MikroTik

erlinden

You can do better, @gotsprings. Unless I missed something?

Anything to share so we can help you out?

erlinden

I'm seeing this on the hAP ax3, can confirm that latest beta doesn't fix. If MikroTik support thinks I could help in some way, I ask them to please contact me. Create supout file and share with support. Meanwhile, please feel free to share your config to have a sanity check on it: /export file=anyn...

erlinden

It's a bit odd, different behaviour. You might even want to consider using the 7.18beta release for testing purposes. Also, on your CAPsMAN VLAN filtering is missing on the bridge. If you want to know more about VLAN and MikroTik, have a look at this topic: https://forum.mikrotik.com/viewtopic.php?t...

erlinden

Has anyone observed that as well?

I upgraded, having installed all v7.17 beta's and rc's before, to 7.18beta2 and all clients keep on working without a glitch.
Can you provide some more info?

erlinden

For seamless roaming, at least over more than one accesspoint, CAPsMAN is required. Once you understand it, you are going to love it!

erlinden

Thanks for the additional information, @holvoetn. And I fully agree on what you are saying, actually I was trying to say the same. I was referring to this part: /interface bridge add admin-mac=D4:01:C3:0E:D8:E5 auto-mac=no name=bridge-lan /interface vlan add interface=bridge-lan name=bridge-vlan70-c...

erlinden

AFAIK, for the VLAN interface (and it's attached DHCP Client), VLAN filtering should be enabled.

erlinden

Why isn't VLAN filtering enabled on the bridge of the hAP AX?

erlinden

Think there are some issues with your config, specifically VLAN related. I prefer to use explicit VLAN's and try to avoid VLAN 1 where ever I can. I used this nice topic to let me be inspired: https://forum.mikrotik.com/viewtopic.php?p=1103942 Be aware that setting the correct VLAN on a wifi interfa...

erlinden

Just to be sure, this is the only device suffering?

Can you please share all (and complete) configs of all devices? So both CAPsMAN and CAPs?
And don't forget to remove serial.

erlinden

any suggestions on how to configure STP on capsman and caps?

Why?

It seems that the signal is really bad...how come? Disconnectiong with a signal of -90dB isn't strange at all.
Can the device (what is it?) be tested in the -40 to -60 range of the CAP?

erlinden

Can you explain how you want this switch to work? I see some VLAN's, ether1 being part of a bridge and having it's own IP, multiple bridges...doesn't make much sense to me (I have to admit not having experience with ospf).

erlinden

In the web page scenario surely it requires the IP to access it? but why can't i ping it?

You tell me...is the firewall blocking ICMP traffic?
Can you share the config?

/export file=anynameyoukike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

@npeca75, can you share their configs for sanity checking?

erlinden

For accessing the router (through any protocol) from a pc, a working connection (wired or wireless) is necessary.
Can you elaborate what you are saying?

erlinden

I'll be honest, the config is a mess. Hence I agree with @anav for either getting the knowledge yourself (training) or externally (consultant): https://forum.mikrotik.com/viewtopic.php?p=1120094#p1120094 The community (at least me) is more than willing to help. But you have to have some basic knowle...

erlinden

Not sure what memory is used for adlist, but you might want to decrease its size:
/ip dns cache-size

What is it currently set to? Default is 2048.

erlinden

From the config:

/ip address
add address=172.18.224.5/22 comment=defconf interface=bridge network=\
    172.18.224.0
add address=172.18.224.5/22 interface=ether1 network=172.18.224.0

You set identical IP addresses on ether1 and bridge.

But that is really not your biggest problem here.

erlinden

Have you tried admin/admin and admin/[empty] as well?
Any (more) luck using telnet/ssh/web (not sure if these are available out of the box)?

Last resort is (always) netinstall:
https://help.mikrotik.com/docs/spaces/R ... Netinstall

erlinden

Sounds like a common scenario, strange it doesn't roam yet.
Can you share your config?

Haven't seen it yet, you should be using CAPsMAN to get this to work seamlessly.

erlinden

Agree with @massinia (hence I suggested to remove encryption settings).
Hope this makes things better for you. Keep us posted.

erlinden

Could you do these steps (at least for testing purposes):

Remove encryption settings (leaving it to ccmp as default)
Remove wpa3-psk
Reboot all CAP's
Remove wifi network from client and add it again (and check if that improved anything?)

erlinden

Sure there is no firewall on the machine blocking?

It helps reading all remarks and questions posting. Glad it is working now.
Hope you can fix your firewall on the MikroTik as well.

erlinden

For the CRS112 it is important to configure the switch chip instead of the bridge. Otherwise all traffic will be passed through the CPU. Therefore, please share the config (in a new topic) to validate current config. When running into problems, create a supout file and send it to support: https://he...

erlinden

Can you please add the config from a working cAP as well?
Is CAPsMAN (don't ask Anav about this option) considered in this environment?

erlinden

Please show adjusted config and logging.
As well, add RouterOS and firmware version.

erlinden

If you want the accesspoints to be bridges, why are they configured as router?

erlinden

What is correct then?

