MikroTik

jaclaz

Check by opening a terminal and issuing in it: /interface/detect-internet/print if you see it as "none" after you changed it in Winbox (before rebooting) BUT it changes back to "all" after a reboot, there must be a script (or *something else*) that re-initializes it. That whole s...

jaclaz

Very likely irrelevant to your (speed) issue, only notes, at a first read: 1) usually bridges are set with auto-mac=no and given a fixed MAC 2) you have wlan1 largely not configured, but in both devices it is set as ap-bridge, if you don't use it, it will be better if disabled on both devices 3) you...

jaclaz

Giving you a much broader and cheaper set of switch choices. Hmmm. Yes and no, if you look at the costs, compared to CAT6/6a/7 patch cables, let's say 5-10 US$ each, using DAC's you are going to need some 20-30 US$ per connection, while using fiber (or copper) SFP's, more like 60-70 US$ at least, s...

jaclaz

Good

, AND I'll move it one notch up:

1) You do not use VLAN1
2) You DO NOT use VLAN1
3) You do not use Quickset
4) You do not use detect internet
5)...

jaclaz

Maybe this post will be relevant to your situation:
viewtopic.php?t=187932#p947857

jaclaz

The whole concept of innocent until proven guilty?

Overridden by Andreotti's famous:

You sin in thinking bad about people - but, often, you guess right.

jaclaz

@holvoeth Your correction is overruled :lol: : Judge Chamberlain Haller: Mr. Gambini? Vinny Gambini: Yes, sir? Judge Chamberlain Haller: That is a lucid, intelligent, well thought-out objection. Vinny Gambini: Thank you, Your Honor. Judge Chamberlain Haller: [in a firm tone] Overruled. rules need to...

jaclaz

AFAICU SwOS is just fine (and simpler) if the switch is used as "simple" managed switch, but with RoS you have more possibilities, if needed. The way a router (designed as a router) and a switch (designed as a switch) differ is in the way the ports are connected to the CPU and between them...

jaclaz

I think I will add this to my Mikrotik Club Rules

:
1) You do not use VLAN1
2) You DO NOT use VLAN1
3) You do not use detect internet
4)...

jaclaz

... or causes random problems (worst case).

Judging from the reports I have seen on the forum, the worst case seems to be the normality...

jaclaz

I think telnet in Mikrotik is "interactive only":
viewtopic.php?t=69786

jaclaz

But you already have a route towards the internet (it should be provided by the lte1 interface by itself), the one in your screenshot: DAS 0.0.0.0/0 lte1 reachable is telling the router that any address in 0.0.0.0/0 (all the addresses) should go through lte1. From terrminal, you can check with: /ip ...

jaclaz

In modern windows, the default is to NOT replay to pings, so, unless you change that setting, pinging will result in timeout, but even if the error/result is the same it is not like your PC Is not reachable from the Mikrotik, simply the PC does not respond. 192.168.86.x and 192.168.88.x are two diff...

jaclaz

Interface list is a way to categorize/group items, so It Is the other way round, bridge Is in the category LAN, lte1 is in category WAN, bridge_wlan does not belong (yet) to any category (it doesn't need to belong to any of the two above or to a third one) . In the masquerade rule you use out-interf...

jaclaz

It seems "normal" to me.

You have two domains pointing to a same IP address.

When you src-nat and dst-nat to your local network you are using the two domains, but they will both be resolved to the same a.b.c.d IP address, wouldn't they?

jaclaz

I am not really sure what your intended setup is, but: The bridge_wlan is neither LAN nor WAN: /interface list member add comment=defconf interface=bridge list=LAN add comment=defconf interface=lte1 list=WAN And your firewall nat is only for WAN: /ip firewall nat add action=masquerade chain=srcnat c...

jaclaz

If you can use fiber, use it. Not only because it is better/faster/whatever, but because temperatures of fiber SFP's are "acceptable", copper SFP's are essentially small electric stoves (that can often create issues for the amount of heat they generate, definitely not good on passive coole...

jaclaz

If your current config works for you, good :) . You should anyway check this post by rextended on that same thread: https://forum.mikrotik.com/viewtopic.php?t=189277#p958546 Point of note: remove only connections that have a longish remaining timeout, to avoid attempting to remove connections that a...

jaclaz

The routing speed of the RB5009 is very similar to that of the CCR2004 (actually a little bit faster), so if 8 ports are enough for you, you'd better save the money for the moment. What may make the difference is if you are going to use the SFP(s), the second SFP port of the CCR2004 may be useful fo...

jaclaz

Well, start by posting your current configuration of the wsAC lite, follow this post instructions: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 It would be "unusual" that you have it configured "as router" (unless someone fiddled with it) as the common configuration...

jaclaz

The QMP comes (but the good Mikrotik guys do not show an explicit/clear photo of them) with two "attachment" devices: 1) a sort of bayonet plate suitable for the SXT and similar devices 2) a short, round, one You can see it (once you know it exists, in the second photo of the product: http...

jaclaz

Yes and no, if the devices are on a same network (let's say like in your case in a same /24) communication between them happens (should happen) at L2 level (switching/bridging) if the networks are different the communication happens (should happen) at L3 level (routing) or however some specific sett...

jaclaz

If you need more SFP's probably you should add a (passive cooled) switch, *like*
https://mikrotik.com/product/crs309_1g_8s_in
https://mikrotik.com/product/crs310_1g_5s_4s_in

jaclaz

Which main board device ( above) would you get? Also What switch for would you get? Strangely enough it depends on your requirements, number and type of devices, internet connection, what kind of speed you want to achieve and which infrastructure you have (cables) and budget. The CCR2004 @$465.00 i...

jaclaz

I think the advise was to make your MAC static and different from any other one you have on that machine, see this: https://forum.mikrotik.com/viewtopic.php?t=190747 There are reports that the mechanism the RoS uses to auto-assign MAC can, in certain situations, change the MAC, creating havoc in cer...

