MikroTik

jaclaz

... but that doesn't allow me to connect via winbox to then import the script. I'm sure I'm doing something lame since no one else seems to have encounter this issue. Maybe you are just using the "wrong" method? Winbox can connect to IP (that don't exist after a reset) or to MAC (that doe...

jaclaz

Flat !Round.
28 AWG !23 AWG.

https://www.fs.com/blog/flat-or-round-c ... -4537.html

https://www.cablexpress.com/blog/cat6-c ... -deal-awg/

jaclaz

Even if not damaged "flat", "cat6e" and "30 meters" rarely can work at 10 Gb, personally I wouldn't use the 28 AWG ones for more than 15-20 meters, maybe the 32 AWG for 30 m. If I recall correctly good manufacturers give max 60 or 65 m for those and the rule of thumb to...

jaclaz

Only for the record (and it depends on country/local regulations) there are ethernet cables certified to be installed in the same conduit as mains/current ones. And fiber is also a possibility (the real issue with fiber is too tight curves and the termination, otherwise a fiber can pass almost anywh...

jaclaz

Still, if the ports are set to 10 Gb it should show "no link" (and not "running" status), this kind of "almost connected" (interface running, but not a real communication on it) seems like a tricky issue. In the (good?) ol' times there was a monthly column on Byte by Je...

jaclaz

And the Hex refresh is roughly double of that, 498.1: https://mikrotik.com/product/hex_2024#fndtn-testresults still half the speed you want/need. You need either (looking ahead) a RB5009 at around 3 Gb, $219: https://mikrotik.com/product/rb5009ug_s_in#fndtn-testresults or a hap Ax3 (as router), 1145...

jaclaz

Check also here: https://forum.mikrotik.com/viewtopic.php?t=212240 You can have both old and new capsman running on the Ax3, but you will lose its radios. Besides the fun of experimenting there are different opinions among the more expert members on the board on the utility/convenience of using caps...

jaclaz

The status of "searching" means that the DHCP server is not found. Otherwise it would be "bound", and you would see the assigned IP. Better leave quick set alone. You can add manually an IP address to the bridge to see if pinging to 192.168.1.1 works, let's say 192.168.1.9/24. Bu...

jaclaz

I have the same problem, but I can't solve it as suggested. Downgrading also not helping. Is there any help on this?

Well, maybe it is not the same problem.

Post your configuration, following these instructions:
viewtopic.php?t=203686#p1051720

jaclaz

It remains "strange", even if it happens only on some particular versions the Ax2 is a common device and 7.15.2 is old enough that should have already been some reports.
The good news are that 7.14.3 seems like a very stable version for wi-fi issues.

jaclaz

No idea if it can be "ported" to your devices, but the "wireless wire" (Cube Pro's) have the 60 and 5 ghz in bonding and the settings don't seem that much complex, but it is for failover:

viewtopic.php?t=205042#p1059476

jaclaz

Well, the "dumb" bridge should have an IP (L3) assigned to be able to ping a destination. A "dumb" bridge is L2 and knows nothing of L3, while not becoming "smart"; it will become a "disadvantaged" switch if you give it a L3 address. Once an address is assigne...

jaclaz

Maybe going again through the factory version did reset *something* that was mis-ported during one of the past updates.

jaclaz

Winbox BOTH by MAC and IP? I would try assigning manually a MAC to the bridge, maybe it is unrelated, still it won't make any harm: https://forum.mikrotik.com/viewtopic.php?t=190747 Another thing to try is to put a (dumb) switch between your PC and the AX2, it is one of those mysterious things that ...

jaclaz

Your crs304-4xg-in is defective :shock: it has two ether4 ports :wink: :lol: Now, seriously, how are you managing the Mikrotik? (I presume with Winbox via MAC). A good idea is (unless you really-really need it) is to keep a port outside the bridge, for emergency access (it is not a problem in a &quo...

jaclaz

It seems to me like the second approach is easier as it is more similar to usual failover. Though usually failover is done enabling and disabling routes, not enabling and disabling interfaces. Post your current configuration, following these instructions: https://forum.mikrotik.com/viewtopic.php?t=2...

jaclaz

Yep, and by choosing Mikrotik there is the added value of saving on an optician test: you need reading glasses.

jaclaz

Not generally, no. I run all my sites at or above 48V and all the MikroTik gear seems to be just fine. Yep, but other Mikrotik gear "stamped" with (presumed) 802.3af/at compliance have usually voltage range 12-57 (example https://mikrotik.com/product/wap_60g ) or 18-57 V (example https://...

jaclaz

Details are not scarce, they are not existing. That routers with credentials admin/blank (or admin/admin and similar) can be easily accessed (or bruteforced for simple, common passwords) is not "news", and the referenced CVE (from 2023) is founded on the same basic issue, from its descript...

jaclaz

I don't understand.
Can you draw a schematic of how this relay is connected?
In any case the scheduler script can be made to check the current status and act depending on that.

jaclaz

IMHO, correct or incorrect is in the eye of the beholder. Your AP now behaves as bridge for the "normal" wi-fi and as router for the "guest" wi-fi, If you prefer you have double (or triple, depending on what is your connection to the ISP) NAT on the guest "wi-fi". This ...

jaclaz

Yep, how can the 10.10.10.x devices connect to the gateway at 192.168.88.1?

Do you want to route that connection?

jaclaz

You seem to have the gateway set to "self" (10.10.10.1).
If the router has a dhcp server enabled (as it normally should) there might be additionally a conflict with the dhcp addresses.