Depends: what is "correct"? What kind of logging are you expecting?

erlinden

No longer needed. From your config, remove: /ip route add distance=1 dst-address=192.168.0.254/32 gateway=192.168.0.1 After that, reboot the router (if possible) to make sure all caches are emptied. Consider restoring default firewall rules and adding a dstnat rule for port forwarding. This together...

erlinden

I'm trying to access it via IP address, so, http://192.168.0.254:8096

Is it accessable on the computer itself (hosting Jellyfin)?
Sure the service is running?
Sure there is no firewall on the machine blocking?

What does netstat -na | find "8096" return on the Jellyfish host?

erlinden

No need to do anything about routing 192.168.0.0, no routing involved. So, no routes and no firewall changes (default filter rules are better).

Are you approaching the server through IP or name?
UPnP is evil,

, please don't enable if unless you know what it is for (and then also don't).

erlinden

At least the config seems necessary: /export file=anynameyoulike Remove serial and any other private info, post between code tags by using the </> button. Is the Jellyfin Server in a different network segment? Then your problem isn't the MikroTik. As far as the internet says The Internet is wrong, a...

erlinden

Can you share a config from one cAP? Just to be sure...
Anything in between the CCR and the cAP that could cause this problem?

erlinden

Could this device been compromised?
Was it a backup of the identical (or same) device?

I would netinstall the device (don't forget both packages):
https://help.mikrotik.com/docs/spaces/R ... Netinstall

erlinden

You might want to open a new topic, @BobA. There you can supply your config and get some more feedback. As well, you can request for support. Did you also upgrade firmware besides RouterOS?

erlinden

What is the difference to access list where I can also set VlanID and passphrase for each individual client (mac address) too ? At home I'm using a single SSID and, depending on the passphrase (I'm using a passphrase for home and a different passphrase for guest), the VLAN is assigned. As I underst...

erlinden

Set FT Preserve VLAN ID to No.

erlinden

Quick scan: /interface bridge vlan add bridge=bridge1 tagged=bridge1,ether1,vlan10,vlan20,vlan30 vlan-ids=10,20,30 Should be: /interface bridge vlan add bridge=bridge1 tagged=bridge1, vlan-ids=10,20,30 Only tagged ports should be added. This can be removed: # Allow User1 (VLAN10) to access devices b...

erlinden

Just to be sure, better not use static IP addresses, instead work with staic leases (where clients use DHCP client).
If the topic is answered, please feel free to mark it as solved.

erlinden

Are you also going to blame car manufacturers if the owner puts in water in the tank ?

Depends on where you life I think, Europe isn't that bad.

Let's remain a bit logical and practical, shall we ?

erlinden

To have roaming working for all devices, I had to add connect-priority=0/1 on security besides ft=yes and ft-over-ds=yes. @nclmrc, you are missing country on the guest network. I think it doesn't matter as it is the slave config, but still... And antenna-gain is incorrect (and shouldn't be used at a...

erlinden

Again: non-issue.

It would actually be an issue if netisntall would have to be performed through any other port then WAN.
What I do agree on is that any device connected to any port on the Routerboard is a potential thread.

erlinden

I think you forgot to "attach" your IP pool to the DHCP server: /ip dhcp-server add interface=lan lease-time=12h name=dhcp1 /ip pool add name=dhcp_pool ranges=192.168.1.2-192.168.1.254 Should be: /ip dhcp-server add address-pool=dhcp_pool interface=lan lease-time=12h name=dhcp1 /ip pool ad...

erlinden

Glad it works, please feel free to mark this topic as solved

erlinden

Bigger isn't always better...necessity of higher TX Power is an indication that you don't have enough accesspoints.

erlinden

All is currently handled by the CPU, while you should have VLAN filtering handled by the switch chip. Something like this should work: /interface bridge add name=bridge1 protocol-mode=none /interface wireless security-profiles set [ find default=yes ] supplicant-identity=PoE-RTR-1 /interface bridge ...

erlinden

Here is all relevant documentation on how to configure: https://help.mikrotik.com/docs/spaces/ROS/pages/15302988/Switch+Chip+Features#SwitchChipFeatures-SetupExamples Make sure you read all comments on the QCA8337, because it has some exceptions. Can you share the current config? /export file=anynam...

erlinden

Nowhere in the documentation does it say that the upgrade is done automatically. It doesn't work for me unless I put the packages in the "Packge path" folder. Here the text can be improved, as "suggests" seems to either "tried" or "performed". In regards to t...

erlinden

How do I stop my cap from auto updating when I update my router? /interface/wifi/capsman/upgrade-policy none - do not perform upgrade require-same-version - CAPsMAN suggests to upgrade the CAP RouterOS version and, if it fails it will not provision the CAP. (Manual provision is still possible) sugg...

erlinden

If I understand you correct, you want a (so called) hybrid port.
Please read this great topic about all kind of ports (access/hybrid/trunk):
viewtopic.php?t=143620

Only limitation afaik is you can't do both tagged and untagged of the same VLAN ID.

erlinden

Please show your config (of all involved devices):

/export file=anynameyoulike

Next, please supply all RouterOS and firmware versions of all involved devices.

