you want to risk an issue with it (unless version 7.xx offers some new feature that you ...

jaclaz

Well, you are mixing the upnpc versions, try using ONLY the latest 2.27. This way results would be comparable. Run: upnpc -l on both the 7 and 6 devices. Then upnpc -u http://192.168.88.1:2828/gateway_description.xml -l on the 7 and upnpc -u http://192.168.88.1:2828/gateway.xml -l on the 6. The issu...

jaclaz

Yes, I saw that thread, but I wasn't able to find any useful hints on how to solve it. That one seemingly solved by itself, upnpc couldn't find the device but upnp did work on the OP network. Sort of what is reported here: https://superuser.com/questions/873998/miniupnp-thinks-my-router-doesnt-supp...

jaclaz

There is at least another case where upnpc had troubles with detecting the UPNP: https://forum.mikrotik.com/viewtopic.php?t=201510 but actual devices were actually working. You seem to be running an older version: (c) 2005-2019 Thomas Bernard. than the OP in the other thread: (c) 2005-2022 Thomas Be...

jaclaz

Reviews are a dime a dozen, authoritative ones are somewhat harder to find. Following is a definitely non-authoritative one, for what it is worth. Are the mikrotk access point so good or not ? It depends. :shock: Do you want to spend sleepless nights studying and experimenting because you believe (w...

jaclaz

More than "controller", the posted example seems like a (good looking) "dashboard".
https://en.wikipedia.org/wiki/Dashboard_(computing)

jaclaz

Thanks everyone for the suggestions. My question was simply to get clean output without printing the prompt, just like the "@echo off" statement in Windows cmd. The @echo off command in a batch does not suppress prompt , it suppresses echoing the following commands (including the prompt),...

jaclaz

The basic issue is that the good Mikrotik guys like to call "stable" something that is usually very unlike it, It is more like a "feature freeze" release, but from that to have a "stable" in the sense of "reliable" OS, there is a long way. Ideally you should h...

jaclaz

The netinstall procedure is a bit finnicky, but doable, if using a recent Windows there may be settings on firewall or in some other program that need to be changed, using netinstall from Linux is said to be more reliable, but reports vary, it also depends on which RoS version/netinstall version you...

Search found 1380 matches