MikroTik

jaclaz

Do you think that is a valid strategy?

No idea, but you should post again your current configuration, so that some members experienced with VLANs (and VAPs) may give you some more hints/advices.

jaclaz

Maybe connected, maybe not, but VLAN1 is generally a no-no:
viewtopic.php?t=208061

jaclaz

But does it remain unreachable even if you (for testing) disable the "main" 0.0.0.0 route or set it with distance 3?

jaclaz

The 04 should be fine, it is the 05 (now removed) that created the biggest issues: https://forum.mikrotik.com/viewtopic.php?t=204440#p1058092 Still blindly updating everything together at the same time just because someone, even Mikrotik, tells you to do so is not particularly smart, because if you ...

jaclaz

You must upgrade the device to the last stable version, not downgrade! He knows, he is asking if there is a way back, should the upgrade not provide increased stability. Not saying that it always pays to be prudent/conservative, but right now the OP with an oldish RoS version and oldish modem firmw...

jaclaz

Downgrading from running RoS version to any earlier one (down to the factory installed one, no earlier) is always possible and relatively easy, see: https://forum.mikrotik.com/viewtopic.php?t=194542 There has been a change in wireless packaging/modules between 7.12.x and 7.13, but that shouldn't be ...

jaclaz

Yes, but the dubitative form is anyway appropriate when the standard power supply is used, the 24V/1.2A are IMHO very "tight" to power both the "main" device and another one via (passive) PoE. As said PoE is already a mess in itself, but the good Mikrotik guys, with their lacking...

jaclaz

re:vlan ID 99 The board parser shows them in green (as if they were a comment and not a valid setting): add bridge=LAN_bridge tagged=ether2_Switch_1,ether3_Switch_2,LAN_bridge \ untagged="ether4_SmartHome_Controller1,ether5_SmartHome_Controller2,ether6_NVR,ether7_Synology,ethe\ r8_ProxMox"...

jaclaz

For the moment I wouldn't update the RoS (unless you are missing some other feature implemented in later versions) and definitely not the firmware of the LTE thingy, given the issues reported on the mentioned thread that seems objectively worse than the ones you are reporting.:

jaclaz

PoE is a mess in itself, and Mikrotik doesn't help with the confusing documentation they provide. The hap Ax2 is documented as having PoE out: PoE-out ports Ether 1 PoE out Passive PoE Max out per port output (input 18-30 V) 600 mA Max total out (A) 0.6 A Total output current 0.6 Total output power ...

jaclaz

You seem to be affected by the USB device detection bug holvoeth mentioned. It seems to be affecting some devices (USB sticks from a given brand, namely Sandisk) more than other ones, there are a couple workarounds that you could try integrating in your script, either reset the USB bus or rename the...

jaclaz

Not at all a "solution" to your issue, but if the failures are one or two weeks apart a workaround would be to set a scheduler to reboot the router once every (say) two days at (still say) 4:00 in the morning (i.e. at the time when it is likely not in use). I would however check if the con...

jaclaz

It could be. Rebooting when testing a configuration is almost always a good idea, not only because some settings actually *need* a reboot to work, but because a reboot is the best simulation of what happens next time you have mains returning after a blackout or when you take power out for any other ...

jaclaz

I don't know, at first sight your dhcp settings look fine to me: /ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=\ 192.168.88.0 add address=192.168.89.1/24 comment=myconf interface=wlan1 network=\ 192.168.89.0 /ip pool add name=dhcp_pool0 ranges=192.168.89.64-192.168...

jaclaz

Coughy, which EXACT "POE device" are you trying to power? Make/model, please. Mikrotik devices such as the hapAX2 provide a (actually a bit limited in current) out voltage that is at the same level as the voltage that powers the device. So if you are powering the Ax2 with the standard 1.2A...

jaclaz

Yep, your proposal is just fine, everything is in one place, and it would be even better if the settings would be moved from "main"
/interface ethernet switch port
to its own level:
/interface ethernet switch port mirroring
or
/interface ethernet switch port mirrors

jaclaz

Maybe a bit OT, cannot say if things have changed (probably they did) or whether my following anecdotal data was the effect of a "rogue" device, but I remember many years ago a small office network brought down to its knees when a NAS device was added to it. It came out that the device was...

jaclaz

Yep, I understand now, you like to win easily, don't you? :lol: You should never copy and paste a whole configuration anyway. For three reasons: 1) some commands may sort of overwrite existing settings improperly (as an example increasing a reference) 2) some commands may make no sense (to the under...

jaclaz

Yes, you can do the reset from the button or - if you have access to the unit (like you have) from terminal command line or winbox (easier). See configuration reset here: https://help.mikrotik.com/docs/display/ROS/Configuration+Management https://help.mikrotik.com/docs/display/ROS/Configuration+Mana...

jaclaz

In theory, there is a default configuration (made in factory) that can (maybe) still recovered doing a reset. But for all we know it could also be that (for whatever reasons) there has been an error in packaging or an exchange of units in this or that passage from Mikrotik to the importer, from the ...

jaclaz

Sorry, I meant the cube pro ... which has both 60GHz and 5GHz radios. Then an actual default configuration is here: https://forum.mikrotik.com/viewtopic.php?t=205042#p1059476 The wlan1 and w60g are bonded into interface bond1: Master: /interface w60g set [ find ] disabled=no mode=bridge name=wlan60...

jaclaz

Well, if I have ether1, ether2, etc., I surely can have mirror-source1, mirror-source2 and mirroring1, mirroring2, etc. BTW, I don't oppose to changing names of properties/obiects/whatever I am opposing to the idea that *something* to work needs settings in two different places. Another, still IMHO ...

jaclaz

Cannot say why your deices are like you describe, but setting them up as they should be is relatively easy. The 192.168.88.1 is the default for a "single" Mikrotik device. Cube Pro pairs usually have 192.168.88.2 and 192.168.88.3. Maybe someone tested them and ran Quickset (or whatever), b...

jaclaz

Here you are:

#Hypothetical syntax
/interface ethernet switch
set switch1 mirror-source1=ether2 mirror-source2=ether4  mirror-source3=ether4 mirror-target=ether3 mirroring1=egress mirroring2=ingress mirroring3=both

jaclaz

Optical cables are more robust than one thinks, BUT they don't like to be bent with a smallish radius nor to be pinched. I wouldn't say that they are fragile, they only need to be treated with some respect. Though field connectors/splice ferrules do exist, they are not exactly easy to assemble, even...

jaclaz

I believe that the speed of the 60 GHz link degrades (decreases) if (say) the rain increases until connection is lost but the 5 GHz link replaces it immediately. How long is the "immediately" I cannot really say. Since the two interfaces are in a bonding, they are essentially a same interf...

jaclaz

@mworsnop
It seems to me like a good plan

.

