MikroTik

erlinden

/interface ethernet switch vlan
add independent-learning=yes ports=ether1,switch1-cpu switch=switch1 vlan-id=90
add independent-learning=yes ports=ether2,ether3,ether4,ether5,switch1-cpu switch=switch1 vlan-id=100

Sure the independent-learning is required?

erlinden

Sure, just add a firewall filter rule on the forward chain.

erlinden

Did you add a route?
https://help.mikrotik.com/docs/display/ ... figuration

erlinden

Last step you could take befor RMA-ing it is using netinstall to do a fresh install.

erlinden

Nothing in the config explaining this behavior? Like a fixed linkspeed?

erlinden

What is the purpose of having a single VLAN?
Have you seen this "Bible of VLAN":
viewtopic.php?t=143620

erlinden

erlinden

How often do you power off your device?
For me, power interruption is pretty critical.

erlinden

Have you tried using a different browser (and/or in-private mode)?
What device are you referring to?

erlinden

The amount of services you make avaiable publically is a bit worrying. Both through port forward but also on the router itself. Chances are that devices becomes (or already is) compromised...big red flag. I.e.: add action=accept chain=input dst-port=11337 protocol=tcp add action=accept chain=input d...

erlinden

security setting are WPA/WPA2/WPA3

Why not leave it open?

Have you tried with WPA2-PSK only? And is the bandwidth set to 20MHz. And preferably frequency set to: 2412, 2437 or 2462?

erlinden

It's a real headache at times, isn't it?

Learning is...

erlinden

Can you share the config for that?

/export file=anynameyoulike

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

Not, as far as I know.
Though giving a lot of options, you don't have to use them...

erlinden

The NAT rule is the main thing as a catch-all queries, if this shouldn't work, why does it work? Because the client is using 1) DNS servers supplied through DHCP or 2) public DNS servers that are intercepted by the rules. As soon as the client uses DoH or DoT (as @pe1chl mentioned), the requests ar...

erlinden

Appart from using ether5 instead of wlan5 (typo?), indeed all you have to do is:

/interface bridge port
add bridge=bridge1 interface=ether5 pvid=10

# optional

/interface bridge vlan 
add bridge=BR1 tagged=bridge1 untagged=ether5 vlan-ids=10

erlinden

This shouldn't happen, as you understand. Did you change from 192.168.88.x to 192.168.0.x? Did you change on 3 locations: /ip address /ip dhcp-server network /ip pool Can you share your config after changing the subnet? /export hide-sensitive file=anynameyoulike Remove serial and any other private i...

erlinden

Have you tried/are you familiair with netinstall?
https://help.mikrotik.com/docs/display/ROS/Netinstall

erlinden

I really hope this doesn't mean I once again have to set up everything from scratch.

Pretty sure you created an export, just in case this happens!? Especially after previous event...

erlinden

It helps when you speak out your doubts. If the current setup is working for you...leave it as it is. If the SSID per accesspoint is intended...leave it as it is. If there is anything you want to change, explain. I.e. roaming has some requirements; single SSID (and security and same subnet) is one o...

erlinden

Sure...go ahead.

Like: share config:

/export file=anynameyoulike

Remove the serial and any other private info.

You did read the documentation?
https://help.mikrotik.com/docs/display/ ... ionexample:

erlinden

Wpa-psk is not safe, betternot iuse it (opr use no encryption at all.
Probably (my best guess) is the 40MHz bandwidth, the entire bandwidth of 2.4GHz band is...40MHz. Not sure if that is configured in the CAPsMAN...Reconsider using encryption and bandwidth.

erlinden

GOTO:
viewtopic.php?p=1099690#p1099690

erlinden

Wall mounted cAP AX running 7.17beta2, didn't bother getting of the couch to get any closer to the accesspoint(which will improve speed). Configured very basic with CAPsMAN. As client I'm using the Intel(R) Wi-Fi 6 AX200 using driver version 23.70.2.3. https://1drv.ms/i/s!AqxQT9uqCMGovOdPYVfk7Y5q9G9...

erlinden

Config is far from complete, hence vey difficult to advice.

