MikroTik

erlinden

Question is how ? How I changed frequency on 3 AP ? I am in primary settings set one frequency , how I changed frequenci on 3 AP ??

Create provisioning rule per radio. Add radio mac to make it radio specific. That's it.

erlinden

But I don't understand how I changed AP settings

Documentation helps a lot:
https://help.mikrotik.com/docs/pages/vi ... )-Examples

Please provide a complete config of the device running CAPsMAN.

erlinden

The only reason to use capsman is two fold.
a. You have all AX devices and thus can really benefit from all standards to make handover smoother.

Can you change that to You have all wifi-qcom(-ac) devices? I love the roaming experience with my cAP XL ac and wAP ac!

erlinden

Having some difficulties understanding your problem. I assume you want to have the hAP ac3 (is this the correct model?) controlled by CAPsMAN2 as well? To accomplish this, you have to uninstall the wireless package and install the wifi-qcom-ac driver. Then you will be able to manage it through CAPsM...

erlinden

I'm far from VLAN expert, but... I red that using multiple bridges is not necessary (and not recommended). It is recommended not to set VLAN id to a bridge. I'll continu reading your config... Update With the CRS3xx you can use the switch. There is a great help page on this type of switch: https://h...

erlinden

Just to be sure...you know the difference between an OS upgrade and a firmware upgrade?

erlinden

You mean:

/interface/wifi/registration (or menu /WiFi/Registration)?

erlinden

Can you share the config:

/export file=anynameyoulike

Remove serial and any other private info. And post between code tags by using the </> button.

Did you upgrade firmware as well?

erlinden

Meanwhile, I have been going through the entire manual looking for what might be the case. Apparently, it was v6 that was "broken". More on that to follow.

Nice finding!

Looking forward to your update!

erlinden

I want to set a different frequency for each device. But I don't understand why? I have 3 APs and they should be in the same frequency... right? Wrong, when using multiple accesspoints within a network you want to have all settings identical except the channels . If you want to have network seperat...

erlinden

It is v7 that has changed something.

Something

We are talking about a major upgrade of the OS.

You could consider using a V6 config (if that is available?), after performing a netinstall to V7.14.2 (or other) doing a manual config by use of the V6 config file.

erlinden

Have you tried through Winbox using the MAC address (which can hopefully be found in discovered)?

erlinden

That is correct.
And you are very welcome...wifi on MikroTik is a real quest. Any experiences with it, should be shared.

erlinden

just for the purpose of completeness, this is what i ended up doing. I was not able to combine SSID, it would go back to defaulting to 2ghz no matter what I tried.. maybe there is something i am just missing. Looks a lot better, think that channels is a bit redundant (as one definition per channel ...

erlinden

CAPS Mode (and perhaps with No Default Configuration, but I think that is not mandatory) will set it to CAPS Mode. So, no NAT.

erlinden

In regards to the poolsize:

192.168.0.x - 192.168.88.y

Sure that is what you want?

erlinden

Which of all the packages do I need to download and how do I install it? Thank you As the wAP ac is an ARM device, you can select the Extra Package on ARM, version 7.14.2: https://cdn.mikrotik.com/routeros/7.14.2/all_packages-arm-7.14.2.zip Assuming your wAP ac is currently running this version. Wh...

erlinden

In regards to channel (which handles the...channel): /interface wifi channel add band=5ghz-ax disabled=no frequency=5180-5700 name=5G-80 skip-dfs-channels=10min-cac width=20/40/80mhz-Ceee add band=2ghz-ax disabled=no frequency=2412,2437,2460 name=24G-20 width=20mhz By using the above, the frequency ...

erlinden

The wAP ac does perform best when using the wifi-qcom-ac driver. You can find more information here: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-Overview The driver is part of the Extra packages file that can be found here: https://mikrotik.com/download Once installed, the wifi config has t...

erlinden

The only thing I see is an address list "back-to-home-lan-restricted-peers" that could indicate...something. And that list isn't used. Is the export complete? Or did you perhaps redact it? For your info: I configured Wireguard manually. And by looking at your config I'm surprised it is wor...

erlinden

You should not rebuild with the exact same version string. That causes trouble over and over again.