No reason to install wifi-qcom on the CCR, CAPsMAN is available from the main package (since 7.13.x).

erlinden

There are a couple of items I was not expecting in the config: /interface ethernet set [ find default-name=ether1 ] comment="Input" set [ find default-name=ether5 ] comment="Output" /interface list add comment=defconf name=WAN add comment=defconf name=LAN /ip neighbor discovery-s...

erlinden

Is this a copy-paste thing (I'm not familiar with this country)? /caps-man configuration add channel=WLAN50 country="germany 5.8 ap" datapath=datapath1 distance=\ dynamic installation=outdoor max-sta-count=250 mode=ap name=cfg50 \ security=security ssid=SSID Can you also post the config of...

erlinden

Can you please share the config of both CAPsMAN and a working CAP? /export file=anynameyouwish Remove serial and any other info and post between code tags by using the </> button. If the CAPs has default CAP config, you could consider resetting the non working CAP's: https://help.mikrotik.com/docs/s...

erlinden

Block both 53 and 853, both UDP and TCP. Be aware that DoH won't be blocked this way (but probably most IoT devices will only perform "normal" DNS requests). In addition, you could also redirect all outbound DNS requests to your router DNS server (where you have to replace the IP address b...

erlinden

The Cap (RBcAPL-2nD) is managed through the old CAPsMAN, while cAP AX is managed through the latest version. Therefor, you will have to run both versions (the latter is available when you upgrade the CAPsMAN device to 7.13.x or above). Alternatively you can configure the cAP AX manually (instead of ...

erlinden

What do you mean by stencils, are you referring to item templates that can be used with Visio?
The first hit I got on stencils is this:
https://en.wikipedia.org/wiki/Stencil

erlinden

Something isn't working while importing the old config. Hard to say what it is.
You could reset the new device (what exact device do you use) without default config and then import the old config (which device was that).

It should work (at least, DHCP leases are exportable and importable.

erlinden

You have limited Tx power on 2.4GHz channel quite a lot - how to improve it? Just remove (max) tx-power. /interface wifi security add disabled=no name=xxxxxx Sure you want an open wifi network? Could you give this a try: /interface wifi configuration add name=cfg2 country=Poland mode=ap ssid=Wifi c...

erlinden

Ok, anything we can help you with?

erlinden

It wasn't like that on the old Asus, when I connect an access point I don't have this problem, so it's 100% Mikrotik's fault. Often, the real problem is between the chair and the computer 8) If you want it solved, please share your current config so we can check the curren configuration: /export fi...

erlinden

Glad it worked out, you can mark this topic as solved.

erlinden

Can you please share your (wifi) config:

/interface wifi export file=anynameyoulike

Remove any private info, post between code tags by using the </> button

erlinden

Just to be clear, you are not using them as paperweights?

To be honest...they are absolutely terrible...as paperweights

erlinden

Would you be so kind to share that with us, @lmeira? Perhaps an export of the relevant part?
I currently use PPSK, but am looking for a more future proof solution (that supports WPA3 as well).

erlinden

Good job, this will help a lot of people. Very nice to use trunk ports, also on the CAP's! Some suggestions: Place all code parts between code tags, by using the </> button Supply the (config) rsc files as attachments to have a complete example (like used in https://forum.mikrotik.com/viewtopic.php?...

erlinden

Can you give this a try:

/ip firewall raw
add action=drop chain=prerouting disabled=yes dst-port=80 protocol=tcp tls-host=!*diretta*
add action=drop chain=prerouting disabled=yes dst-port=443 protocol=tcp tls-host=!*diretta*

erlinden

This way, you have to make sure that there is no configuration on the new device (/system, reset configuration, no default config).
If you want to have a clue what is happening, copy the rsc file line by line and paste it into a terminal.
Make sure there are no MAC addresses in the commands.

erlinden

I see you have multiple VPN servers enabled, with what VPN server are you connected? To be able to access your local network, you should have an accept rule in the forward chain for this. Do you have access to the router itself (ping while VPN server is up)? Any asterisk in an export is an indicatio...

erlinden

Instead of re-implement PiHole you could have a look at AdList:
https://help.mikrotik.com/docs/spaces/R ... DNS-Adlist

Made me remove all my PiHole/AdGuard instances.

erlinden

Same issue on a CCR2116, GPON SFP makes the health monitoring fail after some time...

Did you create a support ticket for this?
https://mikrotik.com/support

erlinden

When using VLAN's, you should create an /interface/vlan for management purposes. And...the bridge should not have an IP address when using VLAN filtering. My best guess is that it does, but that would require the config for confirmation. Don't know if you are familiar with this great topic: https://...

erlinden

But as I understand it, this mode is not compatible with wpa3-psk? Is there any example of how it is used? You are correct. But I don't mind not using wpa3-psk at the moment. I followed the instructions in this topic (though there isn't any CAPsMAN configuration), it is not really hard. Be aware th...

erlinden

As the documentation states, you can always downgrade. But not below factory installed version.
What does /system/resource/print show?

erlinden

Or, to replace RB2011 with newer router maybe?
Would L009UiGS-2HaxD-IN be a good alternative to my RB2011UiAS-2HnD-IN?

