MikroTik

jaclaz

Well, you had just posted an /ip route print where both ether1 and ether2 got their ip route just fine (so the DHCP client worked fine on both interfaces), now your /ip route print seems to show that it only works on ether1 and not (anymore) on ether2, so something has changed. The main ISP modem cr...

jaclaz

Two vlans makes much sense to me. Not only to you, but there are logical priorities, that you are not taking into account, and as well you are not considering how the OP is a beginner. Priorities (in my perverted mind): 1) have a decent setup for 1 internet connection 2) add a second connection 3) ...

jaclaz

@anav there is no reason why OP would want or should have two VLANs. Very likely the double entry in: /ip dhcp-server network is a mistake/accident. OP is a beginner and is trying to get the hang of a simple home/soho setup, no need for now to make it more complex than needed. @bbmikrotik You have t...

jaclaz

It could well be one of the pin disconnected (like a cold solder on the PCB).
10/100 use 4 pins/wires, if 1,2,3 and 6 are good, up to 100 the connection is good
1000 uses all 8 of them, so if any among 4,5,7 and 8 is disconnected, 1000 connection will fail.

jaclaz

7.15 is seemingly much more "strict" than previous versions. It could be a permission/policy issue or something nearly invisible, such as a missing quote or an excess newline. Check this: https://forum.mikrotik.com/viewtopic.php?t=208272 saving the script as .rsc and then dry-run importing...

jaclaz

No, i am not user command /ip hotspot user reset-counters; i used: /ip hotport user reset-counters [find name = "a"]; but it still works for all in case "a" is removed. Exactly. :) You use the command: /ip hotspot user reset-counters [find name = "a"] BUT the find comm...

jaclaz

No, you just need to remove the ether2 from the bridge, leaving in the bridge only ether3,4,5. Ether2, once outside the bridge, will be able to have a DHCP client enabled on it, just like it is now ether1. in CLI that would be: /interface bridge port remove [ find interface=ether2 ] Let see if I can...

jaclaz

Don't mistake me for a Mikrotik expert, I am also only a beginner, just knowing enough for basic configurations like yours. /interface bridge port add bridge=bridge comment=defconf interface=ether2 Your ether2 is still part of the bridge, hence the DHCP server error, that sees it as slave interface ...

jaclaz

Allow me to disagree Syntax/commands need to be precise, actually exact. Comments need to be descriptive/understandable. The ethernet cable physically connects ether5 to a port on another device identified by the MAC address. Packets/whatever travel back and forth on this ethernet cable. It is clear...

jaclaz

The default is: ether1:WAN ether2-5:joined in a bridge LAN What you have to do is to take ether2 (by convention the lower numbered ports are those that connect to the internet) out of the bridge, so that you will have: ether1:WAN (1) ether2:WAN (2) ether3-5 joined in a bridge:LAN Be careful to not l...

jaclaz

So, there is the need of two "monodirectional" rules:
comment="Allow from 00:E0:4C:00:03:A7 to ether5"
and:
comment="Allow to 00:E0:4C:00:03:A7 from ether5"
?

jaclaz

Maybe I see it from a different perspective :shock: , but I would have said that the Hap Ac Lite has a reset/wps button (inside a hole) on the front . Like: https://www.youtube.com/watch?v=LMz49kUvH_c This is interesting, however, many/most "consumer" devices have the ethernet ports on wha...

jaclaz

yes, there are many ways to fix this "bug", I just brought up an irrationality of the [find] condition. But that [find name="a"] works just fine, as it finds nothing and returns nothing. The issue is in the command: /ip hotspot user reset-counters that works for "all" ...

jaclaz

So it is not a quirk of the find command in itsellf, but rather a "wrong implied default" of "all" in the command /ip hotspot user reset-counters?

How can it be worked around?
Like checking if "numbers" is defined and only run the command if the condition is true?

jaclaz

Good.

For next time, a good practice when testing/troubleshooting a script is to add commands that shows the actual value variables get.
If you had a:
:put $ftpDstPath
you would have seen that the value was not correct.

jaclaz

Many (important) details are missing or are unclear. On the back of which router? I believe that the AC LITE has not a physical WPS button. :? The 192.168.1.1 is the AC LITE or another device? If the former, how do you connect to it? Winbox, normal browser (Webfig), or what? You should describe with...

jaclaz

If the server is the same and out of two different ways to connect to it one works and the other doesn't it is more likely that the server response is a (misleading) reflection of something wrong on the client. The FTP error 553 error could mean "I don't like the Path and Name of the file you w...

jaclaz

The first thing I would try is another power supply/adapter. It Is a common failure mode of (switching) power supplies to be able to still supply *some* Volts but not enough Amperes. The effects on many devices is that some led(s) lights up seemingly normally but when during booting some more "...

jaclaz

OK, so, if anyone is interested in this "universal image", in the attached spreadsheet there are the basic instructions to modify the image so that it boots both in BIOS and in UEFI. NOT a fully tested script, only the needed info and the commands I used manually. Due to the hardcoded addr...

jaclaz

@tangent The origin is (probably) a (I believe now lost forever) twitter post, cited here (which explains some of the reasons to increase DTIM interval for Apple devices): https://www.sniffwifi.com/2016/05/go-to-sleep-go-to-sleep-go-to-sleep.html The analysis seems to make sense, and this "set ...

jaclaz

Only for the record, there is a lot of confusion around POE and Mikrotik has some own quirks on top of that. 802.3af=POE 802.3at=POE+ 802.3bt=POE++ Mikrotik's 802.3af/at=POE and almost, but not quite, POE+, as mkx noted earlier the amount of current is below the one in the standard, and even raising...

jaclaz

The "cleanest" option is to use a sensor (soldering on the board will void warranty). A small circuit *like* this one: https://www.arrow.com/en/research-and-events/articles/build-and-use-a-simple-light-detector-sensor-circuit can be used as "led signal extender". Or - even simple...

jaclaz

Consumer grade equipment can run without any issues at 70C, industry grade goes to 85C or so. Military grade can surpass 120C. Yep, as said it is not "preoccupying", but it all depends on where the sensor is and what kind of dissipation happens. If a temperature sensor is near the *whatev...