Post the output of these commands (on the AP):

/ip address print

and:

/ip route print

jaclaz

Re-thinking about it, I believe you can also attempt "brute-forcing" the values. It is not like there are tens or hundreds of possibilities, the single oob record cannot logically be smaller than 8 bytes, and more likely is either 16 or 32 bytes (i don't think that odd values or non multip...

jaclaz

Neither can I, but again, with a hex viewer and a little patience it should be easy to identify the oob, see here another example:
https://redballoonsecurity.com/flash-dump/

jaclaz

For anyone interested I've used this configuration on the AP https://www.youtube.com/watch?v=6P0MDlYWR_E

Maybe or maybe not

(mistakes and typos happen).
It would be better/easier if you post your current configuration of the AP.

jaclaz

Allow me to disagree. What would be the problem in having the update process actually checking that there is enough space (+ a reasonable amount of "slack") and simply plain refusing to go on? With a message *like*: The pre-update check determined that this device has x.xx Kbytes free, a m...

jaclaz

Nice find. :) The related blog post: https://www.j-michel.org/blog/2014/05/27/from-nand-chip-to-files explains in detail how the oob/spare data works :) , and on the main page: https://github.com/Hitsxx/NandTool/tree/master it is clear that you can use oob and page size instead of chip ID (as it see...

jaclaz

You can add a script in scheduler, it has an option to run at startup (and interval must be 0), see:

https://help.mikrotik.com/docs/spaces/R ... /Scheduler

jaclaz

I would start from this post by pcunite (the same author of the main VLAN related tutorial on the forum: https://forum.mikrotik.com/viewtopic.php?t=143620 ): https://forum.mikrotik.com/viewtopic.php?t=141279 It seems like your setup is similar to that one, the difference is only that you have a seco...

jaclaz

The RB2011 is a "special" device that has two switch chips: https://help.mikrotik.com/docs/spaces/ROS/pages/15302988/Switch+Chip+Features Atheros8327 (ether1-ether5+sfp1); Atheros8227 (ether6-ether10) The "modern" way to do what you want to accomplish (good on *any* Mikrotik hard...

jaclaz

I think unsquash Is very "strict" and expects a "sound" filesystem and throws a fit even if minor issues are found. I cannot remember if a tool for recovery/fix exists, something *like* dmde which Is excellent for other filesystems. 7-zip should be capable of reading a squashfs a...

jaclaz

Yep, also a degree in electronics with a master in networking might help, but come on, it is a home network, if the requirements are not absurd it should be possible to fulfill them in a relatively simple way. The concepts in themselves are not that difficult (Mikrotik specific implementation might)...

jaclaz

The same address on ether1 and on the bridge containing it is "wrong", whether it is part of the issue or not, only the bridge should have an IP address. It is not sent in unicast mode and it is sent as broadcast? Sent by which device? The CCR, right? So there are two possibilities: 1) the...

jaclaz

I am not sure to understand the setup with ether1 part of the bridge (actually I am pretty sure I don't understand it), but maybe using the interface instead of the interface list?:
add action=drop chain=forward comment="drop all coming from ether1" in-interface=ether1

jaclaz

Happy you solved it

.

jaclaz

So, you have a chain *like*: Mikrotik CCR <- running centralized DHCP server Cisco 2960 #1 Cisco 2960 #2 Mikrotik AP If the same Mikrotik AP moved to another building (with a similar chain of devices) works, it must mean that *something* is different in another device, either the CCR settings/config...

jaclaz

I don't think that the issue is related to the macintosh vs. windows or linux. Check that the MAC on the label is the same as in the paper leaflet and the same one as the MAC you get in Winbox, while it is possible that a device has been exchanged during manufacturing/packaging, it is - I believe - ...

jaclaz

Post what you get for: /ip address print and /ip route print I would try anyway to change this: /interface detect-internet set detect-interface-list=all internet-interface-list=all lan-interface-list=\ all wan-interface-list=all to: /interface detect-internet set detect-interface-list=none internet-...

jaclaz

I think the thread, and the threads referenced therein, do not point to an MT device that is definetly compatible with Verizon Wireless in the USA.

Exactly.
It seems like such device does not exist (yet) in the Mikrotik product range.

jaclaz

Maybe this thread:
viewtopic.php?p=1082937
can give you some ideas.

jaclaz

Only for the record: Firewall rules are not created automatically. They are present in the default configuration for so-called SOHO Mikrotik devices, that typically have: 1 ) all ports BUT ether1 in bridge 2 ) ether1 as WAN 3 ) bridge as LAN 4 ) default firewall filter rules 5 ) dhcp client on ether...

jaclaz

Yup. Product page says Unit has 12-57V PoE with 802.3af/at support ( with unshielded cross cable ) (emphasis is mine) In addition to emphasis, can you also translate from Mikrotikish? What (the heck) is a cross cable? Does it mean cross over ? But in crossover cables the 4,5,7,8 used for PoE remain...

jaclaz

So you agree, that if an IT person for a university is going to use MT product ... You talkin' to me? :?: I don't know/cannot say, I am non-IT and non-university, and just a beginner level user of MT products, I am only commenting on what I see (and on the little I can understand of it) of the post...

jaclaz

Compare with the list here: https://help.mikrotik.com/docs/spaces/ROS/pages/13500447/Peripherals some of them are only supported if they have a certain firmware revision or USB vid/pid or will only work on v7 and not v6. HUAWEI E3372h-153 -> should work? HUAWEI E3372h-320 -> v7 only HUAWEI E352S-5 -...

jaclaz

I am perplexed :? (but what do I know?) Both ether1 (classified as WAN) and bridge (classified as LAN) have the same static IP address of 172.18.224.5/22, AND ether1 is member of bridge, AND it is the only flagged trusted interface, AND dhcp snooping is on, AND there is a static route with gateway. ...

jaclaz

I think we are getting into a sort of circular reasoning. There are two theories right now: 1) the CHR image at first boot gets somehow "personalized" to the (virtual or real) hardware it is booted on, and from second boot it will only work on exactly same or very similar (virtual or real)...

jaclaz

You mean the R B TFC11: https://mikrotik.com/product/RBFTC11 ? By default it comes with an injector that is this one: https://mikrotik.com/product/RBGPOE That definitely uses mode B (4,5+/7,8-). In theory a 802.3af/at compliant PD should accept both Mode A and mode B (it is the PSE that decides on w...

jaclaz

Maybe you need:
add address=192.168.10.3/32 list=FOR-WAN1
?

jaclaz

Well, there may be some confusion in terminology. A bridge is an interface that contains interface(s), i.e. you don't assign a bridge to an interface, you add the interface(s) to the bridge. You can then strip the interface from the bridge, not viceversa. If you prefer an interface (like ether1 for ...

jaclaz

Aside from updating, what can be done to prevent someone from making such forensic bit-by-bit images and make sure there is plenty of variance? You can update as much as you want, if the hypothetical hacker interested in the secrets you store on your router has physical access to the device for eno...

jaclaz

When you say the main table - are you talking about the firewall table then? No. It Is the table you printed, containing routes. By default on Mikrotik there Is only one routing table, called "main". But more tables can be added. All traffic will use this main table, unless explicit modif...

jaclaz

Sorry to be the bearer of bad news, but (IMHO) you won't get very far with GUI only tools, the Mikrotik configuration settings are already at the same time scattered all over the place and mixed up together that without some use of terminal/command line they are impossible or near to impossible to u...

jaclaz

Beginners dont normally need more than 50 addresses ....