jaclaz

Shouldn't be too different from:
viewtopic.php?t=163396

jaclaz

About docker on mipsbe I'vefound this topic, but doesn't report the way to obtain it:
viewtopic.php?t=187595

Well, that is what is generally referred to as "wishful thinking":
https://en.wikipedia.org/wiki/Wishful_thinking

jaclaz

I think a line must be drawn *somewhere*, between "same network" and "other network". If your PC has 192.168.88.253, i.e. belongs to network 192.168.88..0/24, and the bridge on the Mikrotik is /ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=\ 192....

jaclaz

Good, so kleshlki's example in post #28 or your reported adaptation in post #29 (minus typos/errors) are the right references "as they are".

jaclaz

I made a mistake in the last step — datapath configuration. I fixed it and it worked

It would be nice if you could describe exactly what the error(s) and the correction(s) were, so that this thread may become useful as a reference for similar issues.

jaclaz

The common reports about 60 GHz Is that you need clear line of view, even some fog or medium heavy rain can compromise the link, tree leaves are a no-no. A Cube in such a setup will likely continuosly fall back to the (much slower) 5 GHz. Besides the SXT SA5 AC, which I believe is intended for much ...

jaclaz

You can also use "/system/script export where name=XXXX" to get the "escaped form" of any script (and then cut-and-paste that as needed).

Good to know, thanks

.

jaclaz

When you have PPPoE up: 0 ADS 0.0.0.0/0 pppoe-out1 1<- this is (DHCP) and Active, ALL outbound traffic goes through this 1 S 0.0.0.0/0 192.168.8.1 2 -<- this is (Static) and NOT Active (because of higher distance=2), so it is irrelevant 2 A S 1.1.1.1/32 pppoe-out1 1<- this, (Static) is Active and be...

jaclaz

ROSv7 is too generic.
Different versions of 7.13, 7.14 and 7.15 (besides latest-latest 7.16) have been object of alternate reports of instabilities on Wi-Fi.
From what has been reported, 7.14.3 seems to be the safest bet or - at least - the better "base".

jaclaz

These: add dst-address=0.0.0.0 gateway=192.168.8.1 distance=2 add dst-address=1.1.1.1 gateway=pppoe-out1 distance=1 Should actually be, I believe: add dst-address=0.0.0.0/0 gateway=192.168.8.1 distance=2 add dst-address=1.1.1.1/32 gateway=pppoe-out1 distance=1 (but maybe the network is implied) But ...

jaclaz

At a quick glance I see two common settings missing (cannot say if you avoided them on purpose):
1) static MAC address to the bridge
2) categorizing ether8 as WAN

jaclaz

We're talking about a boat here, so few other factors make it bit harder of a problem. e.g. it's going to bake in sun, vibrate/move slightly (wind), and perhaps be in salty air. So even @normis's reasonable and fun suggestion to 3D print a case for a Chateau, requires a high-temp printer to use som...

jaclaz

@mkx
Well, I paid 1.80 for that same cable, so it costs us nothing - combined - we are still ahead, and we can even afford to pay the unjust and unfair duty the Sheriff of Nottingham just imposed on us.

jaclaz

There are AFAICU mainly two consequences of using VLAN1: 1) possible incompatibilities with other vendor devices 2) possible incompatibilities with Mikrotik internal usage of VLAN1 for *some settings*, i.e.: https://forum.mikrotik.com/viewtopic.php?t=206946#p1071170 I am pretty sure that expert, kno...

jaclaz

So you have no firewall filter rules that may interfere? I see now that you did declare the vrf's, my bad :oops: . I don't particularly appreciate your naming scheme, when/if you will need to use ether2@port1 you will see why, but this is irrelevant. I cannot see anything blatantly "wrong"...

jaclaz

Yep, as said RF shielding is tricky business, strange that you did not notice some differences. Well, at least we tried ... An alternative (that you won't like) could be modifying the hAP lite, add an external antenna connector and use an external flat (directional) one: https://forum.mikrotik.com/v...

jaclaz

Very likely completely unrelated to the issue you still need to solve, but using VLAN1 is what we highly specialized technicians

commonly call "looking for troubles".

JFYI:
viewtopic.php?t=208061&

jaclaz

Here are some related info:
viewtopic.php?t=32935
particularly:
viewtopic.php?t=32935#p161412

And this post is the one that (for me) is easier to remember, the concept of a mirror of a /32:
viewtopic.php?t=32935#p382118

jaclaz

Wouldn't this be similar to the "Simple Static Routing" here (minus the two different WANs instead of the single one on the wiki example):
https://wiki.mikrotik.com/wiki/Manual:S ... ic_Routing

jaclaz

In a still not perfect world, but better than this one, wifi-qcom-ac would have probably been still called wifi-qcom-ac, but wifi-qcom would probably have been called wifi-qcom-ax. You would have wifi ac devices, and need wifi-qcom- ac , you would have wifi ax devices, and need wifi-qcom- ax . In th...

jaclaz

If it is v7, you are seemingly missing the explicit declaration of the three rouiting tables.
It is better if you post your whole configuration (as opposed to the parts that you believe relevant) as the devil is in the details.

jaclaz

Plwase recheck your post. RT1 is 192.168.1. 1 , you wrote 192.168.1. 2 in a few places. Post the configuration of the RT1 too. I think it is better to go step by step, i.e. if PC1 connection to RT1 is not working the issue can be in three places, (besides PC1), SW2, SW1 and RT1, but if SRV2 connecti...

jaclaz

Yep, there was a photo posted some time ago, about picture on the box and actual contents, cannot find it right now, but this one will do:

jaclaz

That TP-LINK thingy is not a standard (which standard?, I love standards, there are so many of them :wink: ) PoE device. The PoE injector that comes with that is intended to be more than anything else an "extension cable" powered by the "normal" power supply that comes with the d...

jaclaz

Now we are waiting for the Stable version before officially using it into production.