jaclaz

Yep, but 20 degrees? At which voltage are you powering the hexS: 1. when using the jack 2. when using the PoE ? The hexS power supply is 24V. It accepts 12-57V as PoE In, if you are using the (normal) 48V, it could be the voltage regulator/converter that creates the heat, but it doesn't sound right ...

jaclaz

I am sorry, I have no idea about that. The (little) theory I understood is that ARP is a L2 protocol, so it should be limited to local network. From this (and the linked to Linux article): https://forum.mikrotik.com/viewtopic.php?t=176461#p865029 I understand that when you do a "normal" pi...

jaclaz

With all due respect for the good guys @Mikrotik, in this particular case something went wrong, they failed, and failed big. If they wanted to have the CHR image to be only BIOS bootable (through their - let's call it "strange" - method, bootsector code and hardcoded map) why did they add ...

jaclaz

@jaclaz, I wouldn't get too crazy. Sure, I know, it is more like, you know :wink: The way I see it, if you're gonna build a time machine into a car, why not do it with some *style?* The IPXE could be another royal PITA, I am now a bit rusty about BIOS/UEFI and filesystems, but at least in my days I...

jaclaz

Good news

, thanks.

jaclaz

@jaclaz, you're the boss - 7.17.beta2 mangled using your gdisk magic made Vultr happy. Good. :) So this part of the problem is solved, at least until the good Mikrotik guys don't change something relevant in the images. A solution to the other part ( keeping compatibility with BIOS booting) is on i...

jaclaz

So you're telling me that until now I've been connecting via RouterOS to the CPE, not the AC Lites? Yep :) . We (highly specialized technicians :roll: ) call that "barking up the wrong tree" :wink: . So if I find the IP for the AC Lites (somewhere in the range 192.168.1.10-192.168.1.200) ...

jaclaz

Well, there is something strange going on. Does the device(s) you are using look *like*: https://mikrotik.com/product/rblhgr#fndtn-gallery https://cdn.mikrotik.com/web-assets/rb_images/1874_m.png or more like: https://mikrotik.com/product/RB952Ui-5ac2nD#fndtn-gallery https://cdn.mikrotik.com/web-ass...

jaclaz

Please re-read the post just above yours, all the needed information is there, what is that you have doubts about?

jaclaz

Actually, you have none (shown).
Follow the instructions here:
viewtopic.php?t=203686#p1051720
and post your configuration.
You sure that is an AC LITE?

jaclaz

Interesting possibility.
But how/why this started happening last friday on multiple devices?

jaclaz

In that same thread there is a link to this post on another thread: https://forum.mikrotik.com/viewtopic.php?t=205042#p1059476 Where the standard configurations of a pair ( both master and slave) are posted. Since you already have one half of the old (good) configuration, It should be easy to recrea...

jaclaz

Yep, but the one you should try Is the third one, 7.15.3 using the last modified gdisk script. The idea Is that the last posted gdisk script creates (should create) an image functionally identical to the 7.14.3 modified by the full (including gdisk) kriszos script. Maybe there is still some differen...

jaclaz

As I see It, a (LTE) modem that has not a bridge mode Is a (LTE) router. So It has a WAN side (the LTE) and a LAN side (on one or more ethernet ports) that you have set with IP address 10.0.0.1. The RB2011 will have as well a WAN side (by convention ether1) and a LAN side (usually a bridge with all ...

jaclaz

So, if I get this right, the CAPSMAN appeared enabled in Winbox/Webfig while it was actually disabled in the actual (CLI/terminal) configuration?

It seems like a bug that can deceive/trick lots of people.

jaclaz

Back to the off topic SIM card size issues :shock: . I think that it greatly depends on how the actual socket receptacle is made, in theory the nano is thinner than the micro (by a teeny tiny amount, 0.67 instead of 0.76 mm) to allow the adapter to have a "back sheet" (that can often be re...

jaclaz

Yep, but if the good Mikrotik guys (who have an established record for omitting even vital documentation and even when documenting it, doing it in the most minimal and succinct possible form) felt compelled to put this info in the manual, adding even a picture, it must mean that the issues with that...

jaclaz

Coincidentally, recent:
viewtopic.php?t=210717

jaclaz

The good Mikrotik guys did warn you, though :shock: : https://help.mikrotik.com/docs/pages/viewpage.action?pageId=73826313 SIM slot usage https://manuals.plus/wp-content/uploads/2023/10/Chateau-LTE12-Routers-and-Wireless-User-SIM-slot-usage.png SIM card slot is designed to use with Micro SIM cards. ...

jaclaz

It should be checked, if under the thermal pad there is another chip, and from the white L shaped marks it seems like the heatsink should have gone over TWO chips, the one where the thermal pad still is and the other one without thermal pad, it would make little sense to place the heatsink in a so m...

jaclaz

Only for the record, and as a side-side note, besides using the "right" adapter and not attempt to combine two into one, metal adapters (as opposed to plastic) do exist, they don't cost (IMHO) excessively more and they are much more sturdy and the SIM fits in them more tightly.

jaclaz

The built-in bitwise XOR: https://wiki.mikrotik.com/wiki/Manual:Scripting#Bitwise_Operators should work also for IPv6 and num data types: Bitwise Operators Bitwise operators are working on number, IP and IPv6 address data types. So, using your code but with IPv6 (and : instead of . as separator) you...

jaclaz

Check if they are of this kind called MS156:
viewtopic.php?t=153582

jaclaz

Very good :) . So, as soon as Sindy will be able to (hopefully) report success in the environment(s) he uses, the matter should be pseudo-solved. Still, if the image (with just the ext2 to Fat16 conversion) works, running the gdisk script makes little sense, once set aside the things we have learned...

jaclaz

Removed once and destroyed nanosim-to-microsim-to-sim adapter because it was very difficult to pull it out. Sure, life stinks. :( Anyway, there are three common adapters in a kit: 1. nano to micro 2. micro to standard 3. nano to standard Sometimes 1+2 doesn't make 3. The nano to micro is so thin on...

jaclaz

Isn't there a (removable) SIM card?

jaclaz

To expand on the above, wireless wire kit is philosophically like a two ports managed switch. An IP address for it is needed only for management, it can be *any* address, as long as it is reachable. This particular two ports switch is however divided in two, so it needs two IP addresses, again, sinc...

jaclaz

Sorry, double post.

