MikroTik

jaclaz

In a configuration a route can be usually:
1) be generated by connection (Dynamic)
2) be provided by DHCP server (Dynamic)
3) be set manually (Static)

No way to know what you did or did not do without seeing your configuration.

jaclaz

Maybe related to: https://help.mikrotik.com/docs/display/ROS/Policy+Routing It is not recommended to use both methods at the same time or you should know exactly what you are doing. If you really do need to use both mangle and routing rules in the same setup then keep in mind that mangle has higher ...

jaclaz

Maybe it is the same thing we were discussing with Amm0 here:
viewtopic.php?t=198999#p1102299
In a nutshell masquerade vs. src-nat helps, but there is not a magic provision that helps in all types of connections.

jaclaz

Which of the two devices is intended to run a DHCP server? At a quick glance it seems to me like you are running two DHCP servers on the two devices (with overlapping pool), and the CAP one is "strange": router: /ip pool add name=dhcp ranges=192.168.88.10-192.168.88.254 /ip dhcp-server add...

jaclaz

"no route to host" means, that a valid route to the destination cannot be found, i.e. you either have no route for that particular address or - more likely if you did not configure properly the device, no routes at all. You will need to post the configuration of your hap Ac2, follow the in...

jaclaz

I don't know, maybe the bridge filter rule need to be narrowed to the device address?

jaclaz

You have a technician? :shock: I thought that the Asus was a router, not another PC, and, no, it is not "normal" that when "cloning" a PC also the network MAC is cloned, only the hard disk contents (and it is normally never a proper clone, strictly speaking, as drivers, the OS li...

jaclaz

I don't buy that you have a casual MAC collision. It is more likely that either of the two devices has had the MAC address manually set (cloned from the other) for one reason or the other in the past. It is more probable that you set the MAC on the Asus Rog than on the Dell, but cannot say, it is a ...

jaclaz

There is a post/tutorial by pcunite (that might need to be adapted to newish RoS7) about this specific matter:
viewtopic.php?t=154954

No idea if newer versions have different provisions.

jaclaz

Well, start by posting the exact make/model of the ISP router/modem AND a copy of your current Mikrotik configuration, follow the instructions here: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 What you report is an error at a pretty much "basic" level, if it is something con...

jaclaz

Cannot one add to the quickset (reference is still tangent's article): /interface wifi add … master-interface=wifi2 name=wifi2g … /interface bridge filter add action=drop chain=forward in-interface=wifi2g /interface bridge filter add action=drop chain=forward out-interface=wifi2g /interface bridge p...

jaclaz

It is not even clear what should be achieved? Forwarding and not forwarding at same time? Closed and open at same time? This makes no sense to me.

Now, don't tell me you never heard of Schroedinger's ports...

jaclaz

Tangent has an article about that:
https://tangentsoft.com/mikrotik/wiki?n ... ns%20VLANs

Check if your quickset did make the settings detailed in the last part of the article.

jaclaz

I don't think that it is easy to manage a (vast) software project such as RouterOS and - at the same time - manage the development of the hardware it runs on, but - as seen from the outside - it seems like the priorities are largely mixed up. The amount of changes in each new release (and the number...

jaclaz

Complete tutorial here:
viewtopic.php?t=203686#p1051720

jaclaz

Do you mean that friends don't let friends use netwatch icmp?

jaclaz

i add a manual nat rule, chain=dstnat action=dst-nat to-addresses=192.168.8.195 to-ports=61125 protocol=udp in-interface=sfp-sfpplus1 dst-port=61125 log=no log-prefix="" and it just works, i figure the upnp on MT sets dst-port and to-port differently is the problem (ASUS router is the sam...

jaclaz

I would try removing the sfp1 from bridge (as opposed to leaving it there disabled) but it may be unrelated:
/interface bridge port
...
add bridge=bridge comment=defconf disabled=yes interface=sfp1

jaclaz

You’re complaining the cheaper product isn’t keeping up with a more expensive product? I think that what was really meant is that the (admittedly cheaper) Mikrotik environment (hardware+software) is not keeping up with some more expensive product (which is expected and OK) but also misses in practi...

jaclaz

There are some presets of icmp type in netwatch that are (stupidly) not shown/visible. One of them may be the reason why the link is sensed as down, probably thr-rrt-avg (whatever it is), but it may also be another (hidden) default parameter. Check: https://forum.mikrotik.com/viewtopic.php?t=190925 ...

jaclaz

. Nowhere quickset is being mentioned. You must be joking. If I had one euro for each thing (command/setting/reference/whatever) that exists in router OS or on the device that is not mentioned anywhere (and certainly not on the related documentation) I wouldn't be rich, but certainly I would be muc...

jaclaz

Since there are two devices available, the easiest would be to configure and test one device as AP-router working on ether1 and the other as AP-bridge working on ether2, then, once each one works as expected, find the differences and adapt a script *like* this one: https://forum.mikrotik.com/viewtop...

jaclaz

Right now watching some Youtube cat videos over this connection.

Be very aware of cupboard cat attacks

:
https://youtu.be/QefxGauB3_c
You'll never know what hit you.

jaclaz

As often happens I may be wrong, but if there is no particular need to "filter" or block VLAN(s) you don't need to care about them, a simple "wireless wire" setup between the two devices would be enough. I.e., as I see it, the two devices should behave like a two ports unmanaged ...

jaclaz

The APN, then if needed username, password, etc. It depends on the SIM, it could be "internet" or "internet.telekom" or "internet.v6.telekom": https://www.telekom.de/hilfe/mobilfunk/mobiles-internet/mobilfunkstandards/apn See also this: https://forum.mikrotik.com/viewto...

jaclaz

Yes, pinging a public IP like 8.8.8.8 gives error "timeout". So it is not a missing route the issue (otherwise you would have "no route to host"). Have you configured (properly) the APN? It depends on the ISP that issued the SIM, some work just nicely with the automatic APN (tha...

jaclaz

Did you have a double glazed glass on the bench between the two devices? :shock: If not, speed is not comparable, let's say that you lose 1 Mbps because of the 75 m distance and 499 because of the glass. Can you try (briefly) what do you have with the window open? Are you sure-sure that you have no ...

