MikroTik

jaclaz

This:

/ip address
add address=192.168.1.2 interface=vlan3 network=192.168.1.2

Is a /32 address/network.

Very likely you want instead a /24 one, i.e.
/ip address
add address=192.168.1.2/24 interface=vlan3 network=192.168.1.0

jaclaz

Very likely you had to login to post and that triggered the "can view attachments" flag.
Take your time, the more you play with the tools and get familiar with them, the better

.

jaclaz

I think all these three solutions should be possible.
Personally I would prefer #3, as the Mikrotik right after the ISP router should allow more control and security, even if the ISP router cannot be put in bridge mode and there will be double NAT.

jaclaz

Forum users can't check support tickets, so no reason to post ticket numbers here It is of no use for other common forum members, but this way you or other Mikrotik staff happening to pass by and interested in a report on the forum may be able to check in more detail what the issue is, without need...

jaclaz

I have no idea, I am just trying to understand the exact requirements and provide some expanded/explained context of your suggestions, so that even an absolute beginner (as the OP clearly is) can understand and replicate them. (my role is only that of a friendly, slightly more familiar with Ros, beg...

jaclaz

To better understand, the solution anav suggested is for the topology on the right, whilst you would prefer the one of the left, correct?
It shouldn't be particularly difficult to transform the one into the other.

jaclaz

Well, you have a pretty much sane (largely default) configuration, it is just a matter to learn a few things as also your intended final configuration (per anav's post) is pretty much standard. You now have: 1. a single ethernet port (ether1) self-standing and added as WAN to the interface list 2. a...

jaclaz

Which Routerboard device? With which antenna? On which frequency range (2.4 or 5 GHz)? On which Channel in the range? Any change in any of the above may modify - slightly or sensibly - the result. If you are looking for measuring distances, you might want to have a very directional antenna to minimi...

jaclaz

Ah, ok, MacOS Is - as often happens - doing things its own way, AFAIK in Windows It Is not allowed and on Linux you need to add the -b switch. I now understand better your setup, the first router, the ISP one, is conceptually not really a router, in the sense that being not configurable (if not for ...

jaclaz

I see, the issue is with (icmp) packet size (which is not MTU). It is strange that forwarded pings go through however, they should still be 56 bytes, I believe it is the default on most Operating Systems. Size of icmp packets in tool netwatch has been only implemented in later 7.x version I believe,...

jaclaz

I don't know, but it sounds to me not normal

that your router cannot ping normally an IP on the internet.
I would try to solve that problem before looking for a way to replicate a workaround you found

.

jaclaz

Sure :) , but at the moment you had posted only the input chain rules. I was trying to highlight how futile it was replacing a rule that doesn't do what is its intended goal (because it is in the wrong chain) with a (better) inverted logical approach that as well is in the wrong chain and thus fails...

jaclaz

You could set it up like this: https://wiki.mikrotik.com/Manual:Simple_Static_Routing In that example, Router2 needs not an additional route because there is a gateway set (that automatically means 0.0.0.0/0 i.e. "everything" is reachable through it), i.e. the "upstream" route in...

jaclaz

I've seen this project on github, but I never figured out why it's needed... It depends on what hardware (real or virtual) you run the image on. Since several releases the image Mikrotik provides is not fully compliant with UEFI because the "system partition" is formatted as ext2fs (inste...

jaclaz

There must have been an obstruction in the notification drainpipe, now removed

https://www.bbc.co.uk/news/articles/cvg7x8l5pv2o

jaclaz

I want to block access to WAN for addresses from the list (that was my comment on this rule). Unless you have another recommendation. The combination of these two rules: add action=accept chain=input src-address-list=Authorized ... add action=drop chain=input comment="drop all else" give ...

jaclaz

It seems to me like you have no (sensible) firewall filter rules. This can be very dangerous, your router (and network) is essentially open from the outside. On the other hand you have some not-so-common more advanced settings (ovpn. queues, etc.). It seems like it was configured by someone familiar...

jaclaz

Hmmm. :? Just for the fun of it, run the Wireless Network watcher from Nirsoft (it is not for wireless only): https://www.nirsoft.net/utils/wireless_network_watcher.html besides other things, it identifies "Network Adapter Company" (cannot say if via MAC or through other means) my guess is...

jaclaz

It seems to me like the first thing you should do is to get Winbox (the dedicated program to manage Mikrotik gear) and use it instead of what you are using now (I presume browser, i.e. webfig). https://mikrotik.com/download One of the distinctive advantages of Winbox is that it can usually connect t...

jaclaz

@anav
In the OP's current config the DNS server Is on another device, 192.168.1.9.

jaclaz

And you also spoof the MAC to a TP-LINK one?

jaclaz

Possibly a stupid idea

, but would it be possible to generate a log entry with the variable and its value and then parse it out from the log?

The log is usually volatile (in ram, doesn't survive reboot), isn't it?

jaclaz

@Mossii Maybe you need some background to understand the set of configuration johnson73 provided. Here you define two interface lists, one is LAN or inside/safe, the other one is WAN or outside/dangerous: /interface list add name=WAN add name=LAN Here you define which interfaces are what, a default ...

jaclaz

Netwatch is triggered by a change in the status of pinging <some address>, and the discrimination is only between ping OK and ping NOT OK.

If the pinging always fails, no matter if the ether interface has a connection or not, it won't be triggered, I believe.

jaclaz

Besides it being useful or not, I am failing to understand the logic of the if conditions (i am just trying to understand). The base condition is whether $bound is 1 or not: a. if $bound is not 1, then remove ALL routes with that comment b. if $bound is 1 then: b.1 if there is not a route with that ...

jaclaz

OT, but calling the router Archer AX53 seems to me a touch of genius.

jaclaz

Not what you asked, but the (good?) ol' way :shock: would have been to protect the router putting it inside an electrical box or, if WAF is involved, a hand made wooden box and keep the LAN topology as is. I guess this shows how old I have become, attempting to solve problems with last century techn...

jaclaz

it is *very* usefull to dynamically booting diskless machines.