If you go for the XS+85LC01D you are "safe", there shouldn't be any compatibility issues, and you have some slack for changing the hardware to even faster speeds in the future.

jaclaz

It is one of those (actually trifling) things that make you believe that sometimes the good Mikrotik guys do not think too much before changing a syntax. I mean, I do understand how the new syntax allows to select whether the miroring is ingress or egress traffic (or both) but it could have been imp...

jaclaz

I am on 7.16rc4, but it also happened with 7.15. https://help.mikrotik.com/docs/display/ROS/CRS3xx%2C+CRS5xx%2C+CCR2116%2C+CCR2216+switch+chip+features#CRS3xx,CRS5xx,CCR2116,CCR2216switchchipfeatures-PortBasedMirroring Port Based Mirroring Starting from RouterOS version 7.15, it is possible to conf...

jaclaz

But do you have a "switch1"? I asked for the output of /interface/ethernet/switch because yours could be called "switch2" or "mickey mouse", and in some cases it may be easier to refer to the number (that you should get from the output of print). Or try command line aut...

jaclaz

What do you get with: /interface ethernet switch print The command seems loosely of the kind: set <object> <attribute1=value1> <attribute2=value2> Once you are in: /interface/ethernet/switch the command: set switch1 mirror-source=ether2 mirror-target=ether7 is different from the one you posted: set ...

jaclaz

Yep, there isn't that much choice (within Mikrotik range of products) for a suitable single device with dual band 60/5GHz links, I believe only: https://mikrotik.com/product/wireless_wire_cube_pro It is just a kit of two Cube Pro's pre-configured, it is not cheaper than two separate Cube Pro's but s...

jaclaz

Semi-random idea, but do you really-really needs to run 7.15.3? I know that Mikrotik calls it "stable", but it is still relatively new and testing RoS on switches is probably less common than on routers, so it is still IMHO well possible that there is a not yet reported/solved bug in the s...

jaclaz

I think you inverted the screenshots or inverted the scheme/drawing addresses. One router has 1 static route and two Dynamic/Automatic one: AS 0.0.0.0/0 gateway=172.16.0.1 <- this sets the interface with ip address 172.16.0.1 as the gateway for ALL outbound traffic DAC172.16.0.0/30 gateway=? <- this...

jaclaz

The issue is - I believe - your definition of "connection". Devices such as the Cube have built in - not so casually - a 5GHz "failover" radio, this means that the 60 GHz will - occasionally - fail, the 5 GHz is much less prone to issues with adverse climate (fog/heavy rain). So ...

jaclaz

Ooops :oops: . my bad, I wrongly assumed that you were making a sort of wireless wire connection. Not at all an expert with Mikrotiks, particularly when it comes to wireless settings, but from what I understand when you are using AFRINET to connect (say) a laptop and start downloading a large file, ...

jaclaz

Check by opening a terminal and issuing in it: /interface/detect-internet/print if you see it as "none" after you changed it in Winbox (before rebooting) BUT it changes back to "all" after a reboot, there must be a script (or *something else*) that re-initializes it. That whole s...

jaclaz

Very likely irrelevant to your (speed) issue, only notes, at a first read: 1) usually bridges are set with auto-mac=no and given a fixed MAC 2) you have wlan1 largely not configured, but in both devices it is set as ap-bridge, if you don't use it, it will be better if disabled on both devices 3) you...

jaclaz

Giving you a much broader and cheaper set of switch choices. Hmmm. Yes and no, if you look at the costs, compared to CAT6/6a/7 patch cables, let's say 5-10 US$ each, using DAC's you are going to need some 20-30 US$ per connection, while using fiber (or copper) SFP's, more like 60-70 US$ at least, s...

jaclaz

Good

, AND I'll move it one notch up:

1) You do not use VLAN1
2) You DO NOT use VLAN1
3) You do not use Quickset
4) You do not use detect internet
5)...

jaclaz

Maybe this post will be relevant to your situation:
viewtopic.php?t=187932#p947857

jaclaz

The whole concept of innocent until proven guilty?

Overridden by Andreotti's famous:

You sin in thinking bad about people - but, often, you guess right.

jaclaz

@holvoeth Your correction is overruled :lol: : Judge Chamberlain Haller: Mr. Gambini? Vinny Gambini: Yes, sir? Judge Chamberlain Haller: That is a lucid, intelligent, well thought-out objection. Vinny Gambini: Thank you, Your Honor. Judge Chamberlain Haller: [in a firm tone] Overruled. rules need to...

jaclaz

AFAICU SwOS is just fine (and simpler) if the switch is used as "simple" managed switch, but with RoS you have more possibilities, if needed. The way a router (designed as a router) and a switch (designed as a switch) differ is in the way the ports are connected to the CPU and between them...

jaclaz

I think I will add this to my Mikrotik Club Rules

:
1) You do not use VLAN1
2) You DO NOT use VLAN1
3) You do not use detect internet
4)...

jaclaz

... or causes random problems (worst case).