In the documentation is a lot of information. I would start without VLAN and add that later.
https://help.mikrotik.com/docs/display/ ... iFiCAPsMAN

erlinden

Before importing the backup script, have you made sure that the device is reset with "No Default Configuration" is checked and wifi devices are enabled? You can also do the config with the script file line by line through terminal. At least you get feedback on where the script file is fail...

erlinden

Basically three approaches:

- use external DNS server with this functionality
- use internal DNS server with this functionality
- use AdList *)

*) https://help.mikrotik.com/docs/display/ ... DNS-Adlist

erlinden

Got it running, besides from working (as expected) I really like the Auth Type and Band in Wifi Registration!

erlinden

I have been playing with Mikrotik OS since 2005.

And after 19 years you decided to create an account just to post this message...sure.

erlinden

Funny you missed i.e. this video:
https://www.youtube.com/watch?v=bHotZT41w3E

erlinden

I think that everything and more is possible by using CAPsMAN. Any specific doubts you have?

erlinden

I absolutely love Winbox 4, have it running on both Windows and Debian!

erlinden

Sooo many questions, so little information.

Please provide network diagram, purpose of the VPN and an export of the current config:

/export file=anynameyoulike

Remove serial and any other private info, post in between code tags by using the </> button.

erlinden

Good find! You are very welcome, enjoy it!

erlinden

Anything in the log that might be of help? I.e. enough free disk space?

erlinden

Can have someone any solution for this?

Do you have VLAN ID 1 configured?
Anything in the logging?
Or better, share your config?

/export file=anynameyoulike

Remove serial and any other private info.

I have the same MikroTik and this didn't happen for me.

erlinden

The reboot is not necessary for implementing CAPsMAN, it's just for clean up purposes.
Do you still have the config of the hAP ac2? Then it would be sufficient to just import the /interface wifi part of that device (ewxcepot for any local config).

erlinden

Aaah...sorry it took me this long :oops: :oops: :oops: You have the wireless package installed and are configuring the old CAPsMAN: /caps-man Remove the wireless package, it's useless. Then, follow the guide: #create a security profile /interface wifi security add authentication-types=wpa3-psk name=...

erlinden

By disabling the accept rule is disabled (and it is no longer accepting traffic). Instead, enable it and remove the in-interface. Again...just for testing. You can enable logging to see which traffic is passing that rule.

erlinden

You are absolutely right, @mkx!

Checked everything (I could), I doubt if this rule is correct:

add action=accept chain=input comment="admin access" in-interface=Bridge-LAN \
    src-address=192.168.0.0/24

Can you, at least as a test, remove the in-interface?

erlinden

add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" disabled=yes \
    dst-address=127.0.0.1

Sure this has to be disabled?

erlinden

Then I think the IP configuration of the switch is incorrect. Doesn't explain why devices connected to the switch don't receive IP addresses. Have you already asked on the Unifi forum? Update The IP assignment is done through reservation (static lease). Hence the misinterpretation. On what port is t...

erlinden

Can the controller be reached from anywhere other in the network? It could be a route that is missing, could also be a misconfigured gateway on the switch. And what controller are the accesspoints configured to?

erlinden

This is a Unifi thing, set the controller IP address fixed through CLI:

set-inform http://[IP address of controller]:8080/inform

Your firewall rules have changed, order is a bit messed up and the forward chain is not complete. Please reconsider the current rules.

erlinden

Do you set the Unifi Controller address manually on the switch (or is it supplied through DHCP)? Does any other device get an IP address from the RB4011 (when directly connected to the RB)? Do you use VLAN's? Can you share the RB's config /expoort file=anynameyoulike Remove serial and any other priv...

erlinden

All my static leases for other Mikrotik devices got messed up after update to 7.16.

Have you set fixed Admin MAC Address on the bridge for these devices?

For me, upgrade went well on all devices (coming from either 7.16 RC5 or 7.15.3):
RB4011
hEX S
hAP AX 2
cAP AX
cAP XL ac
wAP ac

erlinden

Depends on the wifi driver you are using:

wifi-qcom(-ac)
/interface/wifi/registration-table/

wifiwave2
/interface/wifiwave2/registration-table/

wireless
/interface/wireless/registration-table/

All can be accessed through menu items and cli.

erlinden

On your forward chain (in pseudo code):

allow access to specific site (by IP address?) for single device (by fixed IP address?).
drop everything else

erlinden

So you want to forward the remote users to a stand alone Wireguard server?

erlinden

My best guess would be a security policy of some kind. Would that be possible? Have you tried asking support?

erlinden

You should bind the DHCP servers to each VLAN's interface (/interface vlan) instead of binding it to the bridge.