Beginners (with lots of friends) throwing parties like there is no tomorrow?

jaclaz

But is the issue generated by the DHCP server or by the last element in the chain (the Mikrotik Ap's) or somewhere in between? Which device acts as DHCP server? I would try connecting to one of its ports a dumb switch and see if a device attached to this dumb switch gets an IP and does so in a timel...

jaclaz

The things rplant suggested are firewall (raw) rules (in prerouting I believe), not routing rules (policy routing).

https://help.mikrotik.com/docs/spaces/R ... 6/Firewall

jaclaz

.... but you will need to post a full (anonymized) /export, otherwise it will be difficult for willing helping members to guess your (say) mangle rules or in any case, holistically evaluate your configuration.

jaclaz

github.com/ayufan-research/mikrotik-qemu-arm64 yep, but we are back that what you do at home may (or may not) work on the cloud: 4. use it as a reference image/configuration to deploy in the wild. As explained above, using a reference image is exactly what you can not do with a CHR, because the fir...

jaclaz

sxt lte mgmt vlan ether 1 -> rb5009 ether3 vlan 200 mgmt (added to bridge-LAN) sxt lte passthrough ether 1 -> rb5009 ether 3 WAN_LTE What you describe doesn't seem to match with your config: /interface vlan add interface=bridge-LAN name=VLAN_10_LAN vlan-id=10 add interface=bridge-LAN name=VLAN_20_K...

jaclaz

1. run it in your local environment

oh, oh:

@jaclaz: even if that was possible, how would you do it for architecture you don't have at home (e.g. ampere)?

jaclaz

So, the only "defense" is what rextended suggested for the other case where default config (reset) might get online (LTE devices where you don't want or cannot remove SIM)? but in that case there are some 20-30 seconds of time before the SIM registers to the network: https://forum.mikrotik...

jaclaz

On the cAP: /interface list add comment=defconf name=WAN add comment=defconf name=LAN this sets two categories. WAN and LAN (if you prefer outside and inside, dangerous and safe). But then you have: /interface list member add comment=defconf interface=bridge list=LAN add comment=defconf interface=et...

jaclaz

@sindy Not even: 1) download a "clean" CHR image from Mikrotik 2) mount/run it locally (VM) 3) change admin user and set a "strong" password 4) upload to cloud 5) configure online ? :shock: I did know that the "s" in "cloud" is the same as the one in "iot...

jaclaz

Out of curiosity, did you brick all four of them? If a "plain" reset does not work, you can try netinstall, but since the latter is often tricky to setup (PC network card/firewall, sometimes need of a dumb switch between PC and router, etc), it would help to simulate it on a surely working...

jaclaz

Get a mikrotik, create those bridges and then place a device (or two) that has two ethernet interfaces behind one enslaved port of bridgeA and another of an enslaved port of bridgeB. Sure, and introduce by mistake 2 to 34 of the possible 4587 differences between your configuration and the recreated...

jaclaz

Whereas most cloud providers allow to install your own disk image, the first start of the CHR image downloaded from the Mikrotik site includes some initialization, so installing the CHR on your virtualization platform at home, setting up some basic firewall rules or even a VPN, and then installing ...

jaclaz

Semi-random thought, but do you really need a "multidot" filename? I know that the (good ol') '90's are long gone, but (still good ol') 8.3 filename can some times help. Only for the record, in the (again good ol') days of BartPe, XP USB booting, etc. it was a common saying "oh noes, ...

jaclaz

A device that Is intended for links up to 1500 m or more cannot be very good at short distances, generally speaking. I like to imagine that the two devices, which have very good hearing, are shouting at each other at the top of their lungs. At 20 meters alignment Is a non-issue, you turn the device ...

jaclaz

There is some confusion in your configuration. You should start by using the "normal" default firewall settings, but first fix the following otherwise your ether8 won't have correct access: /interface list add name=WAN add name=LAN /interface list member add interface="sfpplus1-(INTER...

jaclaz

The gdisk analysis of that image is fine, (no problems found). It is a MBR/GPT hybrid, the data in both the partition tables is correct. The first partition is (correctly for UEFI booting) a FAT filesystem. All sizes are ALREADY megabyte aligned BUT there is something strange (at least on my Windows...

jaclaz

So It Is what rextended posted : Put a switch on the WAN and attach the gateway WANs to it ... If we can abstract for a moment from the fact that having more than one bridge on a single Mikrotik device Is usually not advised, you could have: bridgeWAN with ether1 and ether2 in it and bridgeLAN with ...

jaclaz

No idea on the peculiarities (if any) of ARM architecture, but on x86/x64 there Is no differences whatsoever among the various interfaces/buses (like ide/sata/scsi). There are two partitioning styles, i.e. MBR and GPT, and that's It. Then there Is the issue (for UEFI) of the accessibility of the fir...

jaclaz

I believe that it Is possible to (ab-) use the hotspot/captive portal features. Particularly if - as in your case - you can redirect to a specific url and if the Mikrotik device isn't the gateway (or Is It?). I was thinking of something similar a few day ago, but in my intended case the issue Is con...

jaclaz

If it's normal, can someone give me a hand and create a script that pings from rb5009 to crs318 and if fails disable / enable sfp interface... Personally I don't think it is normal, but if the crs318 has an IP address, you could use netwatch for the check. https://help.mikrotik.com/docs/spaces/ROS/...

