MikroTik

jaclaz

Good.

There still remains the issue (or the non-issue) of a practically non existent firewall.

Up to you if you can trust the firewall(s) - if any - of the ISP router(s) or if it is the case to configure a "proper" set of firewall rules on your hex.

jaclaz

Post an export of your actual configuration (change addresses /anonymize it if needed) as per:

viewtopic.php?t=203686#p1051720

as opposed to your own textual representation of it, the devil is in the details.

jaclaz

I really appreciate your thorough reply. I learned something new today. You solved my issue in a day when the internet couldn't help me for weeks.

sindy 1
internet: 0

Go, sindy, go!

jaclaz

The issue is clearly (from your screenshot) that the two routes for 0.0.0.0/0 are S (Static) while they should be AS (Active Static). No idea why that happens though :( . Have you tried rebooting the router after all the additions/modifications? Please reboot it and then do a new export and post the...

jaclaz

No, why do you want to change the device? You have at hand an Ax lite LTE6, use that. An Ax lite can be configured as Access Point just fine (of course you need not any firewall on it and the LTE will be disabled/not used). The issue is only that: v6.xx used drivers for the local radios that were co...

jaclaz

I cannot find a complete one. The essence can be found here: https://superuser.com/questions/1855137/setup-of-new-mikrotik-router-to-act-as-a-switch-with-wifi-enabled On the other hand, if you start with a blank configuration (let's say you've factory-reset it, then connected via mactelnet/macwinbox...

jaclaz

The idea of having a free, self-standing port for emergency access is only that of having an emergency access, it is relatively easy to lock oneself out of Winbox MAC access too when fiddling with settings. Your current situation is not "normal", unless (intentionally or accidentally) disa...

jaclaz

can you describe more, what do you thing by that

viewtopic.php?t=208899

jaclaz

Good, so you need a "normal" AP setup. Complete examples for a "pure" AP setup on 7.x are rare (most are for older v 6.x or however for "wireless" whilst you have "wifi" or are related to the much more complex CAPSMAN setup). But it should be pretty much strai...

jaclaz

Well the first few rules of the Mikrotik Club are: https://forum.mikrotik.com/viewtopic.php?t=212419#p1108288 VLAN1 is seemingly used internally, and using it externally may create issues: https://forum.mikrotik.com/viewtopic.php?t=206946#p1071170 If you really cannot change those UNIFI VLAN 1 setti...

jaclaz

It is not a good idea to have a router facing the internet without a firewall, and thus granting connection to the router itself (Ok, a user NOT default and a secure password would help) and to any device in your LAN from the outside, but you have as gateways 192.168.1.1 and 192.168.8.1, so the devi...

jaclaz

I have router in my garage and simply the signal in upper floor is pour but I have sockets RJ45 in each room so was thinking to connect Mikrotik to one of the socket and repeat same wifi as primary router in the garage. It is not at all clear (to me) what you are trying to achieve. You have a route...

jaclaz

The question is: do you really need the VRF's?
Or you can with simpler different routing tables (fib)?

VRF's can be tricky as some services might not work on them (as an example DNS is only partially working), and unless really really needed it is better to avoid them.

Post your configuration.

jaclaz

Can winbox connect via MAC address? Instead of clicking on the IP address (that will populate the field "Connect To:" with 192.168.0.1, try clicking on the MAC address of the hex, the "Connect To." will be populated with the MAC address of the device. How did you manage to create...

jaclaz

Only to keep things as together as possible, the proposed solution by sindy was tested as working in a very similar setup, here: https://forum.mikrotik.com/viewtopic.php?t=213056 At the end a couple of blackhole routes were needed in addition to avoid the second device to be reached through the main...

jaclaz

Very good.

The syntax I posted was for Ros 7, sorry

, but I see you adapted it to your Ros 6.x just fine

.

jaclaz

Why, in my day ... [1]
All I had was a Sinclair Zx80, 1 kb memory and I had to solder components myself.
And we liked it
.... kids today.

[1] https://tinyapps.org/blog/200702250700_ ... y_day.html

jaclaz

What are the routes (/ip route print) at the time the machine is disconnected (pull the cable)? Very likely the routing rule (that is for "new-routing-mark=port1") that in your posted output is #0 is not anymore AS (Active, Static) but becomes just S or IS (Inactive), and either the "...

jaclaz

You can copy and paste those configurations on the board, only, please put them inside "code" tags, the button that looks like a fat dot inside square brackets or as </>, see:
viewtopic.php?t=203686#p1051720

jaclaz

viewtopic.php?t=210305#p1093070

jaclaz

The "active address" in that row seems to be assigned to MAC address 00:00:00:00:00:00, so maybe the base issue is not the missing client id, but the (empty) MAC.

jaclaz

It may depend on other rules in the firewall or even in their actual position, the firewall (filter, mangle and nat) rules need to be checked in their entirety. It should not be needed, but usually an in-interface and out-interface is added to the forwarding rules, *like*: /ip firewall filter add ac...

jaclaz

Very good. :) What still needs to be cleared (at least to me) is whether the netmap and the dst-nat actions can be exchanged at will or not (it seems that in cases like this one both work, so it is not clear if there is a reason to prefer the one over the other). To be fair sindy did attempt to expl...

jaclaz

Yep, but we have no final report of success (if any) on that thread.

