MikroTik

what could be so f***ed up that you can't fix it from the fully working command line, but you can type "partition activate" command? There have been a couple of case in my experience with RouterOS, when after a version upgrade some services did not work as expected, and no change in confi...

Those features existed previously and if you used them, they are still working. Only new configuration requires approval by button press, for remotely connected user, to protect against remote intruder. On Audience running 7.16: [andrew@MikroTik] > /system/device-mode/update partitions=yes expected...

which ones did not exist?

partition, downgrade and bootloader

You can set this option today in 7.16, and it will remain after upgrade. Existing config is not affected by device mode limitations. This won't work with the options that did not exist before 7.17. Maybe, release a version where partition, downgrade and bootloader are known, but have no effect and ...

I already explained, that if you have access to this device and are able to issue commands, you can also fix your config in other ways, not just by partition change. Except when config is internally f*cked up by an upgrade and manually fixing the issue is no longer possible. The only solutions in t...

most people?
Yes. Plenty of posts about this already in this thread.

Do you only see what you want to see? There are also plenty of posts in this thread where people asked to keep the groups as they are.
I explained why I think the groups are better than tabs here.

I hope, they will return them in editing windows also instead of these ugly groups, because, as you correctly said, you need to scroll too much up and down to navigate. Please don't! A light touch on a scroll wheel is almost always faster/easier/better than repositioning you mouse on top of the dia...

Talking about comments, specifically comments in the Firewall section, I am used to using the comments as a logical group divider. I.e., I group the firewall filter rules logically, then add a comment to the topmost rule in a group, and in the old Winbox that comment applies to the whole group and v...

@nmt1900 It is not the (absence) of tabs in the rule editor dialog that many complain about. It is the tabs in the Firewall window itself (i.e. the one where all the rules are listed).

A couple of words regarding the departure of tabs that many complained about, specifically in the Firewall window: I do agree that in the main Firewall window tabs were better than the drop-down menu that we have now, however I really like groups instead of tabs in the firewall rule editing dialogs....

This is because in the Terminal window maybe you have SSH into some Linux system and running VIM, Terminal listens to all shortcut keys. CTRL+W is "eaten" by terminal I would much prefer and additional click to close the terminal window. Please-please-please make Ctrl+W work with non-term...

Ctrl+Shift+W to close a window is ridiculous, too complex and unintuitive. All modern browsers use just Ctrl+W for that (at least on Windows) and I believe many people are already familiar and comfortable with that combination. Can we get it supported in the WinBox as well? As others have pointed o...

With old wireless driver I could see the wifi symbol on my Android device disappear and reappear after 1 ~second. The only case when I personally observed anything similar with the old drivers was if I forcibly kicked (via the access list) clients off an AP based on the signal strength. When I let ...

These versions are of course installed on routers in the factory.

Do you still manufacture devices with v6 preinstalled?

It's not great if the currently unused memory is not become free again

Doing so is not always possible.

Isn't it recommended by Mikrotik documentation in the L3HW docs and the basic VLAN docs to not place a VLAN directly on top of a physical interface?

Only if that physical interface is a bridge port.

And for static routes linux doesn't need to run any daemons.

It still needs some user-land program to manage static routes, and I strongly suspect they put everything routing into a single binary.

Yeah, that's clear. But why should it have any effect on the client interfaces?

Upgraded Audience from 7.12.1 (with wifiwave2) to 7.13.3. Overall, upgrade went smooth, with the only exception that the wifi3 interface in the station-bridge mode refused to connect to my AP (running on channel 163, i.e., 5745/ac/Ceee) until I explicitly specified the country (on the station!) Why ...

Maybe not ... I guess that CAPsMAN initiated upgrades of CAPs are actually more or less handled by CAPs the same way as "manually initiated upgrades from within ROS" are ... only the kick to do it comes from CAPsMAN (instead of a GUI button click) and npks are downloaded from different so...

And this possibly requires change in netinstall as well

As well as the way CAPs are upgraded from CAPsMAN (both versions), I guess. And yet we might not see the whole picture...

rextended you see more with one eye, than most with two eyes............

He will change the avatar again soon, and then nobody understands your message anymore.

Or one could go back to RouterOS v6 long-term, it is still supported and will be for some time as far as I can tell...

Nope. Mikrotik still sells devices with 16MB SPI flash onboard, and many (all?) of those are shipped with v7 from the factory, which makes downgrading them to v6 impossible.

I've heard that many chips used to require SPI of 16MB or less to boot from; and if you need more room you add NAND flash in addition to the SPI that is still needed to boot from.