Can you share your config?

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

What OS are you using, @Hakens? I assume Windows, as you are referring to taskmanager. Is it shown on the taskbar? Where is the executable located? Have you tried removing it and afterwards, download it again (and start it from the Downloads folder)? I ran into the (different) problem that the windo...

erlinden

On port level you have three options: Per port you have three options: - Trunk (where all VLAN ID's will be tagged) - Accessport (where one VLAN ID will be untagged) - Hybrid (which is a combi of trunk and access) Here you find some more info and examples: https://help.mikrotik.com/docs/display/ROS/...

erlinden

- .encryption=ccmp,gcmp,ccmp-256,gcmp-256. Is this something WinBox sets? Or is this on purpose? I found that @normis gave this as advice: 2) in "configuration" tab add one config template, that is all you need. don't enter anything else except SSID name and wireless password (select WPA2...

erlinden

Perhaps the interfaces are disabled?

erlinden

Intervlan communication can be blocked on a router. By default it will be accepted.
What router are you using?

Please consider not using VLAN ID 1, better assign a VLAN ID explicitely (except for ID 1).

erlinden

Same iPhone, upgraded to iOS 18; nothing changed with WiFi on ax^3.

Then it might be helpfull to share your (wireless) config

/interface wifi export

Remove serial and any other private info.

erlinden

Does the TV get an IP address? Is the light of the port on?

The config would be helpfull:

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

I remember some Apple devices (at least in the past) could have issues with mixed languages on APs within the same SSID domain.

What do you mean with mixed languages?

erlinden

Have you added the wireguard interface to the LAN interface list?
Made any changes to the firewall (forward chain)?

erlinden

If you are referring to CAPsMAN forwarding mode, you are correct. From the documentation: "WifiWave2 CAPsMAN only passes wireless configuration to the CAP, all forwarding decisions are left to the CAP itself - there is no CAPsMAN forwarding mode." and "WiFi CAPsMAN only passes wireles...

erlinden

I have had lots of problems when setting encryption to everything except TKIP (Android and Windows). Can you give it a try (assuming you use Winbox) by unselecting everything, and collaps the encryption part?

erlinden

Can someone point me to instructions for enabling wireless debug logging?

/system logging rules
Add Topics :debug & wireless, Actions: memory.

That's it.

Can you share the wireless part of the config? Just to check current settings.

erlinden

Make an export if possible, that will help you reconfigure after netinstall.

erlinden

Use fixed channels and lower their transmission power on the 2.4GHz radios .
Second best, add reselect-interval to let the radios periodically scan for best frequencies.

erlinden

The keys are useless in regards to the problem, but very usefull for unethical stuff.

erlinden

Decrease to a max of 4 SSID's per radio.

erlinden

No problem:

Use /system scheduler for the scheduling part and /sysstem/script for enabling/disabling the wifi interface.

erlinden

Without a doubt...use the wifi-qcom-ac driver. I have zero problems with Android and FT (as well as WPA3, I just disabled WPA3 for the time being). It all comes to configuration, you might want to give us the opportunity to help you get it to work. /export show-sensitive file=anynameyoulike Remove s...

erlinden

Thanks for this post! I switched my hybrid ports to trunk ports on all devices (router/switches/accesspoints). Ran into the problem that from time to time management IP addresses were assigned to mobile devices. Hope this improves my situation.

erlinden

Could it be roaming related? Do you have RSTP configured?

erlinden

One VLAN? What is the purpose of having a single VLAN?
Can you share the config?

/export file=anynameyoulike

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

Running both 5GHz radios on the same frequency is terrible for roaming. As well your 2.4GHz radios might transmit on the same frquency...

Next, accesslist rules I prefer to order as filter rules: specify what is accepted, block (reject) what isn't on the end of the chain.

erlinden

Get the export:

/export file=anynameyoulike

Remove serial and any other private info, post in between code tags by using the </> button.

erlinden

The things I noticed is that you have two bridges, please remove bridge1-Public, it serves no purpose. Are you sure you want to have all ports on the same bridge? Could there be a loop in the network? Could you provide a network diagram? My first guess would be introducing spanning tree protocol: ht...

erlinden

Can you share the config, just to rule out anything on that part?