There is however a similar one where everything is seemingly working:
viewtopic.php?t=212702
(though still not a fully working complete configuration)

jaclaz

As a general rule, whenever you find in a Mikrotik a value that is normally text replaced by an asterisk "*" followed by a number (often a hex number) it basically means: "Here is a placeholder for something that did exist but has been removed/renamed/whatever and now I cannot find it...

jaclaz

I think that the 2.5 Gb are actually written in the documents as "up to 2.5 Gb" and what you really get in practice is more like 1 Gb, see this (Italian): https://forum.fibra.click/d/32863-vodafone-fibra-25-gbs-velocita-wifi-ed-ethernet seemingly even if you tell them that you want to conn...

jaclaz

and if each bridge has one interface than how does the ports in the "boxes" communicate with each other since they're in different boxes? Through a clever use of straws. You can pierce a hole in the box, reach the orange and get the juice. Seriously, you have IP addresses assigned to the ...

jaclaz

Looks just fine to me

.

jaclaz

At least for the moment, it is reported to work just fine with 7.x, see this post by holvoeth: https://forum.mikrotik.com/viewtopic.php?t=212925 https://forum.mikrotik.com/viewtopic.php?t=212925&hilit=map#p1111973 In the future there might be issues, but the good Mikrotik guys are doing their be...

jaclaz

Naaah, leave that fasttrack rule alone, if everything is working, you are surely better than before. Which doesn't mean that your configuration is "perfect" as there can be other things to fix, or to better, as more expert members advised, re-analyzing requirements and starting form a clea...

jaclaz

I am not sure to understand, you mean that your ISP Is bringing actual 2.5 Gbit to the house and then immediately bottlenecks It with an inadequate router/ONT?
Which Speed/bandwidth Is on the contract?

jaclaz

This needs to be fixed: interface list member add comment=defconf interface=bridgeLAN list=LAN add comment=defconf interface=ether1 list=WAN ether1 Is not anymore a self-standing interface, should be replaced by bridgeWAN. (or you could leave It as-is and add an entry for bridgeWAN as WAN) Post the ...

jaclaz

When you get an error: [Admin@MikroTik] > interface list [Admin@MikroTik] /interface/list> add name=Z-WAN failure: already have interface with such name [Admin@MikroTik] /interface/list> add name=INT-LAN failure: already have interface with such name [Admin@MikroTik] /interface/list> /interface list...

jaclaz

The terminal is very similar to Linux (or Windows) command prompt). / <- means root Changing directory you don't need cd, you can use direct full path or first change to the intended path, i.e.: /ip route print will print routes /ip route print will first change to directory /ip route, and then prin...

jaclaz

The antennas that come with the RB2011 are (in theory) omnidirectional ones, their emission shape is loosely a doughnut, which is fatter for lower antenna gains and slimmer for higher gain antennas, see this picture: https://www.radiolabs.com/images/omni-antenna-radiation-pattern.png And this thread...

jaclaz

It is difficult/confusing to get data from screenshots.
A textual export is much easier to read.

Besides the "wholesome":
/export file=myexport.txt

command, you can use in Winbox terminal a "section export", i.e.
/ip firewall filter export
and copy and paste the output.

jaclaz

This:

/ip address
add address=192.168.1.2 interface=vlan3 network=192.168.1.2

Is a /32 address/network.

Very likely you want instead a /24 one, i.e.
/ip address
add address=192.168.1.2/24 interface=vlan3 network=192.168.1.0

jaclaz

Very likely you had to login to post and that triggered the "can view attachments" flag.
Take your time, the more you play with the tools and get familiar with them, the better

.

jaclaz

I think all these three solutions should be possible.
Personally I would prefer #3, as the Mikrotik right after the ISP router should allow more control and security, even if the ISP router cannot be put in bridge mode and there will be double NAT.

jaclaz

Forum users can't check support tickets, so no reason to post ticket numbers here It is of no use for other common forum members, but this way you or other Mikrotik staff happening to pass by and interested in a report on the forum may be able to check in more detail what the issue is, without need...

jaclaz

I have no idea, I am just trying to understand the exact requirements and provide some expanded/explained context of your suggestions, so that even an absolute beginner (as the OP clearly is) can understand and replicate them. (my role is only that of a friendly, slightly more familiar with Ros, beg...

jaclaz

To better understand, the solution anav suggested is for the topology on the right, whilst you would prefer the one of the left, correct?
It shouldn't be particularly difficult to transform the one into the other.

jaclaz

Well, you have a pretty much sane (largely default) configuration, it is just a matter to learn a few things as also your intended final configuration (per anav's post) is pretty much standard. You now have: 1. a single ethernet port (ether1) self-standing and added as WAN to the interface list 2. a...

jaclaz

Which Routerboard device? With which antenna? On which frequency range (2.4 or 5 GHz)? On which Channel in the range? Any change in any of the above may modify - slightly or sensibly - the result. If you are looking for measuring distances, you might want to have a very directional antenna to minimi...

jaclaz

Ah, ok, MacOS Is - as often happens - doing things its own way, AFAIK in Windows It Is not allowed and on Linux you need to add the -b switch. I now understand better your setup, the first router, the ISP one, is conceptually not really a router, in the sense that being not configurable (if not for ...

jaclaz

I see, the issue is with (icmp) packet size (which is not MTU). It is strange that forwarded pings go through however, they should still be 56 bytes, I believe it is the default on most Operating Systems. Size of icmp packets in tool netwatch has been only implemented in later 7.x version I believe,...

jaclaz

I don't know, but it sounds to me not normal

that your router cannot ping normally an IP on the internet.
I would try to solve that problem before looking for a way to replicate a workaround you found

.

jaclaz

Sure :) , but at the moment you had posted only the input chain rules. I was trying to highlight how futile it was replacing a rule that doesn't do what is its intended goal (because it is in the wrong chain) with a (better) inverted logical approach that as well is in the wrong chain and thus fails...

jaclaz

You could set it up like this: https://wiki.mikrotik.com/Manual:Simple_Static_Routing In that example, Router2 needs not an additional route because there is a gateway set (that automatically means 0.0.0.0/0 i.e. "everything" is reachable through it), i.e. the "upstream" route in...

jaclaz

I've seen this project on github, but I never figured out why it's needed... It depends on what hardware (real or virtual) you run the image on. Since several releases the image Mikrotik provides is not fully compliant with UEFI because the "system partition" is formatted as ext2fs (inste...

jaclaz

There must have been an obstruction in the notification drainpipe, now removed

https://www.bbc.co.uk/news/articles/cvg7x8l5pv2o

jaclaz

I want to block access to WAN for addresses from the list (that was my comment on this rule). Unless you have another recommendation. The combination of these two rules: add action=accept chain=input src-address-list=Authorized ... add action=drop chain=input comment="drop all else" give ...