JFYI, in Mikrotikish "stable" has a somehow different meaning than "production ready".
I think it is one of those language subtleties that are lost in translation.

jaclaz

@bpwl That seem like one of the few cases where a cAP might be more useful than a hAP if you mount it on a ceiling or high on a wall. @acrophobic Sure, if you have the possibility a sheet of aluminium some (say) 2 mm thick would be light enough and have the mechanical resistance to hold the two devi...

jaclaz

The / only means "start from root", if you prefer without it it is a "relative path", with it it is an "absolute path": The good thing about RoS (and not only) scripting is that everyone can (within limits) write anything the way he/she likes :) (including overcomplicat...

jaclaz

As said it would IMHO be advisable to add a /32 route for the destination and leave the general 0.0.0.0/0 gateway alone. The gateway set in your lggh devices is only used for (say) NTP or something else, unless you expect days long interruptions of the lte, the 2 wireless devices can live without in...

jaclaz

Thanks for all for the possible solution, i have another question, the ping or the netwatch functions use the system gateway for the instradation, i think that i have to set first it in the script otherwise i have a infinite loop, is correct? Sorry, I don't understand the question, can you try expa...

jaclaz

Wouldn't some tin foil between the two devices (RF shielding) have the same effect of having the devices a few meters apart?
It costs nothing to test, and if it works one could experiment with a very fine metal mesh (mosquito mesh) that could be simply glued/fixed to one side of the hAP Lite.

jaclaz

It is now a Generic matcher:
https://help.mikrotik.com/docs/display/ ... ricmatcher

And if you want to live dangerously, the new 7.16beta3 has an added option, substring matching, see also:
viewtopic.php?t=191884

jaclaz

That's a very interesting comment. As far as we know, most people use Webfig. And Linux/macOS users very much try to avoid Wine at all costs. So thank you, this brings more varied opinions in to the mix. As a side note, and if I may, the idea of optionally removing webfig from the low storage devic...

jaclaz

I don't really know, but there must be something else, you just proved that VLAN devices are at the same time Dynamic and NON-Dynamic, which doesn't sound right.

Schroedinger's VLAN devices?

jaclaz

Yep, the names are confusing (generally) and to add to it every make/brand use some, slightly or greatly, different naming for the same thing. I have no idea how the eero thingies work, but probably you don't need to do anything on the Mikrotik to have it working, at least from what I can understand...

jaclaz

YMMV, therefore I'm not going to write exact rules here. You have discovered a truly marvelous proof of this, which this margin is too narrow to contain? :wink: :lol: Seriously, if you can, do post the configuration that actually solved the problem, even if mileage of other members may vary, at lea...

jaclaz

I don't want to seem unfriendly or rude, but the proper answer to your question would be: Yes. http://jdebp.info/FGA/questions-with-yes-or-no-answers.html Please describe your overall network setup, then follow the instructions here: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 and pos...

jaclaz

The hap AC lite is $59 (official list price). The Ax lite at the same price is a steal, but it has only 2.4 GHz radio, if only 2.4 GHz is ok, no doubt, go for it. The hap AC costs more than the Ax2, $129. The issues with the hap AC (lite or not) are the architecture (MIPSBE) and the (too) little amo...

jaclaz

Let's list the usual settings when the device is set as a router, the ether1 is "self-standing" (not part of a bridge) has a DHCP client active (it gets its IP address from the ISP router to which is connected) a DHCP server is running on the bridge (to which all othe rinterfaces are added...

jaclaz

Yep, but in the context of Quickset choices, I think (from the already linked threads) that Quickset in "PTP bridge AP" will set mode=bridge anyway, i.e. the "PTP" in the description prevails and sets to have only one single connection, regardless of the license level, maybe one ...

jaclaz

Maybe neighbor Discovery Is disabled?
https://help.mikrotik.com/docs/display/ ... +discovery
Or MAC Winbox server?
https://help.mikrotik.com/docs/display/ROS/MAC+server

jaclaz

Well, there is some difference between: An error has occurred and something *like*: script "mynicescript" running on device with MAC 00:ww:xx:yy:zz caused a "device not responding" error on line 42 These pieces of info: 1) name of the script 2) on which device it is running 3) th...

jaclaz

The "Typical_AP.rsc" is the configuration for a CRS326-24G-2S+

(which I doubt is a typical AP

)

jaclaz

@rextended Let's assume that by pure chance there is not any Mikrotik device in the customer's network. Doing an IP-scan from windows is a perfectly legit operation, but IMHO the original post over-complicates it a bit. A window computer set to get IP address from DHCP should already get an APIPA ad...

jaclaz

A "normal"/common Netwatch script would do. Usually: The on-down script/commands would change the route to the alternate one The on-up script/commands would restore the previous route. In your case, instead of changing/enabling/disabling routes, you would change the gateway in the dhcp ser...

jaclaz

To be fair the fact that a given (wrong) practice has been in effect in v6 doesn't justify in any way insisting on it in v7. In other fields, when *something* results in a given number of (minor) accidents or a single serious one, that *something* is usually changed (hopefully for the better). The f...

jaclaz

I guess that what erlinden asked for as "logging" was meant as:

/log print

and copy and paste a few related lines of the log around the "probably loop" error you posted.

jaclaz

I think that with some clever scripting it is possible to change the gateway provided by the two DHCP servers, but the change in the two MIkrotiks DHCP settings will not be actually propagated until next DHCP request/negoitiation/lease. So, when the LTE goes down: 1) all clients in both buildings wi...

jaclaz

To be fair, the default (from factory) configurations of a paired couple is pretty much straightforward, and similar to the "standard" (as quickest would make them) ones, the only (relative) complication is the bonding together of the two 60 and 5 GHz radios. But the bonding is needed to a...

jaclaz

Since the replacement with a similar device didn't change result (I doubt that two devices can be defective in exactly the same manner), it is actually possible the the RB750GR3 "filters" some activity on the network that ultimately causes the flapping issue. I would exclude that a commonT...

jaclaz

Good :) , so you can temporarily go for 7.12. But did the new batch come with already 7.14.1? If yes it must be new-new, 7.14.1 came out at the end of march 2024 . Unless you cannot manage to use 7.12 - since it is in production - I would wait for a non-beta version with the feature fixed before upg...

jaclaz

So you think the switch is damaged? It was connected to eth5 for months without any problem. That or *something else* on the network that the unmanaged switch allows through but the 750GR3 intercepts/blocks, hard to say. How many ports has the TP-LINK switch? Try changing them around, it is entirel...

jaclaz

Yes, but I still miss something :? . In a normal situation (both ADSL and LTE up) is : 1) both buildings A and B access internet via LTE and ADSL is only a backup or 2) building A goes through ADSL and building B goes through LTE Or - in other words - does only building B need to switch from LTE to ...

jaclaz

I tried to manually install loaded missing ARM package but it doesn't install anything.