As mentioned, only when switching between channels you will run into this situation. As a former developer I really like this approach.

erlinden

I'd appreciate it if someone from MikroTik could comment on this. ;-)

I think they have a couple of times (on different releases). Has to do with different builds per channel (test/stable/long term).

erlinden

This part of the documentation should be sufficient:

https://help.mikrotik.com/docs/display/ ... Fi-CAPsMAN:

When interested, only read the part of the wifi-qcom driver beneath.

erlinden

Looks like you have all your radios on the same channel frequency. That is, especially when using the 2.4GHz radio, not the recommended config. Besides, you could also have interference with anything transmitting in the 2.4GHz band. What you can do to improve: Find the best frequency per ap (doing a...

erlinden

By far the easiest (and in my opinion best) way is to add:

 /interface list member
add interface=back-to-home-vpn list=LAN

This way, all wireguard connections are handled as being part of the trusted LAN list.

erlinden

Thanks for the addition, @mkx. You are absolutely right. Only in very specific situations you want to adjust the CAPs coinfig. And this is not such a situation.

erlinden

Can you share your config? Still a bit puzzled by the problem you are running into and what you are trying to accomplish.

erlinden

From what I know and have red:

- cAP ax: reset config and set it in CAPs mode (this is enough)
- CAPsMAN: config datapaths with corresponding VLAN id's

Use a hybrid port with management VLAN untagged, Corporate and Guest tagged.
Don't use VLAN id 1 (implicitly or explicitly), when using VLAN's.

erlinden

Does a computer get an IP address if directly attached to the ISP connection (so without the router in between)?
This way you can test if it is router related or caused by something mentioned above (in the great and complete answer).

erlinden

Is it visible in /IP/ARP ?

erlinden

I would expect a rule on the input chain like this: /ip firewall filter add action=accept chain=input comment="allow WireGuard" dst-port=51820 protocol=udp The above rule allows UDP traffic from any interface on port 51820. The dst-nat rules are, as far as I know, port forwarding rules. Be...

erlinden

What is listening on IP address 192.168.200.1 and what on 192.168.200.11?: Line 458: add action=dst-nat chain=dstnat comment="Wireguard hairpin nat" !connection-bytes !connection-limit !connection-mark !connection-rate !connection-type !content disabled=no !dscp !dst-address dst-address-li...

erlinden

One tutorial to follow:
https://help.mikrotik.com/docs/display/ ... iFiCAPsMAN

erlinden

I'm planning to migrate to new wifi-capsman (qcom-ac package), but read mixed reviews about it (at least for 7.14 - VLANs not working properly (bridge filtering), huge packetloss issues, radios not assigning channels). Not sure if I'm waiting until this has been ironed out. The nice thing is that y...

erlinden

Are the radios transmitting on different channels (preferably 2412, 2437 and/or 2462)? My experience is that the channels are equal when all (my) access points are provisioned at the same time. I'm running an RB4011 in combination with 2x cAP XL ac and 1x wAP ac. The upgrade to the wifi-qcom-ac driv...

erlinden

Backup is only for restoring on the same device. You might want to reset the ax2. Transferring through config can be done (is it a complete export?). Be aware that i.e. the 2.4GHz radio on the ac2 is wifi1, while it is wifi2 on the ax2. And it is in a new menu structure, so better not import it, jus...

erlinden

I can't seem to find this on the documentation. How does it work? How do we configure it? How are the values mapped or parsed internally? Your wish... Maximum link distance in kilometers, needs to be set for long-range outdoor links. The value should reflect the distance to the AP or station that i...

erlinden

Something like this (though not being a rumor)?
https://mikrotik.com/product/netbox_5_ax

Do you require 802.11ax or is 802.11 ac sufficient?
Any other requirements?

erlinden

What does the logging say? Perhaps activate debug logging on wifi!?

erlinden

The solution about doing the tagging in a different way is covered a forum post somewhere

There is actually a help page about this:
https://help.mikrotik.com/docs/display/ ... ionexample:

erlinden

You should always set country code identical on all wireless interfaces.
You might want to remove serial (it's of no use).

Hope this helps.

erlinden

Can't help the change in channel

The additional information is showing that it is using eeeC, so no DFS channels involved.

Can you supply your config information?

/interface/wifi export file=anynameyoulike

erlinden

My guess would be that both tx power and frequency have changed, correct? When selecting a DFS channel *), your device will scan for radar signals. If found, the radio will change its frequency (and tx power accordingly) to comply. You can check the log for radar detected events. *) If your bandwidt...

erlinden

Signal strength of 50 is quiet impossible as far as I know.
Can you share your (/wifi) config on the CAPsMAN?

 /interface/wifi export file=anynameyoulike

erlinden

My experiences are very good with the new driver (cAP ac, cAP XL ac, wAP ac).
In accordance with the benefits mentioned above.

erlinden

I prefer to work with VLAN filtering on the bridge. Please read this great topic befor continuing:
viewtopic.php?t=143620

erlinden

You are missing an important part of making VLAN available on a router: VLAN filtering on the bridge.
Please have a look at this topic, that will help you understand configuring VLAN the right way:
viewtopic.php?t=143620

erlinden

I have configured FT and FT over DS on the security part of the config: /interface wifi security add authentication-types=wpa2-psk connect-priority=0/1 disabled=no ft=yes ft-over-ds=yes group-encryption=ccmp name=[whatever] wps=disable I absolutely dislike steering, it is always up to the client to ...

erlinden

Think your cap isn't a cap at the moment (not 100% sure about the correct syntax):

/interface wireless cap enabled=yes

erlinden

Is it possible to do roaming between asus and mikrotik? If yes then maybe you could use both on different channels.