jaclaz

OK, it has been a nightmare (as it often happens) but I found out that the chr-7.15.3.uefi-fat.raw image (thanks Amm0) boots in virtualbox. A .vmdk descriptor is needed, but it is easy to make: # Disk DescriptorFile version=1 createType= RW 262144 FLAT "chr-7.15.3.uefi-fat.raw" 0 ddb.uuid....

jaclaz

Link to the actual page containing links to the various documents: https://fccid.io/TV7WAPGR52AX A rendering of the new device can be found in: https://fccid.io/TV7WAPGR52AX/Label/Label-7634072 It appears like a rather compact device, probably around 10x15x3 cm. I haven't found actual photos, but I ...

jaclaz

About BIOS booting, it cannot really work, as some parts are misssing: 1. MBR boot code - check 2. MBR partition entry for the first partition active - check 2. Magic Bytes (55AA) in the MBR - check 3. Boot code in the bootsector - check (to be verified) 5. BPB (Bios Parameter Block) in the bootsect...

jaclaz

Yes, each partition is one sector bigger in the GPT partition table than in the MBR one. The two partitions start on both MBR and GPT partition tables on Sector 34 and 65570. In the GPT the first partition goes then over the second. The second goes over the space marked as occupied by the backup GPT...

jaclaz

Well, the overall script changes anyway the filesystem from ext2/3 to FAT(32), evidently that is the "key" (and compatible with the UEFI requirement). On PC's, there are UEFI installable drivers (some made by the motherboard manufacturers or the one by P.Batard, the Author of Rufus for NTF...

jaclaz

@Ammo Problem: partitions 2 and 1 overlap: Partition 2: 65570 to 258048 Partition 1: 34 to 65570 Aborting write of new partition table. .... Recovery/transformation command (? for help): /dev/nbd0 disconnected That is not "an error", it is a "critical error", as it means that the...

jaclaz

@Ammo Ok, the Linux version then finds the same errors as the Windows version I tested and after the changes it writes to the image. (Do you want to proceed? (Y/N): OK; writing new GUID partition table (GPT) to /dev/nbd0. The operation has completed successfully). But what is the same output with th...

jaclaz

So we are back to the reason why I made a few slightly different scripts. The first one is the one that should produce an image most similar to the one as modified by the original script. I don't have handy a suitable Linux environments right now, not a suitable VM, so I am not able to test the resu...

jaclaz

Ah. OK. In any case the three different scripts may come useful in case there is the need to experiment, should the chosen one fail (for this or that reason). The script that I believe creates the most correct output is this one (the one called "MODIFIED SCRIPT3 (pure EFI/GPT, NO Hybrid) "...

jaclaz

can i have OFF, port 1,2,3,4,5 and ON port 6,7,8? Yes. (there is always some confusion between interface and port, as they can be synonym or mean different things, as a matter of fact the single ports (or standalone interfaces) are changed under a /interface sub-menu. /interface ethernet poe set et...

jaclaz

in this case, what adhesive you use? replace the current adhesive? Usually you just get a replacement thermal pad, if you cannot find one of the exact size you can buy a larger one and cut it yourself to measure. Specific thermal epoxy glues do exist, but if the original was setup with a thermal pa...

jaclaz

Yes and no (mostly no). Your RB5009 can provide PoE (PoE 802.3af and - almost - PoE+ 802.3at) and comes with a 48V2A96W power adapter, BUT the output on a single port is current limited, so you can have on a single port 440 mA (@48V). The CRS310 has no provision for PoE in, but accepts 18-57 V on th...

jaclaz

I am not sure to understand the problem, PoE can be switched :
poe-on=auto-on | forced-on | off
on a per-interface basis:
https://help.mikrotik.com/docs/display/ ... rtSettings

Port Settings

PoE-Out can be configured under the menu. Each port can be controlled independently.

jaclaz

Improving, learning, experimenting, maintaining, monitoring -- that's the whole point.

I thought that the point was more like improvise, adapt, overcome, let it be

(i.e. have the d@mn network running, then leave it alone until/if it breaks

) .

jaclaz

I can offer testing the images on both Proxmox and Hyper-V and, once that proves successful, even in the paid environment, but I suspect the logistics might be a bit complicated. If you have the time/will to test (before the images), the actual gdisk script on a Linux machine, it's fine, no need to...

jaclaz

Only as a side-side note, I could never understand the (I believe general) love for DHCP on simple, small, "static" networks. Of course it is a must have for wireless, and useful for cabled PC's, but cameras? I can imagine very few things as "static" as cameras, you have to go th...

jaclaz

Yes, that way could work. But the switch has NOT any network, it is L2, the AP can have the "normal" network and be bridged to the rest of the network, if there is a connection from the Hex to the PoE switch to which the other cameras are connected, the two added cameras can have the same ...

jaclaz

I think I speak for almost everyone,
writing that there is no one who does such a foolish thing.

I instead suspect that there are plenty of people doing even more foolish things, only they don't have the ingenuity (or the guts) to publicly admit doing them.

jaclaz

Good to know. I believe that also using the 7.14.3 image as base and replacing/resyncing the files on the two partitions with the 7.15.3 ones should work. Is there a free environment where the image bootability can be tested? I made a few tests and the image for 7.15.3 should be fixable through a sl...

jaclaz

Double post, removed.

jaclaz

Do you mean like inserting a

delay 10s

before the line running PrincipalDown script?

jaclaz

Maybe via Wayback Machine:
https://web.archive.org/web/20230311130 ... tings-list
https://web.archive.org/web/20230311130 ... list#toc_2

jaclaz

You could have the two added cameras on a small, completely different, network, with only three devices in it, let's say 10.0.0.0/29 (ok, six addresses). Then you could use the Hex (or a hap Ax lite) placed near the Windows PC to route or netmap them to 192.168.5.x addresses, but of course this devi...

jaclaz

A switch is L2. IP addresses are L3. For all it matters to the switch you could connect to one of its ports a device with *any* IP address, it is a connection on another level. The issue (or non issue) is only that the two networks won't be anymore physically separated, i.e. the two added cameras wi...

jaclaz

Yes and no :shock: , that may (or may not) be the issue (that then could be solved by only creating a FAT32 volume with the boot loader on it), but the script additionally attempts to solve the non-bootable issue by using a hybrid MBR alright, besides the FAT formatting: ( echo 2 # use GPT echo t # ...