As it misses 5GHz (as far as it is required?), I would prefer hAP AX3 personally.
But it depends on requirements. Sure you will do just fine

erlinden

This weekend I setup CAPsMAN using PPSK (which is part of the security settings: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-SecurityProperties) and I absolutely love it! I had a guest network, configured OWE (https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiF...

erlinden

RB2011 is wireless (driver) only Therefor, you can't install any other driver. If you want to have it manage the cAP AX, you have to upgrade to at least RouterOS version 7.13.x and up. But, as @holvoetn mentioned, you won't really benefit from it as you have to do the settings twice (wireless and w...

erlinden

(Seamless) roaming requires identical SSID, password, encryption and network segments. It would make sense to use CAPsMAN for having roaming available in the best way (at least for the MikroTiks). What made you choose to have different SSID's? Have you enabled DHCP debug logging? This might give som...

erlinden

RB2011 is wireless (driver) only, while cAP AX is wifi-qcom (driver) only. If you want to manage the cAP AX from the RB2011, you need to upgrade the latter to 7.13.x (or above, current stable is 7.16.2). Then you need to run both the old CAPsMAN (for wireless) and the new CAPsMAN (for wifi-qcom, whi...

erlinden

Mixing different security profiles (while having the equal SSID) could give a problem. Can you start by setting both security profiles identical, so wpa2-psk only (and aes as you already did).
Also, 802.11 k/r/v are not supported on the old wireless driver, so it makes no sense to activate it.

erlinden

There is documentation:
https://help.mikrotik.com/docs/spaces/R ... Parameters

If I may ask: why ZeroTier?

erlinden

Because of this rule, all incoming tcp traffic to port 443 is answered by the router: add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp The input chain is used for traffic to the router, the forward chain for traffice between networks (like WAN and LAN). Next thi...

erlinden

In terminal, execute:

/export file=anynameyoulike

This will produce a text file (rsc extension) containing most of the config.
Download it, edit it (remove serial and any other private info) and post here between code tags by using the </> button.

erlinden

Yes they are in ROS v7 (where IPv6 is not optional any more). And yes they are if ipv6 optional package in v6 is installed and enabled when ROS config is reset to factory default. Wasn't aware of this... TS: Can you reboot whatever is in front of the Audience and perform another test again? And sup...

erlinden

It is not (completely) default config. I.e. the IPv6 rules are not there by default. No problem... As mentioned, the overlap could cause strange behavior (if there is a client using .253 as well). Can you check DHCP leases? Do you see any errors/retries on the WAN interface? Could you perform a spee...

erlinden

I wonder why it is to hard for MT to write the fundamental things clear in their help-documentation... I know not all possible situations and scenarios are described, but basic things like opening ports you can find here: https://help.mikrotik.com/docs/spaces/ROS/pages/250708066/Firewall Why are su...

erlinden

At first sight it looks like a nearly default config. Just a few NAT rules and the fasttrack rule as first rule. Is this rule hit? What is the cpu usage while performing a test? Have you performed a test when connected directly wired to the Audience? What does the speed test exactly consist of? Spee...

erlinden

Instead of setting antenna gain (which is fixed), set tx-power (which is part of the configuration). The first option is a hack (in my opinion), while the latter is how you should do it. The correct documentation reference: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-Property...

erlinden

Please share your current config, otherwise this will remain a riddle:

From terminal (or SSH):

/export file=anynameyoulike

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

Half (give or take) actually. 2.4GHz band (for anything newer than 802.11B) is 70MHz wide (in NA and related parts of universe) or 80MHz wide (elsewhere) ... and 2462/n/eC channel is 40MHz wide. Yeah yeah, I know. There is more bandwidth. Let me try it in a different way: Frequency 2462, Control ch...

erlinden

I have a hap ac2(AP mode) with wifi-qcom-ac connected wirelessly(2.4gHz) to another hap ac2(station bridge mode) every several days it goes through a period of connection disconnection cycle (up to 15 minutes) for no apparent reason signal is between -70 and -74, reason code 1 is given on station b...

erlinden

Does this mean I will have 2 CAPsMAN configurations on the router? Correct One under Wifi (new AX devices) and one under Wireless (for old AC devices)? Isn't there a CAPsMAN menu item? For the old CAPsMAN. I see both menus on the router (without running wifi-qcom-ac package on the router). Should I...

erlinden

The problem doesn't occur only with Intel network cards.