It's all about the expectations. When I opted in to being a moderator, the expected duties were pretty simple: delete spam and approve new posts . I can totally understand normis when he favors positive attitude towards new beginners over the technical expertise of senior jerks nerds members (me inc...

Google says your camera supports 802.3af POE only, which SXT LTE does not support.
You may have some luck if you power your SXT with a 48V power supply and then force the POE-out to be always on, but this may as well not work (or even burn your camera).

You may have better luck asking this on the D-Link's forum/support/whatever.
Based on your description, I'd say that the "rogue" IP most likely comes from your D-Link.

after that I've tried with a Dell laptop, a Fire tablet, and even a Surface, with no luck.

Regarding Windows laptops and roaming, check this message out.

@S8T8 Whatever you set the connect-priority to, the duplicate MAC addresses should not be allowed withing the same connect-group . But you are probably correct in your assumption that the connect-priority=0/1 setting is less secure than whatever the default setting is. Please note that the 'MacStea...

!) rose-storage - moved SMB service in the RouterOS bundle; !) smb - removed legacy SMB service (replaced with newer and faster ROSE SMB service); I wonder how this change affects the bundle size. Compared to beta6, the beta7 ARM and MIPSBE packages seem to be 20K larger, and for the 16M-flash devi...

Windows only supports FT over the networks with 802.1X (i.e. when using WAPx EAP), it does not work in open networks or networks with WAPx PSK. That does not mean Windows laptops does not roam at all, it just meas Fast BSS Transition is not supported in those cases. When using the new CAPsMAN, howev...

1) Yes, mostly to apply a nicely configured session from an existing device to a new one. 2) They store Winbox windows' layouts (windows positions and sizes, columns visibility, order and widths, etc.). 3) No idea (other than making the session file human readable/editable). 4) I've always believed ...

Do you want me to look up each kernel change log and flood this forum post with 500+ lines of networking stack change log? No, of course I don't! But I want you to validate specific pieces of evidence you post before actually posting them. Please note that I, personally, do not argue against the ne...

Which part of Not all features/data plane functionality is 100% L3HW. This is MikroTik, not Juniper MX/PTX. is unclear? I specifically quoted the part that is unclear. You posted a link to an articles that talks specifically about a TCP end-point optimization to prove your point that the kernel on ...

They should upgrade to Linux Kernel 6.8, read this for why:
https://www.phoronix.com/news/Linux-6.8-Networking

I fail to see how that may be relevant for a router.

where did you get that from? would like to bookmark that

https://help.mikrotik.com/docs/display/ ... ackagetype

Please advise how I can get this resolved through official support.

By contacting the "official support" first, I guess.
https://help.mikrotik.com/servicedesk/servicedesk or support@mikrotik.com

Feels like yet another "missing feature" (albeit a rather minor one) in the new wireless (wave2) vs the legacy wireless.

No. You first create a configuration profile and put all you settings in there: /interface wifi configuration add name=my-wifi-config ... Once done, use it for provisioning your remote CAPs and also set that profile for your local radios: /interface wifi set [ find default-name=wifi1 ] configuration...

... (wifi menu for controlling the wifiwave2 devices) ... Just use the same configuration profiles for both CAPsMAN and local radios. For that, you don't need to join the local box as a CAP, everything (including the roaming protocols) will still work. P.S. Please note that this thread was original...

It is just the "auto" setting that is no longer available (and it was removed in 7.12, not 7.13). You can still force it on or off, though.

Makes me think you were connected to 2.4GHz radio ?

L009 does not have 5G radio.

do I need to report this to MT support?

Reporting problems to support never hurts.

This tiny device does not support HW-offloaded bridge VLAN filtering, so enabling bridge-vlan-filtering may have a rather serious impact on performance. In case you really need to do anything VLAN-wise on the switch/bridge you should do that in the /interface ethernet switch menu instead. But, based...

I'm not quite sure how `disabled` is affecting the channel selection. Does it bypass the CAC requirements and use the channels without scanning them first or does it comply with regulations and uses DFS and CAC where requested by the law? The latter. I just want to know if there is any chance to by...

Looking over your configuration real quick, I don't see the bridge-vlan-filtering being enabled.

Question: I have a network with two AC2s, one as a router and one as an access point via ethernet. If I want to finally have roaming between them, do I just need to install the new wifi driver or do I also have to use Capsman? For 802.11k/r/v CAPsMAN is a must. Do you recommend Capsman for two AC2?...

Check this post out.