As long as all security settings (and SSID) are equal, you should be able.

erlinden

Kidcontrol uses simple queues, based upon MAC address.

erlinden

Without checking the config...did you add the VLAN to LAN in the /interface list member?

erlinden

Thanks for investing your time in trying to help me! I appreciate it. I guess you are out of ideas as I am?

Last thing I can think of is setting frequency as well as bandwidth. And then I'm out of ideas.

erlinden

Can you give it a try with fixed channel and bandwidth?

erlinden

I ran into such a situation once when the radio I tried to connect to was running with 40MHz bandwidth (2.4GHz).
Can you supply all information about the radio you want to connect to?

erlinden

Do you have a passphrase configured?
Is this the complete config?

erlinden

Sounds like the problem is somewhere outside of the customers network (IP block?). You can test that by using a VPN on the customers site and see if you can access the website while connected through vpn. So i figured out, that the problem is on the route behind our mikrotik and we cant do anything ...

erlinden

Instead of using the DDNS address, you can just use the peers IP address.
Can you make an overview (diagram) of all devices involved?

erlinden

Why?
Does it have to be fixed, the standard is backward compatible and will be used by older devices.

Band has to do with radio frequency.

erlinden

You should specify the antenna gain to comply with regulations. But to be honest, I wouldn't be to worried about the default antennas...unless you have some sort of problem?

erlinden

In /ip/firewall/connections you can see all connections, just filter on Dst. Address 192.168.88.100 to get the list of Src. Addresses. Still unclear what makes you think your router is part of the hack. Especially because the only log you provide is from the XAMPP server. Can you provide your router...

erlinden

L009 is only nice looking switch. CPU is garbitch.

Garbitch?

Do you mean garbage!?

erlinden

Image?
Like https://images.google.com/ ?

Maybe this question is already answered:
viewtopic.php?t=158281

erlinden

I would expect three datapaths on CAPsMAN, @sinisa (assuming there are two VLAN's involved). On for ac devices and two for ax devices. And you have to do manual VLAN filtering on ac devices (using the wifi-qcom-ac driver), as it doesn't support this through the current driver. The ax devices do supp...

erlinden

When seeing things like this on a cap, I get goosebumps: /ip upnp set enabled=yes I would advise to reset the cap into CAPsMode (see this topic how to: https://forum.mikrotik.com/viewtopic.php?t=148207) and start from there. Next, follow this guide to the letter (as you have done in your config): ht...

erlinden

I would (and have

) choose VLAN.
Especially because my IoT devices are not allowed to access Internet (which is a single line in the firewall).

erlinden

Is the firewall rule hit?
How are you testing?

erlinden

Think on your dst-nat rule you are missing:

in-interface-list=WAN

Besides:
Are you indeed having 2 internet connections?
Why do you have all these IPv6 lines while you are not running IPv6?

erlinden

If you have questions about availablilty, you better contact your distributor.

erlinden

If you're all so annoyed by this, just set up your logging correctly. Perhaps my question wasn't clear: what is Wireguard "giving up" after 20 attempts? Besides...my complete wireguard logging: 10:29:18 wireguard,info WG-Interface: [public key]: Handshake for peer did not complete after 5...

erlinden

WireGuard fix solves an issue where RouterOS was trying to connect to peers which have not been used yet and there is no known endpoint-address. I'm running into the situation that after enabling and disabling RoadWarrior on a client device (where endpoint is not set on the router), the router is s...

erlinden

Probably because there is no changelog on the provided URL, @diamuxin. Also from the browser it results in a 404.

erlinden

The wiki is the v6.x documentation, you better have a look at "help" which is the v7.x equivalent: https://help.mikrotik.com/docs/display/ROS/Netinstall What do you exactly mean by backup? Because a backup can only be restored to the same RouterOS version and device as far as I know. Have ...

erlinden

For ax devices it is sufficient to set the device to CAP (reset with CAPs Mode). No manual settings on the CAP have to be done, unless you want "something" done with VLAN on the ethernet interfaces. The wireless interfaces can be completely managed by CAPsMAN, including VLAN.

erlinden

Don't know if this provides more info: can you activate debug logging?
Have you tried swapping power supply?

erlinden

Put it in a (remote) repository.

erlinden

Is it accessible through VPN?

erlinden

Your wireless interfaces on the CAP aren't part of the bridge, hence it can't be controlled.