jaclaz

Now I finally have found the country setting on the QuickSet window, unexpectly under the wireless settings, as I was thinking wireless means local wireless stuff, not mobile stuff. And you were right, the country is related to local wireless (the wifi radio) as different countries allow different ...

jaclaz

Sure, it is DA d H, maybe it is just the newish RoS that calls (why?) the interface "vrf-interface" :? . A thing that is not advised is the use of VLAN1, if you would use (say) VLAN99 as management you would remove a possible source of issues (but that again might or might not be connected...

jaclaz

It seems to me that what you want is exactly like the example given in :
https://help.mikrotik.com/docs/display/ ... -DHCPRelay
(it has two DHCP servers and relays, but you need only one).

jaclaz

No idea if part of the problem, but in your /ip route print detail there is: vrf-interface=ether3-wan-backup but there is no vrf in your configuration that I can see. Shouldn't that be (like the other routes) something *like*: local-address=XXX.XXX.205.39%ether3-wan-backup But if this is an issue, i...

jaclaz

So, you want a DHCP server running on ether1 and a DHCP client running on ether2. This Is not in any way and issue, as a matter of fact most Mikrotik devices (cannot say the mAp) have a similar setup, only "reversed", with a DHCP client running on ether1 (which is WAN) and a DHCP server ru...

jaclaz

@Amm0 I guess that the doubts (my ones) are only: 1) is masquerade preferrable also on static setup ( because of the way It handles inherently the existing connections in case of failover) 2) or is src-nat "better" and it can be integrated by a simple ( like rextended's one, a few lines) s...

jaclaz

Can you try to better explain the intended use?
Possibly making a couple examples, I cannot understand what do you mean by "sole wireless AP" and "generic wireless router".

And - if I get It right - you want a same device be capable of changing between the two scenarios?

jaclaz

I have still not fully grasped the implications, in practice, that can make one prefer masquerade over src-nat or viceversa, but yes masquerade should be able to take care - at least partially - of the existing/interrupted connections, but for static settings I understood that src-nat was to be pref...

jaclaz

If you put an APN manually, It Is ignored if the "use network APN" is ticked. Not to be overly critic of the good Mikrotik guys, but I think that GUI designer apprentices learn on the first or maybe second day that when a check box disables a field, the field must be grayed out and made no...

jaclaz

The lines that have a # sign prepended and that the board code parser marks red are not good: /ip dhcp-client # Interface not active add interface=ether3-wan-backup use-peer-dns=no use-peer-ntp=no # Interface not active add interface=sfp1-xgspon use-peer-dns=no use-peer-ntp=no The second one is expe...

jaclaz

I don't think that edit works in scripts, it is interactive, thus command line only.

You can try using the set command, something *like*:
/interface bonding set [find name=wan1] slaves=ether1, ether2
or - possibly easier - remove the whole bonding and re-add it with the new settings.

jaclaz

I seem to remember that it was already reported in at least one case that a Mikrotik device that should have had the sticker password was actually found as having a blank one, probably because of an hiccup of some kind in factory. So it is possible that the "old" password was blank (by mis...

jaclaz

/export file=anynameyouwish ( minus router serial number, any public WANIP info, keys etc..) Hi Anav, I don't get your message Translated :wink: it means: Please follow the instructions here and post your complete configuration: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 The generic...

jaclaz

There are not that many choices in current Mikrotik range of products, I think that you can choose between the CAp Ax: https://mikrotik.com/product/cap_ax or - it still has to be announced officially, but should become available soon - the WAp Ax: https://forum.mikrotik.com/viewtopic.php?t=210117#p1...

jaclaz

I will just update this thread with the fact that it happened again, and we have given up completely on the switch. We simply can't get the suppliers to check them first, and we waste weeks sending unit back and forth, it's a complete circus show. If anyone knows a supplier (anywhere in the world, ...

jaclaz

Interesting approach :) , I like the idea of the "cross backup" for this case of two different sources (home and business traffic). Now next step would be IMHO to see if it is the case in such or similar setups, to add to the netwatch up and down scripts the "reset existing connection...

jaclaz

You are welcome

.

In the meantime there is yet another very interesting ongoing thread about firewall,and its rules, JFYI:
viewtopic.php?t=211574

jaclaz

I am not sure to understand, the netwatch Is associated to a ping address (8.8.4.4) in this example. To get there, there Is one /32 route (going through the "main" DSL connection. If 8.8.4.4 is reachable, the LTE route is disabled, if It Is not the LTE router Is enabled and takes precedenc...

jaclaz

Follow this:
viewtopic.php?t=203686#p1051720
and post your configuration.

jaclaz

No packets at all... It seems like it doesn't even try to boot into netboot mode. Maybe it has some protection options enabled? If so, how to disable them? It is possible that it has a protected routerboot timing set, see: https://help.mikrotik.com/docs/display/ROS/RouterBOARD#RouterBOARD-Protected...

jaclaz

Only to keep things as together as possible I just "sold" this Filo's approach to a new user, with a few changes. I got rid of the separate routing table and of the mangle by adding a "narrow" /32 route to the "canary" ip address in "main" table. And I didn't ...

jaclaz

If when you touch the area (i.e. you exert some pressure on some components) the thingy works it could also mean a (invisible or almost invisible) cold solder point. A failed component is of course possible, but it shouldn't change behaviour if you touch it. You could try to see how the board behave...

jaclaz

Not that I am actually qualified for giving an expert opinion on bridging vs. routing, so take my advice with a grain or two of salt. In theory the bridge mode is more direct, so It should be faster, in practice in your case It Is slower, and not a little slower, some 30 percent slower is a lot. Of ...

jaclaz

My bad, should have been: /ip route add blackhole dst-address=8.8.4.4 distance=2 Let's see if I can help you grasp the concepts, the more you get them the more you will be able to correct/fix/tune your setup. Normally there are two "all internet" rules, the first going through the LTE (dis...

jaclaz

Ok, it starts to make sense, so, for *some reasons* the "narrow" route becomes invalid if the ether1 cable is disconnected. (I suspect it to be due to the ether1 still having the dhcp client and not a static address, but maybe there are other reasons) so the 8.8.4.4 ping takes the "LT...

jaclaz

So: Netwatch disabled, mangle disabled, LTE enabled: both 8.8.4.4 and 8.8.8.8 works., got back all the answers no timeout

With ether1 disconnnected?