Isn't it MIPSBE? (not ARM):
https://mikrotik.com/product/RBwAPG-5HacT2HnD

jaclaz

We have here, as a reference, the normal cube Pro pairs complete setup (from factory): https://forum.mikrotik.com/viewtopic.php?t=205042#p1059476 One end is mode=bridge and the other is mode=station-bridge, then there is the bonding between the 60 and the 5 GHz interface. And yes, the Quickset does ...

jaclaz

I am not sure to understand your setup/what you want to obtain. Normally (with both internet connections working) clients in building A go through internet access A and clients in building B go through internet access B (lte)? And when the lte connection is down you want cliients in building B to sw...

jaclaz

Possibly simpler is to highlight the modes to better understand the basic incompatibilty: What I purchased for the SFP connector is described as: "1.25G 850nm Multi mode SFP LC Transceiver Fiber Module 550 Meters 1000Base-SX LC MMF for Cisco GLC-SX-MMD/SX-MM/SFP-GE-S,Fortinet,Ubiquiti UniFi UF-...

jaclaz

Only as a side note: The default rules that come with Mikrotik SOHO devices have two features that your ones miss: 1) they are marked in comment as "defconf" which is useful when/if you want to change some of them 2) they have a comment summing up what the rule does As well, the generic ad...

jaclaz

You'll have to go through this thread (which is the officially unofficial Mikrotik guide for VLAN by Pcunite):
viewtopic.php?t=143620

jaclaz

Thanks for taking your time and explaining it. As far as I can tell by the images. The 5.1k ohm is pulldown resisors, right? It looks like you soldered them to ground. If so, I have something to do tonight. :) No, I didn't solder them (user gwynbleidd reported doing that). Yes, they are pull down r...

jaclaz

i have fixed the dhcp-client config, changing masquarade to out ether1 makes it no longer work But if you have ether1 in a bridge, likely you have to add the masquerade to the bridge and not to ether1 (which is slave)? Or it means that you need interface-list=LAN because this way you are masqueradi...

jaclaz

It is a known issue. The Ax lite (LTE6 or not) uses a USB-C connector AND 5V BUT it is not a USB-C compliant device. It does NOT negotiate with a USB-C power supply the voltage (which is OK, as it needs 5V) nor the amperage (there is a special provision in USB-C specs to allow 3A on 5V passively, ot...

jaclaz

Personally I believe that once something is working, the more "narrow" you can make the related rules/settings, the better, so, yes, I would check if the setup works with the masquerade rule attached to the single port you are interested to as opposed to an interface list. i,e, try; add ac...

jaclaz

In this guide topic here:
viewtopic.php?t=143620

jaclaz

By default ether1 is WAN on most Mikrotik devices, it is possible that you did not change its categorization to LAN? If this is the case, likely you have some firewall rules that block the connection. Follow the instructions in this post: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 an...

jaclaz

You will need to use one of these methods: https://forum.mikrotik.com/viewtopic.php?t=185514 https://forum.mikrotik.com/viewtopic.php?t=185514#p929556 The script in itself (or the command added to the scheduler script) should amount to: delay 10s /interface vpls disable [find] delay 5s /interface vp...

jaclaz

It sounds like a timing issue when rebooting.
The fact that it happens only some times (and possibly only on some routers) makes it difficult to avoid completely.
Probably the workaround would be a script set to run (say) after 3 minutes after boot that disables and re-enables the VPLS interface.

jaclaz

If the routers work as they should I would leave them alone. You are using 297 out of 970752 on the one and 113 out of 1015808 on the other. The max-entries depend on the amount of free RAM on the specific machine, it is calculated automatically and it is a read-only property: https://help.mikrotik....

jaclaz

See:
viewtopic.php?t=193667#p984874

Any Dynamic DNS may fail, anyway, and past performance may not necessarily be an accurate forecast of the future reliability.

Decisions, decisions, always decisions ...

jaclaz

About the log, open a new terrminal Windows in Winbox, in it input /log print This way you can select and copy. About the configuration, the upgrade should have not deleted It completely, maybe when you ran It without the drivers something got corrupted. Follow the instructions here and post the con...

jaclaz

Besides the convenience (or non convenience) of having your router up a pole outside :wink: , the SXT LTE6 is not a very fast device, so (it depends on the fiber connection you have) it may be a bottleneck. At what speed you have your fiber connection? If faster than 100 Mbps or so the SXT will be t...

jaclaz

The Mikrotik DDNS service should be available to people using MIkrotik hardware or a CHR license, see this as an example:
https://foisfabio.it/index.php/2022/12/ ... -gratuito/

jaclaz

No need for wifi in the basement? Or outside, in the courts or park? Anyway as access point, in Mikrotik catalog you can currently choose between the Cap Ax:and the Cap Ax: https://mikrotik.com/product/cap_ax Maybe and maybe soon, there will be a new device that may be suitable, the Wap Ax. In metri...

jaclaz

It's strange. You have a DAc (Dynamic, Active, connected) route (generated automatically by the router, hence with distance 0): DAc 100.64.0.0/10 ether8-StartLink 0 And seemingly no other ones interfering, so the destination 100.64.0.1 should be reachable. The one you added to the DHCP client with d...

jaclaz

Routing rules are usually "better", but mangle marks allow more granularity, so if you can obtain the expected result with routing rules, they should be preferred.