If i will upgrade to 7.13, the wireless packages of ac2 will be upgraded to the new drivers packages or i have to manually install them?

Manually.

do i have to reconfigure all my wifis from scratch?

Yes, you do.

The latest versions of 6 were all bundled.

No. Even on the very latest v6 (6.49.11 as of this writing) you can still install individual packages in place of a bundle, leaving anything you don't really need out. v7 is very different in this regard.

Netinstall

- "stable" means "no more fixes" :we moved on to new features Rather the opposite, "no new features", but fixes may still come (with the third version number increasing). - point release are "blocking" paths in upgrades Mikrotik is not the only vendor doing t...

News for you, I have many MIPSBE devices, and I use those "lost" features.... "Legacy" wireless package is still available for MIPSBE devices, is fully supported and (as I understand) will keep receiving security fixes. And there are no "lost feature" in the legacy wir...

Now my old devices are not supported, and will not have any security updates after 7.12.1

Why do you think so? That's simply not true.

Is there a guide on making both CAPSMANs work at the same time on the same MikroTik device?

I've tried but they don't seem to be able to coexist.

Check this out and see if it helps.

It should report: 7.13 and epoch date: 1702542240 approx. I suspect that URL was used by RouterOS itself to check for new versions. Now that they mandate the 7.12.x to be an intermediate stop on the upgrade path to 7.13 and newer, I believe they introduced a new URL, and the old one will point to t...

Setting connect-priority=0/1 ensures connections to a new AP are immediately accepted and the old AP connection is dropped automatically. When using PSK authentication, this allows seamless roaming even without FT.

Thanks for the tip, man. You are a lifesaver!

@Santi70, do you have specific reasons to desire a kernel upgrade? Or is it upgrade for the sake of upgrade, just because a newer version is available?

I don't really get all this tagged/untagged discussion. The 802.11 frame header has no place for a VLAN ID, so, technically, wifi interfaces are never tagged.

Well, to me, it actually sound logical. If there were a parameter named default I'd expect it to mean "return this if the input buffer is empty", whereas preinput sounds more like "pre-fill the input buffer with this string, please".

@Qalderu: being a MacOS limitation this cannot be fixed on the RouterOS side.
If you really need this fixed you should chase the Apple's support instead.

...new Winbox has new exe signature.

Something's wrong with this signature:

2023-07-26_154929.png

2023-07-26_154843.png

Hard to be sure without seeing the full config, but it feels like a PMTUD problem.

This traffic selector ("local 0.0.0.0/0 remote 0.0.0.0/0") is typically used for VTI, but does not make much sense for the classic policy-based IPsec. And Mikrotik does not support VTI.

Some pretty off-topic posts have been split into a separate topic and can now be found here: viewtopic.php?t=194519

@sc0ch viewtopic.php?t=190351#p967604

Several posts above you wrote that you have a serial cable. Try entering the Netinstall mode from the RouterBOOT menu.

For IPv6 you have to define a separate set of firewall rules in /ipv6 firewall filter. It's not clear from your original post if you have those in place. The rules that work for IPv4 won't match the IPv6 packets.

CAPsMAN can only control physical interfaces, not virtual.
And you cannot manually create a virtual interface if its parent is managed by CAPsMAN.

No, at least not on the same interface.

In the classic policy-based IPsec there is no such thing as "IPsec interface". But even if there were such thing, it would have been a peer-to-peer connection interface, and so MAC address would not make much sense there. The outgoing ESP traffic is originated from your VPN endpoint (your ...

If I look in a packet trace though those ESP packets still have src and dst MACs. When an ESP packet travels across an Ethernet segment the encapsulating Ethernet frame will contain the source and destination MAC addresses, obviously. Those addresses will not survive crossing the segment's boundary...

if we are going to assign /64 then it will waste alot of ip addresses

Is that a problem?
(I mean, do you understand what the capacity of the IPv6 address space really is?)

No, it is encapsulated in ESP, which is an L4 protocol.

Basically a client has asked me what the src MAC address will be of any traffic going over this tunnel and I've come to the conclusion that it will either be the MAC of the "WAN" interface, or the MAC of the LAN interface that the IP range is configured on... WAT? IPsec (as even the name ...

I need just the basic setup steps with any brand of repeater, There is no such thing as a generic WiFi repeater configuration steps. if I can still use the multiple users and vouchers configured on the MicroTik Router for the users after the Wi-Fi Repeater ... ? No, you cannot, unless you use anoth...

from the Mikrotik I cannot reach the devices behind the Cisco. ... When debugging the connection, it appears as if the interesting traffic is being NATTED out the WAN interface You have not shared your config, so I can only speculate here. Since you seem to be testing (pinging?) directly from your ...