Is it the same with ether1 connected but internet not available because dsl line is disconnected from router?

jaclaz

Sorry, I do not understand your last report. Can you try EXACTLY this test: Let's try the alternative. 1) disable (temporarily) the netwatch scripts 2) disable (temporarily) the mangle rule 3) enable (temporarily) the LTE route 2) add a "narrow" route to the "main" table: /ip rou...

jaclaz

The only thing I know about VLANs is Rules #1 and #2 of the Mikrotik Club, which may or may not be useful in your case, still I would respect them, to avoid possible issues: https://forum.mikrotik.com/viewtopic.php?t=210809#p1096639 One explanation: https://forum.mikrotik.com/viewtopic.php?t=208061#...

jaclaz

The usual advice is to post the whole configuration, see: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 There are reasons for that, the way a configuration works (or completely fails to) can be "hidden" in a seemingly unrelated part, but more than that a member willing to help...

jaclaz

Yep, but I meant that at first sight this:
interface=$"iface"
seems like a typo for the (probably) intended:
interface="$iface"
or maybe:
interface=$iface
Only a doubt.

jaclaz

I am still not sure to understand what re-triggers the "up" script. You are simulating the down by disconnecting ether1, right? Try to simulate It instead by leaving the ISP router connected and disconnecting the DSL/telephone line from It. Does It still flap? If not, the issue could be in...

jaclaz

Don't worry about the /30, the /24 is just fine, however JFYI, most non-mikrotik routers use the different notation for network mask: 255.255.255.0=/24 <- 256 values of which 254 usable (first and last are reserved for network and broadcast) ... 255.255.255.248=/29 <- 8 values of which 6 usable 255....

jaclaz

That script should go as the DHCP client script (on the ether1 entry), it is a property (just like interface or default-route-distance) of /ip dhcp client. https://help.mikrotik.com/docs/display/ROS/DHCP#DHCP-Properties I.e. this: /ip dhcp-client add comment=defconf default-route-distance=2 interfac...

jaclaz

You sure about these double quotes?

interface=$"iface"

jaclaz

The strength of lists Is that the default firewall (again on soho devices) Is based on those categories (LAN/WAN) so you can easily add to the two categories the wanted interfaces without ever needing to modify firewall filters (and also NAT). Home made and - with all due respect - half baked firewa...

jaclaz

Well, if the CQ-18 Is an AP, It Is an AP and will never become a client device. If you can have the two devices near between them and connect both via ethernet to the mAp then yes, you can have the mAp configured as a bridge for the two ethernet ports and have the wifi either bridged or routed. But ...

jaclaz

CHR is Mikrotik Cloud Hosted Router.
It is more or less the same that you have, but intended to be run in a Virtual Machine, so I assume it has the same non-configuration.

jaclaz

Good, happy it is more or less working :). So the links/routes are sometimes "flapping"? Every thirty seconds look suspiciously linked to the running of the netwatch script. Try changing the interval to a higher value or - maybe better - try inserting in the netwatch script a small delay *...

jaclaz

I am not sure to understand. Normally the default configuration of Mikrotik devices of the SOHO series is - though basic - rather complete, while the configuration on professional devices is (so I read) almost inexistent. You are talking of the CHR, right? I was just playing with a CHR in a virtual ...

jaclaz

I've recently heard an opinion that connected USB3 device may affect wireless (friends who have ax3 had problems with usb and didn't have without). I had problems before I attached USB disk, and now there isn't much transfers (only error logs by now). Maybe it will be useful if anyone who has probl...

jaclaz

RB1100AHx4 list 329$, dual power supply
CCR2004-16G-2S+ list 465$, lots of ports you don't need.

Alternative:
RB5009UG+S+IN list 219$, enough ports for your use, faster in routing than the RB1100AHx4

jaclaz

If I get it right, the CQ-18T will be "main" device, connected wirelessly with the mAp, and the mAp connected via ethernet cable to the Driverrack. From what I can understand, the CQ-18T works as Access Point. This means that the mAp needs to be configured as client, i.e. in Mikrotik jargo...

jaclaz

You should both open a ticket at Mikrotik Support, while sometimes the developers do read forum posts, it is not given that they will do anything without an opened ticket.

jaclaz

On this page (third party): https://www.getic.com/product/psu-open-frame-12v-7a-for-ccr-r2 the compatible models are listed as: CCR1016-12G CCR1036-12G-4S CCR1036-12G-4S-EM CCR1036-8G-2S+ CCR1036-8G-2S+EM CCR1016-12S-1S+ CRS326-24S+2Q+RM CCR2004-1G-12S+2XS CCR2116-12G-4S+ but cannot say if the sourc...

jaclaz

You could try a different power supply, it is a common failure mode for (switching) power supplies to still be able to provide some Volts but not enough Amperes, so that some basic things works (like led lights) but the device doesn't actually boot or doesn't boot completely.

jaclaz

It is not clear (to me) what you actually need/want, a router or a switch?

Anyway missing requirements are:

number of ports
speed of the ISP connection and of the LAN
need for SFP sockets/connections

jaclaz

Yep, it looks fine to me. :) Now you have: D d 0.0.0.0/0 5.187.172.1 2 D A d 0.0.0.0/0 192.168.1.1 1 The "main" one is NOT A ctive, the LTE is. If you disable the LTE, the main should immediately be back to A ctive (i.e. D A d). JFYI, when you have more than one table, from CLI you can use...

jaclaz

I could change the distance to 2 and 1 in respective, now the DSL IP is blue not black like others, I created the DSL routing table with FIG, but cannot change the routing table for Dd 0.0.0.0/0 5.187.172.1 ether1 blue line, it is grayed out for main, or should I add with the + a new one? and delet...

jaclaz

Right now you have both the DSL and the LTE routers connected and the two routes "towards internetet" (the 0.0.0.0/0) active at the same time (the + sign tells us this) because they both have the same distance (of 1 which is the default). Next step is changing the distance of the two conne...