This.
I usually boot (dynamically) two or three diskless machines every day, just before breakfast.

jaclaz

Don't worry :) , it happens to everyone, it is the second mistake that happens to everyone (the first one is losing access to the device when fiddling with settings and needing to reset it). The mAP should run fine with latest 6.x version (6.49.17 if I recall correctly) whilst with v 7.x versions it...

jaclaz

I am not sure to understand:
https://mikrotik.com/product/ccr2004_1g_12s_2xs
https://mikrotik.com/product/CCR1036-8G-2Splus
https://mikrotik.com/product/CCR1072-1G-8Splus

jaclaz

0. ether1 is an interface and it has its own "dignity" and you can assign an address to it. But when you add it to a bridge, the bridge is *like* WE ARE THE BORG; YOU WILL BE ASSIMILATED.YOUR UNIQUENESS WILL BE ADDED TO OUR COLLECTIVE. RESISTANCE IS FUTILE. :wink: the individual address of...

jaclaz

Well, which IP address are you pinging? The bridge has none set. Only ether1 has one (and it is a /32): /ip address add address=172.31.246.2 interface=ether1 network=172.31.246.2 Try running /ip address print and post the output. Same for /ip route print, this way we can understand what happens with...

jaclaz

I meant conceptually (since I'm not sure IP firewall rules are even processed when ports are bridged). But just in case, I added accept rules for in/out/fwd at the top of the list, and no difference. There must be a reason for this I don't understand Conceptually firewall should be not part of the ...

jaclaz

Do I have to adjust firewall rules to permit something here?

We won't know until you post your current configuration for review.

jaclaz

Well, the setup I posted is (intentionally) static only, it is that of a device that I use to give wireless connectivity to a device that has only a wired port but is physically in a room where there is not an ethernet cable arriving nearby. In your case you may want or need to set it with a DHCP cl...

jaclaz

Yep, sometimes the terminology can be confusing. Routes are just routes (and the go in /ip route). Routing rules are a mechanism for policy routing (that go in /routing rules) that allow to "filter" and modify some particular connections, you can think of them as similar to mangle rules (t...

jaclaz

Ok, here is the (very, very basic) configuration that you could use as a base: # nov/29/2024 10:09:05 by RouterOS 6.49.17 # software id = [redacted] # # model = RouterBOARD 941-2nD # serial number = [redacted] /interface bridge add admin-mac=[redacted] auto-mac=no name=bridge1 /interface wireless se...

jaclaz

Post what you have, see instructions here:
viewtopic.php?t=203686#p1051720

If you want a reference, I have somewhere a hap lite (should be very similar to the map/map lite) with a very simple configuration that I can share.

jaclaz

You must have somehow mixed the printout. Let's start with the main router (the one you posted the configuration on first post) you have on it two IP addresses assigned: /ip address add address=192.168.1.1/24 interface=LAN-Bridge network=192.168.1.0 add address=192.168.0.3/24 interface=ether1-WAN ne...

jaclaz

Wait for 802.11az wide adoption?

jaclaz

Because I setup all my forwarding firewall rules to be port specific (eg: rule applies if going out ether1). How do you handle that? Is there a way to make the rules to refer to a group of ports (so it will automatically apply to port 1 and port 3)? Or do I have to duplicate a bunch of rules? Since...

jaclaz

Excuse me rextended, if I get this right, that means an untold: Hey, user, you won't connect to my wifi. The more knowledgeable users might read the above unwritten message as: Hey, user, you won't connect to my wifi unless you disable the randomized MAC address feature of your device (yes the one t...

jaclaz

...and - as generic advice - don't use VLAN1, it is used internally and can cause issues in a configuration. Use (say) VLAN10 and VLAN20, instead. ether2? Instead of a supout, follow this post here: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 and post your (anonymized) configuration. ...

jaclaz

If you use the Mikrotik as a switch you need to use one of the available (station-) bridge modes, if you are going to use it as a router, then you want to the "plain" station mode.

jaclaz

Any bright ideas? Cannot say if bright, but once removed possible issues with the Windows firewall, the common advice is to have ONLY the ethernet port in use enabled on the PC (if it is a laptop or however has also another wireless interface - and you did that) and use a dumb switch between the PC...

jaclaz

One Mikrotik would be enough. You want to use station pseudobridge mode (or possibly station-pseudobridge-clone). If you have two Mikrotiks, you can use station bridge mode, but if there is a single device connected to the station, there should be no difference in practice between the three and four...

jaclaz

Maybe it could be changed from "not running" (that does sound like there is a problem with the interface) to something like "no connection" (that would mean both an empty port or a port connected to a device that is off)?

jaclaz

You have three bridges? /ip address add address=192.168.131.1/24 interface="Infrastructure Bridge" network=192.168.131.0 add address=192.168.132.1/24 interface="Full-access Bridge" network=192.168.132.0 add address=192.168.133.1/24 interface="Limited-access Bridge" netw...

jaclaz

In Mikrotik client is called "station".
And there are a few modes available, you want station pseudobridge, see:
https://help.mikrotik.com/docs/spaces/R ... tion+Modes

jaclaz

Check this:
viewtopic.php?t=97113#p807074

jaclaz

I am happy to report that I can finally get UDP packets from the devices to the controller. Thank you to all who contributed!