DCO is an implementation detail of the original OpenVPN software. As far as I am aware, Mikrotik does not use the original OpenVPN software, they have reimplemented the OpenVPN protocol handling themselves.

Bon appetit!

Zero Trust Cloudflare package option missing.

https://www.youtube.com/watch?v=BbDnBxlBTdY

... I cannot understand why Cisco had to invent the new nonstandard VTI protocol for something that was already covered (and implemented by them!) before as IPIP over IPsec transport mode (or GRE over IPsec transport mode).

The main reason was a few extra byte of MTU, I guess.

wow a new high power CCR with 12 gigabit ports insetad of 12 sfp+ 10 gigabit ports..... nosense Mikrotik missing of fiber datacenter router (CCR2004 is not stable and has a lot problems with packets loss) CCR2116 is based on the CPU from the same family, so will likely be suffering from the same pr...

@Buster2, logging topics have always worked like that.
Next time you want to complain about something similar, please do that in a separate topic as it is in no way 7.1rc1 specific.

Log level should be either info or debug, but not both at same time. That's "topic", not "level". They are not equivalent. I don't think there's such thing as log level in RouterOS. You can only specify severity for a certain combination of topics when sending log records to a r...

I don't think Netinstall is really necessary in your case. At lease not yet.
Here's a Quick Start Guide for your device: https://i.mt.lv/cdn/product_files/RB201 ... 191058.pdf
Read the "Buttons and Jumpers" section carefully, then follow the procedure to reset configuration.

If you look at the block diagram of your RB953GS-5HnT you may notice that only the first SFP cage is connected to the built-in switch chip, whereas the second SFP cage is connected directly to the SoC (CPU). That means all the transit L2 traffic goes through the CPU, which may be a seriously limitin...

how is the router supposed to know that certain traffic is to be routed to that L2TP connection unless it already is established

You can specify L2TP interface itself as a gateway in a static route (including default one).

Reinventing the wheel continues...

Have you seen this MUM presentation?
https://www.youtube.com/watch?v=B9neG3oAhcY (Slides: https://mum.mikrotik.com/presentations/ ... 338589.pdf)

That's a result of using action=masquerade in NAT. Using action=srcnat instead is a solution. This will require manually specifying your public IP address, however.

That appears to be a cosmetic WinBox issue, you can simply ignore those messages.

Are you talking about IPsec?
If yes, what you are asking for does not seem to be possible/supported...

While 802.11 defines the 4-address wireless frame format, it provides no guidelines on how to actually use it. So all vendors implements WDS in their own proprietary ways, which are generally incompatible with each other. Both Mikrotik's WDS and station-bridge mode support fall into this category.

Rextended, you are missing the point here. What OP is asking is a session settings that are used to bootstrap new sessions when you connect to some box for the very first time. Indeed, that would be a nice to have feature.

RB4011 only support Passive PoE (both -in and -out). Datasheet for your AX214 does not provide any information on what types of PoE it accepts, so I assume it is 802.3af/at only. Which means they are not compatible and you cannot power AX214 using RB4011.

Hence, it's not quite the same. All this noise about google is here because the original poster wrote this: Google uses this algorithm everywhere, it means that there is a future behind this algorithm. Whereas in fact it does not mean anything. So in this context "it is actually quite the same...

The point is, asking Mikrotik to implement something that would allow others to keep violating the standards means encouraging those others to keep doing what they are doing. One should rather ask people violating the standards to stop doing that. You always have choice. In case your ISP provides yo...

This sounds like "I would rather not use Mikrotik products because there is no way to workaround DHCP client bugs in some 3rd party products, but keep using those buggy 3rd party products..."

Forum became so boring idle rextended decided to reply to a 5 year old unanswered question...

Yes, via USB.
Check this page out to get an idea of what may be supported: https://help.mikrotik.com/docs/display/ROS/Peripherals

My guess is that many people would assume that the parameter is applied in the default config sourcenat rule with action=accept when reading the MT file. I don't think I understand what you meant here. I dont believe many would think If there is no action parameter then we should assume there is ac...

I can think of at least two approaches here.

The first approach is a so called split-horizon DNS. I don't think you can do this on a Mikrotik router, an external DNS server is required.

The second approach is "hairpin NAT". Search the forum, there are plenty of example here.