jaclaz

And I would add also where the cat6 sockets are located, if on the ceiling of a central room the wAP is not so suitable as it Is not omnidirectional and a cAP (or another manufacturers ceiling AP) would be more suitable. That Is if the floor plan Is roughly a square, if It Is long and narrow it's an...

jaclaz

The 951/mipsbe will work with wireguard on Ros 7.x, the issue is working around your apparent lack of a public address.

jaclaz

An ax-lite or hex refresh is 60 bucks or so, try converting that in minutes/hours/days :shock: (depending on where you are located) of engineer time, + minutes/hours/days of industrial machine production margin, usually (not always, but often enough) bosses are sensible to this way to present them t...

jaclaz

Wireguard?

https://help.mikrotik.com/docs/spaces/R ... /WireGuard

It should run just fine (with a low bandwidth, but surely you don't need speed) on your 951, updated to v7.x RoS:
viewtopic.php?t=197824

jaclaz

Hello, would you please provide an updated reference? "In that case you simply need this guidance - https://forum.mikrotik.com/viewtopic.php?t=182276", the link is not working Could you please provide a solution based on the attached config? Thank you Wayback Machine to the rescue: https:...

jaclaz

You can put together a script. As an example combining this: https://forum.mikrotik.com/viewtopic.php?t=198614 with this: https://forum.mikrotik.com/viewtopic.php?t=189253 Or - way easier if you are not into scripting, try splunk: https://forum.mikrotik.com/viewtopic.php?t=179960 you can have someth...

jaclaz

I don't understand how it can connect to your Wi-Fi access point as there is no station (or station-bridge or station-pseudobridge) mode set in /interface wireless and without wpa and wpa2-pre-shared-key (maybe these latter are not shown without the show sensitive, as in /export show-sensitive, but ...

jaclaz

Well,. at least we tried. Re-searching I found this thread https://forum.mikrotik.com/viewtopic.php?t=136510 where sindy was (as he always is) clear: https://forum.mikrotik.com/viewtopic.php?t=136510#p672515 So I re-asked an already asked and replied to question, my bad. :oops: It remains (IMHO) a p...

jaclaz

Yep, but this would assume that the LAN is all DHCP clients (which isn't right now) but even if I changed it to becoming dynamic (possibly needing a few machines to have static assignments via MAC), I would need this "temporary replacement device" to replicate the same DHCP server settings...

jaclaz

For *some reasons* the US site specification page: https://www.tp-link.com/us/business-networking/omada-sdn-access-point/omada-eap770/#specifications does not show power requirements. The Italian site does: https://www.tp-link.com/it/business-networking/omada-wifi-wifi7/eap770/ EU: 24.05 W (802.3bt,...

jaclaz

Or even older foot messengers ...

jaclaz

All employees have a cell phone...... Send mass text message - internet out restoration time est XX:XX Hrs. I see from your reply how you have a vast experience of (graciously) managing personnel in activities that run 24/7 (please read shifts) and that your employees at home or in vacation simply ...

jaclaz

I understand now, you are proposing a "captive portal" that leads to nowhere, I was tricked by the word "hotspot" that I instinctively connected with "Wi-FI stuff", almost any tutorial/example I had seen was about the /ip hotspot assigned on wlan1, but of course it can ...

jaclaz

Yes, I had in mind a possible re-use for one old hap Lite I have around, but I have also a couple (still old) thin clients I am not using, so a minimal Linux with a web server would also be possible. But using hotspot would catch only wi-fi users, and anyway the half-lease time would be too long. An...

jaclaz

As the thread title says. Maybe it is a stupid question, and it is a non-problem, still I would be curious to know if something like this exists and/or there is some other "common practice" or similar thing. When you do a maintenance intervention on - say - elevators, you put a sign "...

jaclaz

Well, if we assume that the final desired result is: a. type the destination IP address in the browser without specifying port b. *somehow* connect the browser on a specific port of the specific destination IP address a dstnat port remapping seems like a possible solution, it should be something *li...

jaclaz

This topic:
viewtopic.php?t=185541

seems to me very similar, maybe you can get some ideas/approaches from that one.

jaclaz

Good. :) Now that you have the general idea/basic setup working, you should check the post by Sindy right after that: https://forum.mikrotik.com/viewtopic.php?p=1110759#p1111163 as his version is more elegant, and compare with the "final" version on the other already mentioned thread: http...

jaclaz

Naah, the Planet one Is generally available, but It Is not cheap, example:
https://www.digitx.it/codice/c-poe_e201 ... od-115326/
70 €!
Of course if you are wasting investing the awful amount of money a Doorbird costs, It could be fine.

jaclaz

Doorbird is a strange Beast. It declares 802.3af Mode A, which Is against the specs, as 802.3af PD's should be compatibile with BOTH mode A and mode B. Anyway, the question is which specific devices we are talking of, both the Mikrotik and the Doorbird. If the interfaces are 10/100 It Is relatively ...

jaclaz

Well it gets to 172.20.10.1 (and stops there) . What is that address? Your network gateway? I don't really understand how it even gets there without a route (I was suspecting a ping error of "no route to host".). Anyway, post the output of: /ip address print and of /ip route print so that ...

jaclaz

Well, also the Teltonika RUTX12:
https://teltonika-networks.com/products/routers/rutx12
nice thingy, not exactly cheap.

jaclaz

Trying an alternate power supply won't be difficult anyway, the hex S accepts a wide range: DC jack input Voltage 12-57 V but also AC3 is pretty much flexible: DC jack input Voltage 12-28 V Personally I would still suspect the zener diodes, and as said they are easy to test with a tester/voltmeter.

jaclaz

I don't understand. The mAP lite has only one ethernet port, ether1. You want to connect your radio (wlan1) to an existing wi-fi network? Then the device is a "client" or "station" (and not an AP). And - it depends on choices - it can be configured both as "router" (wit...

jaclaz

UNfortunately the "timeout" in the ping could be due to anything along the connection, including the remote 74.208.xx.xx prevented from replying to ICMP requests (newish windows as an example have a firewall rule that prevents replying from pings coming from outside the local lan), but it ...

jaclaz

Good.