jaclaz

It should be avoided by using fasttrack, but you seem like having it enabled alright. Maybe it is an artifact of the test, or of the device used for it, see this thread (where another possible cure, queues, seems to come out like being often worse than the illness): https://forum.mikrotik.com/viewto...

jaclaz

Yep, essentially the posted bash script makes use of gdisk (a version of it can run also on Windows, if you are not running Linux) by Roderick Smith, which is the defacto standard for checking/correcting/modifying MBR and GPT images or disks: https://www.rodsbooks.com/gdisk/ and can - among other th...

jaclaz

The setting shouold be only on the "wireless" package (not on wifi/qcom-ac). https://help.mikrotik.com/docs/display/ROS/Wireless+Interface distance (integer | dynamic | indoors; Default: dynamic) How long to wait for confirmation of unicast frames (ACKs) before considering transmission uns...

jaclaz

It works now with IPv4 Fullstack ! Thanks for the help.

Good.

I still wonder how the "IP sharing" works when the ISP router is set as router.
Maybe they do some kind of remapping of ports, assigning one fourth of them to each of the four co-users?

jaclaz

Your configuration seems just fine to me. Since the ether1 is getting its IP from the ISP router/modem (and consequently routes), it is likely to be an issue with what your ISP provides. Your case seems very similar to this one, same Freebox and same issues with bridge vs. router mode: https://forum...

jaclaz

Hard to say without knowing your configuration.
It could be a mis-configuration of NAT or firewall filters, but also any issue with routes and/or missing/conflicting IP addresses.

Follow the instructions here:
viewtopic.php?t=203686#p1051720
and post your configuration.

jaclaz

Only as a side note, in the few "official" videos from Mikrotik I have watched (I simply cannot bear videos, but that's just me) I have noticed that the good Mikrotik guys often use Macs, so I believed that they are "Apple users" (last time I had a Mac and an iPad I was practical...

jaclaz

I cannot see at first sight anything obvious, but I am a bit perplexed by your settings for static ARP, I don't know but it seems to me like you risk some kind of conflict between your static arp entries and DHCP leases, I am not sure that this is "right": /ip arp add address=192.168.88.24...

jaclaz

Yep, rest assured it is not you fault, usually when searching on Google the first results are on the (old) wiki that often gives obsolete info, then, when you get to the right "help" site finding the relevant information you are looking for is often challenging. The way the topics are orga...

jaclaz

Ah, ok, it should be clear that nothing is ever perfectly secure, but the probabilities of something happening (or not happening) should always be considered when attempting to implement settings or procedures intended as defense or countermeasures. In a post-mortem it is of course different and unt...

jaclaz

I am not sure to understand what you did.
You should post the output of /ip route print at the exact time and in the exact conditions when you are having the issue you are trying to troubleshoot.
If you change some of the conditions, the output may be misleading.

jaclaz

Yep, so - essentially - we are still (back) in the "you'd better use a different network, or you could ..., but ...". BTW mtest001 has already posted another tested approach using (or mis-using) proxy-arp here: https://forum.mikrotik.com/viewtopic.php?t=200602 this proving that VRF's are n...

jaclaz

We all know about exploits which (often with help of a user) compromise some LAN-connected computer which then serves as entry point for further attacks. With all due respect, surely they exist, but what is the ratio from_LAN/from_WAN, more like 1:100 or more like 1:10000000000000000 zillion occurr...

jaclaz

Maybe you have some previous instances that did not release connection, see: https://forum.mikrotik.com/viewtopic.php?t=45719 That could actually be connected with DHCP connection issue, if I get the linked thread right, fetch attempts to connect and if it fails, the job may remain "hanging&quo...

jaclaz

If the LAN side is also on 192.168.1.x/24? :? This is where I always fail to get a proper answer. I have always thought (and I may well be very wrong) that if the LAN side interface is 192.168.1.x/24 the other interface(s) can be either: 1) in the same 192.168.1.x/24 and then the device needs to be ...

jaclaz

Yes, all your routes involving 190.xxx.xxx.254 are ISH in the /ip route print you posted. Even the Dynamic one for that network is DIcH, even if it has distance 0, being dynamic (like your other dynamic routes) it should be DAc. It is like you had no ethernet cable connected to ether2 (or however no...

jaclaz

Maybe I'm missing something here... But what is the point of using VRF for ISP failover? — VRFs have nothing to do with "automatic failover". Failover works without VRFs, and so layering VRF on top of failover mechanisms just make config even more complex. The point is about having multip...

jaclaz

You have a direct route on 190.xxx.xxx.254, besides the recursive one via 8.8.8.8: /ip route add disabled=no dst-address=0.0.0.0/0 gateway=190.xxx.xxx.254 routing-table=\ main suppress-hw-offload=no add check-gateway=ping comment="RUTA FIBERTEL" disabled=no distance=10 \ dst-address=0.0.0....

jaclaz

I guess it greatly depends on the "type" of shop/business, small ones, possibly managed by younger people, go for newish devices, such as sumup, zettle or similar.
But I would say that - say - 90- 95%+ use the solution provided by the bank (which ends up being Ingenico).

jaclaz

Make an export if possible, that will help you reconfigure after netinstall.

Unless there is some other trick, I don't think so, If it is the same attack as on the given link the admin user is prevented from opening Terminal.

jaclaz

Are both router1 and router2 Mikrotik devices? If yes, which models? ether1 is a (the first) RJ45 port lte1 is (usually the only) LTE interface (3G/4G modem) The wifi interfaces are "wlan" (wlan1, wlan2). You normally use the scheduler for disabling an interface for a given period (daily o...

jaclaz

It sounds like your device has been attacked/hacked, there are several reports that an user "system" is created with all privileges and admin is limited to only a few ones. https://forum.mikrotik.com/viewtopic.php?t=202945 Only way out - I believe - is netinstall and start again from scrat...

jaclaz

A list of compatible devices (or more likely chipsets) has been posted here:
viewtopic.php?t=196111
it seems like limited to vary few devices and the AR5B22 or AR9462 are not among them.

jaclaz

At least here in Italy most "mobile" POS (Point of Sale) card readers come with their own (GSM or LTE, cannot say) modem and SIM (cannot say if physical SIM or e-sim) as they are provided (rented) by the bank or financial firm that has the convention with the cards (like Visa, Mastercard, ...