jaclaz

It seems to me like you have no (sensible) firewall filter rules. This can be very dangerous, your router (and network) is essentially open from the outside. On the other hand you have some not-so-common more advanced settings (ovpn. queues, etc.). It seems like it was configured by someone familiar...

jaclaz

Hmmm. :? Just for the fun of it, run the Wireless Network watcher from Nirsoft (it is not for wireless only): https://www.nirsoft.net/utils/wireless_network_watcher.html besides other things, it identifies "Network Adapter Company" (cannot say if via MAC or through other means) my guess is...

jaclaz

It seems to me like the first thing you should do is to get Winbox (the dedicated program to manage Mikrotik gear) and use it instead of what you are using now (I presume browser, i.e. webfig). https://mikrotik.com/download One of the distinctive advantages of Winbox is that it can usually connect t...

jaclaz

@anav
In the OP's current config the DNS server Is on another device, 192.168.1.9.

jaclaz

And you also spoof the MAC to a TP-LINK one?

jaclaz

Possibly a stupid idea

, but would it be possible to generate a log entry with the variable and its value and then parse it out from the log?

The log is usually volatile (in ram, doesn't survive reboot), isn't it?

jaclaz

@Mossii Maybe you need some background to understand the set of configuration johnson73 provided. Here you define two interface lists, one is LAN or inside/safe, the other one is WAN or outside/dangerous: /interface list add name=WAN add name=LAN Here you define which interfaces are what, a default ...

jaclaz

Netwatch is triggered by a change in the status of pinging <some address>, and the discrimination is only between ping OK and ping NOT OK.

If the pinging always fails, no matter if the ether interface has a connection or not, it won't be triggered, I believe.

jaclaz

Besides it being useful or not, I am failing to understand the logic of the if conditions (i am just trying to understand). The base condition is whether $bound is 1 or not: a. if $bound is not 1, then remove ALL routes with that comment b. if $bound is 1 then: b.1 if there is not a route with that ...

jaclaz

OT, but calling the router Archer AX53 seems to me a touch of genius.

jaclaz

Not what you asked, but the (good?) ol' way :shock: would have been to protect the router putting it inside an electrical box or, if WAF is involved, a hand made wooden box and keep the LAN topology as is. I guess this shows how old I have become, attempting to solve problems with last century techn...

jaclaz

it is *very* usefull to dynamically booting diskless machines.

This.
I usually boot (dynamically) two or three diskless machines every day, just before breakfast.

jaclaz

Don't worry :) , it happens to everyone, it is the second mistake that happens to everyone (the first one is losing access to the device when fiddling with settings and needing to reset it). The mAP should run fine with latest 6.x version (6.49.17 if I recall correctly) whilst with v 7.x versions it...

jaclaz

I am not sure to understand:
https://mikrotik.com/product/ccr2004_1g_12s_2xs
https://mikrotik.com/product/CCR1036-8G-2Splus
https://mikrotik.com/product/CCR1072-1G-8Splus

jaclaz

0. ether1 is an interface and it has its own "dignity" and you can assign an address to it. But when you add it to a bridge, the bridge is *like* WE ARE THE BORG; YOU WILL BE ASSIMILATED.YOUR UNIQUENESS WILL BE ADDED TO OUR COLLECTIVE. RESISTANCE IS FUTILE. :wink: the individual address of...

jaclaz

Well, which IP address are you pinging? The bridge has none set. Only ether1 has one (and it is a /32): /ip address add address=172.31.246.2 interface=ether1 network=172.31.246.2 Try running /ip address print and post the output. Same for /ip route print, this way we can understand what happens with...

jaclaz

I meant conceptually (since I'm not sure IP firewall rules are even processed when ports are bridged). But just in case, I added accept rules for in/out/fwd at the top of the list, and no difference. There must be a reason for this I don't understand Conceptually firewall should be not part of the ...

jaclaz

Do I have to adjust firewall rules to permit something here?

We won't know until you post your current configuration for review.

jaclaz

Well, the setup I posted is (intentionally) static only, it is that of a device that I use to give wireless connectivity to a device that has only a wired port but is physically in a room where there is not an ethernet cable arriving nearby. In your case you may want or need to set it with a DHCP cl...

jaclaz

Yep, sometimes the terminology can be confusing. Routes are just routes (and the go in /ip route). Routing rules are a mechanism for policy routing (that go in /routing rules) that allow to "filter" and modify some particular connections, you can think of them as similar to mangle rules (t...

jaclaz

Ok, here is the (very, very basic) configuration that you could use as a base: # nov/29/2024 10:09:05 by RouterOS 6.49.17 # software id = [redacted] # # model = RouterBOARD 941-2nD # serial number = [redacted] /interface bridge add admin-mac=[redacted] auto-mac=no name=bridge1 /interface wireless se...

jaclaz

Post what you have, see instructions here:
viewtopic.php?t=203686#p1051720

If you want a reference, I have somewhere a hap lite (should be very similar to the map/map lite) with a very simple configuration that I can share.

jaclaz

You must have somehow mixed the printout. Let's start with the main router (the one you posted the configuration on first post) you have on it two IP addresses assigned: /ip address add address=192.168.1.1/24 interface=LAN-Bridge network=192.168.1.0 add address=192.168.0.3/24 interface=ether1-WAN ne...

jaclaz

Wait for 802.11az wide adoption?

jaclaz

Because I setup all my forwarding firewall rules to be port specific (eg: rule applies if going out ether1). How do you handle that? Is there a way to make the rules to refer to a group of ports (so it will automatically apply to port 1 and port 3)? Or do I have to duplicate a bunch of rules? Since...

jaclaz

Excuse me rextended, if I get this right, that means an untold: Hey, user, you won't connect to my wifi. The more knowledgeable users might read the above unwritten message as: Hey, user, you won't connect to my wifi unless you disable the randomized MAC address feature of your device (yes the one t...