I didn't ask what the default action for action is, but if inserting a NO ACTION rule is a BUG or does something ... C'mon! You are playing on words, aren't you? And in case you are not, action in a firewall filter/NAT/mangle rule is nothing more than just another parameter. The default value of a ...

which does this. Except, it does not... :) udpxy is a web server (proxy) that subscribes to multicast streams on behalf of its clients, then sends the contents of the received multicast streams back to clients over HTTP connections. Correct me if I am wrong, but I do not remember anything in the mu...

Ah, I now see where the rextended's question on "useless NAT rules" came from!

The default NAT action is "accept", so that "shortest rule" will NOT do masquerading. Rather the opposite, it will exempt all traffic from NAT.

The default action is "accept" (here's a documentation link), so those rules are not useless at all.

Make sure you do not fasttrack the inner-tunnel traffic. Perhaps just try disabling all fasttrack rules first and see if it helps.

Because nobody moderates the forum 24/7. Your post was approved when one of the moderators had time to do that.

Assuming they don't improve it further, would that mean it's a false economy to get the RB5009 if the RB4011 is just as fast if you use v6?

If you watched the video introduction, there they said RB5009 will NOT be compatible with v6.

"how to do reverse proxy in mikrotik" You can NOT do that on Mikrotik itself, there is simply NO reverse HTTP proxy on RouterOS. The L7 hack is NOT a proxy. Also, a few posts back I wrote the following, I think this may be the best solution in your situation: I suspect you already have so...

This forum is not the best place for asking help with licensing problem. Please contact support instead: https://help.mikrotik.com/servicedesk/servicedesk

but that would require that I add a 12V->24V boost converter Is adding another 12V battery in series an option? Also, the original question was about Powerbox Pro, but since in your case it is RB260GSP you have an option to disable/limit that overcurrent protection by enabling the "Port1 PoE I...

And so what? Ports are different. And while for SSTP there are good reasons to keep it running on 443/tcp, are there any equally good reasons to run WireGuard on, say, 443/udp?

Well, for SSTP that kinda makes sense. But not so much for WireGuard since it only uses UDP as a transport...

@Cablenut9, all your options suggest that you needed this for yourself only. In that case setting up some kind of a VPN would have been a much easier, cleaner and more flexible solution... @prisoner267, I suspect you already have some web server on you NAS, your other machine, or both. So one thing ...

could you tell me when it is usefull to setting 2 peers for the same policy?

It may be useful for failover.

@Cablenut9, I am 99% confident that in OP's case both MyNAS.XYZ.com and MyBlog.XYZ.com point to the same IP address. That's kinda obvious...

You need a so called HTTP reverse proxy to do this kind of redirect properly. RouterOS does not have that, so "L7 hack" is your only option in case you absolutely have to do that on Mikrotik itself.

The unit accepts both 802.3af/at and Passive PoE on input, but only provides Passive PoE on output. The injector that ships with the unit is Passive only.

Good work on the support Mikrotik, not.

Did you realize this is a user forum and not a support platform? I am not sure anyone from support saw this topic at all.

Do you happen to use the .local domain for your static entries? I saw someone mentioned in another thread that Apple only uses mDNS (but not "regular" DNS) to resolve names ending in .local.

This only works if the bottom 2 bits in the top octet of the MAC are 0, but should they not be in any situation where you'd use this rule? I will assume "bottom 2 bits" means "least significant 2 bits" here. The two least significant bits of the first octet of a MAC address have...

Yes. On each side I have a dedicated edge device for each ISP line (those are three ASA boxes on one side and three RB4011 on the other). An IPsec tunnel is built between each pair of edge devices, three tunnels in total. All these tunnels share exactly the same policies (i.e. bridge exactly the sam...

I have an installation where I do similar thing, except I have three ISP connections on both sides, not two. It is easy in my case because I have 4 routers on each side. And I am not sure you can do that with just one.

Is there any point sending a supout to Mikrotik....?

Yes, there is. Please do.

Do you have any hints on the "restoring configuration from export" ? I do that rather rarely, mostly while changing/upgrading gears. What works best for me is /system reset-configuration keep-users=yes no-defaults=yes skip-backup=yes , then connect using MAC-WinBox or MAC-telnet and apply...

I've been doing exactly that (tracking configuration history by storing configuration exports in svn) for several years now, and it is working great for me. I would only encourage you to use /export terse - the output will be slightly less human-friendly, but much more diff-friendly, which I find to...

QuickSet is a tool for housewives with little to no knowledge in networking to quickly make their brand new gear up and serving WiFi in their kitchens. The number of configuration choices is deliberately limited to keep the damn thing simple. QuickSet is not meant to make trivial things more accessi...

this method doesn't require that you leak your login credentials to anyone with a copy of the shortcut

Anyone "double-clicking that shortcut" should have read access to a copy of the private key and that automatically grant him/her full access to the router.