It would be useful if you could post the final configuration that works for you, so that it can be useful as a reference for other people that may need something similar.

jaclaz

This is a snippet from the posted file: /interface wifi # chains not supported set [ find default-name=wifi1 ] channel.skip-dfs-channels=disabled \ configuration.antenna-gain=0 .chains=0,1,2,3,4,5,6,7 .country=Italy \ .dtim-period=1 .hide-ssid=no .manager=local .mode=ap .multicast-enhance=\ disabled...

jaclaz

Yep, but you cannot squeeze lemon juice from cucumbers, if all OP can get is: 300Mbps download / 50Mbps upload. that's it. I would assume that some firewall rules will be needed, the 750 GR3 that can be expected in theory to have 265.2 Mbps routing is weak, the hex refresh at 498.1 Mbps seems like m...

jaclaz

Yep, but you are planning to have 2, 20 or 200 customers? The 750Gr3 as "central router" seems like a very weak device for many users, but if you are convinced that it is powerful enough and if you have to buy new, a new more powerful version of the hex was just released: https://mikrotik....

jaclaz

Yep, I meant coverage (and its "shape"). Let's take a square room 6m x 6m. The ideal situation would be a cAP in the center of the ceiling as it supposedly toroidal (doughnut) emission shape should cover everything. If you put a wAP on (say) the north wall, in the middle, it will probably ...

jaclaz

To be fair, "we expect" has a meaning which Is (IMHO) very different from "are required".
It seems more like a "good willing wish" than a contractual clause.

jaclaz

Then probably the wAP is just fine for your use, and the cAP - set aside the 160 MHz width - would have been less suitable. But it is really hard to say as indoors there are reflections/absorptions/whatever that may make the real world coverage different from the theoretical or geometrical one. The ...

jaclaz

Very likely in routers 3 and 2 you have a route for 0.0.0.0/0 pointing "upstream". And of course in main router you have a route for 0.0.0.0/0 pointing to the ISP router: /ip route add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.0.1 \ pref-src="" routing-table=ma...

jaclaz

I can’t increase the transmit power on my mobile device (in this case the PlayStation 5) but it’s maybe possible to do it on my mikrotik right ? Yep, but it is two way communication. The PS5 may be able to "hear" the Mikrotik if it "shouts", but the Mikrotik may still not be abl...

jaclaz

Be aware of the meaning of the model name and consequently its radiation pattern: c=ceiling omnidirectional (360°, at least in theory) w=wall directional 90° to maybe 120° or so. The radiation pattern of the Wap seems to be like an off center ball with a flat bottom, see: https://forum.mikrotik.com/...

jaclaz

I like to think that since RouterOS is under the hood a derivative from Linux, GUI parts, both Winbox and Webfig, are "overlays" over textual commands. You can normally connect to a Mikrotik device via SSH (or telnet) and do all the configuration on the command line. What happens - particu...

jaclaz

Ah, I see now, you were talking CAD, the price in US$ are correct ( in line with official list price). The cost of shipping seems crazy to me, I understand that Canada is a large country, but the parcel would be small and weight less than half a kg. The cAP ac XL on that same site Is 145 CAD/99 US$,...

jaclaz

Hmmm:
https://www.store.mikrotikcanada.ca/wir ... 07711.html

jaclaz

The Cap AC XL, before and besides any other consideration, is now an old device, with only 16 Mbyte of storage, which is already starting to be an issue with current Ros v7 (upgrading may be complex). You could consider the newish Wap Ax: https://mikrotik.com/product/wap_ax It is talked about here: ...

jaclaz

There is no secret.
There are some requirements for security mandated by the EU that the good Mikrotik guys believe they are complying with in this way.

JFYI:
viewtopic.php?p=1093341

jaclaz

Ok, I did a few tests in GNS3, and the vrf approach seems to be working (at least I can ping both with ICMP and UDP from PC to the two targets). Setup: VPCS named PC-source set with ip 192.168.0.254/24 connected to ether1 of a Mikrotik CHR (runnning 7.15.3) VPCS named target1 set with ip 192.168.10....

jaclaz

Yes, that one (with no marker) is static, the one below it is coming from the DHCP and is marked with D (Dynamic). And then you can remove the (only) static rule, the markings on the first: # DST-ADDRESS GATEWAY DISTANCE 0 As+ 0.0.0.0/0 10.221.215.1 1 mean that it is #0 (i.e. you can remove it) then...

jaclaz

I don't know, as said I believe (but I may well be wrong) that netmap maps "everything", but maybe there is the need to specify protocols and/or ports. :? But then it could be that for *some reasons* your tool/program/whatever does not expect this kind of netmapping from/to IP addresses. I...

jaclaz

Yep, but you probably should do the reverse. Remove the static address and let the DHCP client run. Since the DHCP server is managed (I believe) by your ISP if they change it (for whatever reason) to another subnet your static assigned address will become m00t. Moreover the DHCP server will provide ...

jaclaz

It looks mostly fine to me :) , the only thing you should re-check is: /ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=\ 192.168.88.0 add address=10.221.215.2/24 interface=ether5 network=10.221.215.0 /ip dhcp-client add comment=defconf interface=ether5 ether5 has bot...

jaclaz

The advice Is to NOT touch anymore Quickset, not even for viewing its current settings. Is time you start evolving from absolute beginner, read this post: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 and follow the instructions and post your full configuration. There is something "...

jaclaz

My appologies, I have never seen that eth1 is a combined port. Yep :) , and of course which port has PoE IN is not specified on the Ax3 page, probably it is left as an exercise for the reader. The sad news (OT but not much) are that this sloppy way to document devices and their features is becoming...

jaclaz

Befor you follow these steps (which are explained quit well!): The eth1 is a PoE in port, you will have to connect the cAP AX to eth5 of the hAP AX3 to have it powering the cAP AX. The ether1 is PoE-Out on the A x 3: https://mikrotik.com/product/hap_ax3 PoE-out Details PoE-out ports Ether 1 PoE out...

jaclaz

Well, the CRS should be written as C R S to better convey the performance of the device. And the proxy for real world performance is the 512 byte packet, so without any firewall rule, it is more like 300 Mbps. For around 1 Gb throughput, I presume with just 1 WAN connection, instead of a replacement...

jaclaz

What I don't understand from your post is whether you just took the two cubes out of the box(es) and attempted connecting them or if you configured them (via Winbox or Webfig or SSH). In the first case it could be a factory mis-configuration of one device, in the second it could be a mis-configurati...

jaclaz

there must be a typo/inversion in the referenced post :shock: chain is dstnat action is netmap. your: /ip firewall nat add action=dst-nat chain=netmap dst-address=192.168.0.170 to-addresses=192.168.10.2 add action=dst-nat chain=netmap dst-address=192.168.0.171 to-addresses=192.168.10.2 should be: /i...

jaclaz

I would define "rare" the case that something Sob suggests is not working. Post your full configuration, maybe there is *something else* that needs to be corrected or some "wrong" other setting that some of forum members may be able to spot.. Netmap (from what I understand) shoul...