jaclaz

...and - as generic advice - don't use VLAN1, it is used internally and can cause issues in a configuration. Use (say) VLAN10 and VLAN20, instead. ether2? Instead of a supout, follow this post here: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 and post your (anonymized) configuration. ...

jaclaz

If you use the Mikrotik as a switch you need to use one of the available (station-) bridge modes, if you are going to use it as a router, then you want to the "plain" station mode.

jaclaz

Any bright ideas? Cannot say if bright, but once removed possible issues with the Windows firewall, the common advice is to have ONLY the ethernet port in use enabled on the PC (if it is a laptop or however has also another wireless interface - and you did that) and use a dumb switch between the PC...

jaclaz

One Mikrotik would be enough. You want to use station pseudobridge mode (or possibly station-pseudobridge-clone). If you have two Mikrotiks, you can use station bridge mode, but if there is a single device connected to the station, there should be no difference in practice between the three and four...

jaclaz

Maybe it could be changed from "not running" (that does sound like there is a problem with the interface) to something like "no connection" (that would mean both an empty port or a port connected to a device that is off)?

jaclaz

You have three bridges? /ip address add address=192.168.131.1/24 interface="Infrastructure Bridge" network=192.168.131.0 add address=192.168.132.1/24 interface="Full-access Bridge" network=192.168.132.0 add address=192.168.133.1/24 interface="Limited-access Bridge" netw...

jaclaz

In Mikrotik client is called "station".
And there are a few modes available, you want station pseudobridge, see:
https://help.mikrotik.com/docs/spaces/R ... tion+Modes

jaclaz

Check this:
viewtopic.php?t=97113#p807074

jaclaz

I am happy to report that I can finally get UDP packets from the devices to the controller. Thank you to all who contributed!

It would be useful if you could post the final configuration that works for you, so that it can be useful as a reference for other people that may need something similar.

jaclaz

This is a snippet from the posted file: /interface wifi # chains not supported set [ find default-name=wifi1 ] channel.skip-dfs-channels=disabled \ configuration.antenna-gain=0 .chains=0,1,2,3,4,5,6,7 .country=Italy \ .dtim-period=1 .hide-ssid=no .manager=local .mode=ap .multicast-enhance=\ disabled...

jaclaz

Yep, but you cannot squeeze lemon juice from cucumbers, if all OP can get is: 300Mbps download / 50Mbps upload. that's it. I would assume that some firewall rules will be needed, the 750 GR3 that can be expected in theory to have 265.2 Mbps routing is weak, the hex refresh at 498.1 Mbps seems like m...

jaclaz

Yep, but you are planning to have 2, 20 or 200 customers? The 750Gr3 as "central router" seems like a very weak device for many users, but if you are convinced that it is powerful enough and if you have to buy new, a new more powerful version of the hex was just released: https://mikrotik....

jaclaz

Yep, I meant coverage (and its "shape"). Let's take a square room 6m x 6m. The ideal situation would be a cAP in the center of the ceiling as it supposedly toroidal (doughnut) emission shape should cover everything. If you put a wAP on (say) the north wall, in the middle, it will probably ...

jaclaz

To be fair, "we expect" has a meaning which Is (IMHO) very different from "are required".
It seems more like a "good willing wish" than a contractual clause.

jaclaz

Then probably the wAP is just fine for your use, and the cAP - set aside the 160 MHz width - would have been less suitable. But it is really hard to say as indoors there are reflections/absorptions/whatever that may make the real world coverage different from the theoretical or geometrical one. The ...

jaclaz

Very likely in routers 3 and 2 you have a route for 0.0.0.0/0 pointing "upstream". And of course in main router you have a route for 0.0.0.0/0 pointing to the ISP router: /ip route add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.0.1 \ pref-src="" routing-table=ma...

jaclaz

I can’t increase the transmit power on my mobile device (in this case the PlayStation 5) but it’s maybe possible to do it on my mikrotik right ? Yep, but it is two way communication. The PS5 may be able to "hear" the Mikrotik if it "shouts", but the Mikrotik may still not be abl...

jaclaz

Be aware of the meaning of the model name and consequently its radiation pattern: c=ceiling omnidirectional (360°, at least in theory) w=wall directional 90° to maybe 120° or so. The radiation pattern of the Wap seems to be like an off center ball with a flat bottom, see: https://forum.mikrotik.com/...

jaclaz

I like to think that since RouterOS is under the hood a derivative from Linux, GUI parts, both Winbox and Webfig, are "overlays" over textual commands. You can normally connect to a Mikrotik device via SSH (or telnet) and do all the configuration on the command line. What happens - particu...

jaclaz

Ah, I see now, you were talking CAD, the price in US$ are correct ( in line with official list price). The cost of shipping seems crazy to me, I understand that Canada is a large country, but the parcel would be small and weight less than half a kg. The cAP ac XL on that same site Is 145 CAD/99 US$,...

jaclaz

Hmmm:
https://www.store.mikrotikcanada.ca/wir ... 07711.html

jaclaz

The Cap AC XL, before and besides any other consideration, is now an old device, with only 16 Mbyte of storage, which is already starting to be an issue with current Ros v7 (upgrading may be complex). You could consider the newish Wap Ax: https://mikrotik.com/product/wap_ax It is talked about here: ...

jaclaz

There is no secret.
There are some requirements for security mandated by the EU that the good Mikrotik guys believe they are complying with in this way.