jaclaz

Post your complete configuration for review, (anonymizing/masking sensible data) instructions here:
viewtopic.php?t=203686#p1051720

Or compare your setup with the one in this thread:
viewtopic.php?t=196448
maybe the solution is there.

jaclaz

Maybe related, maybe not, Windows (I am presuming Windows 10 or 11) does normally not respond to pings (if the network is categorized as Public, it should work if Private, but sometimes it is needed to change a firewall rule on windows). See: https://community.fortinet.com/t5/FortiGate/Troubleshooti...

jaclaz

@aleab The issue you are having is a known one. There is not (yet, seemingly things are in the works) support for DNS in vrf's. I have a similar setup, in my case I "reversed" the vrf, putting it on the LAN side, so that the interfaces on the WAN side are on "main", and thus the ...

jaclaz

This type of SIM holders are tricky, it is not Mikrotik only, they are used on other manufacturers devices as well, in many cases that extra push is needed and there is the risk of accidentally damage the SIM with the tool used, ideally one should use a plastic one. And sometimes the SIM gets stuck ...

jaclaz

802.3af/at is NOT 24V:
https://en.wikipedia.org/wiki/Power_over_Ethernet

jaclaz

Not with a 48V power supply. They may work if you power the RB5009 at a lower voltage 24V or so. But if you do so, all Poe out ports of the RB5009 will be at this lower voltage and other devices actually 802.3af/at compatibile that you may want to connect to other ports won't work. There are splitte...

jaclaz

Place the hap Ax lite vertical on its "feet" (or rotate the photo you posted 90 degrees counterclockwise) and compare against the instructions picture. It seems to me rather accurate. And you are inserting the SIM with a different orientation from that picture/drawing. With the hap Ax lite...

jaclaz

Which camera? Most cameras are either non-PoE (and need a splitter/converter) or 802.3af. To extremely simplify, 802.3af means 48V. That Hex PoE lite is passive PoE, which - again extremely simplified - means 24V. They talk very different languages. The power adapter coming with the Hex is 24V 2.5A,...

jaclaz

And again: To get some meaningful help you should follow the instructions here: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 and post your current configuration. About the DHCP server, if - as it should be - you have a bridge between ether1 and wifi interfaces, and you have a DHCP clie...

jaclaz

To further explain, the "general" action is src-nat, masquerade is a special form of source nat that auto-computes the ip address.
See:
viewtopic.php?t=11368
viewtopic.php?t=98960

jaclaz

Do you think that is a valid strategy?

No idea, but you should post again your current configuration, so that some members experienced with VLANs (and VAPs) may give you some more hints/advices.

jaclaz

Maybe connected, maybe not, but VLAN1 is generally a no-no:
viewtopic.php?t=208061

jaclaz

But does it remain unreachable even if you (for testing) disable the "main" 0.0.0.0 route or set it with distance 3?

jaclaz

The 04 should be fine, it is the 05 (now removed) that created the biggest issues: https://forum.mikrotik.com/viewtopic.php?t=204440#p1058092 Still blindly updating everything together at the same time just because someone, even Mikrotik, tells you to do so is not particularly smart, because if you ...

jaclaz

You must upgrade the device to the last stable version, not downgrade! He knows, he is asking if there is a way back, should the upgrade not provide increased stability. Not saying that it always pays to be prudent/conservative, but right now the OP with an oldish RoS version and oldish modem firmw...

jaclaz

Downgrading from running RoS version to any earlier one (down to the factory installed one, no earlier) is always possible and relatively easy, see: https://forum.mikrotik.com/viewtopic.php?t=194542 There has been a change in wireless packaging/modules between 7.12.x and 7.13, but that shouldn't be ...

jaclaz

Yes, but the dubitative form is anyway appropriate when the standard power supply is used, the 24V/1.2A are IMHO very "tight" to power both the "main" device and another one via (passive) PoE. As said PoE is already a mess in itself, but the good Mikrotik guys, with their lacking...

jaclaz

re:vlan ID 99 The board parser shows them in green (as if they were a comment and not a valid setting): add bridge=LAN_bridge tagged=ether2_Switch_1,ether3_Switch_2,LAN_bridge \ untagged="ether4_SmartHome_Controller1,ether5_SmartHome_Controller2,ether6_NVR,ether7_Synology,ethe\ r8_ProxMox"...

jaclaz

For the moment I wouldn't update the RoS (unless you are missing some other feature implemented in later versions) and definitely not the firmware of the LTE thingy, given the issues reported on the mentioned thread that seems objectively worse than the ones you are reporting.:

jaclaz

PoE is a mess in itself, and Mikrotik doesn't help with the confusing documentation they provide. The hap Ax2 is documented as having PoE out: PoE-out ports Ether 1 PoE out Passive PoE Max out per port output (input 18-30 V) 600 mA Max total out (A) 0.6 A Total output current 0.6 Total output power ...

jaclaz

You seem to be affected by the USB device detection bug holvoeth mentioned. It seems to be affecting some devices (USB sticks from a given brand, namely Sandisk) more than other ones, there are a couple workarounds that you could try integrating in your script, either reset the USB bus or rename the...

jaclaz

Not at all a "solution" to your issue, but if the failures are one or two weeks apart a workaround would be to set a scheduler to reboot the router once every (say) two days at (still say) 4:00 in the morning (i.e. at the time when it is likely not in use). I would however check if the con...

jaclaz

It could be. Rebooting when testing a configuration is almost always a good idea, not only because some settings actually *need* a reboot to work, but because a reboot is the best simulation of what happens next time you have mains returning after a blackout or when you take power out for any other ...

jaclaz

I don't know, at first sight your dhcp settings look fine to me: /ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=\ 192.168.88.0 add address=192.168.89.1/24 comment=myconf interface=wlan1 network=\ 192.168.89.0 /ip pool add name=dhcp_pool0 ranges=192.168.89.64-192.168...

jaclaz

Coughy, which EXACT "POE device" are you trying to power? Make/model, please. Mikrotik devices such as the hapAX2 provide a (actually a bit limited in current) out voltage that is at the same level as the voltage that powers the device. So if you are powering the Ax2 with the standard 1.2A...