jaclaz

I would not update to 7 yet.
It is not a bad idea, but the procedure is not exactly simple, and if I were you I would wait until you have become more familiar with the devices and their configuration/management.

jaclaz

60 GHz needs direct line of sight, no ifs, no buts.
If you have that, go for it, but if you have even a japanese style paper wall between the two devices 60 GHz won't work properly.
Devices like the Cube Pro have a backup at 5 GHz because fog or relatively heavy rain can break the 60 GHz connection.

jaclaz

I see now, so in the referenced post the new and old AP are to be intended as same AP but new and old bands.

jaclaz

Having dst-address the same as the gateway add disabled=no distance=1 dst-address=100.64.0.1/32 gateway=100.64.0.1 \ pref-src="" routing-table=main scope=10 suppress-hw-offload=no \ target-scope=10 which is in route print: 2 As 100.64.0.1/32 100.64.0.1 1 doesn't look right to me :? , maybe...

jaclaz

Very often the issue is with the APN. Make sure what the MEO APN should be, "internet" is probably a generic one. In some cases you need to explicitly set: use-network-apn=no https://help.mikrotik.com/docs/display/RKB/Chateau+LTE12+APN+problem https://forum.mikrotik.com/viewtopic.php?t=161...

jaclaz

Easy bet. It is already known this is the root of the issue. That's why people commonly tinker around with connect-priority.

I thought that was related to issues when roaming with two or more different AP's?
viewtopic.php?p=1093107#p1093107

jaclaz

Another observation. Normally, the SSID for 2.4GHz and 5GHz are identical. However, for this test, I added "5G" on the end of the SSID so I could force it onto one band or another. When the SSIDs are different, the SA Query timeout errors never occur. Even though the RX signal is poor, it...

jaclaz

And don't hold your breathe while waiting for a new product to appear, it may take longer than you can live without breathing

Corollary:
Do you think that's air you're breathing now? /size]

jaclaz

Sorry, but ROSE is clearly not enterprise feature ...

https://help.mikrotik.com/docs/display/ROS/ROSE-storage

ROSE (RouterOS Enterprise) package adds

... and the 2024 award for the most inaccurate package name goes to ...

jaclaz

I wonder why the Ax2 is always represented as standing ... :? AFAIK it needs to be standing because of better heat dissipation, but it is possible that the internal antennas are designed to work with the device standing and having it flat on the table reduces their efficiency (or you have a lot of s...

jaclaz

... unless you first set a secure password (meaning requiring sensible password complexity ...

JFYI:
https://neal.fun/password-game/

jaclaz

Also made sure the antennas were tightly screwed to the board and aiming at 45 degrees like this. You have strange degrees where you live. :lol: Here the angles in the photo would be between 60 and 72. (they would fit either an hexagon or a pentagon placed on top of your Ax3) https://t4.ftcdn.net/j...

jaclaz

Well., post your current configuration:
viewtopic.php?t=203686#p1051720
and describe what you want to achieve.
Post also an output of:

/ip route print

jaclaz

When you make a cake, decoration is the last thing. :wink: Postpone access lists to later, once you will have the basics working. The Capsman is running, on the AC2, right? Have you followed the tutorial on the Wiki? https://wiki.mikrotik.com/wiki/Manual:Simple_CAPsMAN_setup Alternatively, did you r...

jaclaz

Sorry I did not understand the comment directed at me. Can you clarify the point you are making? Unfortunately MikroTik is popular with two very very different groups. Home users that plug and play (or mobile operator that just gives them a router). and professional installers. We have to make both...

jaclaz

It is not like I cited the CRA (which is not yet in effect) casually. Annex 1, Article 1, paragraph 3 (a) is exactly about this: (a) be delivered with a secure by default configuration, including the possibility to reset the product to its original state; This is what MIkrotik is IMHO already doing....

jaclaz

Just in case here is my personal translation table: https://forum.mikrotik.com/viewtopic.php?t=208346#p1080389 And I concur that the issues are unlikely to be connected to hardware (it is not like Mikrotik has own proprietary chips or circuits) and AFAICU now they are using not anymore their proprie...

jaclaz

Hmmm, Normis seemingly stated the opposite:
viewtopic.php?p=1090870
Maybe there is confusion in the terms used?

jaclaz

Do you know the scene from Spaceballs movie?

Yep.
We're at now now.

... as a non native speaker ...

... which makes a nice round two of us.

jaclaz

To be fair: you said "now" like it is something new.

Well, I wrote now meaning now, as in now, would already have been better?

Or should I have gone all the way to adding "since the dawn of times" or "AFAICR"?

jaclaz

I don't know where you live, but I never ever received a credit/bank card shipped with PIN code in same envelope ever in my whole life. Exactly, as I said, the PIN cannot be shipped in the same envelope as the card, to avoid the possibility that if the card is stolen "in transit" it can b...

jaclaz

If you check the Annex I, article 1, paragraph 3 of the mentioned CRA it can be read (in a restrictive way) to the effect that shipping a router with a password is not a sufficient measure to prevent unauthorized access to it. :shock: Not unlike what happens now with credit/debit cards (the PIN cann...

jaclaz

Welcome to the world of (Mikrotik) wi-fi mysteries. A cap Ax is designed to be mounted on a ceiling (though it is also possible to mount it vertically on a wall, though in this latter case it will likely perform worse). The board is full of reports about the cap Ax being either very good or a terrib...

jaclaz

I haven't actually read the EU law regarding the passwords, but if every other vendor did it by forcing a password change, instead of random passwords per device, then I am inclined to believe that 'random passwords' wasn't a requirement by law. Possibly because it is not at all clear which specifi...

jaclaz

Then I need to get the POE Power into the device. 4 cameras take 0.5 amps each. Seems like there are lots of POE power supplies available. What should I use for this? 0.5 amps? :shock: Maybe they use 0.5A@12V or 0.5A@24V. Most PoE cameras are nowadays 802.3af, which usually work @48V, and to be af ...