I think he didn't mention that, he just informed us about an updated Intel driver that seems to give him better stability.

erlinden

You don't, CAPsMAN is automatically installed with version 7.13.x and up. It has moved, can be configured on /interface wifi (or the wifi menu item). Here is a link to the official documentation: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-WiFiCAPsMAN And...if you don't use t...

erlinden

/interface wifi configuration add channel.band=2ghz-ax .skip-dfs-channels=10min-cac .width=20/40mhz country=Portugal datapath=data-main disabled=no mode=ap name=cfg-2-main-ax security=security-main security.authentication-types=wpa2-psk .encryption=ccmp .ft=yes .ft-over-ds=yes ssid=Wifi@Casinha add...

erlinden

Still could help to have a look at that topic.

What IP address do you have on the client when managing this routerboard? Is it in the same network segment as where the routers mgt IP is in?

erlinden

You currently have your ap configured as router, what would you like it to be and how would you like it to work?
If you want to know more about VLAN, have a look at this great topic:
viewtopic.php?t=143620

erlinden

TLDR, this doesn't really answer my question.. are there supposed to be hits on DST NAT rules for traffic that is not permitted by the FW?

It depends on the order of rules, if the rule I mentioned is above the others you mentioned it makes perfect sense.
But you would have to answer that.

erlinden

Can you share your complete firewall filter rules?
You don't have this default rule?

/ip/firewall/filter/
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN

Besides this...why would you want to open port 22?

erlinden

Why introduce bridge1? There are many reasons not to have multiple bridges.
But if necessary to have an additional bridge, can you set interface for DHCP-client to bridge1?

erlinden

Without a config it will be very hard to say something, can you therefor share both configs:

/export file=anynameyoulike

Remover serial and any other private info and share between code tags by using the </> button.

erlinden

The WAN port definitely is not part of the bridge. It's sfp-sfplus1 and its by itself.

Indeed, sfp1 is not the same as sfp-plus1...

erlinden

You are making it hard for us as well... Can you please provide the config of the CRS326? /export file=anynameyoulike Remove serial and any other private info and post the result between code tags by using the </> button. Next, please describe all ports of the Dell switch (tagged/untagged/bonded/etc).

erlinden

Looks like you have triple NAT-ting, if the Edgerouter is an additional device. In the end, the CRS is not a router, though it can be configured as a router. But performance will be very poor. Can you supply us with a networkdiagram that also contains the VLAN's? Can you also have a look at my remar...

erlinden

Start from scratch and keep it DRY (Don't repeat yourself): /interface wifi configuration add name=conf2 country=Denmark mode=ap ssid=My_Mgmt_2 channel=chan2 add name=conf5 country=Denmark mode=ap ssid=My_Mgmt_5 channel=chan5 /interface wifi channel add name=chan2 skip-dfs-channels=10min-cac band=2g...

erlinden

Also, clients won't connect to 127.0.0.1 as DNS server, remove that IP from /ip dhcp-server network: /ip dhcp-server network add address=80.144.1.0/24 comment="Network for VLAN600" dns-server=100.48.48.1,127.0.0.1,8.8.8.8 gateway=80.144.1.1 netmask=24 add address=80.144.10.0/24 comment=&qu...

erlinden

/ip dns set allow-remote-requests=yes cache-size=4096KiB max-concurrent-queries=200 max-udp-packet-size=8192 servers=127.0.0.1,31.22.13.211 By setting 127.0.01. you are referring the router to itself, and that is incorrect. Just remove it and leave 31.22.13.211: /ip dns set allow-remote-requests=ye...

erlinden

/interface wifi configuration add channel=channel24 country=Sweden disabled=no mode=ap multicast-enhance=enabled name=cfg24 security=sec24 security.connect-priority=0 .ft=no .ft-over-ds=yes ssid=\ Topp14 steering.rrm=no .wpm=no I prefer to keep things DRY: all security settings can (and should) be ...

erlinden

Anyway - I will update my ticket and revert.

/interface wifi export please (to make sure all is fine).

erlinden

Kid control is not really intuitive, can you explain functionally when users are allowed and when not? Have you followed the example from the documentation: https://help.mikrotik.com/docs/spaces/ROS/pages/129531911/Kid+Control#KidControl-Applicationexample Are you sure the routers firewall rules are...

erlinden

Error message says it clearly.

Oops...

erlinden

Can you try a different power supply? Or is it powered through PoE, @qwertykolea?

erlinden

Here is the part in the documentation mentioning this:
https://help.mikrotik.com/docs/spaces/R ... i-Overview

erlinden

Thanks @Marvitex, new functionality makes perfect sense.
Afaik MikroTik upgraded the Qualcom(?) driver, which seems to have influence for some users (for me only more logging is profided but no problems with stability).

erlinden

What kind of CAPs are you using, @pekulse? Did you upgrade firmware as well as RouterOS?
I have better experience with 7.17RC than 7.16.x.

Did the clients get a (error) message?

erlinden

I agree, except for this part: 2. open port for DNS in firewall /ip/firewall/filter add action=accept protocol=udp port=53 Apart from a missing chain, you don't want to provide access to your DNS server from the internet. And there is a default rule in place that implicitely provides access to the r...

erlinden

Not sure (haven't tried it), but it sounds like something you should be able to do with VLAN's, simple queues and scheduler. But it depends on your use case. What policies should be in place?

erlinden

Welcome to the forum. Anything in the log? Have you tried replacing the power supply? Is the device/rack grounded? What does the network look like? Any information (apart from the model name) might be relevant.
What RouterOS version? What bootloader/firmware version?

erlinden

Security reasons?