/export file=anynameyoulike

Remove serial and any other private info and post in between code tags by using the </> button.

erlinden

You might want to change this: add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN into: add action=accept chain=input comment="allow access from LAN" in-interface-list=LAN add action=accept chain=input comment="DNS from VLAN&qu...

erlinden

Any reason why you are not using 10.172.12.0/23 ?

erlinden

I would use CAPsMAN, that will give you the option to manage the network with one device. There are some thing to make it work great: Use latest stable, currently 7.15.3 Install wifi-qcom-ac on the hAP ac3 (instead of wireless package) Set the cAP ax into CAPS Mode Resources on this topic: https://m...

erlinden

Perhaps having a DHCP scope consisting of a single IP address can do this for you? Bind the DHCP server to this interface (port) and set a short lease time.

erlinden

There is only one correct CAPsMAN version managing ax (wifi-qom) devices. This is part of RouterOS version 7.13 and up.
No need to install anything additional (like wifi-qcom-ac or wireless) for having CAPsMAN.

erlinden

Very good combination, the wifi-qcom-ac is only beneficial if you need wireless on your hAP ac3. Otherwise, @infabo mentioned, you can uninstall it.

erlinden

If I recall correctly however, ping (ICMP) is allowed inbound by default. I prefer to block this via firewall rule.

Actually, ICMP traffic is accepted. It is used for more then ping only.

erlinden

I have found this: /interface bridge vlan add bridge=bridge comment=Gasten tagged=bridge vlan-ids=30 add bridge=bridge comment=IOT tagged=bridge vlan-ids=20 I would expect to see VLAN filtering on the port(s) as well. Currently the VLAN config is incomplete. Is there a trunk/hybrid port to the switc...

erlinden

For feedback or help, the config is required:

/export file=anynameyoulike

Remove serial and any other private info.

There is no option to run wired? Wireless backhaul is consuming a lot (at least halve) of your wireless bandwidth.

erlinden

If you run the wifi-qcom-ac package on the cAP ac (instead of the wireless package) you should be fine. Here you can find the documentation: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-CAPsMAN-CAPsimpleconfigurationexample: Could you add the ouput of this command as well? /interface/wifi ex...

erlinden

I would like to advise you to reset the CAP to CAPS Mode:
https://help.mikrotik.com/docs/display/UM/cAP+XL+ac

erlinden

This explenation, which is part of the official MikroTik documentation, will explain exactely how to configure this setup:
https://help.mikrotik.com/docs/display/ ... uardtunnel

erlinden

Can you share the config?

/export file=anynameyoulike

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

Can you share the config:

/export file=anynameyoulike

Remove serial and post between code tags by using the </> button.

Also, here is a great reference when it comes to VLAN:
viewtopic.php?t=143620

erlinden

If no VLAN's are involved, the D-Link will do just fine (assuming it has gigabit ports). The cAP ac does handle the wifi-qcom-ac pretty well (in my experience), though I red someone having out of memory problems (therefor a daily reboot was introduced). Haven't seen that problem myself (uptime over ...

erlinden

Can someone help?

Depends on how you want it to work exactly. Fyi, legacy supports CAPsMAN forwarding, wifi-qcom(-ac) doesn't.

erlinden

And how can i disable the port for everyone else

Add a drop rule on the forward chain that drops everything else:

add action=drop chain=forward

Make sure this rule is at the end of your rules.

I prefer the "allow specific traffic and drop everything else" way of thinking.

erlinden

Allow on Source Address List, with dst port 587, protocol 6 (tcp), on the forward chain. This should be sufficient information...

erlinden

Now I see...you don't want to have your IP address of the accesspoint in the same range as the office IP. Normally (I assumed because of the VLAN ID) you would have a management VLAN where you do the IP assignement of all hardware involved. To get it to work you can set the BAS_VLAN to ID 100. Not s...

erlinden

Looks like MGT and CORP VLAN are messed up. I.e. the different network ranges are incorrect. Start with a basic setup and follow the topic by the letter. Then make changes as desired.