Judging from the reports I have seen on the forum, the worst case seems to be the normality...

jaclaz

I think telnet in Mikrotik is "interactive only":
viewtopic.php?t=69786

jaclaz

But you already have a route towards the internet (it should be provided by the lte1 interface by itself), the one in your screenshot: DAS 0.0.0.0/0 lte1 reachable is telling the router that any address in 0.0.0.0/0 (all the addresses) should go through lte1. From terrminal, you can check with: /ip ...

jaclaz

In modern windows, the default is to NOT replay to pings, so, unless you change that setting, pinging will result in timeout, but even if the error/result is the same it is not like your PC Is not reachable from the Mikrotik, simply the PC does not respond. 192.168.86.x and 192.168.88.x are two diff...

jaclaz

Interface list is a way to categorize/group items, so It Is the other way round, bridge Is in the category LAN, lte1 is in category WAN, bridge_wlan does not belong (yet) to any category (it doesn't need to belong to any of the two above or to a third one) . In the masquerade rule you use out-interf...

jaclaz

It seems "normal" to me.

You have two domains pointing to a same IP address.

When you src-nat and dst-nat to your local network you are using the two domains, but they will both be resolved to the same a.b.c.d IP address, wouldn't they?

jaclaz

I am not really sure what your intended setup is, but: The bridge_wlan is neither LAN nor WAN: /interface list member add comment=defconf interface=bridge list=LAN add comment=defconf interface=lte1 list=WAN And your firewall nat is only for WAN: /ip firewall nat add action=masquerade chain=srcnat c...

jaclaz

If you can use fiber, use it. Not only because it is better/faster/whatever, but because temperatures of fiber SFP's are "acceptable", copper SFP's are essentially small electric stoves (that can often create issues for the amount of heat they generate, definitely not good on passive coole...

jaclaz

If your current config works for you, good :) . You should anyway check this post by rextended on that same thread: https://forum.mikrotik.com/viewtopic.php?t=189277#p958546 Point of note: remove only connections that have a longish remaining timeout, to avoid attempting to remove connections that a...

jaclaz

The routing speed of the RB5009 is very similar to that of the CCR2004 (actually a little bit faster), so if 8 ports are enough for you, you'd better save the money for the moment. What may make the difference is if you are going to use the SFP(s), the second SFP port of the CCR2004 may be useful fo...

jaclaz

Well, start by posting your current configuration of the wsAC lite, follow this post instructions: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 It would be "unusual" that you have it configured "as router" (unless someone fiddled with it) as the common configuration...

jaclaz

The QMP comes (but the good Mikrotik guys do not show an explicit/clear photo of them) with two "attachment" devices: 1) a sort of bayonet plate suitable for the SXT and similar devices 2) a short, round, one You can see it (once you know it exists, in the second photo of the product: http...

jaclaz

Yes and no, if the devices are on a same network (let's say like in your case in a same /24) communication between them happens (should happen) at L2 level (switching/bridging) if the networks are different the communication happens (should happen) at L3 level (routing) or however some specific sett...

jaclaz

If you need more SFP's probably you should add a (passive cooled) switch, *like*
https://mikrotik.com/product/crs309_1g_8s_in
https://mikrotik.com/product/crs310_1g_5s_4s_in

jaclaz

Which main board device ( above) would you get? Also What switch for would you get? Strangely enough it depends on your requirements, number and type of devices, internet connection, what kind of speed you want to achieve and which infrastructure you have (cables) and budget. The CCR2004 @$465.00 i...

jaclaz

I think the advise was to make your MAC static and different from any other one you have on that machine, see this: https://forum.mikrotik.com/viewtopic.php?t=190747 There are reports that the mechanism the RoS uses to auto-assign MAC can, in certain situations, change the MAC, creating havoc in cer...

jaclaz

Shouldn't be too different from:
viewtopic.php?t=163396

jaclaz

About docker on mipsbe I'vefound this topic, but doesn't report the way to obtain it:
viewtopic.php?t=187595

Well, that is what is generally referred to as "wishful thinking":
https://en.wikipedia.org/wiki/Wishful_thinking

jaclaz

I think a line must be drawn *somewhere*, between "same network" and "other network". If your PC has 192.168.88.253, i.e. belongs to network 192.168.88..0/24, and the bridge on the Mikrotik is /ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=\ 192....

jaclaz

Good, so kleshlki's example in post #28 or your reported adaptation in post #29 (minus typos/errors) are the right references "as they are".

jaclaz

I made a mistake in the last step — datapath configuration. I fixed it and it worked

It would be nice if you could describe exactly what the error(s) and the correction(s) were, so that this thread may become useful as a reference for similar issues.

jaclaz

The common reports about 60 GHz Is that you need clear line of view, even some fog or medium heavy rain can compromise the link, tree leaves are a no-no. A Cube in such a setup will likely continuosly fall back to the (much slower) 5 GHz. Besides the SXT SA5 AC, which I believe is intended for much ...

jaclaz

You can also use "/system/script export where name=XXXX" to get the "escaped form" of any script (and then cut-and-paste that as needed).

Good to know, thanks

.

jaclaz

When you have PPPoE up: 0 ADS 0.0.0.0/0 pppoe-out1 1<- this is (DHCP) and Active, ALL outbound traffic goes through this 1 S 0.0.0.0/0 192.168.8.1 2 -<- this is (Static) and NOT Active (because of higher distance=2), so it is irrelevant 2 A S 1.1.1.1/32 pppoe-out1 1<- this, (Static) is Active and be...

jaclaz

ROSv7 is too generic.
Different versions of 7.13, 7.14 and 7.15 (besides latest-latest 7.16) have been object of alternate reports of instabilities on Wi-Fi.
From what has been reported, 7.14.3 seems to be the safest bet or - at least - the better "base".

jaclaz

These: add dst-address=0.0.0.0 gateway=192.168.8.1 distance=2 add dst-address=1.1.1.1 gateway=pppoe-out1 distance=1 Should actually be, I believe: add dst-address=0.0.0.0/0 gateway=192.168.8.1 distance=2 add dst-address=1.1.1.1/32 gateway=pppoe-out1 distance=1 (but maybe the network is implied) But ...

jaclaz

At a quick glance I see two common settings missing (cannot say if you avoided them on purpose):
1) static MAC address to the bridge
2) categorizing ether8 as WAN

jaclaz

We're talking about a boat here, so few other factors make it bit harder of a problem. e.g. it's going to bake in sun, vibrate/move slightly (wind), and perhaps be in salty air. So even @normis's reasonable and fun suggestion to 3D print a case for a Chateau, requires a high-temp printer to use som...