jaclaz

So you are on 6.x (routing-mark in /ip route).
Sob's suggestion here:
viewtopic.php?t=187178#p942405
uses netmap, not dst-nat.
That may (or may not) make a difference.

jaclaz

Only as a side note, in the 192.168 range you have only 256 /24 subnets.
In the 10 range you have 256*256=65536.
A collision is still possible, but it is definitely less probable.
Particularly if users use 192.168.x.0/24 ranges

jaclaz

I think a line must be drawn somewhere, it is not the first and only case why someone might want or need to have several devices with the same IP. Only as examples: https://forum.mikrotik.com/viewtopic.php?t=119134 https://forum.mikrotik.com/viewtopic.php?t=187178 https://forum.mikrotik.com/viewtopi...

jaclaz

Well, your ISP router should be running a DHCP server, which you want to keep as "authoritative". You can set the Mikrotik as an AP bridge (i.e with all intefaces, including the Radio/Wi-Fi into a single bridge, with only one ether interface - advised - kept out of the bridge for emergency...

jaclaz

Interesting that the LCD use can have such dramatic consequences. If we consider the usual proxy for real world speed, routing 512 bytes packets with 25 firewall rules:: https://mikrotik.com/product/RB3011UiAS-RM#fndtn-testresults at 452.6 Mbps you are already at the upper limit of what is achievabl...

jaclaz

Let's clear the requisites/intended setup first. The network/internet is connected by wire to the Mikrotik and you want some devices (printer as an example) to connect wirelessly to it. If this is the case, you want the Mikrotik to be an Access Point, not a client (station). Even if it is technicall...

jaclaz

... or some sort of step-down-device from 48V to 24V you could just plug between the 48V supply. Or something like that.

... like:

https://mikrotik.com/product/rbgpoe_con_hp

jaclaz

You could add a custom rule to the Windows firewall allowing reply to ping only if the ping comes from a given IP address, some examples here: https://www.wintips.org/how-to-allow-ping-in-windows-firewall/ https://superuser.com/questions/1696779/enable-ping-in-windows-server-for-specific-ip-addresse...

jaclaz

...and that $500 piece of hardware is now discontinued: https://mikrotik.com/product/chateau_5g and the new one has 128 Mb: https://mikrotik.com/product/chateau_5g_ax for around the same price (if you consider some inflation). The good Mikrotik guys were IMHO a bit "tight" when designing t...

jaclaz

You know, it all depends on the family and their LIAF (Lack of Internet Acceptation Factor), staying a few days without internet might be viewed either as a good, relaxing experience or as an unbearable nightmare. If the cameras are "just for fun" it won't be an issue, but if they are actu...

jaclaz

Viktors says wAP stands for "wireless access point".

I think that that is only to distinguish it from wired access points

jaclaz

To be fair, 36 bucks at a 7% compound interest could become over 50$ in 5 years time. One of Murphy's Law corollaries tells us that if a SPF fails, it will do so just after 6 PM on Friday or anyway before 1 PM on Saturday. So one needs to evaluate if 4-5 days without the link are worth around 50 dol...

jaclaz

You cannot normally update from 6.x.y to 7.16 directly. The procedure is to first update to 7.12 something and only then update to higher version. Upgrading 18 devices all together without having tested the procedure on a 19th identical device in lab seems to me a bit bold, but maybe I am overcautio...

jaclaz

The simple switch may (or may not) use a different loop prevention method (or none at all). The Mikrotik switch may ( or may not) run STP or RSTP or something else: https://www.geeksforgeeks.org/difference-between-spanning-tree-protocol-stp-and-rapid-spanning-tree-protocol-rstp/ You could try disabl...

jaclaz

When you say in Mikrotik (example): 192.168.1.1/24 You are saying: IP address: 192.168.1.1 Netmask: 255.255.255.0 or 24 in CIDR notation When you are saying: 192.168.1.0/24 You are saying: Network: 192.168.1.0 Netmask: 255.255.255.0 or 24 in CIDR notation In some places it may be unneeded, but in mo...

jaclaz

Depends where you live, in small communities, people with same interest/occupation gathers and talk, you never know what you can find out... Well, in small communities you don't even need to share interests or occupation, if the boyfriend of the cousin of the friend of your brother-in-law likes a f...

jaclaz

Key word "environment", which makes company environments much more sensitive than home users environment. If somehow I find out that my ISP is using such way to update their router, from public source script without proper automated source checks / sanitization, I will be concerned and pr...

jaclaz

Sure, you can disable radios just fine.

Then (what I would do if radios is disabled and the antennas are unwanted) you should replace the big ears with dummy loads, to be on the safe side.

jaclaz

But there is nothing to argue about, when doing *anything* there are some risks involved, everyone should be able to evaluate these risks and decide whether to take them or not.

Personally, if it wasn't that I need internet access, I would have only air-gapped systems

.

jaclaz

The raised issue is not related to MITM attacks, possible attack vector is the following, whenever you "blindly" trust a third party and use a given external address/domain on which you have not full control: 1) someone (in perfect good faith) provides a service of some kind 2) you connect...

jaclaz

Possibly not connected to your issue, but you have a couple instances of "something" with an asterisk followed by a (hex) number, this means that there was something with a valid name/reference that was later deleted or renamed. These entries are in the best case doing nothing, in the wors...

jaclaz

How can I check if the time is synchronized in which log?