Though the "fault" is most probably in the client that attempts to login before having a "proper" DHCP address (or wait for a timeout), it is good to know that RouterOS can deal with that.

jaclaz

I presume that the XX.XX.XX.XX is not on the same network 10.8.0.0/24, right?
Can you ping successfully the XX.XX.XX.XX endpoint address from the router?
If not, which error do you get?

jaclaz

To be fair on the posted image, also Huawei claims the same.
It seems more likely that it is something lost in translation (or whatever) connected with amazon than originating from the manufacturers.

jaclaz

Bad, bad router? Or maybe - just maybe - there is the possibility that there could be something that needs to be changed in its configuration? If this latter could be the case, a good idea would be to post the current configuration for review (anonymizing the sensible data), instructions here: https...

jaclaz

I don't know.

Maybe you should recreate the exact configuration that creates the slowdown and post that one.

It is harder to read a configuration where something has been removed (or disabled) as you never know if it is missing or is a leftover from another attempt.

jaclaz

Well, that thread is from 2021, and it is about RouterOS 6.49.1. You are running 7.8 (which is in itself really old). Something may well have changed in the meantime. Even if you don't want to upgrade to latest-latest (that would be 7.16.2) you should IMHO at least upgrade to 7.12.1 (to which you ha...

jaclaz

Try to add the policy policy :shock: I.e.: policy=read,write,test,policy Not that I recommend it, but the primitive method I use when testing scripts is giving them all possible permissions, then remove them one by one until it stops working: https://forum.mikrotik.com/viewtopic.php?p=1050058&hi...

jaclaz

In 7 you need to explicitly add the routing tables and the routing-mark becomes routing-table in /ip route, as already hinted. Like: /routing table add fib name=via-ether2 add fib name=via-ether3 and then: /ip route add distance=1 dst-address=10.1.1.0/24 gateway=ether2 routing-table=via-ether2 in ma...

jaclaz

https://mikrotik.com/product/ltap_mini

jaclaz

Only for the record and JFYI, there is a way out for cases where the narrow route becomes invalid/inactive (for one reason or the other), which is to add a second narrow route as blackhole, but with a higher distance, is that your case?. See, as an example: https://forum.mikrotik.com/viewtopic.php?t...

jaclaz

I think you missed the word "just" in the subject, or misinterpreted that I want to keep things as simple as possible It was more a reply to your question: Can I just install SwitchOS instead of RouterOS? Let me rephrase the answer: No, that device can only run RoS and not SwitchOS. Other...

jaclaz

(besides nicer layout): I don't know :? , those 90° cable bends are ugly :shock: and they are not very good for the flow of data. 0's are usually OK, but 1's may get entangled in those sharp corners. :wink: (I know it's an old joke, but I cannot resist) :lol: Happy the whiole stuff is working. :)

jaclaz

Well, what do you think netwatch is supposed to do? :?: :wink: https://help.mikrotik.com/docs/spaces/ROS/pages/8323208/Netwatch Using the (newish) ICMP mode (as opposed to "simple" ping) it allows for "fine-tuning" the failover triggering, and it has a few other modes too, beside...

jaclaz

@Amm0 That is another aspect. :) But I don't know. :? Let's divide the matter in three: 1 ) what triggers the execution of a script (event) 2 ) what triggers the execution of a script (detection method) 3 ) what remedies we can implement (actions the script executes) The script could be triggered EI...

jaclaz

That is not true and topic is incorrectly marked as solved WHAT is not true? The help page: https://help.mikrotik.com/docs/spaces/ROS/pages/18350234/Cloud+Hosted+Router+CHR Free licenses There are several options to use and try CHR free of charge. free The free license level allows CHR to run indef...

jaclaz

thanks. I'm trying to power 2 Netgear WAX620 access points. The product data sheet says the device uses 25.5W. Seems like the 5009 will underpower them using the supplied barrel connector power supply? That is a beast of access point. :shock: And it is a strange beast, as the datasheet: https://www...

jaclaz

Well, the good news are that: Netzwerkschnittstelle 10Base-T/100Base-TX RJ45 LAN-Anschluss PoE (nur für PoE-Version) IEEE 802.3af (+ Pin 4 und 5 / - Pin 7 und 8) IF it is the PoE version, it uses Mode B, and the interface is 10/100. BUT there is an added issue. Something, to be 802.3af compatible, n...

jaclaz

Yes, this would make much more sense. :) ISP do sometimes have "strange" settings, but in the cases where some services are on tagged VLAN the VLAN number is not 1, it is only the way the Mikrotik "sees" the untagged traffic. @mkx So, it still boils down to "do not use VLAN1...

jaclaz

The CRS304-4XG-IN Is anyway NOT among the dual boot devices:

https://mikrotik.com/products/group/s ... oot%22]#!
So if you want to go down that road you need to choose another device model.

jaclaz

Your router(s), your choice.

jaclaz

Sure, but if you Power a 16 W device with 30 W (max of the 802.3at Power supply) you can expect to draw, total of the other 7 ports, 14 W or so. If you prefer a 802.3at Power supply can Power - chained - no more than 2 x 802.3af *like* devices, let's say the RB5009 and an AP connected to one of the ...

jaclaz

Nothing meant by it....We were surprised by the large number of use cases for our software for Starlink integrators. Ah, ok, you meant more like professional users than final customers, since starlinks are more likely installed in remote areas It makes perfect sense that a remote management solutio...

jaclaz

Neither. :shock: Each port can provide 440 mA: https://mikrotik.com/product/rb5009upr_s_in 0.44A*48V=21.12 W (typical voltage) 0.44A*57V=25.08 W (max voltage) 802.3af 15.40 W @PSE /12.95 W @PD (POE) 802.3at 30.00 W @PSE / 25.50 W @PD (POE+) The triple power input should be irrelevant, but only ether...

jaclaz

I don't see why BOTH approaches cannot be tested. In the script, if LTE cannot be found, try resetting USB. If after - say - 120 seconds the LTE still cannot be found, then, and only then, reboot the router. If It works, It works, and if It doesn't It goes through the full reboot. 120 seconds Is onl...

jaclaz

Yep, this is where I was not understanding.
Native VLAN doesn't necessarily mean VLAN1, do you mean that your ISP is using VLAN1 as "native"?
That would be the typical case of the gun pointed at your head.

jaclaz

Cannot it be quickly tested by replacing in the script

:log error "LTE1 interface does not exist. Rebooting router..."
/system reboot

with:

:log error "LTE1 interface does not exist. Rebooting USB..."
/system routerboard usb power-reset duration=10s

or similar?

jaclaz

Only out of curiosity:

Heck, even Starlink users love us for all the things.