In regards to no access, are you using Winbox? Does it show up on discovery?

erlinden

Here is some knwoledge dump:
https://help.mikrotik.com/docs/pages/vi ... d=56459266

erlinden

Did you follow this wiki step by step?
https://wiki.mikrotik.com/wiki/Manual:Netinstall

As far as I know all ax devices are v7. Any reason for wanting to run v6?

erlinden

Gentlemen, what is the difference between firmware V6 and V7, which is better?

better?

erlinden

Yes, I know. And I'll tell my corporate laptop it should disconnect more often

erlinden

If you post an export of your config, we can have a look:

/export file=anynameyoulike

Post the content here without serial and any other private info en place it in between code tags by using the </> button.

erlinden

Would be beneficial if all people with problems share their config (at least the /interface/wifi part) to validate settings. Additional tip: when going up and down in versions you might run into some strange problems. Actually, I did...hence some steps that might be of use. I would advise (in case y...

erlinden

And in addition to @holvoetn complete answer: when upgrading through CAPsMAN, all packages are required (and installed). Manual upgrade is, as far as I know, the only way to miss packages.

erlinden

Could it be a cache problem? Have you tried using an InPrivate session?

erlinden

Removing and adding the slave interfaces did the trick...working as expected and befor.
Will stick to MikroTik longer.

erlinden

It is indeed, hence you should install the wireless-7.xx.x-mipsbe.npk package (which is located in the \MIPSBE\Extra packages file.

erlinden

I did configure it with VLAN on the bridge, and the HOME network is working perfectly with VLAN ID 50, GUEST on VLAN ID 51 isn't (actually, it created interfaces dynamically with VLAN ID 1 for the GUEST network, hence there were MGT VLAN IP addresses assigned, as that is the untagged VLAN on eth0 of...

erlinden

Thanks as well, @mkx. Really appreciate your help! This is my current config: /interface bridge add admin-mac=xxxxxxxxxxxx auto-mac=no name=bridge-lan /interface ethernet set [ find default-name=ether1 ] name=ether1-trunk set [ find default-name=ether2 ] name=ether2-camera-rechts set [ find default-...

erlinden

Ok, I have adjusted as you configured it and removed the learning part.
Will monitor if this is of any help...thanks!

erlinden

The default rules are enough for protection. Because your picture is no showing (better post /ip/firewall export), it is hard to say what you did. And I'm not going to read some website.

erlinden

The only thing I see in your config that jumps out at me is the independent-learning value.

Thanks gotsprings !

Another difference I notice is that you have switch1-cpu added to all your /interface ethernet switch vlan
May I ask what is the purpose of that?

erlinden

Can you please add the requirements (apart from being outside and handling 20 caravans)?

erlinden

Bringing this topic back to live. I made all the adjustments to get rid of the VLAN ID = 1 necessity. All is working well, except for wireless and VLAN. For some reason I see in ARP and DHCP (leases) that wireless clients do sometimes get both IP addresses from the HOME or Guest VLAN AND the MGT VLA...

erlinden

This could very well be a user problem. Could you share the switch's config?

/export file=anynameyoulike

Remove serial and any other private info and place in between code tags by using the </> button.

erlinden

Your life would be much easier if you choose to go VLAN all the way. Lots of (correct) and great examples can be found in this topic: https://forum.mikrotik.com/viewtopic.php?t=143620 In regards to the firewall, you could consider allowing explicitely and dropping everything else. Just make sure tha...

erlinden

Sorry for missing the link. And thanks @jadaz!

The explanation of any setting can be found here:
https://help.mikrotik.com/docs/display/ROS/WiFi

erlinden

Keepalive should be set on the "client" peer (as well as the is-responder).

erlinden

From the documentation: is-responder (yes | no; Default: no) Specifies if peer is intended to be connection initiator or only responder. Should be used on WireGuard devices that are used as "servers" for other devices as clients to connect to. Otherwise router will all repeatedly try to co...

erlinden

If a wired conneciton is fast, then it is not related to the routing part of the router. I also notice that the 2.4GHz radio is broadcasting on channels 1, 3 and 6. In an ideal world (funny in the 2.4GHz context) you would only use channels 1, 6 and 11. Might want to configure frequencies 2412, 2437...

erlinden

Not only that, but the new capsman is not compatible with the older one. So if you have older devices and you buy a new one, you are SOL. Bit harsh, there are two paths you can walk in this use case: - if only ARM devices involved, upgrade them with the wifi-qcom-ac driver. - it is possible to run ...

erlinden

Can you add both the logging and the config?

/export file=anynameyoulike

Remove serial and any other private info, post in between code tags by using the </> button.

erlinden

You have to come up with your requirements first. If you are aiming for 99.99% uptime, there might be better solutions.
I can tell you it is working perfectly for me, and that might give you the impression it is perfect for you too. But again, only you can tell.

erlinden

So, "down a couple of times" during a period of years can be considered acceptable, right?