MTU of the EoIP interface itself should always match the MTU of the networks you are bridging, i.e. 1500 in most cases.

In-transit fragmentation is forbidden in IPv6 networks, packets may only be fragmented by sending parties. Functional PMTUD is vital in IPv6, so make sure you do not block ICMPv6.

@msatter, I don't see how you tip applies to the OP's situation. Your link basically describes a workaround for a specific case when tunneling all (also with NAT) through IPsec prevents PMTUD to work. That is not a problem for a regular IPsec use case when IPsec is used to interconnect specific subn...

https://download.mikrotik.com/routeros/ ... a4-arm.npk

MSS is a TCP thing, and RADIUS only supports UDP as a transport, so the rules you've mentioned will never work with RADIUS. Fragmenting large UDP datagrams should not be a problem. Unless DF bit set, of course, in which case fragmenting is forbidden. The latter usually happens during path MTU discov...

Try connecting with WinBox using MAC-address instead of IP. And if that does not work then the only option is serial console, I guess.

IPsec encoding of a single TCP stream (connection) is always tied (and thus limited) to a single CPU core to avoid packet reordering. If you run multiple TCP streams in parallel you should be able to get a much higher overall throughput.

Does MikroTik have a recommended one? Mikrotik offers a couple of power supplies (see e.g. MT48-480095-11DG and MT48-570080-11DG ), but you can use literally any with suffucient power output. I wonder why it doesn't come with the appropriate power supply though, is a 24V one actually cheaper? I gue...

You need to use a 48-57V power adapter when you need to provide power to 802.3af/at devices. The 24V power supply that comes with your hEX PoE unit is not sufficient. That is clearly documented on the product page.

Do you know there should be a "Port1 PoE In Long Cable" setting on the System tab? See: - https://wiki.mikrotik.com/wiki/SwOS/CSS106#System (for the current RB260GSP / CSS106 boxes) - https://wiki.mikrotik.com/wiki/SwOS/RB250_RB260#PoE_and_Health_.28RB260GSP_only.29 (for the older/original...

The power drop on (wire1) (actually any wire) depends on the current. So at peak times the power drop may be significantly higher than in a steady state. Now, the overcurrent protection is likely implemented by monitoring (rapid) voltage drops (instead of current peaks). Which means a long (relative...

NAT was just another way to solve your problem. And it was easy. And "universal", meaning you can implement it no matter what else you have configured and how. Your "route to bridge" solution works because you happen to have an interface (bridge) with an IP address that is covere...

It should be "src-nat". The "dst-nat" thing only works for incoming connections destined to your router.

P.S. IPsec is rather "advanced" topic, but the NAT is pretty basic, really. And your NAT-ing mistakes look so naive...

"action=accept" in NAT means "do nothing". No wander nothing changed. :)

Nah, COBOL!

When DNS resolver (on your router) makes a request it uses one of the IP addresses assigned to interfaces of your router. Which one depends on what you have in the routing tables. In most cases that will just be your external address. I am confident that address is not covered by your IPsec policy. ...

Is there a significant difference in real WiFi coverage between the hap ac2 vs hap ac3 to justify the higher price of the latter? hAP ac³ (as compared to hAP ac²) has a slightly better CPU, more RAM and way more flash (and a decent amount of flash, for example, means better chances your WiFi will b...

Can I and how do I , log ( syslog and/or syslog to a remote syslog server ) all NAT translations ? NetFlow is the answer here. It will export ("log") all the connection tracking statistics for you. Use NetFlow v9 as it provides a richer set of information, including full NAT details for e...

Indeed, SwOS Lite version 2.14 topic is here: viewtopic.php?f=21&t=175736

What you need is a NetFlow collector. You setup the collector, then configure you router to export the traffic flow information (see the Traffic Flow manual page). Once your traffic data is collected you can export it in whatever format you want. However, please note that: (a) you cannot run a NetFl...

In the vast majority of cases SMIPS upgrade problems are caused by RAM shortage and not flash shortage. The error message may be misleading, when it talks about disk space it is usually complaining about RAM drive. If you have problems upgrading SMIPS routers try rebooting the device first, then att...

Saiks, SwOS has web interface only. The app is only for RouterOS.

*) ipsec - added SHA384 hash algorithm support for phase 1 (CLI only); Strange effects when attempting to edit ip ipsec profile created with sha384 hash in Winbox 3.27 - the hash is shown as MD5. That "CLI only" remark means setting this up is not currently supported in either WinBox or W...