In the normal log there should be an entry each time the date/time is synchronized via NTP, an entry *like*:

2024-09-19T07:47:44.224614-04:00 system,critical,info ntp change time Sep/18/2024 23:16:01 => Sep/19/2024 07:47:44

jaclaz

So extensive they missed 2 reboot steps to make it clear, as shown by the last posts in this thread

"Extensive" does not necessarily mean "accurate", let alone "clear".

jaclaz

Is there a way of netinstall RB260GS? Yes and no :shock: No netinstall, but BOOTP/TFTP should work, see: https://forum.mikrotik.com/viewtopic.php?t=145981 The info is now here: https://wiki.mikrotik.com/SwOS/RB250_RB260#Reinstall_SwOS_firmware In any case the ACT led needs to be blinking, so that i...

jaclaz

Happy to hear a story of success.

jaclaz

Well, a camera stream can be in order of magnitude of 2 to 4 Mbps (high resolution ones 8 Mbps), good old rule of the thumb is double the camera resolution if using (as most do) H.264, see:
https://reolink.com/blog/ip-camera-band ... lculation/

So a few cameras won't make a problem in your setup.

jaclaz

Also, in log, you should see when the time changes and by what amount, the sync should happen once every day or less often and the change should be seconds at the most. The "default" mode for the NTP client is "unicast", unless you have reasons for it to be set as "multicast...

jaclaz

Well, you have something wrong in the way you copied the configuration here adapting to your addresses. The configuration posted by Sob there: https://forum.mikrotik.com/viewtopic.php?t=187178#p942405 is the "reverse" of the one you just posted, and it uses an approach that is (was) intend...

jaclaz

I don't think that the one or the other solution would give you any particular issue or advantage, they seem to me substantially the same in performance, and given the 50/100 internet speed they are both fine, speedwise. If you can afford the higher expense, the two L009's would IMHO be better for a...

jaclaz

WAP has seemingly a much higher WAF.

jaclaz

What you report Is strange, if I get It right.

Use network APN must be set to no if you are manually setting an APN, if use network APN is set to yes, the one you are providing will be ignored, see:
viewtopic.php?t=210031

jaclaz

I'll work on that later when wife is in bed. I want to stay married. Well, JFYI, if you happen to accidentally cut off internet, it is unlikely that the marriage will break up :o , the outcome is usually either that of wife not talking to you for several days or deciding - since there is nothing be...

jaclaz

Let's go one by one. #1 If you try "/ip route print" in terminal, you will find that the routes you are getting (after a reboot) come from the DHCP client(s) and likely have a distance of 0 or 1 (i.e. they are "very near"). You can do two things (up to you to decide which one or ...

jaclaz

Maybe new package, but from the looks of the one in the picture not new devices. From the screenshot, ether4 transmits something but doesn't receive anything (and this could be - though I cannot imagine how - some false contact or the like mistaking an empty port for a connected one) but ether2 tran...

jaclaz

Hmmm. :? This: add action=accept chain=forward disabled=yes dst-address=192.168.13.145 in-interface= *11 out-interface=bridge1 while might not be related to the issue at hand (it is disabled so, not actually running), is a sign that the router config has been changed/edited the *11 (more generally a...

jaclaz

Vista specifically should not be an issue, there are generically some possible issues with netinstall under windows, connected to its firewall and/or - when doing it on a laptop - with services and programs installed by the manufacturer, but usually they lead to netinstall not seeing the router requ...

jaclaz

Should not be related, but:
/interface list member
add interface=bridge1 list=LAN
add interface=ether1 list=WAN
add interface=wireguard1 list=LAN

wireguard1 should be WAN conceptually.

jaclaz

Yolks on me, much thanks!!!!

You are welcome

, but you still have to correct the first three.
(I am worrying about people that may copy and paste these rules without critically checking them)

jaclaz

anav, you probably have a typo, those "AUTHORIZED" and "DNS/port 53" rules should be on input chain, not forward, right?

jaclaz

Only as a side note, your exported entries are just fine, "disabled=yes" is Mikrotik's way to explicit the enable state and your D marked lines sport "disabled=yes" just fine. The advised approach, as jvanhambelgium stated, is to have a set of explicit rules targeting the traffic...

jaclaz

Active ones (802.3af/at) do exist, *like*:
https://www.newegg.com/p/3C6-001B-009D5?

jaclaz

I agree that the the firmware should be aligned to software :) , what I am not convinced of is to set it as automatic, since the software update is anyway advised as been done manually, I don't see how having the firmware set to automatic is "better", you have anyway to remember to reboot ...

jaclaz

The first rule is to not use VLAN 1 (it can be used but you should really know what you are doing), rename them to VLAN 10 and VLAN 20, to exclude possible issues that are very difficult to find and troubleshoot.

The complete guide is here:
viewtopic.php?t=143620

jaclaz

I see, right idea, but wrong cat.

jaclaz

... although personally I use the later ... Couldn't that be called "preaching virtue but practicing vice"? :shock: :lol: Seriously, I have found at least one case where firmware upgrading caused issues (in an old 6.4x.yz version): https://forum.mikrotik.com/viewtopic.php?t=180096 It seem...

jaclaz

Maybe "routes" is a reserved variable name, try using "myroute" instead of "routes". And/or try with put instead of assigning the result to a variable. Also, you can probably remove the "where" (but that shouldn't change anything): https://forum.mikrotik.com/v...

jaclaz

Yes, limited to the routeboard firmware, automatic update is probably OK, still the usual advice is to have Routerboard firmware release "aligned" to the Ros (let's call it "software") version, so if setting the one, there is the risk to have it automatically be one or more versi...

jaclaz

Also, maybe It Is not your case, but before connecting a device to internet you should make sure to disable all services but Winbox and limit It to LAN interface(s), possibly changing its default port number. AND add a new user, give It full powers, and a strong password and remove or disable the de...

jaclaz

Please allow me to doubt the advice in #1, the good Mikrotik guys are not particularly cautious when tagging a release as "stable" and - if not common - it is far from unusual that in releases marked as stable (and thus subject of automatic updates) new or regression bugs appear. Of course...

jaclaz

Only hurricane winds or heavy rain too?

JFYI, issues with water have been reported several times:
viewtopic.php?t=189614

jaclaz

Well, access points on external walls seem to me a rather common need.

Anyway the coverage Is surely not 180 degrees, more like 120 or less.

On the other thread here:
viewtopic.php?t=212255
the shape of emissions is described with links to the FCC documentation.

jaclaz

maybe an option like mANTBox ax 15s can be considered, i know is not so cheap as the wAP but can be very useful https://mikrotik.com/product/mantbox_ax_15s Yep, but I think OP is already beyond the WAP, a Netmetal Ax (+antenna(s)) is going to cost much more. What is not clear (to me) is how wide th...

jaclaz

... and it is Rule #4 of my Mikrotik Club Rules:
1) You do not use VLAN1
2) You DO NOT use VLAN1
3) You do not use Quickset
4) You do not use detect internet
5)....