Please read this carefully:
https://help.mikrotik.com/docs/display/ ... iFiCAPsMAN

erlinden

Does the switch support VLAN? In that case you can create a "WLAN VLAN" and set a queue on that.

erlinden

Would need to see the config:

/export hide-sensitive file=anynameyoulike

Remove serial and any other private info en post in between code tags by using the </> button.

IP reservations should not be part of the DHCP scope.

erlinden

/interface bridge
add name=bridge-all pvid=100 vlan-filtering=no

Should be:

/interface bridge
add name=bridge-all vlan-filtering=yes

Frame-types should be set on the /interface/bridge/port

erlinden

It would help if you share the config: /export file=anynameyoulike Remove serial and any other private info and post in between code tags by using the </> button. In regards to information: https://forum.mikrotik.com/viewtopic.php?t=143620 (the reference for setting up VLAN on MikroTik) https://help...

erlinden

By default (when resetting a device and setting it into CAPS mode) all interfaces are added on the bridge.
Therefor the interfaces are actually in a switch.

CAPsMAN only manages the wireless interfaces.

erlinden

What is going on?? In my experience it all comes down (or goes up) with good configuration. Had to do some tweaking, enabling debug logging for wireless did provide a lot of useful information (specifically identifying the iPhone 11 having difficulties with both WPA2-PSK and WPA3-PSK enabled). If y...

erlinden

Not sure if isolation has the same function, on the datapath you can set client-isolation on or off.
https://help.mikrotik.com/docs/display/ ... properties

erlinden

Use this absolutely great post and see all connections as trunk ports:

viewtopic.php?t=143620

erlinden

Would be good to have a look at your config:

/export file=anynameyoulike

Going from 6.x to 7.x is a big step. You might want to consider doing netinstall en config manually (or from an export) after.

erlinden

You might be able to route all DNS requests of this device to your specific DNS server: add action=dst-nat chain=dstnat dst-port=53 src-address=[Device IP] protocol=udp to-addresses=[DNS IP] to-ports=53 add action=dst-nat chain=dstnat dst-port=53 src-address=[Device IP] protocol=tcp to-addresses=[DN...

erlinden

Please can you explain a bit more? Why do you want to limit the WAN interface? Like having Gigabit internet speed, but limiting it to 100Mbps? If you want to limit, you can use queues (as you already mentioned). Are simple queues not sufficient? https://help.mikrotik.com/docs/display/ROS/Queues#Queu...

erlinden

Bit hard to tell, you might want to add some relevant information:

Can you post a network diagram, including clients?
Can you share your MikroTik configs:

/export file=anynameyoulike

Remove serial and any other private information and post between code tags by using the </> button.

erlinden

You are missing the fact that ax (as well as wifi-qcom-ac) devices are managed by the new CAPsMAN, that is located on the WiFi menu item. So you are currently not running the new CAPsMAN: /interface/wifi/capsman Here you can find all required information: https://help.mikrotik.com/docs/display/ROS/W...

erlinden

Within the first 5 min of the being online, the device was flooded with "invalid login" attempts across a variety of standard usernames (admin, telecoadmin, root, etc.) This indicates that your logging is working! Is it logged by the default block rule in the input chain, or did you by ch...

erlinden

Can you share the "real" config?

/export file=anynameyoulike

Remove serial and any other private information and post it between code tags by using the </> button.

erlinden

After doing this, the update succeeded. Afterwards I disabled RTSP again.

Why do you have RSTP disabled?

erlinden

Thank you for the advice Erlinder

You are welcome! And please read the link I posted about Wireguard. Then you won't have to do anything (a bit more) complicated (like Zerotier).

erlinden

Swos is very obsolete in my opinion, never got any updates.

You missed this?
viewtopic.php?t=204932

erlinden

Do you have a public (and non CGNAT) IP address? Are you testing from the internal network? Then you might need NAT loopback: https://help.mikrotik.com/docs/display/ROS/NAT#NAT-HairpinNAT My advise: configure Wireguard and use that to administrate the router: https://help.mikrotik.com/docs/display/R...

erlinden

You did not set the second frequency correctly

There are more ways to assign frequencies:

Examples of valid channel.frequency values:

2412
2412,2432,2472
5180-5240:20,5500-5580:20

https://help.mikrotik.com/docs/display/ ... properties

erlinden

From a deny-everything-allow-something, you can remove all drop rules (in the end) except for the last rule (drop everything). This will give the same result, just will have a higher kiss-rate. With that, you can remove all port-scanners rules as well, as they are no longer used. That would bring it...

erlinden

I ran into problems with one client that wasn't able to roam (and some more strange behavour) caused by having both WPA2-PSK and WPA3-PSK.
You might want to give WPA2-PSK only a try.

erlinden

Where is CAPSMAN config on wifi-qcom-ac? In client, there is cap but without interface