Is it acceptable to you? That is all that matters.

erlinden

Have been using it for years. Setup is very easy (checkbox), I noticed that the service has been down a couple of times.

erlinden

You would need to implement VLAN filtering on the bridge.
If you read this topic, you can find the AccessPoint.rsc which contains an example. In this example, all wifi interfaces are VLAN filtered, you just have to make the guest wifi interfaces so called "access ports".

erlinden

It depends, especially as these requirements are far from complete.

And where does the maximum number of accesspoints come from?
Why are you assigned with this task?
What is the budget?

Choosing hardware is the least difficult part of this job.

erlinden

Well, then start by describing the issue you need to resolve first.

The topic name might give an indication

But agreed, both problem description and the requirements are very welcome!

erlinden

Some feedback requires insights into the config:

/export file=anynameyoulike

Remove serial and any other private info and post here inbtween code tags by using the </> button.

erlinden

A topic which is really going to help you:
viewtopic.php?t=143620

erlinden

Giving this a go! Disabled it on 5Ghz interface and switched back from WPA2/3 to WPA/WPA2.

Why use WPA (when you can use open)?

erlinden

Better (best?) idea is using VLAN's. Please read this great topic to get loads of informations and examples:
viewtopic.php?t=143620

erlinden

Because the frequency isn't set, it could take up to 10 minutes until the 5GHz radio is broadcasting.
You can set the frequency to 5180 (channel 36) manually to avoid this situation.

Does the log give any info?
At what frequency is the radio broadcasting?

erlinden

How do I enable the capsman server on one of the AX2? I dont see a Capman option to enable it and set certificate options.

https://help.mikrotik.com/docs/display/ ... ionexample:

erlinden

Yeah...or misconfigured. You make it a bit challenging coming up with a reason with the little info you provide.
Can you post:

/export file=annameyoulike

Remove serial and any other private info.

erlinden

As I mentioned in the article above, I really don't understand it very well, but maybe I can write the config details here as soon as possible and get ideas from you. Thank you.

Sure, no problem. It would be really great to have the config of the cAP ac as well, just to compare.

erlinden

What makes you think it is better and what makes you think it is not. Might be interesting to lower transmission power to get better performance.

erlinden

Then it would be interesting to see your complete config:

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Standalone AP or using CAPsMan?

CAPsMAN:

RB4011, 2x RB960 (v6.49.13), 1x Powerbox Pro (v6.49.13), 2x cAP AX, 1x wAP ac

erlinden

I ran into a problem with VLAN's: wireless clients got MGT VLAN addresses assigned as well as HOME VLAN addresses. Found out from looking at the DHCP leases and IP ARP entries. After downgrading to 7.15.3 the problem was solved.

Yes, all information was supplied to support.

erlinden

Don't use VLAN ID = 1 explicitely /interface vlan add comment="Core infrastructure/Management VLAN" interface=Bridge name=VLAN1 vlan-id=1 add comment="Servers' VLAN" interface=Bridge name=VLAN250 vlan-id=250 Also, I'm missing VLAN 3249 as part of the /interface vlan (while it is ...

erlinden

By using hybrid ports to the CAPs, one can leave them in defaults CAPS Mode. Only identity can be adjusted (if wanted).

erlinden

Indeed, just replace the existing executable with the new one.

erlinden

Winbox can be downloaded on the download page:
https://mikrotik.com/download

https://mt.lv/winbox64 (64 bit)
https://mt.lv/winbox (32 bit)

erlinden

One disadvantage of this config, @neki, is that you have to manually adjust the CAPs (as they expect to be able to reach the CAPsMAN untagged by default).
As far as I know, you can't enable bridge VLAN filtering on ax devices. Only on ac devices, using the wifi-qcom-ac driver, this is supported.

erlinden

From v7.13.x you get the "new" CAPsMAN (capable of managing ax devices) "for free". It is added in the menu under wifi. The documentation will give you some more insights: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-WiFiCAPsMAN The "old" CAPsMAN is part of the ...

erlinden

Downgrade is nearly as easy as upgrading: you have to manually copy the (current) packages to the router en press the downgrade button.
As always, make a complete export (/export file=anynameyoulike) that can be restored any time.

erlinden

Bit of an assumption: connect everything to the MikroTik and you will be fine.
If not (possible), make a small network diagram including all clients.

erlinden

Here you can find the official documentation including an example:
https://help.mikrotik.com/docs/display/ ... uardtunnel

erlinden

Then I found out you have to install QCOM package. So might try updating again.