jaclaz

Yep, your proposal is just fine, everything is in one place, and it would be even better if the settings would be moved from "main"
/interface ethernet switch port
to its own level:
/interface ethernet switch port mirroring
or
/interface ethernet switch port mirrors

jaclaz

Maybe a bit OT, cannot say if things have changed (probably they did) or whether my following anecdotal data was the effect of a "rogue" device, but I remember many years ago a small office network brought down to its knees when a NAS device was added to it. It came out that the device was...

jaclaz

Yep, I understand now, you like to win easily, don't you? :lol: You should never copy and paste a whole configuration anyway. For three reasons: 1) some commands may sort of overwrite existing settings improperly (as an example increasing a reference) 2) some commands may make no sense (to the under...

jaclaz

Yes, you can do the reset from the button or - if you have access to the unit (like you have) from terminal command line or winbox (easier). See configuration reset here: https://help.mikrotik.com/docs/display/ROS/Configuration+Management https://help.mikrotik.com/docs/display/ROS/Configuration+Mana...

jaclaz

In theory, there is a default configuration (made in factory) that can (maybe) still recovered doing a reset. But for all we know it could also be that (for whatever reasons) there has been an error in packaging or an exchange of units in this or that passage from Mikrotik to the importer, from the ...

jaclaz

Sorry, I meant the cube pro ... which has both 60GHz and 5GHz radios. Then an actual default configuration is here: https://forum.mikrotik.com/viewtopic.php?t=205042#p1059476 The wlan1 and w60g are bonded into interface bond1: Master: /interface w60g set [ find ] disabled=no mode=bridge name=wlan60...

jaclaz

Well, if I have ether1, ether2, etc., I surely can have mirror-source1, mirror-source2 and mirroring1, mirroring2, etc. BTW, I don't oppose to changing names of properties/obiects/whatever I am opposing to the idea that *something* to work needs settings in two different places. Another, still IMHO ...

jaclaz

Cannot say why your deices are like you describe, but setting them up as they should be is relatively easy. The 192.168.88.1 is the default for a "single" Mikrotik device. Cube Pro pairs usually have 192.168.88.2 and 192.168.88.3. Maybe someone tested them and ran Quickset (or whatever), b...

jaclaz

Here you are:

#Hypothetical syntax
/interface ethernet switch
set switch1 mirror-source1=ether2 mirror-source2=ether4  mirror-source3=ether4 mirror-target=ether3 mirroring1=egress mirroring2=ingress mirroring3=both

jaclaz

Optical cables are more robust than one thinks, BUT they don't like to be bent with a smallish radius nor to be pinched. I wouldn't say that they are fragile, they only need to be treated with some respect. Though field connectors/splice ferrules do exist, they are not exactly easy to assemble, even...

jaclaz

I believe that the speed of the 60 GHz link degrades (decreases) if (say) the rain increases until connection is lost but the 5 GHz link replaces it immediately. How long is the "immediately" I cannot really say. Since the two interfaces are in a bonding, they are essentially a same interf...

jaclaz

@mworsnop
It seems to me like a good plan

.

If you go for the XS+85LC01D you are "safe", there shouldn't be any compatibility issues, and you have some slack for changing the hardware to even faster speeds in the future.

jaclaz

It is one of those (actually trifling) things that make you believe that sometimes the good Mikrotik guys do not think too much before changing a syntax. I mean, I do understand how the new syntax allows to select whether the miroring is ingress or egress traffic (or both) but it could have been imp...

jaclaz

I am on 7.16rc4, but it also happened with 7.15. https://help.mikrotik.com/docs/display/ROS/CRS3xx%2C+CRS5xx%2C+CCR2116%2C+CCR2216+switch+chip+features#CRS3xx,CRS5xx,CCR2116,CCR2216switchchipfeatures-PortBasedMirroring Port Based Mirroring Starting from RouterOS version 7.15, it is possible to conf...

jaclaz

But do you have a "switch1"? I asked for the output of /interface/ethernet/switch because yours could be called "switch2" or "mickey mouse", and in some cases it may be easier to refer to the number (that you should get from the output of print). Or try command line aut...

jaclaz

What do you get with: /interface ethernet switch print The command seems loosely of the kind: set <object> <attribute1=value1> <attribute2=value2> Once you are in: /interface/ethernet/switch the command: set switch1 mirror-source=ether2 mirror-target=ether7 is different from the one you posted: set ...

jaclaz

Yep, there isn't that much choice (within Mikrotik range of products) for a suitable single device with dual band 60/5GHz links, I believe only: https://mikrotik.com/product/wireless_wire_cube_pro It is just a kit of two Cube Pro's pre-configured, it is not cheaper than two separate Cube Pro's but s...

jaclaz

Semi-random idea, but do you really-really needs to run 7.15.3? I know that Mikrotik calls it "stable", but it is still relatively new and testing RoS on switches is probably less common than on routers, so it is still IMHO well possible that there is a not yet reported/solved bug in the s...

jaclaz

I think you inverted the screenshots or inverted the scheme/drawing addresses. One router has 1 static route and two Dynamic/Automatic one: AS 0.0.0.0/0 gateway=172.16.0.1 <- this sets the interface with ip address 172.16.0.1 as the gateway for ALL outbound traffic DAC172.16.0.0/30 gateway=? <- this...

jaclaz

The issue is - I believe - your definition of "connection". Devices such as the Cube have built in - not so casually - a 5GHz "failover" radio, this means that the 60 GHz will - occasionally - fail, the 5 GHz is much less prone to issues with adverse climate (fog/heavy rain). So ...

jaclaz

Ooops :oops: . my bad, I wrongly assumed that you were making a sort of wireless wire connection. Not at all an expert with Mikrotiks, particularly when it comes to wireless settings, but from what I understand when you are using AFRINET to connect (say) a laptop and start downloading a large file, ...

jaclaz

Check by opening a terminal and issuing in it: /interface/detect-internet/print if you see it as "none" after you changed it in Winbox (before rebooting) BUT it changes back to "all" after a reboot, there must be a script (or *something else*) that re-initializes it. That whole s...

jaclaz

Very likely irrelevant to your (speed) issue, only notes, at a first read: 1) usually bridges are set with auto-mac=no and given a fixed MAC 2) you have wlan1 largely not configured, but in both devices it is set as ap-bridge, if you don't use it, it will be better if disabled on both devices 3) you...

jaclaz

Giving you a much broader and cheaper set of switch choices. Hmmm. Yes and no, if you look at the costs, compared to CAT6/6a/7 patch cables, let's say 5-10 US$ each, using DAC's you are going to need some 20-30 US$ per connection, while using fiber (or copper) SFP's, more like 60-70 US$ at least, s...

jaclaz

Good

, AND I'll move it one notch up:

1) You do not use VLAN1
2) You DO NOT use VLAN1
3) You do not use Quickset
4) You do not use detect internet
5)...

jaclaz

Maybe this post will be relevant to your situation:
viewtopic.php?t=187932#p947857

jaclaz

The whole concept of innocent until proven guilty?