I can think of a thousand and more reasons...want to know from @Marvitex.

erlinden

Honestly, for WiFi I'm starting to evaluate something else.

dtim-period=1 is the default, you could try a bit higher, like 3.
Why evaluate something else, if 7.14.3 is working for you. Why upgrade at all?

erlinden

It is strongly recommended to upgrade the bootloader after RouterOS update. To upgrade the bootloader, execute command "/system routerboard upgrade" in CLI, followed by a reboot. Alternatively, navigate to the GUI System → RouterBOARD menu and click the "Upgrade" button, then re...

erlinden

Did you upgrade both RouterOS and firmware?
Did you manually set interface speed?

erlinden

The question is what the actual value is. I only trust the config (through cli export). Can you check what the value is through export?

By the way, I use dtim-period=3

erlinden

I checked the documentation (haven't used IPSEC befor), and found this: https://wiki.mikrotik.com/Manual:IP/IPsec#Site_2_configuration /ip ipsec profile add dh-group=ecp256 enc-algorithm=aes-256 name=ike2-gre /ip ipsec proposal add auth-algorithms=null enc-algorithms=aes-128-gcm name=ike2-gre pfs-gr...

erlinden

I have never changed the dtim-period setting, and currently its value is 0 on both wireless interfaces. With this value, I have clients constantly disconnecting on router OS versions greater than 7.14.3. That's strange as the range is from 1 to 255 (according to the documentation): dtim-period (int...

erlinden

Please share the config to get some relevant feedback:

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Have you upgraded firmware as well as RouterOS?
Have you tested with different LAN cables?

erlinden

There is only one driver for AX devices: wifi-qcom Because you refer to AC device(s), the hAP ax3 isn't the only device, correct? If the AC device is able to run the wifi-qcom-ac driver (it has to be an ARM device), you can use CAPsMAN from the the wifi menu item. Please have a look at the official ...

erlinden

If you replace the hEX with the Synology, do you get higher wireless speeds?
From the information you supply, the hEX doesn't seem to be the problem.

erlinden

You could consider turning on logging (temporarily) to find out what the source IP address is. Unfortunately it is not possible to do anything about DDOS, you would need your ISP. AFAIK the firewall is properly configured and DNS traffic from the WAN site is already blocked without the pre-routing r...

erlinden

do you set VLAN ID in Datapath in capsman

You could have found the information in the supplied links. Just to help you out, AX: yes and AC: no.

erlinden

can you please explain the steps on how to exactly? Just follow the official documentation on this: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample: And in regards to basic VLAN information, there is a great topic: https://forum.mikrotik.com/v...

erlinden

Best wishes, @normis and MikroTik team!

erlinden

With all 7.17 version both beta and rc, when dns adlist was downloaded and applied one cpu stucks at 100% and dns service is unresponsive. After about one minute cpu usage become normal and dns works as expected. I experienced this both on 4011 and 5009 Haven't seen this myself. Can you share your ...

erlinden

Hmmmm perhaps join the latest century............. take advantage of wireguard and other features.........

Assumption is the mother...
Though I totally agree with your arguments, I really want to know from the TS.

erlinden

What "clients"? What "time"?

erlinden

My best guess would be that the Admin MAC address is not set. That would explain some of the mentioned behavior. Could you please share the current config: /export file=anynameyoulike Remove serial and any other private info, post between code tags by using the </> button. Did you, besides RouterOS ...

erlinden

It made me smile... Instead of channels, MikroTik uses frequencies. To get an indication of how you can us it: /interface wifi channel add band=2ghz-ax disabled=no frequency=2412 name=CHAN-1 width=20mhz add band=2ghz-ax disabled=no frequency=2437 name=CHAN-6 width=20mhz add band=2ghz-ax disabled=no ...

erlinden

Don't use VLAN ID 1...ever!

Want to read more:
viewtopic.php?t=143620

erlinden

A good starting point is to read this topic:
viewtopic.php?t=143620

erlinden

I did a bit of rewriting, assuming that your CAPsMAN is the HEX Refresh and you have multiple CAP's: /interface wifi channel add band=2ghz-n frequency=2412,2437,2462 width=20mhz disabled=no name="CH2G" add band=5ghz-ac .frequency=5180,5260,5500,5660 width=20/40/80mhz disabled=no name="...

erlinden

One of the symptoms I would get is that the Stations would not roam from AX to AC and on the interface I would get the error: client was disconnected because could not assign vlan.