JFYI:
viewtopic.php?p=1093341

jaclaz

Ok, I did a few tests in GNS3, and the vrf approach seems to be working (at least I can ping both with ICMP and UDP from PC to the two targets). Setup: VPCS named PC-source set with ip 192.168.0.254/24 connected to ether1 of a Mikrotik CHR (runnning 7.15.3) VPCS named target1 set with ip 192.168.10....

jaclaz

Yes, that one (with no marker) is static, the one below it is coming from the DHCP and is marked with D (Dynamic). And then you can remove the (only) static rule, the markings on the first: # DST-ADDRESS GATEWAY DISTANCE 0 As+ 0.0.0.0/0 10.221.215.1 1 mean that it is #0 (i.e. you can remove it) then...

jaclaz

I don't know, as said I believe (but I may well be wrong) that netmap maps "everything", but maybe there is the need to specify protocols and/or ports. :? But then it could be that for *some reasons* your tool/program/whatever does not expect this kind of netmapping from/to IP addresses. I...

jaclaz

Yep, but you probably should do the reverse. Remove the static address and let the DHCP client run. Since the DHCP server is managed (I believe) by your ISP if they change it (for whatever reason) to another subnet your static assigned address will become m00t. Moreover the DHCP server will provide ...

jaclaz

It looks mostly fine to me :) , the only thing you should re-check is: /ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=\ 192.168.88.0 add address=10.221.215.2/24 interface=ether5 network=10.221.215.0 /ip dhcp-client add comment=defconf interface=ether5 ether5 has bot...

jaclaz

The advice Is to NOT touch anymore Quickset, not even for viewing its current settings. Is time you start evolving from absolute beginner, read this post: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 and follow the instructions and post your full configuration. There is something "...

jaclaz

My appologies, I have never seen that eth1 is a combined port. Yep :) , and of course which port has PoE IN is not specified on the Ax3 page, probably it is left as an exercise for the reader. The sad news (OT but not much) are that this sloppy way to document devices and their features is becoming...

jaclaz

Befor you follow these steps (which are explained quit well!): The eth1 is a PoE in port, you will have to connect the cAP AX to eth5 of the hAP AX3 to have it powering the cAP AX. The ether1 is PoE-Out on the A x 3: https://mikrotik.com/product/hap_ax3 PoE-out Details PoE-out ports Ether 1 PoE out...

jaclaz

Well, the CRS should be written as C R S to better convey the performance of the device. And the proxy for real world performance is the 512 byte packet, so without any firewall rule, it is more like 300 Mbps. For around 1 Gb throughput, I presume with just 1 WAN connection, instead of a replacement...

jaclaz

What I don't understand from your post is whether you just took the two cubes out of the box(es) and attempted connecting them or if you configured them (via Winbox or Webfig or SSH). In the first case it could be a factory mis-configuration of one device, in the second it could be a mis-configurati...

jaclaz

there must be a typo/inversion in the referenced post :shock: chain is dstnat action is netmap. your: /ip firewall nat add action=dst-nat chain=netmap dst-address=192.168.0.170 to-addresses=192.168.10.2 add action=dst-nat chain=netmap dst-address=192.168.0.171 to-addresses=192.168.10.2 should be: /i...

jaclaz

I would define "rare" the case that something Sob suggests is not working. Post your full configuration, maybe there is *something else* that needs to be corrected or some "wrong" other setting that some of forum members may be able to spot.. Netmap (from what I understand) shoul...

jaclaz

So you are on 6.x (routing-mark in /ip route).
Sob's suggestion here:
viewtopic.php?t=187178#p942405
uses netmap, not dst-nat.
That may (or may not) make a difference.

jaclaz

Only as a side note, in the 192.168 range you have only 256 /24 subnets.
In the 10 range you have 256*256=65536.
A collision is still possible, but it is definitely less probable.
Particularly if users use 192.168.x.0/24 ranges

jaclaz

I think a line must be drawn somewhere, it is not the first and only case why someone might want or need to have several devices with the same IP. Only as examples: https://forum.mikrotik.com/viewtopic.php?t=119134 https://forum.mikrotik.com/viewtopic.php?t=187178 https://forum.mikrotik.com/viewtopi...

jaclaz

Well, your ISP router should be running a DHCP server, which you want to keep as "authoritative". You can set the Mikrotik as an AP bridge (i.e with all intefaces, including the Radio/Wi-Fi into a single bridge, with only one ether interface - advised - kept out of the bridge for emergency...

jaclaz

Interesting that the LCD use can have such dramatic consequences. If we consider the usual proxy for real world speed, routing 512 bytes packets with 25 firewall rules:: https://mikrotik.com/product/RB3011UiAS-RM#fndtn-testresults at 452.6 Mbps you are already at the upper limit of what is achievabl...

jaclaz

Let's clear the requisites/intended setup first. The network/internet is connected by wire to the Mikrotik and you want some devices (printer as an example) to connect wirelessly to it. If this is the case, you want the Mikrotik to be an Access Point, not a client (station). Even if it is technicall...

jaclaz

... or some sort of step-down-device from 48V to 24V you could just plug between the 48V supply. Or something like that.

... like:

https://mikrotik.com/product/rbgpoe_con_hp

jaclaz

You could add a custom rule to the Windows firewall allowing reply to ping only if the ping comes from a given IP address, some examples here: https://www.wintips.org/how-to-allow-ping-in-windows-firewall/ https://superuser.com/questions/1696779/enable-ping-in-windows-server-for-specific-ip-addresse...

jaclaz

...and that $500 piece of hardware is now discontinued: https://mikrotik.com/product/chateau_5g and the new one has 128 Mb: https://mikrotik.com/product/chateau_5g_ax for around the same price (if you consider some inflation). The good Mikrotik guys were IMHO a bit "tight" when designing t...

jaclaz

You know, it all depends on the family and their LIAF (Lack of Internet Acceptation Factor), staying a few days without internet might be viewed either as a good, relaxing experience or as an unbearable nightmare. If the cameras are "just for fun" it won't be an issue, but if they are actu...

jaclaz

Viktors says wAP stands for "wireless access point".