CAPsMAN is configured through the WiFi menu on the Remote CAP tab, CAPsMAN button (or /interface/wifi/capsman). It is available since 7.13.x and has nothing to do with the additional package/driver.

erlinden

Activate wireless & debug, that might give sme insights. Turned out my iPhone 11 had difficulties with combined WPA2-PSK and WPA3-PSK. Turned off WPA3-PSK, after that I didn't run into problems anymore. The problem I ran into, was that this phone couldn't roam. Turned out (from the logging) that...

erlinden

In /ip/firewall/connections you can see all connected IP addresses.

erlinden

A simple search:
viewtopic.php?t=178360
viewtopic.php?t=145607
viewtopic.php?t=190598

And you can "purchase" lots of VPN providers:
https://letmegooglethat.com/?q=vpn+providers

erlinden

Do you have different SSID's, @strelokr?
Can you by chance share your config?

/export file=anynameyoulike

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

Set it to US?
https://en.wikipedia.org/wiki/List_of_W ... h/n/ac/ax)

erlinden

You do have to explicitely block inter VLAN traffic (which makes sense).
Better (in my opinion) is doing it the other way around: explicitely accept and block everything else.

erlinden

Besides port 21, you have to forward a range of ports for passive mode. Depends on the FTP server and how that is configured.
But to be honest...FTP is like legacy. Please consider a different approach instead of FTP, or make it available to the outside world through VPN.

erlinden

You are probably referring to Winbox?

Are both Winbox and the app up to date?
What version of RouterOS are you running?
Are you connecting by IP?
Do you have the same issues when you connect by MAC address?
What exact CCR model are you using?

erlinden

For completeness...what RouterOS version are you running?
Are you expecting radar signal occurences?

erlinden

A look at your config might help as well:

/export file=anynameyoulike

Remove serial and any other private information, and post it between code tags by using the </> button

erlinden

Drop the 2.4GHz support on the RB4011 and use the wifi-qcom-ac driver on it as well. Then you can have all the benefits of the driver.

erlinden

please see the attached video. There is no video attached (yet). Could you please share both configs of CAPS and of CAPsMAN? /export file=anynameyoulike Remove serial and any other personal information. If you post the config in between code tags (by using the </> button) it will be more readable.

erlinden

Can you share your config, @mehr463? I have neither seen this error on my environment.

erlinden

When using Winbox you might be able to connect by MAC address.

erlinden

There is a dedicated page on this topic:
https://help.mikrotik.com/docs/display/ ... switchchip

erlinden

The S in CRS stands for switch, you are using a switch as router. It is functionally capable of working as router, but with the lack of routing performance. You could expect around 250Mbps max, according to this (routring, 25 ip filter rules): https://mikrotik.com/product/CRS125-24G-1S-IN#fndtn-test...

erlinden

As you seem to understand the concept of VLAN...why do you use mutliple bridges? I would like to advise you this topic, which gives really great suggestions on VLAN: https://forum.mikrotik.com/viewtopic.php?t=143620 Will continue reading your config for reasons having this problem. Can you add the w...

erlinden

For real measurements you better test with iPerf instead of (any other) speedtest.

erlinden

If you use Windows, install Winbox (if you haven't yet) and connect through it by MAC address (find it in neighborhood. Otherwise, consider resetting to default by using the reset button as explained here: https://help.mikrotik.com/docs/display/ROS/Reset+Button Enjoy MT, you'll love it once you unde...

erlinden

If I use the rest API extensively for getting stats etc, the user list gets spammed with active users.

Looks like you are using a new connection for every request. Is the list cleared after some time?

erlinden

Either reset it (https://help.mikrotik.com/docs/display/ROS/Reset+Button) or Netinstall it (https://help.mikrotik.com/docs/display/ROS/Netinstall)

erlinden

Follow it by the letter:
https://help.mikrotik.com/docs/display/ROS/Netinstall

erlinden

YES YOU CAN!

https://help.mikrotik.com/docs/display/ROS/WiFi

cAP ac can be run with wifi-qcom-ac driver and does support the latest bennefits.
You really want to read the above link carefully, there are some manual steps to take.

erlinden

I hava had lots of problems when using detect internet, you might want to disable it (set all interfaces to none) en try again:
https://help.mikrotik.com/docs/display/ ... t+Internet

erlinden

How did the hapax2_em get all these settings? Just reset with no default and set it to CAPS Mode (haven't tested it): /system reset-configuration caps-mode=yes Or by pressing the reset button: https://help.mikrotik.com/docs/display/ROS/Reset+Button And indeed, use RSTP: https://help.mikrotik.com/doc...

erlinden

And while we are at it: upgrade to wifi-qcom-ac driver, which is available from RouterOS v7.13.x and up. Consider 7.14 which is better working (for me).

erlinden

Three options: /interface wifi, version 7.13.x and higher /interface wifiwave2, version 7.x up to 7.12.x /caps-man, version 6.x and 7.x legacy https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-WiFiCAPsMAN https://help.mikrotik.com/docs/pages/viewpage.action?pageId=46759946#WifiWave2(7.12andolder)...

erlinden

Is there a sticker on the bottom containing the password?

erlinden

I presume wAP ac is an arm version not mipsbe...