Turned out (for me) that by setting ft-preserve-vlanid=no explicitely on the ac devices, roaming worked fine.

erlinden

Exactly, I have switched from ip behind na to public ip on my main mikrotik router and I forget that Allow remote request is enabling requests not only for LAN but also for WAN! It shouldn't as the default firewall rules only allows calls from LAN (interace list). Perhaps have a good look at your c...

erlinden

Why do you want to upgrade?
Any reason not sticking to V6 and upgrade to 6.49.13 (which is current LTS)?

erlinden

You are probably bound to 2 devices.

erlinden

What private IP address does the Windows machine have?
Can you post a route print?
Can you "see" the traffic to this subnet?

erlinden

Can you please share your config:

/export file=anynameyoulike

Remove serial and any other private info.

And in addition to @holvoetn:
https://help.mikrotik.com/docs/spaces/R ... figuration

erlinden

Why would you prefer copper over fiber?

erlinden

VLAN: viewtopic.php?t=143620

erlinden

GOTO: viewtopic.php?p=1114852#p1114852

erlinden

Can you please point me where are the defaults firewall rules? /ip firewall filter add action=accept chain=input comment="accept established,related,untracked" connection-state=established,related,untracked add action=drop chain=input comment="drop invalid" connection-state=inva...

erlinden

You are aware that roaming is between radios as well? Therefor it might help (as clients can roam from 5G to2.4G, or vice verse). You can play with bandwidth to test if that is more stable: 20MHz on 2.4G and 40MHz on 5G. Have you checked with wifi debug logging enabled? Is the firmware upgraded as w...

erlinden

Anyone with a suggestion on what I can change are welcome to comment freely :). What I already haven't tested I will test :). For me setting connect-priority to 0/1 made roaming work for all devices (i.e. the iPhone 11 didn't roam). Furthermore, I prefer to add security and refer to it in configura...

erlinden

Would you care to make a network diagram?
Have you considered using VLAN (because of the remark about bridges, while one should be used)?

erlinden

At least supply the complete config (minus serial and any other private info):

/export file=anynameyoulike

erlinden

Changing channel with did not help, but disabling ft seems to do the trick. Thanks. Guess, I need a new SSID for it? Or a new iPad 8) Because I want to set in future for each wAP own channel for 2.4 Ghz and 5 GHz for non overlapping. (This isn't yet configured) That make perfect sense...while these...

erlinden

Mikrotik 7.17 - band steering does not work even neighborhood group is selected

You could show your config just to make sure that all settings are correct.

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Can you give it a try when channel width is 20MHz (2.4GHz) and 20/40MHz (5GHz).
Another option to test with is disable FT.
Just for testing purposes.

Can you explain why you have multi provision rules (while two are, in your case, enough)?

erlinden

Both installation and country is there to comply with regulations.
It has, afaik, nothing to do with scan results.

Is it possible there are no radios in the neighbourhood transmitting at those frequencies?

erlinden

Why you say, hope not?!?!?

You firewall rules set isn't complete. What made you decide to change it?
Can you please provide a complete config? Remove serial and any other private info.

erlinden

Does your RB get a public IP address? Hope not...

erlinden

Have you enabled debug wifi logging? There might be something showing.

Perhaps this topic is giving some clue?
viewtopic.php?t=174140

erlinden

As well as lots of frustated users, there are also a lot of users that don't experience the problems. For sure, settings does a lot. Might be interresting to see your config(s) to give some tweaks and suggestions. And when it comes to wifi, environment is of great influence. And please have a look a...

erlinden

/interface bridge port add bridge=bridge1 interface=ether1 add bridge=bridge1 interface=ether2 add bridge=bridge1 interface=wifi1 add bridge=bridge1 interface=wifi2 Your wifi interfaces should not be manually added to the bridge. Only have ether1 and ether2 as part of the bridge: /interface bridge ...

erlinden

To learn a bit (more) about VLAN, please have a good look at this (great) topic:
viewtopic.php?t=143620

erlinden

Congratz, nice to hear! The wAP AX is consuming a bit over 6 Watt at my place, according to my PoE switch.

erlinden

I got the Capsman to work in the setup, but only one client at the time can connect out on the internet. Any ideas? Definitely misconfuguration. Mhy best guess (on currently provided information): your L009 is configured as switch and the client gets the public IP address. As @gigabyte091 requested...

erlinden

RB951 is a device I used over 10 years ago. Great device, but very outdated especially with your ISP supplied Internet speed. But...that is not really ontopic... Can you export the configuration (using termin)? /export file=anynameyoulike Remove serial and any other private info and post between cod...

erlinden

Well, you set the first step. Can you show your config, so we can have a look at your current settings? /export file=anynameyoulike Run above command from a terminal, after executing there will be a file. Copy the content, remove serial and any other private info and post here between code tags by u...

erlinden

From the logging I get the feeling that SSH is publically available. Why?
Is this MikroTik behind NAT? As the IP address it is showing is a private IP? Cam you supply a network diagram including IP addressing in it?

erlinden

Welcome, @gftjhnk. Have you red all comments and changed configuration accordingly? Being able to replicate the problem isn't difficult.

erlinden

If it works for you...well done.