I think that that is only to distinguish it from wired access points

jaclaz

To be fair, 36 bucks at a 7% compound interest could become over 50$ in 5 years time. One of Murphy's Law corollaries tells us that if a SPF fails, it will do so just after 6 PM on Friday or anyway before 1 PM on Saturday. So one needs to evaluate if 4-5 days without the link are worth around 50 dol...

jaclaz

You cannot normally update from 6.x.y to 7.16 directly. The procedure is to first update to 7.12 something and only then update to higher version. Upgrading 18 devices all together without having tested the procedure on a 19th identical device in lab seems to me a bit bold, but maybe I am overcautio...

jaclaz

The simple switch may (or may not) use a different loop prevention method (or none at all). The Mikrotik switch may ( or may not) run STP or RSTP or something else: https://www.geeksforgeeks.org/difference-between-spanning-tree-protocol-stp-and-rapid-spanning-tree-protocol-rstp/ You could try disabl...

jaclaz

When you say in Mikrotik (example): 192.168.1.1/24 You are saying: IP address: 192.168.1.1 Netmask: 255.255.255.0 or 24 in CIDR notation When you are saying: 192.168.1.0/24 You are saying: Network: 192.168.1.0 Netmask: 255.255.255.0 or 24 in CIDR notation In some places it may be unneeded, but in mo...

jaclaz

Depends where you live, in small communities, people with same interest/occupation gathers and talk, you never know what you can find out... Well, in small communities you don't even need to share interests or occupation, if the boyfriend of the cousin of the friend of your brother-in-law likes a f...

jaclaz

Key word "environment", which makes company environments much more sensitive than home users environment. If somehow I find out that my ISP is using such way to update their router, from public source script without proper automated source checks / sanitization, I will be concerned and pr...

jaclaz

Sure, you can disable radios just fine.

Then (what I would do if radios is disabled and the antennas are unwanted) you should replace the big ears with dummy loads, to be on the safe side.

jaclaz

But there is nothing to argue about, when doing *anything* there are some risks involved, everyone should be able to evaluate these risks and decide whether to take them or not.

Personally, if it wasn't that I need internet access, I would have only air-gapped systems

.

jaclaz

The raised issue is not related to MITM attacks, possible attack vector is the following, whenever you "blindly" trust a third party and use a given external address/domain on which you have not full control: 1) someone (in perfect good faith) provides a service of some kind 2) you connect...

jaclaz

Possibly not connected to your issue, but you have a couple instances of "something" with an asterisk followed by a (hex) number, this means that there was something with a valid name/reference that was later deleted or renamed. These entries are in the best case doing nothing, in the wors...

jaclaz

How can I check if the time is synchronized in which log?

In the normal log there should be an entry each time the date/time is synchronized via NTP, an entry *like*:

2024-09-19T07:47:44.224614-04:00 system,critical,info ntp change time Sep/18/2024 23:16:01 => Sep/19/2024 07:47:44

jaclaz

So extensive they missed 2 reboot steps to make it clear, as shown by the last posts in this thread

"Extensive" does not necessarily mean "accurate", let alone "clear".

jaclaz

Is there a way of netinstall RB260GS? Yes and no :shock: No netinstall, but BOOTP/TFTP should work, see: https://forum.mikrotik.com/viewtopic.php?t=145981 The info is now here: https://wiki.mikrotik.com/SwOS/RB250_RB260#Reinstall_SwOS_firmware In any case the ACT led needs to be blinking, so that i...

jaclaz

Happy to hear a story of success.

jaclaz

Well, a camera stream can be in order of magnitude of 2 to 4 Mbps (high resolution ones 8 Mbps), good old rule of the thumb is double the camera resolution if using (as most do) H.264, see:
https://reolink.com/blog/ip-camera-band ... lculation/

So a few cameras won't make a problem in your setup.

jaclaz

Also, in log, you should see when the time changes and by what amount, the sync should happen once every day or less often and the change should be seconds at the most. The "default" mode for the NTP client is "unicast", unless you have reasons for it to be set as "multicast...

jaclaz

Well, you have something wrong in the way you copied the configuration here adapting to your addresses. The configuration posted by Sob there: https://forum.mikrotik.com/viewtopic.php?t=187178#p942405 is the "reverse" of the one you just posted, and it uses an approach that is (was) intend...

jaclaz

I don't think that the one or the other solution would give you any particular issue or advantage, they seem to me substantially the same in performance, and given the 50/100 internet speed they are both fine, speedwise. If you can afford the higher expense, the two L009's would IMHO be better for a...

jaclaz

WAP has seemingly a much higher WAF.

jaclaz

What you report Is strange, if I get It right.

Use network APN must be set to no if you are manually setting an APN, if use network APN is set to yes, the one you are providing will be ignored, see:
viewtopic.php?t=210031

jaclaz

I'll work on that later when wife is in bed. I want to stay married. Well, JFYI, if you happen to accidentally cut off internet, it is unlikely that the marriage will break up :o , the outcome is usually either that of wife not talking to you for several days or deciding - since there is nothing be...

jaclaz

Let's go one by one. #1 If you try "/ip route print" in terminal, you will find that the routes you are getting (after a reboot) come from the DHCP client(s) and likely have a distance of 0 or 1 (i.e. they are "very near"). You can do two things (up to you to decide which one or ...

jaclaz

Maybe new package, but from the looks of the one in the picture not new devices. From the screenshot, ether4 transmits something but doesn't receive anything (and this could be - though I cannot imagine how - some false contact or the like mistaking an empty port for a connected one) but ether2 tran...

jaclaz

Hmmm. :? This: add action=accept chain=forward disabled=yes dst-address=192.168.13.145 in-interface= *11 out-interface=bridge1 while might not be related to the issue at hand (it is disabled so, not actually running), is a sign that the router config has been changed/edited the *11 (more generally a...

jaclaz

Vista specifically should not be an issue, there are generically some possible issues with netinstall under windows, connected to its firewall and/or - when doing it on a laptop - with services and programs installed by the manufacturer, but usually they lead to netinstall not seeing the router requ...

jaclaz

Should not be related, but:
/interface list member
add interface=bridge1 list=LAN
add interface=ether1 list=WAN
add interface=wireguard1 list=LAN

wireguard1 should be WAN conceptually.

jaclaz

Yolks on me, much thanks!!!!