Why the "heck, even"?
Are Starlink users a category apart?

jaclaz

#3 and #4, my bad, The point I was trying to make is that the VLAN1 is *somehow* used (at least in RouterOS) as the default VLAN for *something* and there is the risk that using it for *something else* might create conflicts. Maybe in SwOS it is different, and the (few) people that actually fully un...

jaclaz

Re: #4 Does your ISP provide the service over VLAN1 or in any other ways forces you to use it? I might have missed where you explained how you were forced - with a gun pointed at your head - to use VLAN1. The usual advice is to NOT use VLAN1, unless it is really-really needed because the consequence...

jaclaz

Why is AI needed to generate really poor configuration when the default config meets 95% of the use case?

To prove - once again - that AI is not (yet

) capable of doing anything good?

jaclaz

To further expand on the matter, splitters that take the 24V in and output the 12V for the camera do exist, BUT there is even another issue, Mikrotik (passive) PoE is "mode B", it has to be checked if the splitter is mode A or mode B: https://www.etherwan.com/support/faq/what-poe-power-pin...

jaclaz

A saved export Is enough normally, but a (binary) backup gives added security. They have different uses and different characteristics. The backup allows to "clone" a router, It Is "all or nothing". The export represents the exact configuration, but can be modified or used partial...

jaclaz

Well, I have just replaced in december (with a Mikrotik Ax Lite) a self-made router (a repurposed Fujitsu Siemens S200 running Zeroshell) that had been ticking 24/7 since 2012. The actual device was produced in 2004 or so, processor is Transmeta! I originally got one of these on the cheap (like 20 E...

jaclaz

So, is it working with the correct range settings?

I wasn't at all sure whether the mac-cookie login runs "before" the ip-binding block and thus by-passes it..

jaclaz

Well, the actual idea behind both recursive routing and netwatch checking is to use a "remote" (and likely reliable) DNS server (such as 8.8.8.8, 8.8.4.4.4, 9.9.9.9, 1.1.1.1, etc.) to check the connection to the internet by pinging it. This is done through a "narrow" additional r...

jaclaz

The Brume has also a "dedicated" setting called "drop in gateway": https://docs.gl-inet.com/router/en/4/interface_guide/drop-in_gateway/ From what I understand -besides the actual throughput in practice that would need to be tested - it requires disabling the DHCP of the "ma...

jaclaz

Only as a side note, it is refreshing to see someone that reasonably does not upgrade to latest-latest (your point #2) the "production" machines. Bravo! I understand how the forum is largely populated by people that like to experiment and tinker with Mikrotik newish releases, but often upg...

jaclaz

Semi-random idea, would setting ip-binding to something like:
/ ip hotspot ip-binding
add address=169.254.1.0-169.254.254.255 type=blocked
effectively prevent the APIPA addresses from logging in (via mac-cookie)?

jaclaz

It seemingly shaved some little time off, however.

Before it was
08:31.51->08:33:58=2 minutes 7 seconds

and now is:
06:03:52->06:05:55=2 minutes 3 seconds

Can the keepalive timeout be reduced?

jaclaz

So you need it as main firewall, right? I think you can *somehow* configure a Mikrotik as a bridge and set it to use the firewall rules on the bridge (set use-ip-firewall=yes), but I believe this implies the need to disable hardware offload and this could result in poor performance. The impact of ha...

jaclaz

I think you are describing what Is usually called "recursive routing". Check this post for more details: https://forum.mikrotik.com/viewtopic.php?t=157048 Once you confirm this Is the desired result, we'll talk of the details. If - more generally - you are looking for automatic failover th...

jaclaz

/interface bridge filter # in/out-bridge-port matcher not possible when interface (wlan1) is not slave add action=drop chain=forward in-interface=wlan1 # in/out-bridge-port matcher not possible when interface (wlan1) is not slave add action=drop chain=forward out-interface=wlan1 # no interface add ...

jaclaz

But what is the actual use of the Mikrotik? There are no problems in setting it as a (managed or "dumb") switch, but of course then it will behave like a switch, to all practical effects (besides having three LAN ports available) it would (should) be exactly the same if you bypass it and c...

jaclaz

A packet lost on a LTE connection (possibly through wifi) should not be a problem of actual connectivity. So your DNS is working (it can resolve google.com just fine) and you do have internet connection on both ethernet and wifi. Since you are using windows (I presume a recent one like 10) you shoul...

jaclaz

What anav just posted is a "complete" and "final" confiiguration, I believe it would be more useful, before studying and implementing that solution, to try understanding what is the issue right now, before introducing the complications of the complete setup, with VLAN's and what ...

jaclaz

You seemingly have a duplicate masquerade rule in /ip firewall nat (but that shoudln't be an issue. Post the output of: /ip address print and of /ip route print Try to be more precise when reporting a problem, "cannot access internet" may be due to several reasons, try /ping 8.8.8.8 what i...

jaclaz

Unless I am missing something, it should be possible even without VRF's, the "generic" case being "access multiple devices with same fixed IP address connected to different ports/interfaces". Here is a solved case for two devices (I don't see how it cannot be extended to more dev...

jaclaz

Cheapest wold probably be hap lite, but with only 16 Mb of storage (and 32 Mb RAM) you won't be able to run Ros 7 on it (or at least it won't be easy or working "right"). Nowadays I wouldn't buy (new) a device with less than 64 Mb or 128 Mb storage. Right now probably the best bang for the...

jaclaz

From what I understand what you are experiencing is a "side-effect" of a problem with your configurations. In the 86 and 87 you have (correctly) both ether1 and wlan60-1 added to the bridge: /interface bridge port add bridge=bridge comment=defconf ingress-filtering=no interface=ether1 \ in...

jaclaz

That solved it, I now understand both errors and how they happen and was able to upgrade the one networks wifi extenders and will do the others when next on site.