Overridden by Andreotti's famous:

You sin in thinking bad about people - but, often, you guess right.

jaclaz

@holvoeth Your correction is overruled :lol: : Judge Chamberlain Haller: Mr. Gambini? Vinny Gambini: Yes, sir? Judge Chamberlain Haller: That is a lucid, intelligent, well thought-out objection. Vinny Gambini: Thank you, Your Honor. Judge Chamberlain Haller: [in a firm tone] Overruled. rules need to...

jaclaz

AFAICU SwOS is just fine (and simpler) if the switch is used as "simple" managed switch, but with RoS you have more possibilities, if needed. The way a router (designed as a router) and a switch (designed as a switch) differ is in the way the ports are connected to the CPU and between them...

jaclaz

I think I will add this to my Mikrotik Club Rules

:
1) You do not use VLAN1
2) You DO NOT use VLAN1
3) You do not use detect internet
4)...

jaclaz

... or causes random problems (worst case).

Judging from the reports I have seen on the forum, the worst case seems to be the normality...

jaclaz

I think telnet in Mikrotik is "interactive only":
viewtopic.php?t=69786

jaclaz

But you already have a route towards the internet (it should be provided by the lte1 interface by itself), the one in your screenshot: DAS 0.0.0.0/0 lte1 reachable is telling the router that any address in 0.0.0.0/0 (all the addresses) should go through lte1. From terrminal, you can check with: /ip ...

jaclaz

In modern windows, the default is to NOT replay to pings, so, unless you change that setting, pinging will result in timeout, but even if the error/result is the same it is not like your PC Is not reachable from the Mikrotik, simply the PC does not respond. 192.168.86.x and 192.168.88.x are two diff...

jaclaz

Interface list is a way to categorize/group items, so It Is the other way round, bridge Is in the category LAN, lte1 is in category WAN, bridge_wlan does not belong (yet) to any category (it doesn't need to belong to any of the two above or to a third one) . In the masquerade rule you use out-interf...

jaclaz

It seems "normal" to me.

You have two domains pointing to a same IP address.

When you src-nat and dst-nat to your local network you are using the two domains, but they will both be resolved to the same a.b.c.d IP address, wouldn't they?

jaclaz

I am not really sure what your intended setup is, but: The bridge_wlan is neither LAN nor WAN: /interface list member add comment=defconf interface=bridge list=LAN add comment=defconf interface=lte1 list=WAN And your firewall nat is only for WAN: /ip firewall nat add action=masquerade chain=srcnat c...

jaclaz

If you can use fiber, use it. Not only because it is better/faster/whatever, but because temperatures of fiber SFP's are "acceptable", copper SFP's are essentially small electric stoves (that can often create issues for the amount of heat they generate, definitely not good on passive coole...

jaclaz

If your current config works for you, good :) . You should anyway check this post by rextended on that same thread: https://forum.mikrotik.com/viewtopic.php?t=189277#p958546 Point of note: remove only connections that have a longish remaining timeout, to avoid attempting to remove connections that a...

jaclaz

The routing speed of the RB5009 is very similar to that of the CCR2004 (actually a little bit faster), so if 8 ports are enough for you, you'd better save the money for the moment. What may make the difference is if you are going to use the SFP(s), the second SFP port of the CCR2004 may be useful fo...

jaclaz

Well, start by posting your current configuration of the wsAC lite, follow this post instructions: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 It would be "unusual" that you have it configured "as router" (unless someone fiddled with it) as the common configuration...

jaclaz

The QMP comes (but the good Mikrotik guys do not show an explicit/clear photo of them) with two "attachment" devices: 1) a sort of bayonet plate suitable for the SXT and similar devices 2) a short, round, one You can see it (once you know it exists, in the second photo of the product: http...

jaclaz

Yes and no, if the devices are on a same network (let's say like in your case in a same /24) communication between them happens (should happen) at L2 level (switching/bridging) if the networks are different the communication happens (should happen) at L3 level (routing) or however some specific sett...

jaclaz

If you need more SFP's probably you should add a (passive cooled) switch, *like*
https://mikrotik.com/product/crs309_1g_8s_in
https://mikrotik.com/product/crs310_1g_5s_4s_in

jaclaz

Which main board device ( above) would you get? Also What switch for would you get? Strangely enough it depends on your requirements, number and type of devices, internet connection, what kind of speed you want to achieve and which infrastructure you have (cables) and budget. The CCR2004 @$465.00 i...

jaclaz

I think the advise was to make your MAC static and different from any other one you have on that machine, see this: https://forum.mikrotik.com/viewtopic.php?t=190747 There are reports that the mechanism the RoS uses to auto-assign MAC can, in certain situations, change the MAC, creating havoc in cer...

jaclaz

Shouldn't be too different from:
viewtopic.php?t=163396

jaclaz

About docker on mipsbe I'vefound this topic, but doesn't report the way to obtain it:
viewtopic.php?t=187595

Well, that is what is generally referred to as "wishful thinking":
https://en.wikipedia.org/wiki/Wishful_thinking

jaclaz

I think a line must be drawn *somewhere*, between "same network" and "other network". If your PC has 192.168.88.253, i.e. belongs to network 192.168.88..0/24, and the bridge on the Mikrotik is /ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=\ 192....

jaclaz

Good, so kleshlki's example in post #28 or your reported adaptation in post #29 (minus typos/errors) are the right references "as they are".

jaclaz

I made a mistake in the last step — datapath configuration. I fixed it and it worked

It would be nice if you could describe exactly what the error(s) and the correction(s) were, so that this thread may become useful as a reference for similar issues.

jaclaz

The common reports about 60 GHz Is that you need clear line of view, even some fog or medium heavy rain can compromise the link, tree leaves are a no-no. A Cube in such a setup will likely continuosly fall back to the (much slower) 5 GHz. Besides the SXT SA5 AC, which I believe is intended for much ...

jaclaz

You can also use "/system/script export where name=XXXX" to get the "escaped form" of any script (and then cut-and-paste that as needed).