You are welcome

, but you still have to correct the first three.
(I am worrying about people that may copy and paste these rules without critically checking them)

jaclaz

anav, you probably have a typo, those "AUTHORIZED" and "DNS/port 53" rules should be on input chain, not forward, right?

jaclaz

Only as a side note, your exported entries are just fine, "disabled=yes" is Mikrotik's way to explicit the enable state and your D marked lines sport "disabled=yes" just fine. The advised approach, as jvanhambelgium stated, is to have a set of explicit rules targeting the traffic...

jaclaz

Active ones (802.3af/at) do exist, *like*:
https://www.newegg.com/p/3C6-001B-009D5?

jaclaz

I agree that the the firmware should be aligned to software :) , what I am not convinced of is to set it as automatic, since the software update is anyway advised as been done manually, I don't see how having the firmware set to automatic is "better", you have anyway to remember to reboot ...

jaclaz

The first rule is to not use VLAN 1 (it can be used but you should really know what you are doing), rename them to VLAN 10 and VLAN 20, to exclude possible issues that are very difficult to find and troubleshoot.

The complete guide is here:
viewtopic.php?t=143620

jaclaz

I see, right idea, but wrong cat.

jaclaz

... although personally I use the later ... Couldn't that be called "preaching virtue but practicing vice"? :shock: :lol: Seriously, I have found at least one case where firmware upgrading caused issues (in an old 6.4x.yz version): https://forum.mikrotik.com/viewtopic.php?t=180096 It seem...

jaclaz

Maybe "routes" is a reserved variable name, try using "myroute" instead of "routes". And/or try with put instead of assigning the result to a variable. Also, you can probably remove the "where" (but that shouldn't change anything): https://forum.mikrotik.com/v...

jaclaz

Yes, limited to the routeboard firmware, automatic update is probably OK, still the usual advice is to have Routerboard firmware release "aligned" to the Ros (let's call it "software") version, so if setting the one, there is the risk to have it automatically be one or more versi...

jaclaz

Also, maybe It Is not your case, but before connecting a device to internet you should make sure to disable all services but Winbox and limit It to LAN interface(s), possibly changing its default port number. AND add a new user, give It full powers, and a strong password and remove or disable the de...

jaclaz

Please allow me to doubt the advice in #1, the good Mikrotik guys are not particularly cautious when tagging a release as "stable" and - if not common - it is far from unusual that in releases marked as stable (and thus subject of automatic updates) new or regression bugs appear. Of course...

jaclaz

Only hurricane winds or heavy rain too?

JFYI, issues with water have been reported several times:
viewtopic.php?t=189614

jaclaz

Well, access points on external walls seem to me a rather common need.

Anyway the coverage Is surely not 180 degrees, more like 120 or less.

On the other thread here:
viewtopic.php?t=212255
the shape of emissions is described with links to the FCC documentation.

jaclaz

maybe an option like mANTBox ax 15s can be considered, i know is not so cheap as the wAP but can be very useful https://mikrotik.com/product/mantbox_ax_15s Yep, but I think OP is already beyond the WAP, a Netmetal Ax (+antenna(s)) is going to cost much more. What is not clear (to me) is how wide th...

jaclaz

... and it is Rule #4 of my Mikrotik Club Rules:
1) You do not use VLAN1
2) You DO NOT use VLAN1
3) You do not use Quickset
4) You do not use detect internet
5)....

If the good Mikrotik guys would remove it, I would need to change the list ...

jaclaz

Unless you changed the original configuration, the Cube Pro original one has a static IP 192.168.88.3 or 192.168.88.2 on the ethernet port, it is not grabbing it from anywhere, so it sounds like the device is not booting properly, and - even if the IP is gone because the configuration is invalid - t...

jaclaz

If I may, there are some inconsistencies in the actual question. There are seemingly two of them: 1) Is there a simple way to VLAN? 2) How can I have a Guest network? Answers: #1 No, it is a complex, advanced topic. #2 Yes, actually two ways, one at L3 level (tangent) and one at L2 level (original M...

jaclaz

They are not common, but they exist.
Example:
https://www.quwireless.com/product/qusector-7v-120-2
120 degrees, dual connector, mimo 2x2.

jaclaz

And again /ip route print will show whether the routes are static or dynamic or if coming from the dhcp, etc..

jaclaz

Provide the output of /ip route print, twice, once when in the "normal" state and once when you have the ISP WAN cable detached, as it will be more clear what actually happens. As a side note, and JFYI, another possible approach (IMHO simpler): https://forum.mikrotik.com/viewtopic.php?t=19...

jaclaz

Just to be clear, this config only applies to the cAP? There's no additional config for the hEX? If not, the new firewall rules being added to the cAP won't affect the current set of rules on the hEX? Yes and no. Yes, the "tangent's way" only applies to the cAp, but no, the described appr...

jaclaz

What if I told you that you don't *need* a VLAN?

https://tangentsoft.com/mikrotik/wiki?n ... ns%20VLANs

jaclaz

The posted picture comes from:
https://www.mikrotik-store.eu/
https://www.mikrotik-store.eu/de/mikrot ... etmetal-ax

jaclaz

Ah, ok, I thought that mac-telnet was dependent on telnet service, good to know that it Is instead completely independent and thus must be restricted separately.

jaclaz

Thank you :) , so one should go for the: https://help.mikrotik.com/docs/spaces/ROS/pages/328229/IP+Services way and disable services, to prevent access from anything but Winbox, then, if I get it right, the none in mac-server has in practice the same effect as disabling the telnet service, but this ...

jaclaz

No, the device comes without antennas. The photo on Mikrotik store is more explicit :wink: https://www.mikrotik-store.eu/media/images/org/L23UGSR-5HaxD2HaxD-NM-Beispielantennen_1.png The top cover has two passages so you would normally use two external antenna connected with a (short) piece of cable...

jaclaz

I see now, that prevents telnet connections, thanks :) .(I wish the good Mikrotik guys had called it "/tool mac-server telnet") But the moment the device has an IP address one can still connect via browser/webfig? :? I.e. is there a need for a firewall rule *like*: /ip firewall filter add ...