Thank you very much.

Good.

You are welcome of course.

jaclaz

Make those - say - VLAN10 and VLAN20.
And here ends all my knowledge on VLANs: DO NOT USE VLAN1.

jaclaz

Well, in this configuration: Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, d - DHCP; + - ECMP Columns: DST-ADDRESS, GATEWAY, DISTANCE DST-ADDRESS GATEWAY DISTANCE DAd+ 0.0.0.0/0 192.168.0.1 1 DAd+ 0.0.0.0/0 192.168.1.1 1 DAc+ 192.168.0.0/24 bridge1 0 DAc+ 192.168.0.0/24 bridge1 0 DAc+ 192.168.1.0/24 ...

jaclaz

https://blog.linitx.com/mikrotik-defaul ... lte18-kit/

jaclaz

You have BOTH a static IP address AND a DHCP client running on both bridges: /ip address add address=192.168.1.4/24 interface=bridge2 network=192.168.1.0 add address=192.168.0.4/24 interface=bridge1 network=192.168.0.0 /ip dhcp-client add interface=bridge1 add interface=bridge2 This may (or may not)...

jaclaz

I dont understand this nomenclature add address=10.87.2.28 /28 interface=MGMT_VLAN network=10.87.2. 16 I think the .16 should be .0 and the subnet mask is fine if you really only wanted 14 usable IP addresses!! if the .16 is changed to .0 the .28 will be outside the subnet. https://www.calculator.n...

jaclaz

Essentially the same advice Cat12 just provided a little more detailed: /interface bridge add name=bridge1 /interface list add name=WAN add name=LAN /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik OK. /interface bridge port add bridge=bridge1 interface=eth...

jaclaz

Nevermind, I was commenting on a temporary setup, later corrected.

jaclaz

At least they had the decency of NOT calling it "Mikrotik 365"

.

jaclaz

Yep, also according to a certain holvoeth

that measured it:
viewtopic.php?p=1091642
among the given links here:
viewtopic.php?p=1091642&hilit=rack#p1091642
there are actual pictures.

jaclaz

Well when you have a real network, I may be of assistance. Not going to chase fake GNS3 musings. There is no particular GNS3 musing, and certainly there is nothing fake. There is no need, if you cannot or don't want to provide assistance, to accuse me of faking anything. The GNS3 is only a represen...

jaclaz

There is only one Mikrotik device, the Ax lite, there Is no "main MT", the device in the drawing marked Temp-Mikrotik is only a way to have a switchable on/off device with the "right" 192.168.0.1 address as the "Cloud" device in GNS3 is always on (and has an ip address ...

jaclaz

a. no, all the addresses at play are in the 192.168.0.0/24 and 10.0.1.0/24 ranges. b. no, they are dumb switches. c. how would the Ax Lite as switch keep those separated? Possibly IF the switches were managed ones one could use somehow VLANs, but the only configurable device is the Mikrotik Ax Lite,...

jaclaz

I am working (in GNS3) on a possible setup. The "main" LAN is 192.168.0.0/24. The "child" LAN is 10.0.1.0/24. Internet connection is through a router/modem at 192.168.0.1 (gateway). The "main" LAN should only connect to the internet, exception made for a single PC (PC1-...

jaclaz

Or even before buying anything, you can get a CHR image and play with it. https://help.mikrotik.com/docs/spaces/ROS/pages/18350234/Cloud+Hosted+Router+CHR https://mikrotik.com/download (though no wifi capabilities) You can use that in a VM (like Virtualbox or VmWare) or - if you also want to test so...

jaclaz

If it can be adapted to your situation (and it seems to me it can), this: https://forum.mikrotik.com/viewtopic.php?t=198999 further simplified: https://forum.mikrotik.com/viewtopic.php?t=198999&hilit=simpler#p1102129 is IMHO the simplest method (using a simple Netwatch script that just enables a...

jaclaz

Ahh, good to know, thanks

, the trick is the "on error" , I didn't know that it actually allowed the prosecution of the loop in case of error.

jaclaz

Only as a side-side note, I remember that rextended advised to use a "remaining time" filter of 60 seconds to avoid invalid results when removing connections: https://forum.mikrotik.com/viewtopic.php?t=103812#p977354 though it is aimed to more complex setups with lots of existing connectio...

jaclaz

To the CRS106-1C-5S you would need to add the SFP modules, and besides budget considerations (5 modules at 25-30 US$ each are 125-150$), copper modules on a passively cooled device are not a good idea for the heat management. For that kind of money you could get a "real" 24 port switch: ht...

jaclaz

Well, it is not like - besides the name change - the help pages are any better than the wiki (actually they are largely the same, when different, in very few cases are better, in most they are worse). They rarely provide actual instructions, in most cases they are little more than a quick reference ...

jaclaz

I wonder what is friggin :shock: (the AP mode, the netbox, the sxtsq, the hex PoE, your shop, your house, Mikrotik generally). :lol: You should follow these instructions: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 and post the current configurations of both devices. If you could add ...

jaclaz

If you have a rs-232 port on your computer, a common null-modem one will do.

Reference is here:
https://wiki.mikrotik.com/Manual:Null_modem_cable
https://help.mikrotik.com/docs/spaces/R ... al+Console

There is also a serial header on that model.

jaclaz

It is not at all clear (to me) how what you described is supposed to work. If the IP of the Android box is 192.168. 106 .235 (BTW where does this address come from, is it a static IP manually entered or derives from a DHCP server?), there is no way (unless there is some other device in between or th...

jaclaz

It seems to me you were already on the right track: 1) add a dedicated routing table 2) add a route/gateway on that routing table for the intended gateway 3) add a routing rule filtering the source address range and making use of that router table Loosely, if it was 3 times 1:1, it would be somethin...

jaclaz

Complete instructions here:
viewtopic.php?t=203686#p1051720

jaclaz

Just wondering ... how does that VPN work then without internet connectivity ?