jaclaz

@mkx
Well, I paid 1.80 for that same cable, so it costs us nothing - combined - we are still ahead, and we can even afford to pay the unjust and unfair duty the Sheriff of Nottingham just imposed on us.

jaclaz

There are AFAICU mainly two consequences of using VLAN1: 1) possible incompatibilities with other vendor devices 2) possible incompatibilities with Mikrotik internal usage of VLAN1 for *some settings*, i.e.: https://forum.mikrotik.com/viewtopic.php?t=206946#p1071170 I am pretty sure that expert, kno...

jaclaz

So you have no firewall filter rules that may interfere? I see now that you did declare the vrf's, my bad :oops: . I don't particularly appreciate your naming scheme, when/if you will need to use ether2@port1 you will see why, but this is irrelevant. I cannot see anything blatantly "wrong"...

jaclaz

Yep, as said RF shielding is tricky business, strange that you did not notice some differences. Well, at least we tried ... An alternative (that you won't like) could be modifying the hAP lite, add an external antenna connector and use an external flat (directional) one: https://forum.mikrotik.com/v...

jaclaz

Very likely completely unrelated to the issue you still need to solve, but using VLAN1 is what we highly specialized technicians

commonly call "looking for troubles".

JFYI:
viewtopic.php?t=208061&

jaclaz

Here are some related info:
viewtopic.php?t=32935
particularly:
viewtopic.php?t=32935#p161412

And this post is the one that (for me) is easier to remember, the concept of a mirror of a /32:
viewtopic.php?t=32935#p382118

jaclaz

Wouldn't this be similar to the "Simple Static Routing" here (minus the two different WANs instead of the single one on the wiki example):
https://wiki.mikrotik.com/wiki/Manual:S ... ic_Routing

jaclaz

In a still not perfect world, but better than this one, wifi-qcom-ac would have probably been still called wifi-qcom-ac, but wifi-qcom would probably have been called wifi-qcom-ax. You would have wifi ac devices, and need wifi-qcom- ac , you would have wifi ax devices, and need wifi-qcom- ax . In th...

jaclaz

If it is v7, you are seemingly missing the explicit declaration of the three rouiting tables.
It is better if you post your whole configuration (as opposed to the parts that you believe relevant) as the devil is in the details.

jaclaz

Plwase recheck your post. RT1 is 192.168.1. 1 , you wrote 192.168.1. 2 in a few places. Post the configuration of the RT1 too. I think it is better to go step by step, i.e. if PC1 connection to RT1 is not working the issue can be in three places, (besides PC1), SW2, SW1 and RT1, but if SRV2 connecti...

jaclaz

Yep, there was a photo posted some time ago, about picture on the box and actual contents, cannot find it right now, but this one will do:

jaclaz

That TP-LINK thingy is not a standard (which standard?, I love standards, there are so many of them :wink: ) PoE device. The PoE injector that comes with that is intended to be more than anything else an "extension cable" powered by the "normal" power supply that comes with the d...

jaclaz

Now we are waiting for the Stable version before officially using it into production.

JFYI, in Mikrotikish "stable" has a somehow different meaning than "production ready".
I think it is one of those language subtleties that are lost in translation.

jaclaz

@bpwl That seem like one of the few cases where a cAP might be more useful than a hAP if you mount it on a ceiling or high on a wall. @acrophobic Sure, if you have the possibility a sheet of aluminium some (say) 2 mm thick would be light enough and have the mechanical resistance to hold the two devi...

jaclaz

The / only means "start from root", if you prefer without it it is a "relative path", with it it is an "absolute path": The good thing about RoS (and not only) scripting is that everyone can (within limits) write anything the way he/she likes :) (including overcomplicat...

jaclaz

As said it would IMHO be advisable to add a /32 route for the destination and leave the general 0.0.0.0/0 gateway alone. The gateway set in your lggh devices is only used for (say) NTP or something else, unless you expect days long interruptions of the lte, the 2 wireless devices can live without in...

jaclaz

Thanks for all for the possible solution, i have another question, the ping or the netwatch functions use the system gateway for the instradation, i think that i have to set first it in the script otherwise i have a infinite loop, is correct? Sorry, I don't understand the question, can you try expa...

jaclaz

Wouldn't some tin foil between the two devices (RF shielding) have the same effect of having the devices a few meters apart?
It costs nothing to test, and if it works one could experiment with a very fine metal mesh (mosquito mesh) that could be simply glued/fixed to one side of the hAP Lite.

jaclaz

It is now a Generic matcher:
https://help.mikrotik.com/docs/display/ ... ricmatcher

And if you want to live dangerously, the new 7.16beta3 has an added option, substring matching, see also:
viewtopic.php?t=191884

jaclaz

That's a very interesting comment. As far as we know, most people use Webfig. And Linux/macOS users very much try to avoid Wine at all costs. So thank you, this brings more varied opinions in to the mix. As a side note, and if I may, the idea of optionally removing webfig from the low storage devic...

jaclaz

I don't really know, but there must be something else, you just proved that VLAN devices are at the same time Dynamic and NON-Dynamic, which doesn't sound right.

Schroedinger's VLAN devices?

jaclaz

Yep, the names are confusing (generally) and to add to it every make/brand use some, slightly or greatly, different naming for the same thing. I have no idea how the eero thingies work, but probably you don't need to do anything on the Mikrotik to have it working, at least from what I can understand...

jaclaz

YMMV, therefore I'm not going to write exact rules here. You have discovered a truly marvelous proof of this, which this margin is too narrow to contain? :wink: :lol: Seriously, if you can, do post the configuration that actually solved the problem, even if mileage of other members may vary, at lea...

jaclaz

I don't want to seem unfriendly or rude, but the proper answer to your question would be: Yes. http://jdebp.info/FGA/questions-with-yes-or-no-answers.html Please describe your overall network setup, then follow the instructions here: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 and pos...