If the good Mikrotik guys would remove it, I would need to change the list ...

jaclaz

Unless you changed the original configuration, the Cube Pro original one has a static IP 192.168.88.3 or 192.168.88.2 on the ethernet port, it is not grabbing it from anywhere, so it sounds like the device is not booting properly, and - even if the IP is gone because the configuration is invalid - t...

jaclaz

If I may, there are some inconsistencies in the actual question. There are seemingly two of them: 1) Is there a simple way to VLAN? 2) How can I have a Guest network? Answers: #1 No, it is a complex, advanced topic. #2 Yes, actually two ways, one at L3 level (tangent) and one at L2 level (original M...

jaclaz

They are not common, but they exist.
Example:
https://www.quwireless.com/product/qusector-7v-120-2
120 degrees, dual connector, mimo 2x2.

jaclaz

And again /ip route print will show whether the routes are static or dynamic or if coming from the dhcp, etc..

jaclaz

Provide the output of /ip route print, twice, once when in the "normal" state and once when you have the ISP WAN cable detached, as it will be more clear what actually happens. As a side note, and JFYI, another possible approach (IMHO simpler): https://forum.mikrotik.com/viewtopic.php?t=19...

jaclaz

Just to be clear, this config only applies to the cAP? There's no additional config for the hEX? If not, the new firewall rules being added to the cAP won't affect the current set of rules on the hEX? Yes and no. Yes, the "tangent's way" only applies to the cAp, but no, the described appr...

jaclaz

What if I told you that you don't *need* a VLAN?

https://tangentsoft.com/mikrotik/wiki?n ... ns%20VLANs

jaclaz

The posted picture comes from:
https://www.mikrotik-store.eu/
https://www.mikrotik-store.eu/de/mikrot ... etmetal-ax

jaclaz

Ah, ok, I thought that mac-telnet was dependent on telnet service, good to know that it Is instead completely independent and thus must be restricted separately.

jaclaz

Thank you :) , so one should go for the: https://help.mikrotik.com/docs/spaces/ROS/pages/328229/IP+Services way and disable services, to prevent access from anything but Winbox, then, if I get it right, the none in mac-server has in practice the same effect as disabling the telnet service, but this ...

jaclaz

No, the device comes without antennas. The photo on Mikrotik store is more explicit :wink: https://www.mikrotik-store.eu/media/images/org/L23UGSR-5HaxD2HaxD-NM-Beispielantennen_1.png The top cover has two passages so you would normally use two external antenna connected with a (short) piece of cable...

jaclaz

I see now, that prevents telnet connections, thanks :) .(I wish the good Mikrotik guys had called it "/tool mac-server telnet") But the moment the device has an IP address one can still connect via browser/webfig? :? I.e. is there a need for a firewall rule *like*: /ip firewall filter add ...

jaclaz

@infabo Maybe we should rename to: CSS->CASS (Cloud Actually Switching Switch) and CRS->CARS (Cloud Almost Routing Switch) @flynno Maybe stupid question, but aren't the two HGO-antenna-OUT directly mounted too near to each other to do any good? I know it is even on Mikrotik official pictures: https:...

jaclaz

I think it is a matter of (double) quotes. The dot means "concatenate" (same as - to give you an example - & in Excel formulas), text and variable(s) needs to be separated. And seemingly you missed a closing round bracket (or maybe they are not needed. Your test: /tool e-mail send to=e...

jaclaz

Bravo... Grazie. :) Though I am not convinced that my hypothesis holds, I think that attackers won't spend much time on a "difficult" device (unless of course it is a targeted attack) it is far easer for them go looking for another one, I presume that they go for the low-hanging fruits (t...

jaclaz

@anav Now that the OP issue is solved, can we talk of the absolute minimum configuration? In my perverted mind it would be: /interface bridge add admin-mac=<tt:uu:vv:xx:yy:zz> admin-mac=no name=bridge1 /interface bridge port add bridge=bridge1 interface=all /ip dhcp client add disabled=no interface=...

jaclaz

In case you missed: this thread was about wAP and @Normis tried to explain that wAP (due to being wall AP) doesn't really have spherical radiation pattern. Well, we do have a drawing: https://fccid.io/TV7WAPGR52AX/Test-Report/Antenna-specification-7634095 I think we can define the pattern as "...

jaclaz

Reading the manual would help: https://help.mikrotik.com/docs/spaces/UM/pages/141197416/Chateau+LTE18+ax the hint is here. Antenna usage SMA connectors are for LTE antennas. External antenna sockets are located on the back of the device. Device comes with connected wireless antennas, LTE antennas ar...

jaclaz

They do sell this pigtail: https://mikrotik.com/product/acsmaufl Which should be a hint towards the DIY path, but if I get it right the U.fl connector(s) are on the actual modem card, so it can be applied to *any* of their LtE products. Example for the WAP ac LTE6: https://forum.mikrotik.com/viewtop...

jaclaz

If it is a new installation, it doesn't surprise me that much, it is not unusual that the settings need to be tweaked/tuned, these new devices have a lot of "delicate" settings. Only anecdotal data, and likely completely unrelated to your case, but not so long ago I had a largish Viessman ...

jaclaz

Well, yes, firewall is the thing that might (or might not) allow the ports on the different subnets to talk to each other, so, it is about firewall. Not so sure about routing, in the sense that the routes (at IP level) should be autogenerated in the Mikrotik router, i.e. come out as DAC (dynamic, ac...

jaclaz

"Forcing" the internet access to the one or the other router (ether1/ether2/ether3) could be - I believe - done with routing rules based on source ports (ether4/ether5/ether6): https://help.mikrotik.com/docs/spaces/ROS/pages/59965508/Policy+Routing The other requirement (windows share acro...

jaclaz

No, different devices have (or have not) a number of quicksets (it seems like more recent ones have few of them that's why I asked if your L009 had it). It is not a bad thing in an absolute way, as quickset is known to be prone to cause issues, unless used "from clean" (and this piece of i...