Maybe VPN as in Various People Near the routers?

jaclaz

Hello, can someone help with this configuraton? I set up wifi repeater, have two wlan interfaces, added ether port to bridge, what I should do next? Follow this: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 and post your configuration. Also describe what you want to achieve (goal), it...

jaclaz

First thing. check your configuration, whenever there is a "*" (asterisk followed by a (hex) number, it is a reference to *something* that was deleted/moved/renamed and that RoS cannot find anymore, it is a placeholder for something that was there but doesn't exist anymore: /interface list...

jaclaz

Yes, but 10.61.0.27 is a private IP address. This implies that the ISP connection is NAtted or - anyway - the ISP router is a blackbox with IP address 10.61.0.27, with no other way to connect to it. From your scheme, the switch (or better the devices connected to them) must be in the 10.61.0.0 (/24?...

jaclaz

But how did you configure the laptop IP/network?
Try a static address of 192.168.88.5 network mask 255.255.255.0.
But if Winbox doesn't see It via MAC, there is something wrong with It, since It has a serial/console connection, that Is probably the only to attempt connecting to It.

jaclaz

I see, the block diagram: https://cdn.mikrotik.com/web-assets/product_files/CCR2116-12G-4S_240122.png of that device is a bit unusual. From what I understand in this particular case ethernet13 is peculiar as it is a self-standing interface, not connected "directly" to the other ports. So i...

jaclaz

Naah, it's fine, ether13 in your configuration is not any different from any other ether port (except that in the configuration you posted it was disabled: add bridge=bridge1 disabled=yes interface=ether13). But you have to digest the concept that once a port is added to a bridge it becomes a slave ...

jaclaz

@gotsprings @gigabyte091 Out of curiosity, what is the underlying message (if any :shock: ) I am failing to get? :? OP has a cAP AX that is giving issues on Wi-Fi (and there are a lot of similar posts about the Ax2 and Ax3 on the board). Now you are reporting how good is your experience with the new...

jaclaz

Yes, that's normal. If it is a switch all ports should be part of the bridge. If it is a router the WAN port (ISP or ether1 in your case) must be taken OUT of the bridge (in your posted configuration it is part of the bridge or slave to it): /interface bridge port add bridge=bridge1 interface=ether2...

jaclaz

Provide the output of the following commands: /ip address print and /ip route print But is it is intended to be routing to the ISP modem/router or not? The "ISP" interface (ether1) is part of the bridge, so it should be a "simple" switch. I.e. the configuration you posted seems t...

jaclaz

Is there any configuration that I need to change in order to get the old speeds I’m getting without the RouterBoard?

Maybe yes, maybe no.
Hard to say without knowing your configuration.
Follow this:
viewtopic.php?t=203686#p1051720
and post your configuration for review.

jaclaz

Probably it is something in configuration blocking mac-winbox.
Follow this:
viewtopic.php?t=203686#p1051720
and post your configuration.

jaclaz

Local or remote? Like this? https://forum.mikrotik.com/viewtopic.php?t=172386 or this: https://forum.mikrotik.com/viewtopic.php?t=160169 or this: https://forum.mikrotik.com/viewtopic.php?t=56831 Or using the /tool wol: https://forum.mikrotik.com/viewtopic.php?t=62728 Just in case, there are some dev...

jaclaz

@erlinden @anav If I may ask a few side questions, only trying to understand your suggestions, the proposed changes are shifting all DNS requests (from LAN) to the router/gateway at 10.44.73.1, right? Is this a "generic" good idea/practice or it is something that is only a test specific to...

jaclaz

maybe useful, maybe not:
viewtopic.php?p=1046192

jaclaz

unfortunately i can not publish my export file which is 47000 line with my address list . And how many lines is it without your address list? :?: Maybe - just maybe - you could replace the address list with a shorter reference *like*: <imagine here a loooooooong address list> and post it, I don't t...

jaclaz

Only as a note, maybe you haven't noticed it, but it is important that you understand this for other future configurations. I originally suggested to have ether8 as 192.168.88.1 /24 (assuming that you would have changed the same range set on the bridge to your local lan one). BUT what you implemente...

jaclaz

I think we can say that the script is intended for pre-validated address lists, i.e. all the checks needs to be done before and outside this script, that merely "imports" the (already filtered/corrected/whatever) data.
It seems fair enough to me.

jaclaz

It seems like a common Windows 10 ( but likely nothing much has change in 11) issue when resuming from sleep The workaround (not solution) Is automating disconnection and reconnection, see: https://superuser.com/questions/1849669/wifi-becomes-slow-after-sleep Particularly, but not only, with AX200/2...

jaclaz

RB5009 8.7<16 W
cAP AX 6.4 <11 W
8.7+6.4=15.1 < 27 W
15.1+(some activity)=16.8 < 27 W

If the RB5009 goes high on CPU while the CAP is also loaded it has to be seen how much more power is needed.

jaclaz

273000/12=22750 22750/60=379 379/60=6.32 packets per second (on average) And in any case 18.5 Mb over 12 hours. The action of dropping them shouldn't need a large amount of resources, so large that the consequence "makes it almost impossible for the local network to even ping servers 1.1.1.1 or...

jaclaz

The detailed instructions to export and post the configurations are here: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 Exporting and saving periodically on a PC/NAS/whatever a copy of the export is anyway common good practice, as it is making periodically a backup (surely before upgrad...

jaclaz

I still don't understand. The "natural" role of the RB3011 would normally be that of a router, but in your current scheme you are using it as a switch (with two bridges, one for LAN and one for WAN) and all the routing happens in your CAP1. If the CAP1 is fast/good enough for your needs, t...

jaclaz

If I may, it is not a good idea to connect a router to internet without a proper set of firewall rules. You should first thing add these (they are the default ones from Mikrotik for other devices, adapted for your case): When fiddling with a Mikrotik with only an interface as WAN all the rest in a L...

jaclaz

Yep, but what it is the source address you added to the firewall filter rule? That address is - if I got the configuration right - 192.168.x.10. If this is the case. it is "created" by your current nat rule: /ip firewall nat add action=masquerade chain=srcnat out-interface-list=WAN masquer...

jaclaz

How can I show you the full configuration of my RB5009?

Follow this:
viewtopic.php?t=203686#p1051720

jaclaz

More explicit instructions in this post:
viewtopic.php?t=203686#p1051720

Search found 2164 matches