jaclaz

The hap AC lite is $59 (official list price). The Ax lite at the same price is a steal, but it has only 2.4 GHz radio, if only 2.4 GHz is ok, no doubt, go for it. The hap AC costs more than the Ax2, $129. The issues with the hap AC (lite or not) are the architecture (MIPSBE) and the (too) little amo...

jaclaz

Let's list the usual settings when the device is set as a router, the ether1 is "self-standing" (not part of a bridge) has a DHCP client active (it gets its IP address from the ISP router to which is connected) a DHCP server is running on the bridge (to which all othe rinterfaces are added...

jaclaz

Yep, but in the context of Quickset choices, I think (from the already linked threads) that Quickset in "PTP bridge AP" will set mode=bridge anyway, i.e. the "PTP" in the description prevails and sets to have only one single connection, regardless of the license level, maybe one ...

jaclaz

Maybe neighbor Discovery Is disabled?
https://help.mikrotik.com/docs/display/ ... +discovery
Or MAC Winbox server?
https://help.mikrotik.com/docs/display/ROS/MAC+server

jaclaz

Well, there is some difference between: An error has occurred and something *like*: script "mynicescript" running on device with MAC 00:ww:xx:yy:zz caused a "device not responding" error on line 42 These pieces of info: 1) name of the script 2) on which device it is running 3) th...

jaclaz

The "Typical_AP.rsc" is the configuration for a CRS326-24G-2S+

(which I doubt is a typical AP

)

jaclaz

@rextended Let's assume that by pure chance there is not any Mikrotik device in the customer's network. Doing an IP-scan from windows is a perfectly legit operation, but IMHO the original post over-complicates it a bit. A window computer set to get IP address from DHCP should already get an APIPA ad...

jaclaz

A "normal"/common Netwatch script would do. Usually: The on-down script/commands would change the route to the alternate one The on-up script/commands would restore the previous route. In your case, instead of changing/enabling/disabling routes, you would change the gateway in the dhcp ser...

jaclaz

To be fair the fact that a given (wrong) practice has been in effect in v6 doesn't justify in any way insisting on it in v7. In other fields, when *something* results in a given number of (minor) accidents or a single serious one, that *something* is usually changed (hopefully for the better). The f...

jaclaz

I guess that what erlinden asked for as "logging" was meant as:

/log print

and copy and paste a few related lines of the log around the "probably loop" error you posted.

jaclaz

I think that with some clever scripting it is possible to change the gateway provided by the two DHCP servers, but the change in the two MIkrotiks DHCP settings will not be actually propagated until next DHCP request/negoitiation/lease. So, when the LTE goes down: 1) all clients in both buildings wi...

jaclaz

To be fair, the default (from factory) configurations of a paired couple is pretty much straightforward, and similar to the "standard" (as quickest would make them) ones, the only (relative) complication is the bonding together of the two 60 and 5 GHz radios. But the bonding is needed to a...

jaclaz

Since the replacement with a similar device didn't change result (I doubt that two devices can be defective in exactly the same manner), it is actually possible the the RB750GR3 "filters" some activity on the network that ultimately causes the flapping issue. I would exclude that a commonT...

jaclaz

Good :) , so you can temporarily go for 7.12. But did the new batch come with already 7.14.1? If yes it must be new-new, 7.14.1 came out at the end of march 2024 . Unless you cannot manage to use 7.12 - since it is in production - I would wait for a non-beta version with the feature fixed before upg...

jaclaz

So you think the switch is damaged? It was connected to eth5 for months without any problem. That or *something else* on the network that the unmanaged switch allows through but the 750GR3 intercepts/blocks, hard to say. How many ports has the TP-LINK switch? Try changing them around, it is entirel...

jaclaz

Yes, but I still miss something :? . In a normal situation (both ADSL and LTE up) is : 1) both buildings A and B access internet via LTE and ADSL is only a backup or 2) building A goes through ADSL and building B goes through LTE Or - in other words - does only building B need to switch from LTE to ...

jaclaz

I tried to manually install loaded missing ARM package but it doesn't install anything.

Isn't it MIPSBE? (not ARM):
https://mikrotik.com/product/RBwAPG-5HacT2HnD

jaclaz

We have here, as a reference, the normal cube Pro pairs complete setup (from factory): https://forum.mikrotik.com/viewtopic.php?t=205042#p1059476 One end is mode=bridge and the other is mode=station-bridge, then there is the bonding between the 60 and the 5 GHz interface. And yes, the Quickset does ...

jaclaz

I am not sure to understand your setup/what you want to obtain. Normally (with both internet connections working) clients in building A go through internet access A and clients in building B go through internet access B (lte)? And when the lte connection is down you want cliients in building B to sw...

jaclaz

Possibly simpler is to highlight the modes to better understand the basic incompatibilty: What I purchased for the SFP connector is described as: "1.25G 850nm Multi mode SFP LC Transceiver Fiber Module 550 Meters 1000Base-SX LC MMF for Cisco GLC-SX-MMD/SX-MM/SFP-GE-S,Fortinet,Ubiquiti UniFi UF-...

jaclaz

Only as a side note: The default rules that come with Mikrotik SOHO devices have two features that your ones miss: 1) they are marked in comment as "defconf" which is useful when/if you want to change some of them 2) they have a comment summing up what the rule does As well, the generic ad...

jaclaz

You'll have to go through this thread (which is the officially unofficial Mikrotik guide for VLAN by Pcunite):
viewtopic.php?t=143620

jaclaz

Thanks for taking your time and explaining it. As far as I can tell by the images. The 5.1k ohm is pulldown resisors, right? It looks like you soldered them to ground. If so, I have something to do tonight. :) No, I didn't solder them (user gwynbleidd reported doing that). Yes, they are pull down r...

jaclaz

i have fixed the dhcp-client config, changing masquarade to out ether1 makes it no longer work But if you have ether1 in a bridge, likely you have to add the masquerade to the bridge and not to ether1 (which is slave)? Or it means that you need interface-list=LAN because this way you are masqueradi...

jaclaz

It is a known issue. The Ax lite (LTE6 or not) uses a USB-C connector AND 5V BUT it is not a USB-C compliant device. It does NOT negotiate with a USB-C power supply the voltage (which is OK, as it needs 5V) nor the amperage (there is a special provision in USB-C specs to allow 3A on 5V passively, ot...