Yes

Was the wifi-qcom-ac package used?

Yes

How much HDD space was left free on cAP XL ac and wAP ac after the upgrade?

cAP XL ac: 372 KiB
wAP ac: 356 KiB

This according to /system/resources

erlinden

cAP XL ac and wAP ac upgraded (from 7.13.4) without problems (besides my RB4011).
Only had to suppress Wireguard logging.

erlinden

I have wAP ac's running perfectly fine on two different locations. Used the reset-default with CAPS-Mode and afterwards did some magic to support VLAN's and multiple SSID's. Came from version 7.13.2 and upgraded to 7.13.3 and 7.13.4. Any steps from this help page that you didn't do? https://help.mik...

erlinden

Is the wAP ac a mipsbe or a arm device? Only the latter is supported.

erlinden

Something like:

add action=accept chain=forward comment="Kids access to server" out-interface=LAN_VLAN dst-address=[IP single server]

You can add protocol or port as well, now the complete server is reachable.

erlinden

Interestingly...there is no drop filter rule on the forward chain that logs...
Port 80 and 443 seems to be standard web browsing?

erlinden

What devices do you use?
What width is reported in on the WiFi tab in WiFi?

erlinden

What are you looking for? They're both default/delivered and in CAPsMAN mode.

I'm looking for the answer to your question, just like you.

erlinden

Read my previous posts. The cAP AX is GONE. It's now a hAP ax2 and ax3.

You are right!

Okay, can you please share configs of both the hAP ax2 and ax3?

erlinden

I've posted my WiFi configuration numerous times, but okay, here we go again (removed serial #, etc.):

Werte talking about the cAP AX, not the CAPsMAN.

Can you please share the config of the cAP ax? And have you checked the log on it?

erlinden

https://help.mikrotik.com/docs/display/ ... +Balancing (if using RouterOS V7.x)
https://wiki.mikrotik.com/wiki/Load_Balancing (if using RouterOS V6.x)

erlinden

Can you please share your config? Really curious if there is anything that could give a hint.

erlinden

I don't see that behavior, @herbrico. Looking at the changelog I would not expect differences. Do you have anything configured related to the changelog?

erlinden

It shows ax/Ceee in the screenshots.

Indeed, and if I read correctly, the screenshot is of the combination hAP ax2 and hAP ax3.

erlinden

Any thoughts on why this issue is happening? Can you please share the config of the cAP ax? And have you checked the log on it? And can you check if there is a passphrase? This is missing in the posted configs, but I assume removed on purpose...? In your case I would netinstall the cAP ax, and perf...

erlinden

A complete config would be better, can you do a complete export and remove serial (also in your opening post) and any other private information.

erlinden

Then it is probably the Wireguard settings. At least I see the allowed-address in the peer is set to /24, this should be /32. The client-address can be left empty. Did you follow this guide? https://help.mikrotik.com/docs/display/ROS/WireGuard#WireGuard-RoadWarriorWireGuardtunnel Can you also share ...

erlinden

Just add log=yes to the filter rule on the input chain.

At least, when you see the counter increasing.

erlinden

Zou je dit: /ip firewall filter add action=accept chain=input dst-address=192.168.1.254 dst-port=57981 protocol=udp /interface list member add comment=defconf disabled=yes interface=ether1 list=WAN kunnen veranderen naar: /ip firewall filter add action=accept chain=input in-interface-list=WAN dst-po...

erlinden

@holvoetn already gave a good direction, to make it more explicit: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-Overview (where you can read about wifi-qcom-ac which is necessary for the cAP XL ac) https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-WiFiCAPsMAN (things you have to take into...

erlinden

I am pretty sure that is the case.

erlinden

Instead of using multiple bridges, you can also (better) use VLAN. It will make your life so much easier! If you want to solve it with the current config, please share it: /export file=anynameyoulike Remove serial and any other private info and post in between code tags by using the </> button.

erlinden

I think this is the central topic:
viewtopic.php?t=45934

erlinden

Assuming you are not using CAPsMAN, you can follow this great tutorial. Basically, you will add VLAN filtering on the bridge of the cAP ax and assign VLAN ID on the bridge ports: https://forum.mikrotik.com/viewtopic.php?t=143620 If you connect a computer to the same network cable (as the cAP ax is c...

erlinden

I added connect-priority 0/1 to get rid of the SA Query timeout. Did you set it?
This setting can be found in /interface/wifi/security/

erlinden

I would like to suggest starting from a clean situation: remove all /interface/wifi entries and reset the CAP to CAPS Mode. Especially when there are leftovers. Why don't the AX interfaces show up in the bridge/port list? any connection to Because they shouldn't, you should however see the interface...

erlinden

Thanks all, did learn something thanks to you.
I chose RSTP and set priority. Still not sure what edge ports (though I can think of something) are and what can be changed in my config.