jaclaz

Maybe stupid question, but couldn't the (safe/complex/random/whatever) password be asked during the netinstall process for those (older) devices that still have the blank one?

jaclaz

/interface detect internet is not part of the firewall, it is something that very few people actually use, let alone *need*, and is known to mess things in some subtle ways in some configurations. Disabling it is usually advised, see: https://forum.mikrotik.com/viewtopic.php?t=187814 In the best cas...

jaclaz

Follow instructions here and post your configuration:
viewtopic.php?t=203686#p1051720

jaclaz

Yes the only change I turned off for the second result the LTE modem, if I turn on I will get the same result, the problem is when I disconnect ether1 internet is gone no internet going trough ether2 But the same LTE modem works fine when connected to ether1? In theory you should be able to connect...

jaclaz

Well, you had just posted an /ip route print where both ether1 and ether2 got their ip route just fine (so the DHCP client worked fine on both interfaces), now your /ip route print seems to show that it only works on ether1 and not (anymore) on ether2, so something has changed. The main ISP modem cr...

jaclaz

Two vlans makes much sense to me. Not only to you, but there are logical priorities, that you are not taking into account, and as well you are not considering how the OP is a beginner. Priorities (in my perverted mind): 1) have a decent setup for 1 internet connection 2) add a second connection 3) ...

jaclaz

@anav there is no reason why OP would want or should have two VLANs. Very likely the double entry in: /ip dhcp-server network is a mistake/accident. OP is a beginner and is trying to get the hang of a simple home/soho setup, no need for now to make it more complex than needed. @bbmikrotik You have t...

jaclaz

It could well be one of the pin disconnected (like a cold solder on the PCB).
10/100 use 4 pins/wires, if 1,2,3 and 6 are good, up to 100 the connection is good
1000 uses all 8 of them, so if any among 4,5,7 and 8 is disconnected, 1000 connection will fail.

jaclaz

7.15 is seemingly much more "strict" than previous versions. It could be a permission/policy issue or something nearly invisible, such as a missing quote or an excess newline. Check this: https://forum.mikrotik.com/viewtopic.php?t=208272 saving the script as .rsc and then dry-run importing...

jaclaz

No, i am not user command /ip hotspot user reset-counters; i used: /ip hotport user reset-counters [find name = "a"]; but it still works for all in case "a" is removed. Exactly. :) You use the command: /ip hotspot user reset-counters [find name = "a"] BUT the find comm...

jaclaz

No, you just need to remove the ether2 from the bridge, leaving in the bridge only ether3,4,5. Ether2, once outside the bridge, will be able to have a DHCP client enabled on it, just like it is now ether1. in CLI that would be: /interface bridge port remove [ find interface=ether2 ] Let see if I can...

jaclaz

Don't mistake me for a Mikrotik expert, I am also only a beginner, just knowing enough for basic configurations like yours. /interface bridge port add bridge=bridge comment=defconf interface=ether2 Your ether2 is still part of the bridge, hence the DHCP server error, that sees it as slave interface ...

jaclaz

Allow me to disagree Syntax/commands need to be precise, actually exact. Comments need to be descriptive/understandable. The ethernet cable physically connects ether5 to a port on another device identified by the MAC address. Packets/whatever travel back and forth on this ethernet cable. It is clear...

jaclaz

The default is: ether1:WAN ether2-5:joined in a bridge LAN What you have to do is to take ether2 (by convention the lower numbered ports are those that connect to the internet) out of the bridge, so that you will have: ether1:WAN (1) ether2:WAN (2) ether3-5 joined in a bridge:LAN Be careful to not l...

jaclaz

So, there is the need of two "monodirectional" rules:
comment="Allow from 00:E0:4C:00:03:A7 to ether5"
and:
comment="Allow to 00:E0:4C:00:03:A7 from ether5"
?

jaclaz

Maybe I see it from a different perspective :shock: , but I would have said that the Hap Ac Lite has a reset/wps button (inside a hole) on the front . Like: https://www.youtube.com/watch?v=LMz49kUvH_c This is interesting, however, many/most "consumer" devices have the ethernet ports on wha...

jaclaz

yes, there are many ways to fix this "bug", I just brought up an irrationality of the [find] condition. But that [find name="a"] works just fine, as it finds nothing and returns nothing. The issue is in the command: /ip hotspot user reset-counters that works for "all" ...

jaclaz

So it is not a quirk of the find command in itsellf, but rather a "wrong implied default" of "all" in the command /ip hotspot user reset-counters?

How can it be worked around?
Like checking if "numbers" is defined and only run the command if the condition is true?

jaclaz

Good.

For next time, a good practice when testing/troubleshooting a script is to add commands that shows the actual value variables get.
If you had a:
:put $ftpDstPath
you would have seen that the value was not correct.

jaclaz

Many (important) details are missing or are unclear. On the back of which router? I believe that the AC LITE has not a physical WPS button. :? The 192.168.1.1 is the AC LITE or another device? If the former, how do you connect to it? Winbox, normal browser (Webfig), or what? You should describe with...

jaclaz

If the server is the same and out of two different ways to connect to it one works and the other doesn't it is more likely that the server response is a (misleading) reflection of something wrong on the client. The FTP error 553 error could mean "I don't like the Path and Name of the file you w...

jaclaz

The first thing I would try is another power supply/adapter. It Is a common failure mode of (switching) power supplies to be able to still supply *some* Volts but not enough Amperes. The effects on many devices is that some led(s) lights up seemingly normally but when during booting some more "...

jaclaz

OK, so, if anyone is interested in this "universal image", in the attached spreadsheet there are the basic instructions to modify the image so that it boots both in BIOS and in UEFI. NOT a fully tested script, only the needed info and the commands I used manually. Due to the hardcoded addr...

jaclaz

@tangent The origin is (probably) a (I believe now lost forever) twitter post, cited here (which explains some of the reasons to increase DTIM interval for Apple devices): https://www.sniffwifi.com/2016/05/go-to-sleep-go-to-sleep-go-to-sleep.html The analysis seems to make sense, and this "set ...