erlinden

Remove on CAP: /interface bridge port add bridge=TRUNK frame-types=admit-only-untagged-and-priority-tagged interface=VLAN10 pvid=10 add bridge=TRUNK frame-types=admit-only-untagged-and-priority-tagged interface=VLAN20 pvid=20 /interface vlan add interface=TRUNK loop-protect=on loop-protect-disable-t...

erlinden

/interface/wifi/radio/reg-info country="Australia" number=0 ranges: 2402-2482/36dBm/40MHz 5170-5250/23dBm/160MHz/indoor 5250-5330/23dBm/160MHz/indoor/dfs 5490-5590/30dBm/80MHz/dfs 5650-5730/30dBm/80MHz/dfs 5735-5835/36dBm/80MHz This is from a wAP AX cli.

erlinden

The standard way is: /export file=anynameyoulike Remove serial and any other private info and post between code tags by using the </> button. Always good to have more eyes watching. Can you als supply all involved (MikroTik) hardware? Did you also upgrade firmware besides the RouterOS upgrade?

erlinden

Can you share your config, @epkulse? And anything in the logging that could explain the situation?

erlinden

How is the wireless wire configured? And does the cable modem do any routing?

erlinden

Thanks! My wAP ax now arrived and I did a first test with one device. Works fine with CAPsMAN :-) I have a small question about that. On my RB5009, "cap-wifi1" and "cap-wifi2" do show up. Is there any way to rename the name? As those interface are auto generated on RB5009 and ma...

erlinden

Apart from upgrading RouterOS, did you also upgrade firmware (/system/routerboard)?
Anything in the logging that could be helpfull?
Can you share your current config?

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

As far as I know it is a binary clone. So it should contain everything.

erlinden

From the documentation: https://help.mikrotik.com/docs/spaces/ROS/pages/40992852/Backup (RouterOS V7.x) https://wiki.mikrotik.com/Manual:System/Backup (RouterOS V6.x) Quote from the latter: RouterOS backup feature allows you to save your current device's configuration, which then can be re-applied o...

erlinden

Weren't you on the "My Mikrotik wifi6 works like a charm"-train all the time?

It does

Have done a lot of tweaking finding out I already had best settings.

erlinden

Out of everything I tested, enabling both FT and FT over DS and setting Connect Priority to 0/1 is the solution that made the errors stop. For me, specifically adding the connect-priority=0/1 (in combination with default settings mostl) made my Samsung S21+ and iPhone 11 roam without disconnecting ...

erlinden

It is still not able to receive ip from the isp1 router.

Where is your DHCP client?

erlinden

Any reason you haven't updated the RB5009 to version 7.16.2 (which is currently the latest stable release)?
Make sure to upgrade firmware as well...

erlinden

One needs to know what factory firmware version is installed.
My guess would be version V7.x, which does not have a LTS version up till now.

Is it necessary to have an LTS?

erlinden

This is the correct documentation, assuming that the accesspoints are running wifi-qcom(-ac):
https://help.mikrotik.com/docs/spaces/R ... iFiCAPsMAN

erlinden

Please share the current configuration to help you:

/export file=anynameyoulike

This will create a file (which can be found at files) that you can download.
Remove serial and any other private info and post between code tags by using the </> button.

erlinden

You know the difference between RouterOS and firmware?

erlinden

Just attempted to upgrade to 7.17 RC - have to rollback immediately. No devices will connect to 5 GHz - have no time to spend on further investigation, but something appears not to be OK for sure... Next time choose a moment where you can do some investigation. There could be a perfect good reason ...

erlinden

Allow VPN connections to router( from public internet)?
Why would it be safer than secured ssh access?

An additional layer of security?
Bit worried you asking this question.

erlinden

Could you please share your config, at least the wifi part?

/interface wifi export

Remove serial and any other provate info.
With this config we can provide you with some tips and tricks.

erlinden

https://help.mikrotik.com/docs/spaces/ROS/overview

erlinden

Good to hear, Netinstall requires some patience (but always has worked for me).
I like to buy second hand (as well), and will always perform a netinstall....just in case.

erlinden

The config would really help:

/export file=anynameyoulike

Remove serial and any other provate info, post between code tags by using the </> button.

erlinden

Have you tried swapping the power supply? That would be my best guess...

erlinden

Do some testing with an accesspoint (if you have one laying around). Then you get the best indication on attenuation.

Furthermore, what are your requirements? What will WiFi be used for?

erlinden

If the deivce isn't shown in Neighbors using Winbox (either connected to one of the ethernet ports or via wifi if available) I would do a netinstall: https://help.mikrotik.com/docs/spaces/RKB/pages/1409054/Problems+with+Netinstall Make sure to follow it by the letter. Btw: You can either connect usi...

erlinden

Aah, thanks @infabo! That makes sense (from the quote I posted).

erlinden

Local wifi interfaces aren't provisioned as CAPS: CAPsMAN cannot manage it's own wifi interfaces using configuration.manager=capsman, it is enough to just set the same configuration profile on local interfaces manually as you would with provisioning rules, and the end result will be the same as if t...

Search found 2885 matches