As the network won't be (more) complicated then it is currently, I'll keep RSTP active.

erlinden

Don't add the CAP interfaces to the bridge manually, binding is done through datapath.

Have a look at this basic tutorial with CAPsMAN and VLAN:
https://help.mikrotik.com/docs/display/ ... ionexample:

erlinden

Obivously you don't have to use the wifi provided by the router. Seems (to me) that there is not many requests for wifiless routers in that price range.

erlinden

The first thing I notice is that "configuration=Kitchen2AX_valhall", while it is not a configuration. Your naming convention is doomed to be a mess: use unique names, i.e. Kitchen5AX_IOT_cfg and IOT_sec After having another look...mmm, seems you copiy/paste randomly...is this really an exp...

erlinden

Can you share the WiFi settings of the CAPsMAN:

/interface/wifi/ export

Or even better a complete export of the device running CAPsMAN:

/export file=anynameyoulike

Remove serial and any other private information.

erlinden

My settings are a bit different, your range is incorrect: /interface wifi access-list add action=accept allow-signal-out-of-range=10s disabled=no signal-range=-90..0 add action=reject allow-signal-out-of-range=10s disabled=no signal-range=-120..-91 Anything above -90 is accepted, anything below reje...

erlinden

From the basic configuration is See these differences: /interface/wifi set wifi1 disabled=no configuration.country=Latvia configuration.ssid=MikroTik security.authentication-types=wpa2-psk,wpa3-psk security.passphrase=8-63_characters set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-ca...

erlinden

Can you post you config?

/export file=anynameyoulike

Make sure to remove serial and any other private information.

erlinden

I think you are looking for a reverse proxy, as far as I know MikroTik doesn't offer that functionality out-of-the-box.
Perhaps run Traefik in a container?

erlinden

I red a lot about using Spanning Tree Protocol and found that it is recommended to use RSTP when using hAP ax2 and hAP ax3. If the CAP is hAP ax2 or hAP ax3, it is strongly recommended to enable RSTP in the bridge configuration, on the CAP configuration.manager should only be set on the CAP device i...

erlinden

I am not aware of any downsides of having 10m lease time. But I am not a professional. If memory serves me well Apple devices had some issues with that. I have the whole house running on that XE3-4. I turned the 6Ghz Radio back into a 5GHZ radio. But capacity in and around the house takes full adva...

erlinden

You might want to consider adding wireguard to the LAN interface-list. That is by far the fastest solution. But that is something you might need to consider.

erlinden

Not everyone has the same experience when it comes to MikroTik WiFi. I have had Cisco, Ubiquiti and Grandstream and recently I returned to MikroTik. The family is happy, and thus so am I. Rockstable, using the wifi-qcom-ac driver. But again, that is just me...

erlinden

An Endpoint (combination IP address and port) is unique, hence you can only forward a port once. To options to handle this situation: different IP address different port As the port is fixed (by Steam), only a second public IP address would solve this problem. Can your provider supply you multiple I...

erlinden

So you want to say, that when I upgrade a system, it doesn‘t upgrade everything… and I have to do the comlicated part myself? Assuming this remark is for me: The upgrade will do just the upgrade and "nothing changes". No complications. When you consider using the wifi-qcom-ac driver (i.e....

erlinden

You are very welcome, glad it is working!

erlinden

There is a dedicated page for this switch: https://help.mikrotik.com/docs/pages/viewpage.action?pageId=103841836 Think (can't see your current config yet) that you used VLAN filtering on the bridge, but to get better performance you should do it on the switch. Whether the VLAN's can communicate to e...

erlinden

ax devices use the new CAPsMAN (which can be found in the WiFi menu on the RB-3011):
https://help.mikrotik.com/docs/display/ROS/WiFi

erlinden

Usually wifi1 is 2.4GHz, wifi2 is usually 5GHz

In the old days, ax devices are the other way around

erlinden

Make sure that, from a default cofig, wifi2 is not part of the bridge. And make it part of the WAN interface list. At last, bind the DHCP client to wifi2 and you should be good to go. If you are going to add a virtual interface to make 2.4GHz available as well, make sure to set it to ap and add it t...

erlinden

Ah...you are using the old CAPsMAN, that is helpfull information. Follow this information for the CAPsMAN part (and leave the slave part out): https://help.mikrotik.com/docs/pages/viewpage.action?pageId=1409149#APController(CAPsMAN)-Basicconfigurationwithmasterandslaveinterface /caps-man security ad...

erlinden

Besides answering (all) (my) questions, are you please willing to share your config of all devices involved?