The disadvantage of upgrading manually is that you could miss an additional package.
You can add it later any time, just add package.

When upgrading automatically, this won't happen.

erlinden

It isn't...at least, it shouldn't be.
Please test with iPerf to get better insights on the wireless speed. Using speedtest does include a lot of (possible) influencing factors.

To get best performance, please consider using the wifi-qcom-ac driver.

erlinden

Might be a cashing thingy...have you tried reinstalling winbox?
What RouterOS and what Winbox version are you using?

erlinden

Are you using RouterOS or SwOS?
Can you share the config of the switch?

Could there be any queue active on the port (or VLAN)?

erlinden

Looks like your CAPsMAN has some errors: /interface wifi provisioning add action=create-dynamic-enabled disabled=no master-configuration=*4 \ slave-configurations=*3 supported-bands=5ghz-ac add action=create-dynamic-enabled disabled=yes identity-regexp=.*AC.* \ master-configuration=*3 name-format=2G...

erlinden

A complete export of /ip/firewall would be very helpfull. Even better...a complete export:

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

The wireless interfaces look disabled, can you enable them?

erlinden

Happy to hear, you can mark your topic as solved. Will probably give me some karma points

erlinden

If the IPS is blocking the ports , and even if you play with 443 that will not help to establish connections. Not sure why is that,

Are you stating that on the same port and with same protocol OpenVPN will work while Wireguard does (sometimes) not?

erlinden

Have you checked the log?

erlinden

Incorrect cpu architecture? Bit more info would be usefull...

erlinden

You can add "fast transition", which should make it more easy for clients to roam: /interface wifi security add authentication-types=wpa2-psk ft=yes ft-over-ds=yes name=JUJUMAESIN-SEC passphrase=[whatever you use] What signal does the client have when connected to the CAP instead of the ro...

erlinden

Signal is okay! Frequency was my mistake, please try eiher 5180 or leave it empty (for automatic selection). The latter will choose based on a scan.

erlinden

Did you follow this guide to the letter?
https://help.mikrotik.com/docs/display/ ... forWindows

erlinden

Seems a bit low(er) than possible. What is the signal value?
Could you change frequency to 5120 (channel 36)?
Did you perform a frequency scan? Any other wifi networks that could be interferring?

erlinden

If that is the device you test with...yes.
This information can be found either on /interface/wifi/registration (are you using Winbox?) or on the laptop (are you using Windows?).

erlinden

I have found out several topics as well in cookbook, but it seems that it will be not for my setup, so I have to read and find something else.

Here in the documentation you can find it:
https://help.mikrotik.com/docs/display/ ... %22package:

erlinden

Can you post at what connection rate the client is connected?

erlinden

Can you set local-forwarding to true:

/caps-man datapath
add bridge=bridge-guest name=guest local-forwarding=yes

erlinden

Within days/weeks the wAP AX will be introduced. Which, if I understood correct, will be smaller.

Accorindg to @Normis:

wAP ax will be a very small device and is coming very very soon (question of days or weeks)

erlinden

wAP ax will be a very small device and is coming very very soon (question of days or weeks)

erlinden

The new CAPsMAN does only support wifi-qcom and wifi-qcom-ac devices. The latter is supported on ac devices, using the ARM processor. Unfortunately, the RB951 is a MIPSBE device, hence you can't find it. If you want it to be managed by your switch, you have to add the wireless package and run two in...

erlinden

Set extension-channel to either Ce (40MHz) or Ceee (80MHz) on the 5GHz radio to get higher conenction rates. You might as well let the CAPsMAN (actually the CAP) choose a channel itself, as is configured on the hAP ac3.

erlinden

Why did you set bandwidth to 20MHz on the 5GHz radio? This will probably make a huge difference, when set to 80MHz (Ceee). No need to set VLAN ID 1 on the datapath. Instead of using "2412,2422,2432,2442,2462", you better use 2412,2437,2462 for non overlapping channels. When setting transmi...