jaclaz

Personally I believe that once something is working, the more "narrow" you can make the related rules/settings, the better, so, yes, I would check if the setup works with the masquerade rule attached to the single port you are interested to as opposed to an interface list. i,e, try; add ac...

jaclaz

In this guide topic here:
viewtopic.php?t=143620

jaclaz

By default ether1 is WAN on most Mikrotik devices, it is possible that you did not change its categorization to LAN? If this is the case, likely you have some firewall rules that block the connection. Follow the instructions in this post: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 an...

jaclaz

You will need to use one of these methods: https://forum.mikrotik.com/viewtopic.php?t=185514 https://forum.mikrotik.com/viewtopic.php?t=185514#p929556 The script in itself (or the command added to the scheduler script) should amount to: delay 10s /interface vpls disable [find] delay 5s /interface vp...

jaclaz

It sounds like a timing issue when rebooting.
The fact that it happens only some times (and possibly only on some routers) makes it difficult to avoid completely.
Probably the workaround would be a script set to run (say) after 3 minutes after boot that disables and re-enables the VPLS interface.

jaclaz

If the routers work as they should I would leave them alone. You are using 297 out of 970752 on the one and 113 out of 1015808 on the other. The max-entries depend on the amount of free RAM on the specific machine, it is calculated automatically and it is a read-only property: https://help.mikrotik....

jaclaz

See:
viewtopic.php?t=193667#p984874

Any Dynamic DNS may fail, anyway, and past performance may not necessarily be an accurate forecast of the future reliability.

Decisions, decisions, always decisions ...

jaclaz

About the log, open a new terrminal Windows in Winbox, in it input /log print This way you can select and copy. About the configuration, the upgrade should have not deleted It completely, maybe when you ran It without the drivers something got corrupted. Follow the instructions here and post the con...

jaclaz

Besides the convenience (or non convenience) of having your router up a pole outside :wink: , the SXT LTE6 is not a very fast device, so (it depends on the fiber connection you have) it may be a bottleneck. At what speed you have your fiber connection? If faster than 100 Mbps or so the SXT will be t...

jaclaz

The Mikrotik DDNS service should be available to people using MIkrotik hardware or a CHR license, see this as an example:
https://foisfabio.it/index.php/2022/12/ ... -gratuito/

jaclaz

No need for wifi in the basement? Or outside, in the courts or park? Anyway as access point, in Mikrotik catalog you can currently choose between the Cap Ax:and the Cap Ax: https://mikrotik.com/product/cap_ax Maybe and maybe soon, there will be a new device that may be suitable, the Wap Ax. In metri...

jaclaz

It's strange. You have a DAc (Dynamic, Active, connected) route (generated automatically by the router, hence with distance 0): DAc 100.64.0.0/10 ether8-StartLink 0 And seemingly no other ones interfering, so the destination 100.64.0.1 should be reachable. The one you added to the DHCP client with d...

jaclaz

Routing rules are usually "better", but mangle marks allow more granularity, so if you can obtain the expected result with routing rules, they should be preferred.

jaclaz

I would not update to 7 yet.
It is not a bad idea, but the procedure is not exactly simple, and if I were you I would wait until you have become more familiar with the devices and their configuration/management.

jaclaz

60 GHz needs direct line of sight, no ifs, no buts.
If you have that, go for it, but if you have even a japanese style paper wall between the two devices 60 GHz won't work properly.
Devices like the Cube Pro have a backup at 5 GHz because fog or relatively heavy rain can break the 60 GHz connection.

jaclaz

I see now, so in the referenced post the new and old AP are to be intended as same AP but new and old bands.

jaclaz

Having dst-address the same as the gateway add disabled=no distance=1 dst-address=100.64.0.1/32 gateway=100.64.0.1 \ pref-src="" routing-table=main scope=10 suppress-hw-offload=no \ target-scope=10 which is in route print: 2 As 100.64.0.1/32 100.64.0.1 1 doesn't look right to me :? , maybe...

jaclaz

Very often the issue is with the APN. Make sure what the MEO APN should be, "internet" is probably a generic one. In some cases you need to explicitly set: use-network-apn=no https://help.mikrotik.com/docs/display/RKB/Chateau+LTE12+APN+problem https://forum.mikrotik.com/viewtopic.php?t=161...

jaclaz

Easy bet. It is already known this is the root of the issue. That's why people commonly tinker around with connect-priority.

I thought that was related to issues when roaming with two or more different AP's?
viewtopic.php?p=1093107#p1093107

jaclaz

Another observation. Normally, the SSID for 2.4GHz and 5GHz are identical. However, for this test, I added "5G" on the end of the SSID so I could force it onto one band or another. When the SSIDs are different, the SA Query timeout errors never occur. Even though the RX signal is poor, it...

jaclaz

And don't hold your breathe while waiting for a new product to appear, it may take longer than you can live without breathing

Corollary:
Do you think that's air you're breathing now? /size]

jaclaz

Sorry, but ROSE is clearly not enterprise feature ...

https://help.mikrotik.com/docs/display/ROS/ROSE-storage

ROSE (RouterOS Enterprise) package adds

... and the 2024 award for the most inaccurate package name goes to ...

jaclaz

I wonder why the Ax2 is always represented as standing ... :? AFAIK it needs to be standing because of better heat dissipation, but it is possible that the internal antennas are designed to work with the device standing and having it flat on the table reduces their efficiency (or you have a lot of s...

jaclaz

... unless you first set a secure password (meaning requiring sensible password complexity ...