jaclaz

@infabo Maybe we should rename to: CSS->CASS (Cloud Actually Switching Switch) and CRS->CARS (Cloud Almost Routing Switch) @flynno Maybe stupid question, but aren't the two HGO-antenna-OUT directly mounted too near to each other to do any good? I know it is even on Mikrotik official pictures: https:...

jaclaz

I think it is a matter of (double) quotes. The dot means "concatenate" (same as - to give you an example - & in Excel formulas), text and variable(s) needs to be separated. And seemingly you missed a closing round bracket (or maybe they are not needed. Your test: /tool e-mail send to=e...

jaclaz

Bravo... Grazie. :) Though I am not convinced that my hypothesis holds, I think that attackers won't spend much time on a "difficult" device (unless of course it is a targeted attack) it is far easer for them go looking for another one, I presume that they go for the low-hanging fruits (t...

jaclaz

@anav Now that the OP issue is solved, can we talk of the absolute minimum configuration? In my perverted mind it would be: /interface bridge add admin-mac=<tt:uu:vv:xx:yy:zz> admin-mac=no name=bridge1 /interface bridge port add bridge=bridge1 interface=all /ip dhcp client add disabled=no interface=...

jaclaz

In case you missed: this thread was about wAP and @Normis tried to explain that wAP (due to being wall AP) doesn't really have spherical radiation pattern. Well, we do have a drawing: https://fccid.io/TV7WAPGR52AX/Test-Report/Antenna-specification-7634095 I think we can define the pattern as "...

jaclaz

Reading the manual would help: https://help.mikrotik.com/docs/spaces/UM/pages/141197416/Chateau+LTE18+ax the hint is here. Antenna usage SMA connectors are for LTE antennas. External antenna sockets are located on the back of the device. Device comes with connected wireless antennas, LTE antennas ar...

jaclaz

They do sell this pigtail: https://mikrotik.com/product/acsmaufl Which should be a hint towards the DIY path, but if I get it right the U.fl connector(s) are on the actual modem card, so it can be applied to *any* of their LtE products. Example for the WAP ac LTE6: https://forum.mikrotik.com/viewtop...

jaclaz

If it is a new installation, it doesn't surprise me that much, it is not unusual that the settings need to be tweaked/tuned, these new devices have a lot of "delicate" settings. Only anecdotal data, and likely completely unrelated to your case, but not so long ago I had a largish Viessman ...

jaclaz

Well, yes, firewall is the thing that might (or might not) allow the ports on the different subnets to talk to each other, so, it is about firewall. Not so sure about routing, in the sense that the routes (at IP level) should be autogenerated in the Mikrotik router, i.e. come out as DAC (dynamic, ac...

jaclaz

"Forcing" the internet access to the one or the other router (ether1/ether2/ether3) could be - I believe - done with routing rules based on source ports (ether4/ether5/ether6): https://help.mikrotik.com/docs/spaces/ROS/pages/59965508/Policy+Routing The other requirement (windows share acro...

jaclaz

No, different devices have (or have not) a number of quicksets (it seems like more recent ones have few of them that's why I asked if your L009 had it). It is not a bad thing in an absolute way, as quickset is known to be prone to cause issues, unless used "from clean" (and this piece of i...

jaclaz

What we don't know (or at least I don't know) is what changes the attackers make to the router configuration, it is possible that they do not make any besides changing the permissions to user "admin" and adding the "system" one (of which they set the password to a complex one). I...

jaclaz

Let's see how accurate is my crystal ball (I just got it back from the guy that tunes it, but sometimes he doesn't set it right ): a. User 1: J***** K******, commonly called "dad", age 48, Sagittarius User 2: F**** G******, commonly called "mom" age 47, Gemini User 3: R**** K****...

jaclaz

If I get it right you want to have your L009 in the garage as a "client[1]" to an Access Point that is in your home, right? Is the Access Point also a Mikrotik device or not? The WiFi standards do not really cover this usage, so different manufactures have worked around with different solu...

jaclaz

Side question, but do you really-really need DHCP client on the boiler?
I mean, if you don't go around with your access point (be it the ax or the ax2) the boiler should be pretty much static.
Cannot you set it to a static address and see if the disconnecitons continue or stop?

jaclaz

No idea about the actual issue, but also the board parser seems to behave just like you describe, it "interrupts" the hyperlink on the first space (after the "The"). So it could be something similar. Try replacing the spaces with %20, a http URL must contain no spaces: https://fo...

jaclaz

From what I understand the default configuration is good enough in most cases, particularly, for an internet facing router, do not change the firewall rules until you have understood them[1] (which definitely will take some time) and make sure that interfaces are correctly categorized as LAN and WAN...

jaclaz

Very interesting, thanks. All the tweaks you did make a lot of sense to me, what I find surprising Is the relevance of the positioning. 5 db difference in 10-15 cm displacement seems a lot, I wonder what the reason could be for such a dramatic change at such a short distance, I believed that there w...

jaclaz

Is the power supply provided with the RB5009 sufficient? That is a 24V 1,5A power adapter. Yes and no (actually no and yes, but ...) :shock: . The power supply provided with the "PoE Out" version of the RB5009 (RB5009 UPr +S+IN ) is the 48V 2A: https://mikrotik.com/product/48v2a96w so it ...

jaclaz

Ah, OK :) , I tried again (started from scratch after a reset with no default configuration to be sure) and you are right, though the "logic" is inverted, I can confirm that now it works as you described, then it was only a false alarm, sorry :oops: I wonder how it could have happened yest...

jaclaz

While doing some "crazy" experiments on a hap lite running 6.49.17 I happened to find a "strange" thing related to the /ip dhcp-relay. I tried adding a dhcp relay: /ip dhcp-relay add dhcp-server=192.168.1.151 interface=bridge1 name=relay1 ok. The I tried adding a second one, and ...

jaclaz

Good (all is well that ends well). :) The 8.9 W (183 mA@48.9V) that you see on the RB5009 is what I would have expected for a device that is essentially a media converter/modem, but even if you add to it the wireless (and that is enough to have the Mikrotik freak out) the added draw for the radio(s)...

Search found 1929 matches