jaclaz

Then the issue is related to VLAN settings. No idea about those, I can only observe that you are not using the exacts settings anav suggested (cannot say if those would make a difference). You have the routes as DAC, so you don't need to add them as static. Maybe you can go through this: https://for...

jaclaz

conditions are IMHO AND combined. ssid-regex+passphrase must match both. Dunno what's wrong with their logic. Maybe passphrase is not a filtering parameter. So the only remaining filter param is ssid-regexp and first rule wins. Yes, passphrase is not listed among the "filtering parameters"...

jaclaz

By posting only partial configuration you are making much more difficult to follow your settings. Please post the whole configuration. This: /ip firewall address-list add address=10.0.0.10 list=ZugriffAufDrucker /ip firewall filter add action=accept chain=forward dst-address=10.0.101.250 src-address...

jaclaz

After I tried this solution, the router became a brick. No internet, no vpn, on access to the router via 192.168.88.1 ip address. It is improbable, those settings are only related to outbound traffic and wi-fi, it is more likely that *something else* caused the issue. Anyway, you should be able to ...

jaclaz

"The rules are checked in the order they appear in the list. Only management actions specified in the first matching rule are applied to each connection." Maybe the relevant statement is a few lines after that: Just make sure that the specific client doesn't get matched by a more generic ...

jaclaz

Well, whatever/whomever produced the snippet you posted did not understand the question, let alone provide a meaningful answer. (actually it is wrong even as an answer to another question). Once removed the abstraction level of the variables, it amounts to fiddling with IP addresses of a local port,...

jaclaz

I connect the patch cord to the laptop connector. If you don't have *anything* plugged into a wall socket, then you have no power. Your device is a cap Ac, it is - at least by name - an Access Point, not a Router, hence the initial perplexity. It can only be powered via PoE: https://mikrotik.com/pr...

jaclaz

Let's start form the basics. 1) Which exact device model is it? 2)How are you powering it? From what you write it seems like the device has not power at all. The device needs power, they normally have a DC jack socket, a few can be powered from PoE (Power over Ethernet), but of course in this case y...

jaclaz

Yep.

this remains valid anyway:

Always drive defensively. Expect the unexpected.

jaclaz

@Njumaen AFAIK size of packets is unrelated. The opinion on the forum is that the data from tests Mikrotik publishes are largely inaccurate in the sense that they represent some peculiar lab/test conditions. What has been observed is that coincidentally the value for routing, 25 firewall rules, 512 ...

jaclaz

After all, most exploits are done over network without physical access to device being compromised. Yes, and - again - the insecurity is mainly the fact that *somehow* there is access to the device files from the outside, the Meris that has been cited was a bug that allowed to download the database...

jaclaz

I asked if it is good solution to have DNS server on the MikroTik router or it is better that any client receive the ISP dns. Well, initially you only provided statements, only later you asked the questions, which however, without context, can only be answered as "it depends". The DNS ser...

jaclaz

Still the RB3011 can route in theory at 452.6 Mbps 512 byte packets with 25 firewall rules https://mikrotik.com/product/RB3011UiAS-RM#fndtn-testresults as opposed to 986.3 Mbps of the hap ac2 https://mikrotik.com/product/hap_ac2#fndtn-testresults If OP's WAN is already at 500 mbps, the RB3011 is cur...

jaclaz

If I get this right, you are looking for some sort of failover (more than load balancing) among three target IP's?

You only connect to 1 IP (IP#1) and you expect the Mikrotik to forward/route your connection to any of three other IP's (IP#2, IP#3, IP#4) depending on the availability?

jaclaz

I don't understand your setup. You first add an interface to a bridge (with only one port?) and then you add an IP address to the interface (and not to the bridge). Try removing the IP address from the ether2 and add it to the bridge: /ip address add address=192.168.14.250/24 interface=bridge1 Then ...

jaclaz

It's free?

From the project page:

License

RouterFleet is released under the MIT License. Feel free to explore, modify, and distribute the software as per the license agreement.

https://github.com/eduardogsilva/router ... in/LICENSE

jaclaz

hashtag #nocamelcase

https://en.wikipedia.org/wiki/Camel_case

jaclaz

This doesn't happen with a Zyxcel 12v 4a adapter. Yep. Your device specs: DC jack input Voltage 12-28 V Max power consumption 23 W Max power consumption without attachments 17 W would require no less than 17/12=1.42A@12V or 17/24=0.71A@24V or - better - 23/12=1.92A@12V or 23/24=0.96A@24V Still, if ...

jaclaz

gianry, you evidently have not noticed that the previous replies contain (some) sarcasm. You did not provide a configuration, only a (non-understandable) snippet/screenshot and a very partial description of the settings you used. If you want some sensible replies you should post your configuration: ...

jaclaz

However it is working now!!! Good. :) Can someone explain the difference between my initial config and this? Your connection/route to 10.0.0.1/32 became ADC, the A is active (as before) but it is not anymore static, it is DC (Dynamic and Connected) and has a distance of 0 which means that the route...

jaclaz

Why is that route distance 2?
It should not matter since you have no other routes for 0.0.0.0/0, still it should normally have distance 1.
You should probably specify out-interface=ether1 in your /ip firewall nat masquerade rule. but that is also - I believe - not relevant.

jaclaz

So that Shelly uses digest and fetch supports it directly, good to know.

It remains strange that curl with -anyauth didn't work/didn't provide this info, but all is well that ends well

.

jaclaz

Should be related to the built-in ssh server:
https://help.mikrotik.com/docs/display/ROS/SSH
try disabling ssh in services:
https://help.mikrotik.com/docs/display/ROS/Services

jaclaz

Post again the /ip route print output.

Maybe you can ask the VPS server provider if they have a known to be working Mikrotik setup.

The only other thing I can think of is adding a 10.0.0.x IP address to ether1.