JFYI:
https://neal.fun/password-game/

jaclaz

Also made sure the antennas were tightly screwed to the board and aiming at 45 degrees like this. You have strange degrees where you live. :lol: Here the angles in the photo would be between 60 and 72. (they would fit either an hexagon or a pentagon placed on top of your Ax3) https://t4.ftcdn.net/j...

jaclaz

Well., post your current configuration:
viewtopic.php?t=203686#p1051720
and describe what you want to achieve.
Post also an output of:

/ip route print

jaclaz

When you make a cake, decoration is the last thing. :wink: Postpone access lists to later, once you will have the basics working. The Capsman is running, on the AC2, right? Have you followed the tutorial on the Wiki? https://wiki.mikrotik.com/wiki/Manual:Simple_CAPsMAN_setup Alternatively, did you r...

jaclaz

Sorry I did not understand the comment directed at me. Can you clarify the point you are making? Unfortunately MikroTik is popular with two very very different groups. Home users that plug and play (or mobile operator that just gives them a router). and professional installers. We have to make both...

jaclaz

It is not like I cited the CRA (which is not yet in effect) casually. Annex 1, Article 1, paragraph 3 (a) is exactly about this: (a) be delivered with a secure by default configuration, including the possibility to reset the product to its original state; This is what MIkrotik is IMHO already doing....

jaclaz

Just in case here is my personal translation table: https://forum.mikrotik.com/viewtopic.php?t=208346#p1080389 And I concur that the issues are unlikely to be connected to hardware (it is not like Mikrotik has own proprietary chips or circuits) and AFAICU now they are using not anymore their proprie...

jaclaz

Hmmm, Normis seemingly stated the opposite:
viewtopic.php?p=1090870
Maybe there is confusion in the terms used?

jaclaz

Do you know the scene from Spaceballs movie?

Yep.
We're at now now.

... as a non native speaker ...

... which makes a nice round two of us.

jaclaz

To be fair: you said "now" like it is something new.

Well, I wrote now meaning now, as in now, would already have been better?

Or should I have gone all the way to adding "since the dawn of times" or "AFAICR"?

jaclaz

I don't know where you live, but I never ever received a credit/bank card shipped with PIN code in same envelope ever in my whole life. Exactly, as I said, the PIN cannot be shipped in the same envelope as the card, to avoid the possibility that if the card is stolen "in transit" it can b...

jaclaz

If you check the Annex I, article 1, paragraph 3 of the mentioned CRA it can be read (in a restrictive way) to the effect that shipping a router with a password is not a sufficient measure to prevent unauthorized access to it. :shock: Not unlike what happens now with credit/debit cards (the PIN cann...

jaclaz

Welcome to the world of (Mikrotik) wi-fi mysteries. A cap Ax is designed to be mounted on a ceiling (though it is also possible to mount it vertically on a wall, though in this latter case it will likely perform worse). The board is full of reports about the cap Ax being either very good or a terrib...

jaclaz

I haven't actually read the EU law regarding the passwords, but if every other vendor did it by forcing a password change, instead of random passwords per device, then I am inclined to believe that 'random passwords' wasn't a requirement by law. Possibly because it is not at all clear which specifi...

jaclaz

Then I need to get the POE Power into the device. 4 cameras take 0.5 amps each. Seems like there are lots of POE power supplies available. What should I use for this? 0.5 amps? :shock: Maybe they use 0.5A@12V or 0.5A@24V. Most PoE cameras are nowadays 802.3af, which usually work @48V, and to be af ...

jaclaz

Then the issue is related to VLAN settings. No idea about those, I can only observe that you are not using the exacts settings anav suggested (cannot say if those would make a difference). You have the routes as DAC, so you don't need to add them as static. Maybe you can go through this: https://for...

jaclaz

conditions are IMHO AND combined. ssid-regex+passphrase must match both. Dunno what's wrong with their logic. Maybe passphrase is not a filtering parameter. So the only remaining filter param is ssid-regexp and first rule wins. Yes, passphrase is not listed among the "filtering parameters"...

jaclaz

By posting only partial configuration you are making much more difficult to follow your settings. Please post the whole configuration. This: /ip firewall address-list add address=10.0.0.10 list=ZugriffAufDrucker /ip firewall filter add action=accept chain=forward dst-address=10.0.101.250 src-address...

jaclaz

After I tried this solution, the router became a brick. No internet, no vpn, on access to the router via 192.168.88.1 ip address. It is improbable, those settings are only related to outbound traffic and wi-fi, it is more likely that *something else* caused the issue. Anyway, you should be able to ...

jaclaz

"The rules are checked in the order they appear in the list. Only management actions specified in the first matching rule are applied to each connection." Maybe the relevant statement is a few lines after that: Just make sure that the specific client doesn't get matched by a more generic ...

jaclaz

Well, whatever/whomever produced the snippet you posted did not understand the question, let alone provide a meaningful answer. (actually it is wrong even as an answer to another question). Once removed the abstraction level of the variables, it amounts to fiddling with IP addresses of a local port,...

jaclaz

I connect the patch cord to the laptop connector. If you don't have *anything* plugged into a wall socket, then you have no power. Your device is a cap Ac, it is - at least by name - an Access Point, not a Router, hence the initial perplexity. It can only be powered via PoE: https://mikrotik.com/pr...

jaclaz

Let's start form the basics. 1) Which exact device model is it? 2)How are you powering it? From what you write it seems like the device has not power at all. The device needs power, they normally have a DC jack socket, a few can be powered from PoE (Power over Ethernet), but of course in this case y...

jaclaz

Yep.

this remains valid anyway:

Always drive defensively. Expect the unexpected.

jaclaz

@Njumaen AFAIK size of packets is unrelated. The opinion on the forum is that the data from tests Mikrotik publishes are largely inaccurate in the sense that they represent some peculiar lab/test conditions. What has been observed is that coincidentally the value for routing, 25 firewall rules, 512 ...

jaclaz

After all, most exploits are done over network without physical access to device being compromised. Yes, and - again - the insecurity is mainly the fact that *somehow* there is access to the device files from the outside, the Meris that has been cited was a bug that allowed to download the database...

jaclaz

I asked if it is good solution to have DNS server on the MikroTik router or it is better that any client receive the ISP dns. Well, initially you only provided statements, only later you asked the questions, which however, without context, can only be answered as "it depends". The DNS ser...

jaclaz

Still the RB3011 can route in theory at 452.6 Mbps 512 byte packets with 25 firewall rules https://mikrotik.com/product/RB3011UiAS-RM#fndtn-testresults as opposed to 986.3 Mbps of the hap ac2 https://mikrotik.com/product/hap_ac2#fndtn-testresults If OP's WAN is already at 500 mbps, the RB3011 is cur...

jaclaz

If I get this right, you are looking for some sort of failover (more than load balancing) among three target IP's?