I am sure that 16MB flash nonsense is not so much about money as it is about technology. I've recently posted my thoughts about it here . Now I just wanted to add that the reason all Mikrotik devices with SPI flash chips are limited to 16MB might be the relatively old kernel in v6. Though should it ...

This is clearly off-topic gone wild, but let me add my 2¢ anyways. :) That 16MB flash thing is not only economical, but also technical. If you take a close look on the different RotuerBOARDs you'll notice that all those 16MB flash devices use SPI Flash chips, whereas devices with a larger amount of ...

The reset button is a multi-function thing and needs to be operated properly. You can read about it here:
* Wiki page: https://wiki.mikrotik.com/wiki/Manual:R ... set_button
* Device-specific quick-start guide: https://i.mt.lv/cdn/product_files/rb301 ... 190656.pdf

5ghz backup is useless because:

When the first 60G devices were introduced there were a lot of folks asking for a combined devices with 5G backup. Now that the first such device is introduced there are other guys saying the opposite...

Screenshots are useless. Post full configuration export instead.

But in general, what I wrote in the previous post still applies. Make sure those two requirements are satisfied, and then everything you described should just work.

Would help of course, if ARM was officially supported.

I think they just forgot to update the wiki page. Partitioning works just fine on ARM devices with enough storage.

What is it?

It should be as simple as satisfying the following two requirements:

1. Make sure you do not block traffic between Stream and LAN subnets.
2. Make sure computers on Stream subnet only use your ADCs as DNS servers.

I saw a similar behavior with broken IPsec configuration recently. My issue appears to be partially resolved in 6.48beta48. So one thing you can try doing is upgrade to that beta check if your IPsec configuration can be accessed/exported again in case it can remove everything from /ip ipsec and then...

Do you know that an export command exists on RouterOS?
Check this page out: https://wiki.mikrotik.com/wiki/Manual:C ... figuration

This is already supported, see this: https://wiki.mikrotik.com/wiki/Manual:Partitions

The AP mode is not allowed on my device.

You should use bridge mode instead. For more details please check this page out.

What nonsense.
why do they put USB in it at all.

Guess, 3G/LTE dongles, serial communication, etc. Mikrotik produces routers, not NAS devices, after all, so SMB/FTP/etc functions are purely supplementary (firmware update, backup download/upload, hotspot customization, etc.).

Have a look at RoMON.

Only the reception of the access point may improve, not the signal strength. I was thinking about this lately. I believe better reception (higher rx sensitivity) also means higher sensitivity to the interference. So you are getting better coverage, but can only enjoy it in quiet areas, whereas in t...

Is this the best place to report bugs?

Nope. This is NOT a place to report bugs at all. Bug reports should go to https://mikrotik.com/support.

Do not mix up the antenna gain and the signal strength. When using a high gain antenna your router has to reduce tx power to stay withing the legal boundaries, so the max signal strength you get is the same. However the effective coverage is usually better, thanks to a better sensitivity on reception.

I noticed the PM is now disabled again. Was it that bad being enabled?

Are you sure this is a 7.1beta specific problem? I.e. can you confirm there's no such problem with v6? Also please check you cables. From my own experience, these old HP 2810 series switches are very sensitive to even slight cabling problems, and fallback to 10M half-duplex (or does not work at all ...

If it's just 3 month old, is RMA an option?

When a packet with destination 10.10.10.0/24 gets in the mikrotik router, ECMP computes a hash based on Source Address, Destination Address, Protocol, Source Port, Destination Port, and that decides whether the packet is sent to gateway 10.20.20.2 or 10.20.20.3, right? Not quite. According to this ...

Certificate is OK

Wrong certificate, erlinden was asking about the certificate from download.mikrotik.com, i.e. the one from the page giving the error.

P.S. This is getting pretty off-topic, I'm going to move this whole conversation into a separate thread... Done!

@Delsey Downloads work fine for me. I specifically tried the link from your screenshots, it works as expected, no certificate errors whatsoever.

This may be either a CDN problem in your region, or a sing of an ongoing attack (like MITM, DNS poisoning, etc).

OpenWRT on Mikrotik as a MetaRouter

Metarouter is not supported on hEX S (as well as any other model with SPI flash).

mikrotik.com/dowload

Perhaps because you missed N in dowNload?

I assume you are asking about hEX S (RB760iGS). That is a full-featured router running RouterOS. You can read more about the software here and here. It is pretty powerful and will likely cover most (if not all) your needs.