erlinden

Please elaborate , why are you asking this question on a other vendors forum? Seems to me this is a good question for the UBI forum (or perhaps you already asked there?). Or just join the MikroTik community (as I did) and get proper support. 8) I would expect that the Windows Unifi Controller/Docker...

erlinden

Well... Start by removing this radio MAC address: /interface wifi provisioning add action=create-enabled common-name-regexp="" disabled=no identity-regexp=\ "" master-configuration=config_internal_users radio-mac=00:00:00:00:00:00 \ slave-configurations=config_guests This will pr...

erlinden

English translation (thanks to Google): Hello, I want to make a foreach based on a list of IPs to check if they are assigned in the dhcp and take action to be positive No answers here...you might get some (paid) support here: https://mikrotik.com/consultants OR What have you done so far. What is wor...

erlinden

Can you share the config?

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Can you show exactely what IP addresses should be available for DHCP? You are aware that you can configure multiple pools? In addition, can you please share your (relevant part of the) config: /export hide-sensitive file=anynameyoulike Remove serial and any other private info and post here between c...

erlinden

Do you have examples on what changes you have made that weren't provisioned?

erlinden

Have you changed the IP pool? This is where you define the IP addresses that are available.

erlinden

Could you also show the provisioning?
https://help.mikrotik.com/docs/display/ ... ovisioning

erlinden

First step, forget Quickset (except for initial config...but then, still forget it). Do it manually, you will get so much more options (besides the knowledge you gain). As soon as I change anything in Winbox, the configuration is gone, I have to repeat everything over and over. This shouldn't be the...

erlinden

Are you refering to the part where this switch is (ab)used as router?

erlinden

Just follow this help page: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-WiFiCAPsMAN My tips: - use fixed channels for the 5GHz channels, 40MHz bandwidth (by creating a config/provision rule per CAPS filtered by MAC address) - when not using EAP, use wpa2-psk only with CCMP (only) as encrypt...

erlinden

Can you show the config as well?

/export file=anynameyoulike

Remove serial and any other private info en post between code tags by using the </> button.

erlinden

Can you give it a try with:

WPA2-PSK (only) and CCMP (as encryption)?

erlinden

Really would like to have a peek at your config:

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Are you running the CAP's in default CAPS Mode? Are the CAP's connected to a hybrid port (where MGT VLAN is untagged)? Would you be willing to share your config?

Thanks!

erlinden

I agree except I ran into the problem that clients also received MGT VLAN IP addresses when connecting with a wifi-qcom-ac CAP. Then I started over following the CAPsMAN VLAN description in the help pages (https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample:). Th...

erlinden

For me it works when adding VLAN ID 1 on the switch.

erlinden

Can you post the ouput of:

/ip/upnp print
/ip/upnp/interfaces print

erlinden

When using CAPsMAN you can push upgrades. Set package-path and place the packages in that path.
See here:

https://www.youtube.com/watch?v=1Ct6aJXTE5g

erlinden

Yes!

erlinden

Can you change this rule, where the to port is the default Winbox port?

And change this rule in the firewall as well:

/ip firewall filter
add action=accept chain=input dst-port=8291 in-interface=ether1 protocol=tcp

erlinden

Something like CAPsMAN (for Wifi) or Dude (for complete environment)?

erlinden

Yes it is behind NAT and does not have a public IP address.

Did you do port forwarding on the NAT device as well?

erlinden

I would prefer through VPN over making a service available publically.
Is your MT behind NAT, or does it have a publically available IP address?
Who removed all filter rules that are part of the default?

erlinden

If you can't access it after a reset (sure the credentials are correct?) and it won't go into CAPS Mode, you could consider to perform a netinstall:
https://help.mikrotik.com/docs/display/ROS/Netinstall

erlinden

As the wireguard interface isn't part of the LAN interface list AND doesn't have an accept rule on the input chain, it is blocked (hence you can't ping it). You can test this by either adding an additional rule: /ip firewall filter add action=accept chain=input comment="defconf: accept ICMP&quo...

erlinden

Enable logging on the drop rule to get insights why this rule isn't working.

I would expect the double quotes are the problem.

erlinden

These are the default firewall rules, with some irrelevant ones removed. :? If you want this device to work as router, you want a masquerade rule. But there is a lot more that is missing. If you want to have it working as switch, please read this great topic: https://forum.mikrotik.com/viewtopic.ph...

Search found 2478 matches