You only connect to 1 IP (IP#1) and you expect the Mikrotik to forward/route your connection to any of three other IP's (IP#2, IP#3, IP#4) depending on the availability?

jaclaz

I don't understand your setup. You first add an interface to a bridge (with only one port?) and then you add an IP address to the interface (and not to the bridge). Try removing the IP address from the ether2 and add it to the bridge: /ip address add address=192.168.14.250/24 interface=bridge1 Then ...

jaclaz

It's free?

From the project page:

License

RouterFleet is released under the MIT License. Feel free to explore, modify, and distribute the software as per the license agreement.

https://github.com/eduardogsilva/router ... in/LICENSE

jaclaz

hashtag #nocamelcase

https://en.wikipedia.org/wiki/Camel_case

jaclaz

This doesn't happen with a Zyxcel 12v 4a adapter. Yep. Your device specs: DC jack input Voltage 12-28 V Max power consumption 23 W Max power consumption without attachments 17 W would require no less than 17/12=1.42A@12V or 17/24=0.71A@24V or - better - 23/12=1.92A@12V or 23/24=0.96A@24V Still, if ...

jaclaz

gianry, you evidently have not noticed that the previous replies contain (some) sarcasm. You did not provide a configuration, only a (non-understandable) snippet/screenshot and a very partial description of the settings you used. If you want some sensible replies you should post your configuration: ...

jaclaz

However it is working now!!! Good. :) Can someone explain the difference between my initial config and this? Your connection/route to 10.0.0.1/32 became ADC, the A is active (as before) but it is not anymore static, it is DC (Dynamic and Connected) and has a distance of 0 which means that the route...

jaclaz

Why is that route distance 2?
It should not matter since you have no other routes for 0.0.0.0/0, still it should normally have distance 1.
You should probably specify out-interface=ether1 in your /ip firewall nat masquerade rule. but that is also - I believe - not relevant.

jaclaz

So that Shelly uses digest and fetch supports it directly, good to know.

It remains strange that curl with -anyauth didn't work/didn't provide this info, but all is well that ends well

.

jaclaz

Should be related to the built-in ssh server:
https://help.mikrotik.com/docs/display/ROS/SSH
try disabling ssh in services:
https://help.mikrotik.com/docs/display/ROS/Services

jaclaz

Post again the /ip route print output.

Maybe you can ask the VPS server provider if they have a known to be working Mikrotik setup.

The only other thing I can think of is adding a 10.0.0.x IP address to ether1.

Let's wait if some of the more experienced members have a solution.

jaclaz

Try with the -v (verbose) switch, possibly there will be more details. Checking the capture of the browser, it mentions "algorithm=SHA-256," the Shelly1 and 1plus, from what I read should be using basic auth, later devices do actually use a different method of authentication: https://shell...

jaclaz

Basically it means 10.0.0.1 on interface ether1, or 10.0.0.1 reachable through interface ether1. There are two "modifiers" for gateway addresses: https://wiki.mikrotik.com/wiki/Manual:IP/Route gateway (IP | interface | IP%interface | IP@table[, IP | string, [..]]; Default: "") Ar...

jaclaz

In a Windows command prompt, curl does not work with the Shelly authentication enabled. It works fine with the Shelly authentication disabled. Post the exact CURL command you are using. No error provided when it fails? Under Windows, try running. curl -v -u "user" http://192.168.0.144/.. ...

jaclaz

The "no route to host" is normal, as that route (#0 in the screenshot) is "S" but not "A".

No idea what the problem is, but - for what it costs - I would try a route with gateway=10.0.0.1%ether1

jaclaz

Post the output of:

/ip route print

jaclaz

Try it on a PC (with curl installed/running), then - if it works - you need a script for "basic auth", see my previous edited post.

jaclaz

The user:password actually works from a browser. Very likely because the browser itself manages to encrypt/encode/hash/whatever the username/password before sending it to the Shelly. https://reqbin.com/req/c-fkj7kdqi/curl-request-with-credentials Try with curl: curl http://192.168.0.144 --user &quo...

jaclaz

It seems like you say. https://www.intel.com/content/www/us/en/support/articles/000005714/wireless/legacy-intel-wireless-products.html All wireless products with 802.11n support MIMO. https://info.support.huawei.com/info-finder/encyclopedia/en/MIMO.html Mainstream home wireless routers in the market...

jaclaz

Those are the 2.4 GHz antennas, compare with the picture here:
viewtopic.php?p=1087853&hilit=antenna#p1087603

jaclaz

There may be some settings that need to be changed/tuned, but it shouldn't reboot by itself. The configuration you posted indicates: # managed by CAPsMAN that wifi settings are managed by capsman, but us this the case? (i.e. do you really have anothe Mikrotik device that is controlling this one?) Po...

jaclaz

Wait a minute, the d53g is this one:
https://mikrotik.com/product/chateau_5g
it is an AC device, it should use the wifi-qcom-ac package, not the wifi-qcom, which is for AX devices.
It is confusing, but read carefully:

https://help.mikrotik.com/docs/display/ROS/Packages

jaclaz

The article says: While the vulnerability was patched after its detection back in 2018, it’s still being exploited in compromised devices that do not use the patched RouterOS versions, or that use the default usernames and passwords. The last part of the sentence is "captain obvious" speak...

jaclaz

But, if I recall correctly, the 250,000 of Meris were connected to a router os bug/vulnerability, not to 250,000 compromised passwords.

jaclaz

This is strange.
A package like qcom should be installabile in any moment (i.e. also after the installation of the main routeros package).
Maybe you can try a new netinstall, making available both the routeros and qcom package.

jaclaz

But now, with the appropriate qcom package installed, the wifi is running, right?

jaclaz

Good

.
Yet another happy bunny in the basket

https://msfn.org/board/topic/128727-can ... ent=828512

You are welcome.

Search found 1441 matches