Let's wait if some of the more experienced members have a solution.

jaclaz

Try with the -v (verbose) switch, possibly there will be more details. Checking the capture of the browser, it mentions "algorithm=SHA-256," the Shelly1 and 1plus, from what I read should be using basic auth, later devices do actually use a different method of authentication: https://shell...

jaclaz

Basically it means 10.0.0.1 on interface ether1, or 10.0.0.1 reachable through interface ether1. There are two "modifiers" for gateway addresses: https://wiki.mikrotik.com/wiki/Manual:IP/Route gateway (IP | interface | IP%interface | IP@table[, IP | string, [..]]; Default: "") Ar...

jaclaz

In a Windows command prompt, curl does not work with the Shelly authentication enabled. It works fine with the Shelly authentication disabled. Post the exact CURL command you are using. No error provided when it fails? Under Windows, try running. curl -v -u "user" http://192.168.0.144/.. ...

jaclaz

The "no route to host" is normal, as that route (#0 in the screenshot) is "S" but not "A".

No idea what the problem is, but - for what it costs - I would try a route with gateway=10.0.0.1%ether1

jaclaz

Post the output of:

/ip route print

jaclaz

Try it on a PC (with curl installed/running), then - if it works - you need a script for "basic auth", see my previous edited post.

jaclaz

The user:password actually works from a browser. Very likely because the browser itself manages to encrypt/encode/hash/whatever the username/password before sending it to the Shelly. https://reqbin.com/req/c-fkj7kdqi/curl-request-with-credentials Try with curl: curl http://192.168.0.144 --user &quo...

jaclaz

It seems like you say. https://www.intel.com/content/www/us/en/support/articles/000005714/wireless/legacy-intel-wireless-products.html All wireless products with 802.11n support MIMO. https://info.support.huawei.com/info-finder/encyclopedia/en/MIMO.html Mainstream home wireless routers in the market...

jaclaz

Those are the 2.4 GHz antennas, compare with the picture here:
viewtopic.php?p=1087853&hilit=antenna#p1087603

jaclaz

There may be some settings that need to be changed/tuned, but it shouldn't reboot by itself. The configuration you posted indicates: # managed by CAPsMAN that wifi settings are managed by capsman, but us this the case? (i.e. do you really have anothe Mikrotik device that is controlling this one?) Po...

jaclaz

Wait a minute, the d53g is this one:
https://mikrotik.com/product/chateau_5g
it is an AC device, it should use the wifi-qcom-ac package, not the wifi-qcom, which is for AX devices.
It is confusing, but read carefully:

https://help.mikrotik.com/docs/display/ROS/Packages

jaclaz

The article says: While the vulnerability was patched after its detection back in 2018, it’s still being exploited in compromised devices that do not use the patched RouterOS versions, or that use the default usernames and passwords. The last part of the sentence is "captain obvious" speak...

jaclaz

But, if I recall correctly, the 250,000 of Meris were connected to a router os bug/vulnerability, not to 250,000 compromised passwords.

jaclaz

This is strange.
A package like qcom should be installabile in any moment (i.e. also after the installation of the main routeros package).
Maybe you can try a new netinstall, making available both the routeros and qcom package.

jaclaz

But now, with the appropriate qcom package installed, the wifi is running, right?

jaclaz

Good

.
Yet another happy bunny in the basket

https://msfn.org/board/topic/128727-can ... ent=828512

You are welcome.

jaclaz

You probably got the wrong package, Mikrotik has a strange way to name them Ax=wifi-qcom https://help.mikrotik.com/docs/display/ROS/Packages wifi-qcom (arm, arm64) Mandatory driver package for 802.11ax interfaces. Introduced in 7.13. Wifi CAPsMAN support comes with the system package. Wireless is fo...

jaclaz

The hex s should be very low power (6 W without attachments): https://mikrotik.com/product/hex_s which would be 0.25A@24V or less than half what the RB3011: https://mikrotik.com/product/RB3011UiAS-RM should be capable of providing (0.60A@24V). Which exact model is the WiFI AP that doesn't work? Is i...

jaclaz

So, you have the (dynamic) routes alright. It should work, unless there is something else in firewall (or somewhere else) blocking the connection. As mentioned in the linked to thread/post by mkx. You can try disabling (temporarily) all the firewall rules. But which devices are at IP's 192.168.0.30 ...

jaclaz

"Having a look" does not mean "base design on" nor "here, Mikrotik, take my money and give me one of those". The OP has seemingly not the *need* to replace his currently working (even if not optimally) setup, and since that device does not exist (yet) and there isn't ev...

jaclaz

But given the situation, as I am closer to 60 than 50, I am pulling my hair regarding these stickers that probably are designed by some 18 year old. No way I can read them without strong light and a magnifying glass. The good news :) are that at nearly 60 you still have hairs to pull. The bad news ...

jaclaz

Don you think that HGO antenna's will help to focus the signal in the way I need with a proper orientation (probably the classic 45°)? That has to be seen. The HGO cannot be oriented, it is "straight". You will need a similar antenna, but with the possibility to be set at some angles, or ...

jaclaz

Let's divide the thing in two: 1) succeed in pinging from one network to the other (and viceversa) 2) limit communications to between only two devices, one on each network Your scheme and description is about ether4 (192.168.0.x) and ether5 (192.168.10.x). The snippet of configuration you posted is ...

jaclaz

Follow the instructions here:
viewtopic.php?t=203686#p1051720
and post your configuration.

jaclaz

There is a procedure (lights/flickering/timing/etc. may vary a little bit with models) detailed here: https://help.mikrotik.com/docs/display/ROS/Reset+Button Depending on the date the device was manufactured once the device is reset the credentials will be either: older devices: user:admin password:...

jaclaz

But am I correct in assuming that we should have connected the router to a laptop/pc with ethernet then enter the config page to enable WiFi? As you say, it is an assumption. Obviously how a device will behave depends on its configuration. In the case of a brand-new, still in the box, device, its b...

jaclaz

The answer is, yes it supports a PoE cameras on the eth2 but both PoE (router input and camera input) should be AT mode, AF mode is not supported. So be sure all 4 pairs of cable are connected Excuse me, can you clarify? 802.3at is a sort of superset of 802.3af (in the sense that a 802.3at PSE can ...