jaclaz

What we don't know (or at least I don't know) is what changes the attackers make to the router configuration, it is possible that they do not make any besides changing the permissions to user "admin" and adding the "system" one (of which they set the password to a complex one). I...

jaclaz

Let's see how accurate is my crystal ball (I just got it back from the guy that tunes it, but sometimes he doesn't set it right ): a. User 1: J***** K******, commonly called "dad", age 48, Sagittarius User 2: F**** G******, commonly called "mom" age 47, Gemini User 3: R**** K****...

jaclaz

If I get it right you want to have your L009 in the garage as a "client[1]" to an Access Point that is in your home, right? Is the Access Point also a Mikrotik device or not? The WiFi standards do not really cover this usage, so different manufactures have worked around with different solu...

jaclaz

Side question, but do you really-really need DHCP client on the boiler?
I mean, if you don't go around with your access point (be it the ax or the ax2) the boiler should be pretty much static.
Cannot you set it to a static address and see if the disconnecitons continue or stop?

jaclaz

No idea about the actual issue, but also the board parser seems to behave just like you describe, it "interrupts" the hyperlink on the first space (after the "The"). So it could be something similar. Try replacing the spaces with %20, a http URL must contain no spaces: https://fo...

jaclaz

From what I understand the default configuration is good enough in most cases, particularly, for an internet facing router, do not change the firewall rules until you have understood them[1] (which definitely will take some time) and make sure that interfaces are correctly categorized as LAN and WAN...

jaclaz

Very interesting, thanks. All the tweaks you did make a lot of sense to me, what I find surprising Is the relevance of the positioning. 5 db difference in 10-15 cm displacement seems a lot, I wonder what the reason could be for such a dramatic change at such a short distance, I believed that there w...

jaclaz

Is the power supply provided with the RB5009 sufficient? That is a 24V 1,5A power adapter. Yes and no (actually no and yes, but ...) :shock: . The power supply provided with the "PoE Out" version of the RB5009 (RB5009 UPr +S+IN ) is the 48V 2A: https://mikrotik.com/product/48v2a96w so it ...

jaclaz

Ah, OK :) , I tried again (started from scratch after a reset with no default configuration to be sure) and you are right, though the "logic" is inverted, I can confirm that now it works as you described, then it was only a false alarm, sorry :oops: I wonder how it could have happened yest...

jaclaz

While doing some "crazy" experiments on a hap lite running 6.49.17 I happened to find a "strange" thing related to the /ip dhcp-relay. I tried adding a dhcp relay: /ip dhcp-relay add dhcp-server=192.168.1.151 interface=bridge1 name=relay1 ok. The I tried adding a second one, and ...

jaclaz

Good (all is well that ends well). :) The 8.9 W (183 mA@48.9V) that you see on the RB5009 is what I would have expected for a device that is essentially a media converter/modem, but even if you add to it the wireless (and that is enough to have the Mikrotik freak out) the added draw for the radio(s)...

jaclaz

Not that it anywhere documented properly, but the RB5009UPr+S+IN should be compatible with BOTH 802.3af/at (the latter limited to 440 mA) AND with the "old" Mikrotik passive power @24V. If you power the RB5009 at 24V (by either passive PoE or jack/terminal) it will output 24V (Passive PoE ...

jaclaz

Contacted LinITX.com and they helped me tweak the settings on both APs. Now I am getting solid 400-500Mbps link between the aerials and I am very happy with the bridge! And, unless they are a trade secrets, can you share these tweaks? (I am assuming that they are "generic good practice" t...

jaclaz

Check the users you have. A normal Mikrotik (default) has only "admin" as user (and it is generally recommended to change the name to something else). There are botnets that try to accesa Mikrotik devices and if they succeed, they remove permissions from "admin" and add a user &q...

jaclaz

But your splitter is one with the conversion at 12V? It is entirely possible that the "default" power supply is oversized ( and by turning off the radio surely you reduced the power needed). As well it is possible that a device provided with a 12V supply actually accepts a much wider range...

jaclaz

You could experiment with the Mikrotik Cloud service: https://help.mikrotik.com/docs/spaces/ROS/pages/97779929/Cloud#Cloud-Updatetime no idea how fast it is (and whether its uptime is reliable enough). From the little experience I have with NTP, the time it takes to sync is "random", somet...

jaclaz

It seems just fine to me :) in the sense that it should work, but is not really what I suggested. The idea was that the manual addresses given to the Mikrotik interfaces should be outside the range of the addresses the DHCP of the ISP and LTE would lease, so that when/if you connect additionally ano...

jaclaz

New passwords do not contain those characters anymore.

Sure, but how do you know whether the device ericmason64 is having issues with has an "old style" or a "new style" password?

jaclaz

Be very aware of possible ambiguous characters like oO0, Il1, G6, B8, S5, Z2, the password Is usually written in tiny characters in a not particularly readable font.

jaclaz

Of course It depends, but usually DHCP servers (in *any* device) are pre- configured to not cover the whole address space of the network. As an example, Mikrotik devices are usually configured (defconf) for addresses 192.168.88.10 to 192.168.88.254, while keeping for itself 192.168.88.1. (the wirele...

jaclaz

It looks a lot like an Altice UBC1326 (AA00) made by UBEE in Vietnam. I thought that our good guys at italian TIM/Telecom were good at re-branding/re-naming routers in the most confusing manner possible :shock: , but it seems like the french SFR people are even better at it :lol: . Check here: https...

jaclaz

Maybe it is just a case of serendipity, one of the good Mikrotik developers had this driver/fix/whatever ready in his drawer but never found the time/opportunity to add it to ROS, and crosswind's request just triggered the mechanism that allowed adding it to the next release. About the UEFI booting ...

jaclaz

Post the exact model of that ISP box, maybe specs can be found. Loosely, if the replacement power supply is @12V, it seems like it wants 12V (or maybe 24V) while the Mikrotik will output PoE at the highest available power source (in your case only the default power brick @48V). The PoE splitter that...