Is there any difficulties to implement an external link and provide access to a routerOS through API? Nothing too fancy. The API description is here . At the bottom of that page there is a list of third party clients in different languages. You should enable the API first in the /ip service menu, s...

And to your original question. Have you seen the Customizing Hotspot page on the wiki? Specifically, the "External authentication" section may be of interest to you. And if you don't feel like passing a (temporary) username/password pair in a redirect back to the router, you can consider d...

I tried to open the link in Yandex with a VPN - eventually it's been opened. Well, Ukraine blocks a range of Russian's IP addresses who knows it might be the reason. Just checked, works fine for me. Tried opening that page via several ISPs here in Kharkiv, no problems at all. It's probably the brow...

Please check the /system package menu, the package may be installed, but disabled.

The Block Diagram for this device says the switch chip is QCA8327.

1. routing
2. firewall
3. NAT
4. IPSec policy

This is a pretty incomplete sequence. Please see the packet flow diagrams

All I am saying is, that those who have enough switches that will benefit from a single management plane, will almost certainly need HA features to go with it. My friends have an office here with 200+ client ports, with all cable runs going into a single rack with five 48-port access switches (some...

And once you do anything outside of QuickSet never attempt to use QuickSet again- that has a great potential of ruining your running configuration.

As far as I understand packets belonging to a single TCP stream are always bound to a single CPU core, no matter if it's routing or bridging. This is done to avoid packet reordering (which used to be a huge problem when CCR series devices were first introduced several years ago).

Screenshots are (almost) useless, please post configuration export (run /export hide-sensitive from the command line) instead.

btest itself is very heavy on CPU, this is a well known issue, which has nothing to do with the actual routing performance of your devices. Search the forum again, this has been discussed tons of times.

What do I use then to get traffic data from each client that I do use in Splunk for MikroTik?

NetFlow is an obvious choice for that kind of data.

Sounds like a DFS (radar detection) in action. Check your logs to check if that is the case.

This will be a deal-breaker for MANY people, I'd go so far as to say for the majority of people. Not sure about the majority, we successfully use CAPsMAN in the office, where 24x7 is not a requirement, so that's not a deal breaker for us at all. But you are right, in some cases (like hotel installa...

Please read carefully https://forum.mikrotik.com/viewtopic.php?f=7&t=161563&p=796943#p796661 Right, I've read it again. Please find my comments on it below. So its either Beamforming or Spatial Multiplexing .... normally part of the wireless driver packaging Well... Yes, spatial multiplexin...

Nowhere did I state that Spatial Multiplexing is Beamforming .... grrrr

Then what was your reference to 802.11 and MIMO about?

Beamforming began to appear in routers back in 2008, with the advent of the 802.11n Wi-Fi standard. 802.11n was the first version of Wi-Fi to support multiple-input multiple-output, or MIMO, technology, which beamforming needs in order to send out multiple overlapping signals. Nope. Spatial multipl...

OP was asking specifically about 60G devices, where beamforming IS available (at least on some devices like wAP 60G).

On a broader term, MIMO neither implies nor requires beamforming. Only MU-MIMO does. And none of the Mikrotik devices currently support MU-MIMO, that is a well-known fact.

I am running winbox (32-bit) under wine on a Debian system.
Maybe it behaves differently on a native Windows system?

Sounds plausible. I run Winbox (64-bit) natively on Win10. And (simply out of curiosity) I have just tested 32-bit version, which also works fine for me.

open a window like "IP firewall filters" in a router that is in active use, and make sure the hit-counts of firewall rules are being displayed (and changing all the time). Now, position the mouse over a header separator and keep mouse button pressed to attempt to move the separator to set...

Au contraire. MK has a superior QC department. They created the "obsessive compulsive TRAP".
Looks like it found a victim already.

I like these a lot! Please keep posting!

Interesting!!! I have to dig deeper in this WMM. WMM priority when received over WLAN how is it marked? DSCP (TOS) or MKT priority? Have you seen this article on the wiki: https://wiki.mikrotik.com/wiki/Manual:WMM ? If the priority is maintained in the MKT, then with the default config only priorit...

I struggled to find a Support section or separate Support forum

This is a community forum, for support please look here: https://mikrotik.com/support.

Connection was plug-and-play, 10Gbit link speed is up, however winbox bandwidth test shows speeds lower than gigabit (500-750mbps). Your device is a switch. It can work as a router, but that router is pretty weak. Basically, while switch hardware is powerful enough to forward L2 traffic between all...

Search found 1513 matches