Good to know, thanks

.

jaclaz

When you have PPPoE up: 0 ADS 0.0.0.0/0 pppoe-out1 1<- this is (DHCP) and Active, ALL outbound traffic goes through this 1 S 0.0.0.0/0 192.168.8.1 2 -<- this is (Static) and NOT Active (because of higher distance=2), so it is irrelevant 2 A S 1.1.1.1/32 pppoe-out1 1<- this, (Static) is Active and be...

jaclaz

ROSv7 is too generic.
Different versions of 7.13, 7.14 and 7.15 (besides latest-latest 7.16) have been object of alternate reports of instabilities on Wi-Fi.
From what has been reported, 7.14.3 seems to be the safest bet or - at least - the better "base".

jaclaz

These: add dst-address=0.0.0.0 gateway=192.168.8.1 distance=2 add dst-address=1.1.1.1 gateway=pppoe-out1 distance=1 Should actually be, I believe: add dst-address=0.0.0.0/0 gateway=192.168.8.1 distance=2 add dst-address=1.1.1.1/32 gateway=pppoe-out1 distance=1 (but maybe the network is implied) But ...

jaclaz

At a quick glance I see two common settings missing (cannot say if you avoided them on purpose):
1) static MAC address to the bridge
2) categorizing ether8 as WAN

jaclaz

We're talking about a boat here, so few other factors make it bit harder of a problem. e.g. it's going to bake in sun, vibrate/move slightly (wind), and perhaps be in salty air. So even @normis's reasonable and fun suggestion to 3D print a case for a Chateau, requires a high-temp printer to use som...

jaclaz

@mkx
Well, I paid 1.80 for that same cable, so it costs us nothing - combined - we are still ahead, and we can even afford to pay the unjust and unfair duty the Sheriff of Nottingham just imposed on us.

jaclaz

There are AFAICU mainly two consequences of using VLAN1: 1) possible incompatibilities with other vendor devices 2) possible incompatibilities with Mikrotik internal usage of VLAN1 for *some settings*, i.e.: https://forum.mikrotik.com/viewtopic.php?t=206946#p1071170 I am pretty sure that expert, kno...

jaclaz

So you have no firewall filter rules that may interfere? I see now that you did declare the vrf's, my bad :oops: . I don't particularly appreciate your naming scheme, when/if you will need to use ether2@port1 you will see why, but this is irrelevant. I cannot see anything blatantly "wrong"...

jaclaz

Yep, as said RF shielding is tricky business, strange that you did not notice some differences. Well, at least we tried ... An alternative (that you won't like) could be modifying the hAP lite, add an external antenna connector and use an external flat (directional) one: https://forum.mikrotik.com/v...

jaclaz

Very likely completely unrelated to the issue you still need to solve, but using VLAN1 is what we highly specialized technicians

commonly call "looking for troubles".

JFYI:
viewtopic.php?t=208061&

jaclaz

Here are some related info:
viewtopic.php?t=32935
particularly:
viewtopic.php?t=32935#p161412

And this post is the one that (for me) is easier to remember, the concept of a mirror of a /32:
viewtopic.php?t=32935#p382118

jaclaz

Wouldn't this be similar to the "Simple Static Routing" here (minus the two different WANs instead of the single one on the wiki example):
https://wiki.mikrotik.com/wiki/Manual:S ... ic_Routing

jaclaz

In a still not perfect world, but better than this one, wifi-qcom-ac would have probably been still called wifi-qcom-ac, but wifi-qcom would probably have been called wifi-qcom-ax. You would have wifi ac devices, and need wifi-qcom- ac , you would have wifi ax devices, and need wifi-qcom- ax . In th...

jaclaz

If it is v7, you are seemingly missing the explicit declaration of the three rouiting tables.
It is better if you post your whole configuration (as opposed to the parts that you believe relevant) as the devil is in the details.

jaclaz

Plwase recheck your post. RT1 is 192.168.1. 1 , you wrote 192.168.1. 2 in a few places. Post the configuration of the RT1 too. I think it is better to go step by step, i.e. if PC1 connection to RT1 is not working the issue can be in three places, (besides PC1), SW2, SW1 and RT1, but if SRV2 connecti...

jaclaz

Yep, there was a photo posted some time ago, about picture on the box and actual contents, cannot find it right now, but this one will do:

jaclaz

That TP-LINK thingy is not a standard (which standard?, I love standards, there are so many of them :wink: ) PoE device. The PoE injector that comes with that is intended to be more than anything else an "extension cable" powered by the "normal" power supply that comes with the d...

jaclaz

Now we are waiting for the Stable version before officially using it into production.

JFYI, in Mikrotikish "stable" has a somehow different meaning than "production ready".
I think it is one of those language subtleties that are lost in translation.

jaclaz

@bpwl That seem like one of the few cases where a cAP might be more useful than a hAP if you mount it on a ceiling or high on a wall. @acrophobic Sure, if you have the possibility a sheet of aluminium some (say) 2 mm thick would be light enough and have the mechanical resistance to hold the two devi...

jaclaz

The / only means "start from root", if you prefer without it it is a "relative path", with it it is an "absolute path": The good thing about RoS (and not only) scripting is that everyone can (within limits) write anything the way he/she likes :) (including overcomplicat...

jaclaz

As said it would IMHO be advisable to add a /32 route for the destination and leave the general 0.0.0.0/0 gateway alone. The gateway set in your lggh devices is only used for (say) NTP or something else, unless you expect days long interruptions of the lte, the 2 wireless devices can live without in...

jaclaz

Thanks for all for the possible solution, i have another question, the ping or the netwatch functions use the system gateway for the instradation, i think that i have to set first it in the script otherwise i have a infinite loop, is correct? Sorry, I don't understand the question, can you try expa...

Search found 1551 matches