jaclaz

Only for the record, there is a lot of confusion around POE and Mikrotik has some own quirks on top of that. 802.3af=POE 802.3at=POE+ 802.3bt=POE++ Mikrotik's 802.3af/at=POE and almost, but not quite, POE+, as mkx noted earlier the amount of current is below the one in the standard, and even raising...

jaclaz

The "cleanest" option is to use a sensor (soldering on the board will void warranty). A small circuit *like* this one: https://www.arrow.com/en/research-and-events/articles/build-and-use-a-simple-light-detector-sensor-circuit can be used as "led signal extender". Or - even simple...

jaclaz

Consumer grade equipment can run without any issues at 70C, industry grade goes to 85C or so. Military grade can surpass 120C. Yep, as said it is not "preoccupying", but it all depends on where the sensor is and what kind of dissipation happens. If a temperature sensor is near the *whatev...

jaclaz

Yep, but 20 degrees? At which voltage are you powering the hexS: 1. when using the jack 2. when using the PoE ? The hexS power supply is 24V. It accepts 12-57V as PoE In, if you are using the (normal) 48V, it could be the voltage regulator/converter that creates the heat, but it doesn't sound right ...

jaclaz

I am sorry, I have no idea about that. The (little) theory I understood is that ARP is a L2 protocol, so it should be limited to local network. From this (and the linked to Linux article): https://forum.mikrotik.com/viewtopic.php?t=176461#p865029 I understand that when you do a "normal" pi...

jaclaz

With all due respect for the good guys @Mikrotik, in this particular case something went wrong, they failed, and failed big. If they wanted to have the CHR image to be only BIOS bootable (through their - let's call it "strange" - method, bootsector code and hardcoded map) why did they add ...

jaclaz

@jaclaz, I wouldn't get too crazy. Sure, I know, it is more like, you know :wink: The way I see it, if you're gonna build a time machine into a car, why not do it with some *style?* The IPXE could be another royal PITA, I am now a bit rusty about BIOS/UEFI and filesystems, but at least in my days I...

jaclaz

Good news

, thanks.

jaclaz

@jaclaz, you're the boss - 7.17.beta2 mangled using your gdisk magic made Vultr happy. Good. :) So this part of the problem is solved, at least until the good Mikrotik guys don't change something relevant in the images. A solution to the other part ( keeping compatibility with BIOS booting) is on i...

jaclaz

So you're telling me that until now I've been connecting via RouterOS to the CPE, not the AC Lites? Yep :) . We (highly specialized technicians :roll: ) call that "barking up the wrong tree" :wink: . So if I find the IP for the AC Lites (somewhere in the range 192.168.1.10-192.168.1.200) ...

jaclaz

Well, there is something strange going on. Does the device(s) you are using look *like*: https://mikrotik.com/product/rblhgr#fndtn-gallery https://cdn.mikrotik.com/web-assets/rb_images/1874_m.png or more like: https://mikrotik.com/product/RB952Ui-5ac2nD#fndtn-gallery https://cdn.mikrotik.com/web-ass...

jaclaz

Please re-read the post just above yours, all the needed information is there, what is that you have doubts about?

jaclaz

Actually, you have none (shown).
Follow the instructions here:
viewtopic.php?t=203686#p1051720
and post your configuration.
You sure that is an AC LITE?

jaclaz

Interesting possibility.
But how/why this started happening last friday on multiple devices?

jaclaz

In that same thread there is a link to this post on another thread: https://forum.mikrotik.com/viewtopic.php?t=205042#p1059476 Where the standard configurations of a pair ( both master and slave) are posted. Since you already have one half of the old (good) configuration, It should be easy to recrea...

jaclaz

Yep, but the one you should try Is the third one, 7.15.3 using the last modified gdisk script. The idea Is that the last posted gdisk script creates (should create) an image functionally identical to the 7.14.3 modified by the full (including gdisk) kriszos script. Maybe there is still some differen...

jaclaz

As I see It, a (LTE) modem that has not a bridge mode Is a (LTE) router. So It has a WAN side (the LTE) and a LAN side (on one or more ethernet ports) that you have set with IP address 10.0.0.1. The RB2011 will have as well a WAN side (by convention ether1) and a LAN side (usually a bridge with all ...

jaclaz

So, if I get this right, the CAPSMAN appeared enabled in Winbox/Webfig while it was actually disabled in the actual (CLI/terminal) configuration?

It seems like a bug that can deceive/trick lots of people.

jaclaz

Back to the off topic SIM card size issues :shock: . I think that it greatly depends on how the actual socket receptacle is made, in theory the nano is thinner than the micro (by a teeny tiny amount, 0.67 instead of 0.76 mm) to allow the adapter to have a "back sheet" (that can often be re...

jaclaz

Yep, but if the good Mikrotik guys (who have an established record for omitting even vital documentation and even when documenting it, doing it in the most minimal and succinct possible form) felt compelled to put this info in the manual, adding even a picture, it must mean that the issues with that...

jaclaz

Coincidentally, recent:
viewtopic.php?t=210717

jaclaz

The good Mikrotik guys did warn you, though :shock: : https://help.mikrotik.com/docs/pages/viewpage.action?pageId=73826313 SIM slot usage https://manuals.plus/wp-content/uploads/2023/10/Chateau-LTE12-Routers-and-Wireless-User-SIM-slot-usage.png SIM card slot is designed to use with Micro SIM cards. ...

jaclaz

It should be checked, if under the thermal pad there is another chip, and from the white L shaped marks it seems like the heatsink should have gone over TWO chips, the one where the thermal pad still is and the other one without thermal pad, it would make little sense to place the heatsink in a so m...

jaclaz

Only for the record, and as a side-side note, besides using the "right" adapter and not attempt to combine two into one, metal adapters (as opposed to plastic) do exist, they don't cost (IMHO) excessively more and they are much more sturdy and the SIM fits in them more tightly.

jaclaz

The built-in bitwise XOR: https://wiki.mikrotik.com/wiki/Manual:Scripting#Bitwise_Operators should work also for IPv6 and num data types: Bitwise Operators Bitwise operators are working on number, IP and IPv6 address data types. So, using your code but with IPv6 (and : instead of . as separator) you...