jaclaz

I think the world is divided between those that report how they self-locked themselves out of a Mikrotik quite a few times when experimenting/learning and those that don't. The latter ones are liars :wink: . On a device like the RB2011 where number of ports should not be a problem, a good idea is to...

jaclaz

SInce you have no wireless requirements, you can go "virtual" and use GNS3 with CHR, it is very handy to make tests and understand the syntax of ROS and also experiment with "crazy" setups, even if once you have a configuration working it needs to be tested on the real device/net...

jaclaz

Cannot sat specifically about the ac2, but newish Mikrotik routers come with a user admin and a "random" password preset. The password is (un-[1]) readable both on a sticker on the device and on a label attached to the instructions. AFAIK the reset should get back to those values. [1] prin...

jaclaz

It's not like there are many devices with the requested features:
1. Ax
2. Dual band 2.4 and 5 GHz
3. Omnidirectional or however neithet sector nor directional

In practice only the netmetal ax:

https://mikrotik.com/product/netmetal_ax
(+ HGO antennas)

jaclaz

https://i.chzbgr.com/full/6623623680/hB259C047/what-has-been-seen-cannot-be-unseen Wayback Machine to the rescue 8) : The 908118 is the post number, the thread is 182601: http://web.archive.org/web/20230524024549/https://forum.mikrotik.com/viewtopic.php?t=182601 http://web.archive.org/web/202401150...

jaclaz

Just in case anyone is looking for a quick way to get divorced

:
https://it.aliexpress.com/item/1005007207725543.html

jaclaz

I find this very perplexing, I cannot believe that the good Mikrotik guys are intentionally lying, reporting in changelog a new feature that doesn't actually exist/work and even (as always mis-) document it on the help page. I don't know if anyone has filed a ticket at support, but I think you shoul...

jaclaz

ip scan?

https://help.mikrotik.com/docs/display/ROS/IP+Scan

arp table may not contain all devices connected AFAICT.

jaclaz

Which confirms that the tests with interface= work, while any with the src-address= fail. Someone more expert may be able to explain WHY this happens. In any case the "interface=" should be intended as "out-interface=" (or at least this explains nicely why interface=bridge does n...

jaclaz

Nothing important, but since you have ether1 added to the bridge, the default DHCP client on it is invalid, you should disable it to avoid the red message:

/ip dhcp-client
# DHCP client can not run on slave or passthrough interface!
add comment=defconf interface=ether1

jaclaz

You should freddle the gruntbug, or maybe try foonting the turlingdromes.

Or - possibly better - follow the instructions here:
viewtopic.php?t=203686#p1051720
and post your complete configuration and a description of your network topology and of the issue you are having.

jaclaz

The laptop is running windows 11. Which may be (or not) part of the problem. For *some reasons* netinstall can be finnicky, there are mainly two issues: 1) *whatever* running on the laptop 2) timing problem The #2 can usually be solved putting a dumb switch between the laptop and the device, #1 is ...

jaclaz

See here:
viewtopic.php?t=153582

jaclaz

Something like what is discussed here?
viewtopic.php?t=114153

jaclaz

Proof?:

https://www.reddit.com/r/mikrotik/comme ... _but_isnt/

https://www.reddit.com/r/mikrotik/comme ... s_in_a_10/

https://imgur.com/a/rb5009-10-rack-ears-hNUuCqo

jaclaz

There are two (actually three) CAPSMANs. All of them are called CAPSMAN, in order to easily understand the differences among them. The first one is not used anymore, forget about it. Two remain. One is called sometimes "CAPSMAN", "OLD CAPSMAN" "CAPSMAN v1", "legacy...

jaclaz

@jonglauser I am losing you. If you have a configuration that is working when set the first time and upon reboot (provided that the configuration is not "lost" anymore) it doesn't work anymore, it means that a part of the configuration does not take immediate effect until a reboot is made ...

jaclaz

If you were asked the exact same question, what would you say?

I don't know, try asking on the Mikrotik forum.

jaclaz

Good, now try adding an IP address to the bridge, let's say 192.168.88.10/24. Then try connecting the PC to one of the other ports of the device, (you will need to set your PC connection to VLAN 10 I believe). Anyway experiment on which ports and with which VLAN id you can connect. Once you have suc...

jaclaz

You don't have any firewall filter rules, so it cannot be that blocking your connection. Remove ether5 also from: /interface bridge vlan add bridge=bridge1 tagged=ether2,ether3,ether4,ether5 vlan-ids=2 add bridge=bridge1 untagged=ether2,ether3,ether4,ether5 vlan-ids=10 add bridge=bridge1 tagged=ethe...

jaclaz

It is not like you started from fresh and only added a VRF configuration, the configuration you posted has (among other things) a wireguard connection, a macvlan, a number of src-nat and dst-nat settings, custom firewall rules and there are clear signs of having been configured and re-configured sev...

jaclaz

It is not that (for whatever reason) you have enabled "safe mode"? (accidental pressing of F4 or similar?) https://help.mikrotik.com/docs/display/ROS/Configuration+Management#ConfigurationManagement-SafeMode It is also possible that some of the changes you make appear to be working, but wh...

jaclaz

The problem is that it starts with 10.0.8.0, it won't allocate addresses up to 10.0.13.254 if the network is /22. What I need is to have addresses from 10.0.10.2 to 10.0.13.254. You cannot. Check here: https://www.calculator.net/ip-subnet-calculator.html?cclass=any&csubnet=22&cip=10.0.10.1&...

jaclaz

Yes. The issue (or non issue) is that usually (cannot say specifically the 1100, but I see no reason why it should be different) Mikrotik devices *like* higher voltage, i.e. when connected on different connectors with (say) 24V and 48V they will draw power from the 48V one. Since the internal (dual)...

jaclaz

Search on the forum for "SA Query timeout" there are a few threads reporting similar symptoms, and various settings to try, though AFAIK not a definite explanation and remedy.

Search found 1405 matches