jaclaz

I see, in historical buildings - besides the (high) costs - the paperwork/authorizations are usually an issue (please read as "huge PITA").. It is strange how each country has different (besides standards) local uses when it comes to wiring. When I was living in Germany for a short period ...

jaclaz

Unlike what one could imagine from intuition a higher antenna gain is not necessarily correlated with "better" or "faster" connection. If norms are followed, there is a limit in the output power of the device (tramission), It depends on the device, but if the limit on a given cha...

jaclaz

Well, if 2.4GHz only is needed, maybe the Ax Lite should be considered.

jaclaz

how is it possible for someone to get a "Forum Guru" tag while being so confidently and completely wrong about something like this? No correlation, JFYI. As an example, I got mine automatically when reaching a certain number of posts, the tag is independent from my knowledge or how much a...

jaclaz

If the "source" is "slow" it is not like having an AX device will make it faster, from what you write, an AC Lite TC seems like a good bet:
https://mikrotik.com/product/RB952Ui-5ac2nD-TC

jaclaz

Here is a (better) photo of the AC Lite TC. The board seems identical, and definitely in one corner (now top left on this photo) there are two PCB antennas on two contiguous sides, so at 90°: https://nanoteh.md/en/quickview/9858 https://6e616e6f7465680a.ultracdn.net/radix/img/items/20210219/11/602f8...

jaclaz

A fellow forum user @arnd did measurements and posted results in this post . I strongly believe that all MT rack-mountable devices use same type of "ear mounting" screws... But I don't fully trust that piece of info because of this post (about the 4011 that has a different way to mount ea...

jaclaz

Here is a maybe better description: https://www.arednmesh.org/comment/10459#comment-10459 One connector is definitely in the left hand corner, but you are right, the other two are on the opposite side of the PCB. In any case the thingy seems intended to stay flat, not vertical, at least in the inten...

jaclaz

Can you check the measure of the hole and the thickness of the ear? The screws should be either M4 8 mm length, or M3 6 mm, but if they are a couple mm longer it shouldn't be an issue. Or you can get a suitable kit on (say) Amazon, example: https://www.amazon.com/SZHKM-480pcs-Assortment-Stainless-As...

jaclaz

Look if you can find some data on the FCC documents: https://fccid.io/TV7RB952-5AC2ND In the internal photo: https://fccid.io/TV7RB952-5AC2ND/Internal-Photos/Internal-Photos-3088357 the two antennas are the two dark blocks in bottom left corner, they should be omnidirectional thus emissions should h...

jaclaz

Yep, I understand, but due to the way Mikrotik creates the updates (since they "mix" bug fixes with new features) just updating because a new version came out can actually be less safe. :shock: The same new feature that creates the instability (whatever it is) may well - for all we know - ...

jaclaz

Coax cables (of course it depends on the exact type and on the actual conditions they are in) can actually be very fast, up to 2.5 Gb in theory, but the quality of the cables matters, I think that realistically something around 1 GB can be achieved on *any* coaxial cable. MoCA adapters/converters ca...

jaclaz

Well, RouiterOS 7 (on a beefy enough device, such as a RB5009, but given the slow internet connection also an Ax2/3 might do, cannot say) can run containers, including Pi-hole and Adguard.

No idea how complex (or simple) it is to run one.

jaclaz

7.15 patch notes include wifi-qcom driver update.

I thought that the issues were caused mainly by that driver update

, it doesn't sound like a desired new functionality ...

jaclaz

@KiwiBloke I believe the question is up for debate, and possible answers to it can be different depending on use and hardware involved, some devices (ISP router and LTE modem router) might have very good built-in firewalls or may have not any. If we take for granted that the Mikrotik firewall is the...

jaclaz

Only to clear how it seems like we ( baragoon, rextended and myself) are a bunch of crazy guys there was an initial post by user andreacar: https://forum.mikrotik.com/memberlist.php?mode=viewprofile&u=225916 promoting an article on his blog: https://andreacaracciolo.it/2024/10/26/mikrotik-centra...

jaclaz

Rethinking about it, I think this is "normal" (and had to be expected) due to the dynamic nature of the setup. It should be tested/checked, but this is what I believe it is happening: 1) Since the route to the LTE is created by the LTE modem DHCP, when you turn it off it simply disappears ...

jaclaz

I would probably go with two L009 since they are switches with SFP Hmmm. You must have missed the memo about the "on the cheap" requirement :wink: , you go to the OP parents telling them how it is much better to spend 2x119$=238$ instead of 2x40=80$ to be able to switch at 1352.09 Mbps (i...

jaclaz

Or you could do with a couple of these:
https://www.crxconec.com/en/product/CC-10-00026.html

You can find them as Intellinet IWP-BOX SC-6 or EAN : 4049759111489, at least here they can be found for 7/10 €/each.

jaclaz

I can translate the "article" easily, in one sentence: Here is a video about it: https://www.youtube.com/watch?v=YRscjpVouXA No subtitles, nice (tiny) quad Winbox screenshots. Maybe someone with a huge screen, putting youtube fullscreen, may be able to read something in it. BTW the site re...

jaclaz

Yep, as I see it, if you go down the rack avenue go down it in full (and it has a steep price), otherwise either have long cables from the wall or use wall plates on a box, and keystones all the way. The Hex/hexS/hex refresh are not "rack mountable", the RB5009 or the L009 (say) and higher...

jaclaz

"you get internet on your workplace and you are not allowed to use it to stream youtube for background music and video, if we find you doing that you are fired on the spot". Then you don't have to worry about site blocking anymore. https://www.imdb.com/title/tt0079470/quotes/?item=qt04719...

jaclaz

Yep, but don't take me as an example of "clean", "neat" cables architect. As long as something works, it is enough for me (I know people that buy patch cables with a given colour because they fit better in the environment). I like orange cables, they give you a sense of calm urge...

jaclaz

It is strange, "consumer" devices all have a basic default configuration (including firewall) AFAIK (all with comment "defconf"). Typical default firewall set (it may depend on the exact version of RouterOS yoiu are running, these come from 6.48.6) /ip firewall filter add action=...

Search found 1893 matches