jaclaz

Check if they are of this kind called MS156:
viewtopic.php?t=153582

jaclaz

Very good :) . So, as soon as Sindy will be able to (hopefully) report success in the environment(s) he uses, the matter should be pseudo-solved. Still, if the image (with just the ext2 to Fat16 conversion) works, running the gdisk script makes little sense, once set aside the things we have learned...

jaclaz

Removed once and destroyed nanosim-to-microsim-to-sim adapter because it was very difficult to pull it out. Sure, life stinks. :( Anyway, there are three common adapters in a kit: 1. nano to micro 2. micro to standard 3. nano to standard Sometimes 1+2 doesn't make 3. The nano to micro is so thin on...

jaclaz

Isn't there a (removable) SIM card?

jaclaz

To expand on the above, wireless wire kit is philosophically like a two ports managed switch. An IP address for it is needed only for management, it can be *any* address, as long as it is reachable. This particular two ports switch is however divided in two, so it needs two IP addresses, again, sinc...

jaclaz

Sorry, double post.

jaclaz

OK, it has been a nightmare (as it often happens) but I found out that the chr-7.15.3.uefi-fat.raw image (thanks Amm0) boots in virtualbox. A .vmdk descriptor is needed, but it is easy to make: # Disk DescriptorFile version=1 createType= RW 262144 FLAT "chr-7.15.3.uefi-fat.raw" 0 ddb.uuid....

jaclaz

Link to the actual page containing links to the various documents: https://fccid.io/TV7WAPGR52AX A rendering of the new device can be found in: https://fccid.io/TV7WAPGR52AX/Label/Label-7634072 It appears like a rather compact device, probably around 10x15x3 cm. I haven't found actual photos, but I ...

jaclaz

About BIOS booting, it cannot really work, as some parts are misssing: 1. MBR boot code - check 2. MBR partition entry for the first partition active - check 2. Magic Bytes (55AA) in the MBR - check 3. Boot code in the bootsector - check (to be verified) 5. BPB (Bios Parameter Block) in the bootsect...

jaclaz

Yes, each partition is one sector bigger in the GPT partition table than in the MBR one. The two partitions start on both MBR and GPT partition tables on Sector 34 and 65570. In the GPT the first partition goes then over the second. The second goes over the space marked as occupied by the backup GPT...

jaclaz

Well, the overall script changes anyway the filesystem from ext2/3 to FAT(32), evidently that is the "key" (and compatible with the UEFI requirement). On PC's, there are UEFI installable drivers (some made by the motherboard manufacturers or the one by P.Batard, the Author of Rufus for NTF...

jaclaz

@Ammo Problem: partitions 2 and 1 overlap: Partition 2: 65570 to 258048 Partition 1: 34 to 65570 Aborting write of new partition table. .... Recovery/transformation command (? for help): /dev/nbd0 disconnected That is not "an error", it is a "critical error", as it means that the...

jaclaz

@Ammo Ok, the Linux version then finds the same errors as the Windows version I tested and after the changes it writes to the image. (Do you want to proceed? (Y/N): OK; writing new GUID partition table (GPT) to /dev/nbd0. The operation has completed successfully). But what is the same output with th...

jaclaz

So we are back to the reason why I made a few slightly different scripts. The first one is the one that should produce an image most similar to the one as modified by the original script. I don't have handy a suitable Linux environments right now, not a suitable VM, so I am not able to test the resu...

jaclaz

Ah. OK. In any case the three different scripts may come useful in case there is the need to experiment, should the chosen one fail (for this or that reason). The script that I believe creates the most correct output is this one (the one called "MODIFIED SCRIPT3 (pure EFI/GPT, NO Hybrid) "...

jaclaz

can i have OFF, port 1,2,3,4,5 and ON port 6,7,8? Yes. (there is always some confusion between interface and port, as they can be synonym or mean different things, as a matter of fact the single ports (or standalone interfaces) are changed under a /interface sub-menu. /interface ethernet poe set et...

jaclaz

in this case, what adhesive you use? replace the current adhesive? Usually you just get a replacement thermal pad, if you cannot find one of the exact size you can buy a larger one and cut it yourself to measure. Specific thermal epoxy glues do exist, but if the original was setup with a thermal pa...

jaclaz

Yes and no (mostly no). Your RB5009 can provide PoE (PoE 802.3af and - almost - PoE+ 802.3at) and comes with a 48V2A96W power adapter, BUT the output on a single port is current limited, so you can have on a single port 440 mA (@48V). The CRS310 has no provision for PoE in, but accepts 18-57 V on th...

jaclaz

I am not sure to understand the problem, PoE can be switched :
poe-on=auto-on | forced-on | off
on a per-interface basis:
https://help.mikrotik.com/docs/display/ ... rtSettings

Port Settings

PoE-Out can be configured under the menu. Each port can be controlled independently.

jaclaz

Improving, learning, experimenting, maintaining, monitoring -- that's the whole point.

I thought that the point was more like improvise, adapt, overcome, let it be

(i.e. have the d@mn network running, then leave it alone until/if it breaks

) .

jaclaz

I can offer testing the images on both Proxmox and Hyper-V and, once that proves successful, even in the paid environment, but I suspect the logistics might be a bit complicated. If you have the time/will to test (before the images), the actual gdisk script on a Linux machine, it's fine, no need to...

jaclaz

Only as a side-side note, I could never understand the (I believe general) love for DHCP on simple, small, "static" networks. Of course it is a must have for wireless, and useful for cabled PC's, but cameras? I can imagine very few things as "static" as cameras, you have to go th...

jaclaz

Yes, that way could work. But the switch has NOT any network, it is L2, the AP can have the "normal" network and be bridged to the rest of the network, if there is a connection from the Hex to the PoE switch to which the other cameras are connected, the two added cameras can have the same ...

jaclaz

I think I speak for almost everyone,
writing that there is no one who does such a foolish thing.