/export file=anynameyoulike

erlinden

You need at least 1 configuration. But it depends:

What exact device(s) will you be using as CAP?
What RouterOS version will you be running?
How many SSID's will you use?
Are VLAN's involved?
Do you want to set the frequency per radio manually or do you prefer to have it auto selected?

erlinden

Have you tried by MAC Address, @ormandj? Haven't seen this in my environment (RB4011/hAP ax2/hEX S/cAP ac/cAP XL ac/wAP ac)

erlinden

For most problems it is necessary to get insights on the config, all config related to the problem (which can be complete configs of all devices). By providing this information, discussions can be left out. I assume you still want some help? Your hardware is more than capable to handle the speeds yo...

erlinden

What do you thing about CCR1009-7G-1C-1S+ ?? i could get it for cheap. It is suitable for even 2.5 gbps connection? It's the same for any model, just check test results which are available here: https://mikrotik.com/product/CCR1009-7G-1C-1Splus#fndtn-testresults Check the specs --> TEST Results for...

erlinden

rpki-verify RPKI is not working and must be a bug in the firmware. Can someone please check?

https://mikrotik.com/support

erlinden

Can you provide all relevant information: RouterOS version Standalone or CAPsMAN Config of the cAP ac /export file=anynameyoulike Remove serial and any other private info and post the output between code tags by using the </> button Because you are using the cAP ac, you are able to use the new wifi-...

erlinden

Something like what is discussed in this post?
viewtopic.php?t=194320

erlinden

Glad I could help you...I found the answer on this forum as well

erlinden

To have it working, I had to set connect-priority (0/1) as well. That was for an ac-only setup, perhaps you will benefit from it as well...?
Do you see SA Query Timeouts in the logging?

erlinden

Restore of a backup can only be performed on identical devices: https://help.mikrotik.com/docs/display/ROS/Backup Better to do an export of the config and import that line by line: https://help.mikrotik.com/docs/display/ROS/Configuration+Management For netinstall it is necessary to follow the manual...

erlinden

Anyway, I'm sure someone will be along soon to say it's your config etc........... How do you know his config is correct. There are not a lot of topics where, after sharing the config, there are no improvements to make on the config. @kurio: As far as I know the client will always use the same MAC ...

erlinden

The C stands for Control channel and every C or e (or X) is 20MHz bandwidth. In case of Ceee and channel 5500: 5490-5570 used frequencies, where the control channel is frequency 5500. In case of eCee and channel 5520: 5490-5570 used frequencies, where the control channel is frequency 5520. A tool li...

erlinden

Remove current wifi configuration and start again.

And perhaps you can share your current config:

/interface/wifi/ export file=anynameyoulike

erlinden

If you want to have some documentation on VLAN, please read this post:
viewtopic.php?t=143620

erlinden

Mmm...not to fond of your firewall: Can you please order them: first input then forward chain? Am I correct that you don't want anything accessing your router (except for ICMP)? The longer I look... ...well, just go back to defaults and add VLAN's to the correct interface list. Currently it is a tot...

erlinden

Please, community tell me do I understand VLAN correctly: - Will such configuration work? Sure - Will VLAN 88 clients have winbox access to router via IP 192.168.88.1 address ? Depends on your firewall (that is totally missing in your post) - Will wireless IoT devices "untaggly" connected...

erlinden

What is the problem and how i can improve the 5ghz performance?

Would be helpfull to:

see the configuration
know at what rate the client is connected
how the network speedtest is performed

erlinden

Greetings from the Netherlands

erlinden

But now the CAP does not send the data anymore to the GuestBridge, so it does not get an GuestLAN IP address, will i get forced now to use VLAN ID in the whole network instead? What a joy, you finaly have a good reason for properly configuring your network! Although also in the old world using VLAN...

erlinden

Please share the config:

/export file=anynameyoulike

Remove serial and any other private info and post in between code tags by using the </> button.

erlinden

Just checked on my CAPsMAN, don't see any counter on both /interface and /interface/wifi.
Running 7.13.2 together with wifi-qcom-ac driver and cAP XL ac and wAP ac.

erlinden

You are not the first with this question, hence my advice to search on the forum befor starting a post.
Here is a great tutorial on VLAN's:

viewtopic.php?t=143620

erlinden

Assuming the Schneider devices have network interfaces and they are connected to different ethernet ports on the MikroTik: you should add all interfaces to the bridge, currently only ether1 is part of the bridge. Something like: /interface bridge port add bridge=bridge1 interface=wlan1 internal-path...

Search found 2050 matches