I instead suspect that there are plenty of people doing even more foolish things, only they don't have the ingenuity (or the guts) to publicly admit doing them.

jaclaz

Good to know. I believe that also using the 7.14.3 image as base and replacing/resyncing the files on the two partitions with the 7.15.3 ones should work. Is there a free environment where the image bootability can be tested? I made a few tests and the image for 7.15.3 should be fixable through a sl...

jaclaz

Double post, removed.

jaclaz

Do you mean like inserting a

delay 10s

before the line running PrincipalDown script?

jaclaz

Maybe via Wayback Machine:
https://web.archive.org/web/20230311130 ... tings-list
https://web.archive.org/web/20230311130 ... list#toc_2

jaclaz

You could have the two added cameras on a small, completely different, network, with only three devices in it, let's say 10.0.0.0/29 (ok, six addresses). Then you could use the Hex (or a hap Ax lite) placed near the Windows PC to route or netmap them to 192.168.5.x addresses, but of course this devi...

jaclaz

A switch is L2. IP addresses are L3. For all it matters to the switch you could connect to one of its ports a device with *any* IP address, it is a connection on another level. The issue (or non issue) is only that the two networks won't be anymore physically separated, i.e. the two added cameras wi...

jaclaz

Yes and no :shock: , that may (or may not) be the issue (that then could be solved by only creating a FAT32 volume with the boot loader on it), but the script additionally attempts to solve the non-bootable issue by using a hybrid MBR alright, besides the FAT formatting: ( echo 2 # use GPT echo t # ...

jaclaz

It should be avoided by using fasttrack, but you seem like having it enabled alright. Maybe it is an artifact of the test, or of the device used for it, see this thread (where another possible cure, queues, seems to come out like being often worse than the illness): https://forum.mikrotik.com/viewto...

jaclaz

Yep, essentially the posted bash script makes use of gdisk (a version of it can run also on Windows, if you are not running Linux) by Roderick Smith, which is the defacto standard for checking/correcting/modifying MBR and GPT images or disks: https://www.rodsbooks.com/gdisk/ and can - among other th...

jaclaz

The setting shouold be only on the "wireless" package (not on wifi/qcom-ac). https://help.mikrotik.com/docs/display/ROS/Wireless+Interface distance (integer | dynamic | indoors; Default: dynamic) How long to wait for confirmation of unicast frames (ACKs) before considering transmission uns...

jaclaz

It works now with IPv4 Fullstack ! Thanks for the help.

Good.

I still wonder how the "IP sharing" works when the ISP router is set as router.
Maybe they do some kind of remapping of ports, assigning one fourth of them to each of the four co-users?

jaclaz

Your configuration seems just fine to me. Since the ether1 is getting its IP from the ISP router/modem (and consequently routes), it is likely to be an issue with what your ISP provides. Your case seems very similar to this one, same Freebox and same issues with bridge vs. router mode: https://forum...

jaclaz

Hard to say without knowing your configuration.
It could be a mis-configuration of NAT or firewall filters, but also any issue with routes and/or missing/conflicting IP addresses.

Follow the instructions here:
viewtopic.php?t=203686#p1051720
and post your configuration.

jaclaz

Only as a side note, in the few "official" videos from Mikrotik I have watched (I simply cannot bear videos, but that's just me) I have noticed that the good Mikrotik guys often use Macs, so I believed that they are "Apple users" (last time I had a Mac and an iPad I was practical...

jaclaz

I cannot see at first sight anything obvious, but I am a bit perplexed by your settings for static ARP, I don't know but it seems to me like you risk some kind of conflict between your static arp entries and DHCP leases, I am not sure that this is "right": /ip arp add address=192.168.88.24...

jaclaz

Yep, rest assured it is not you fault, usually when searching on Google the first results are on the (old) wiki that often gives obsolete info, then, when you get to the right "help" site finding the relevant information you are looking for is often challenging. The way the topics are orga...

jaclaz

Ah, ok, it should be clear that nothing is ever perfectly secure, but the probabilities of something happening (or not happening) should always be considered when attempting to implement settings or procedures intended as defense or countermeasures. In a post-mortem it is of course different and unt...

jaclaz

I am not sure to understand what you did.
You should post the output of /ip route print at the exact time and in the exact conditions when you are having the issue you are trying to troubleshoot.
If you change some of the conditions, the output may be misleading.

jaclaz

Yep, so - essentially - we are still (back) in the "you'd better use a different network, or you could ..., but ...". BTW mtest001 has already posted another tested approach using (or mis-using) proxy-arp here: https://forum.mikrotik.com/viewtopic.php?t=200602 this proving that VRF's are n...

jaclaz

We all know about exploits which (often with help of a user) compromise some LAN-connected computer which then serves as entry point for further attacks. With all due respect, surely they exist, but what is the ratio from_LAN/from_WAN, more like 1:100 or more like 1:10000000000000000 zillion occurr...

jaclaz

Maybe you have some previous instances that did not release connection, see: https://forum.mikrotik.com/viewtopic.php?t=45719 That could actually be connected with DHCP connection issue, if I get the linked thread right, fetch attempts to connect and if it fails, the job may remain "hanging&quo...

jaclaz

If the LAN side is also on 192.168.1.x/24? :? This is where I always fail to get a proper answer. I have always thought (and I may well be very wrong) that if the LAN side interface is 192.168.1.x/24 the other interface(s) can be either: 1) in the same 192.168.1.x/24 and then the device needs to be ...

jaclaz

Yes, all your routes involving 190.xxx.xxx.254 are ISH in the /ip route print you posted. Even the Dynamic one for that network is DIcH, even if it has distance 0, being dynamic (like your other dynamic routes) it should be DAc. It is like you had no ethernet cable connected to ether2 (or however no...

jaclaz

Maybe I'm missing something here... But what is the point of using VRF for ISP failover? — VRFs have nothing to do with "automatic failover". Failover works without VRFs, and so layering VRF on top of failover mechanisms just make config even more complex. The point is about having multip...

jaclaz

You have a direct route on 190.xxx.xxx.254, besides the recursive one via 8.8.8.8: /ip route add disabled=no dst-address=0.0.0.0/0 gateway=190.xxx.xxx.254 routing-table=\ main suppress-hw-offload=no add check-gateway=ping comment="RUTA FIBERTEL" disabled=no distance=10 \ dst-address=0.0.0....

jaclaz

I guess it greatly depends on the "type" of shop/business, small ones, possibly managed by younger people, go for newish devices, such as sumup, zettle or similar.
But I would say that - say - 90- 95%+ use the solution provided by the bank (which ends up being Ingenico).

jaclaz

Make an export if possible, that will help you reconfigure after netinstall.

Unless there is some other trick, I don't think so, If it is the same attack as on the given link the admin user is prevented from opening Terminal.

jaclaz

Are both router1 and router2 Mikrotik devices? If yes, which models? ether1 is a (the first) RJ45 port lte1 is (usually the only) LTE interface (3G/4G modem) The wifi interfaces are "wlan" (wlan1, wlan2). You normally use the scheduler for disabling an interface for a given period (daily o...

jaclaz

It sounds like your device has been attacked/hacked, there are several reports that an user "system" is created with all privileges and admin is limited to only a few ones. https://forum.mikrotik.com/viewtopic.php?t=202945 Only way out - I believe - is netinstall and start again from scrat...

jaclaz

A list of compatible devices (or more likely chipsets) has been posted here:
viewtopic.php?t=196111
it seems like limited to vary few devices and the AR5B22 or AR9462 are not among them.

jaclaz

At least here in Italy most "mobile" POS (Point of Sale) card readers come with their own (GSM or LTE, cannot say) modem and SIM (cannot say if physical SIM or e-sim) as they are provided (rented) by the bank or financial firm that has the convention with the cards (like Visa, Mastercard, ...

jaclaz

Post your complete configuration for review, (anonymizing/masking sensible data) instructions here:
viewtopic.php?t=203686#p1051720

Or compare your setup with the one in this thread:
viewtopic.php?t=196448
maybe the solution is there.

jaclaz

Maybe related, maybe not, Windows (I am presuming Windows 10 or 11) does normally not respond to pings (if the network is categorized as Public, it should work if Private, but sometimes it is needed to change a firewall rule on windows). See: https://community.fortinet.com/t5/FortiGate/Troubleshooti...

jaclaz

@aleab The issue you are having is a known one. There is not (yet, seemingly things are in the works) support for DNS in vrf's. I have a similar setup, in my case I "reversed" the vrf, putting it on the LAN side, so that the interfaces on the WAN side are on "main", and thus the ...

jaclaz

This type of SIM holders are tricky, it is not Mikrotik only, they are used on other manufacturers devices as well, in many cases that extra push is needed and there is the risk of accidentally damage the SIM with the tool used, ideally one should use a plastic one. And sometimes the SIM gets stuck ...

jaclaz

802.3af/at is NOT 24V:
https://en.wikipedia.org/wiki/Power_over_Ethernet

jaclaz

Not with a 48V power supply. They may work if you power the RB5009 at a lower voltage 24V or so. But if you do so, all Poe out ports of the RB5009 will be at this lower voltage and other devices actually 802.3af/at compatibile that you may want to connect to other ports won't work. There are splitte...

jaclaz

Place the hap Ax lite vertical on its "feet" (or rotate the photo you posted 90 degrees counterclockwise) and compare against the instructions picture. It seems to me rather accurate. And you are inserting the SIM with a different orientation from that picture/drawing. With the hap Ax lite...

jaclaz

Which camera? Most cameras are either non-PoE (and need a splitter/converter) or 802.3af. To extremely simplify, 802.3af means 48V. That Hex PoE lite is passive PoE, which - again extremely simplified - means 24V. They talk very different languages. The power adapter coming with the Hex is 24V 2.5A,...

jaclaz

And again: To get some meaningful help you should follow the instructions here: https://forum.mikrotik.com/viewtopic.php?t=203686#p1051720 and post your current configuration. About the DHCP server, if - as it should be - you have a bridge between ether1 and wifi interfaces, and you have a DHCP clie...

jaclaz

To further explain, the "general" action is src-nat, masquerade is a special form of source nat that auto-computes the ip address.
See:
viewtopic.php?t=11368
viewtopic.php?t=98960

jaclaz

Do you think that is a valid strategy?

No idea, but you should post again your current configuration, so that some members experienced with VLANs (and VAPs) may give you some more hints/advices.

jaclaz

Maybe connected, maybe not, but VLAN1 is generally a no-no:
viewtopic.php?t=208061

jaclaz

But does it remain unreachable even if you (for testing) disable the "main" 0.0.0.0 route or set it with distance 3?

jaclaz

The 04 should be fine, it is the 05 (now removed) that created the biggest issues: https://forum.mikrotik.com/viewtopic.php?t=204440#p1058092 Still blindly updating everything together at the same time just because someone, even Mikrotik, tells you to do so is not particularly smart, because if you ...

jaclaz

You must upgrade the device to the last stable version, not downgrade! He knows, he is asking if there is a way back, should the upgrade not provide increased stability. Not saying that it always pays to be prudent/conservative, but right now the OP with an oldish RoS version and oldish modem firmw...

jaclaz

Downgrading from running RoS version to any earlier one (down to the factory installed one, no earlier) is always possible and relatively easy, see: https://forum.mikrotik.com/viewtopic.php?t=194542 There has been a change in wireless packaging/modules between 7.12.x and 7.13, but that shouldn't be ...

jaclaz

Yes, but the dubitative form is anyway appropriate when the standard power supply is used, the 24V/1.2A are IMHO very "tight" to power both the "main" device and another one via (passive) PoE. As said PoE is already a mess in itself, but the good Mikrotik guys, with their lacking...

jaclaz

re:vlan ID 99 The board parser shows them in green (as if they were a comment and not a valid setting): add bridge=LAN_bridge tagged=ether2_Switch_1,ether3_Switch_2,LAN_bridge \ untagged="ether4_SmartHome_Controller1,ether5_SmartHome_Controller2,ether6_NVR,ether7_Synology,ethe\ r8_ProxMox"...

jaclaz

For the moment I wouldn't update the RoS (unless you are missing some other feature implemented in later versions) and definitely not the firmware of the LTE thingy, given the issues reported on the mentioned thread that seems objectively worse than the ones you are reporting.:

jaclaz

PoE is a mess in itself, and Mikrotik doesn't help with the confusing documentation they provide. The hap Ax2 is documented as having PoE out: PoE-out ports Ether 1 PoE out Passive PoE Max out per port output (input 18-30 V) 600 mA Max total out (A) 0.6 A Total output current 0.6 Total output power ...

Search found 1631 matches