MikroTik

erlinden

No problem m8, everyone on the forum is willing to help. Glad it is solved, you can mark as solved on the reply that gave the solution.

erlinden

BTW GOOD catch !! : hatsoff:

erlinden

Aah...that would (also) explain the situation.
Good practice...when restoring to other device, don't leave MAC addresses in.

erlinden

in RB5009 with 7.20 beta 2, if i enable VLAN filtering performances are very poor, if i disable it performances are regulary.

Different from previous versions?
Any queues running on specific VLAN's?

Config might be helpfull.

erlinden

The wAP AX is the first device that comes to mind. But be aware that the orientation of this device is important, as its radiation pattern is not omni directional. In comparison to the TP-Link, there shouldn't be that much of a difference if all device comply with regulations (assuming both are tran...

erlinden

I suspect it has something to do with MAC addresses, I just noticed: 74:4D:28:61:00:38 (hAP AC2) 74:4D:28:61:00:39 (hAP AX3) Could it be that it was copied from the hAP AX3 (probably it's ether1 port) en pasted to the hAP AC2? If that is the case, just reset the hAP AC2 to CAPS Mode and everything s...

erlinden

My apologies...seems the snotty brain is messing things up.

erlinden

Check the remark I made in this topic:
viewtopic.php?t=217345

erlinden

Still searching for the differences from the documentation and your config: https://help.mikrotik.com/docs/spaces/ROS/pages/103841836/CRS1xx+2xx+series+switches+examples#CRS1xx/2xxseriesswitchesexamples-Example2(TrunkandHybridPorts) /interface ethernet switch egress-vlan-tag add comment=mgmt tagged-...

erlinden

When you connect a pc instead of a laptop...does it get an IP address?
Can you supply a netowkr diagram showing all VLAN's?

erlinden

Thank you for your help in advance.

Make a new topic and post configs of both devices.

erlinden

I have no experience working with Webfig (I don't like it and every alternative is better imho), might have to do with browser caching. Have you tried clearing cache?

Any particular reason not using either Winbox or SSH?

erlinden

Your config might be of help:

/export file=anynameyoulike

Please remove serial and any other private info, post between code tags by using the </> button.

erlinden

Install HACS in combination with https://github.com/tomaae/homeassistant-mikrotik_router

erlinden

In the beginning there was...the Bible of VLAN:
viewtopic.php?t=143620

erlinden

What ISP do you have? Not any information on their site about running a modem in bridge mode?
In regards to PPPoE:
https://help.mikrotik.com/docs/spaces/R ... PPoEClient

erlinden

What makes you think it is not working? [myusername@RB4011] > /ip cloud print ddns-enabled: yes ddns-update-interval: none update-time: no public-address: xxx.xxx.xxx.xxx dns-name: xxx.sn.mynetname.net status: updated back-to-home-vpn: revoked-and-disabled

erlinden

Press the "Upgrade" button and afterwards (it will show a text message in red letters saying you can reboot) reboot the device. These steps will upgrade the firmware (and there are a couple of firmware changes between the running and available version).

erlinden

Configure one hAP ac as router (place this one in the basement, connected to the modem), the other as accesspoint. Multiple routers is for multiple reasons not advisable.
In this YouTube video from MikroTik you can see step by step how to configure it:
https://www.youtube.com/watch?v=qB1FSvxddi0

erlinden

There is very comprehensive documentation:
https://help.mikrotik.com/docs/spaces/R ... CP-Network

erlinden

Like I posted in the other topic, it looks like 7.20 and 7.19.2 will fix majority of AX related wireless issues that people had

Great news @normis!

erlinden

I hope so. These frequent disconnects ("MAC@wifi disconnected, too strong signal, signal strength 158") are one of the reasons why I cant use wap ax as a daily driver. In my experience the value of the signal strength is incorrect (signal should be less than -90dBm or something around). A...

erlinden

Max Tx Power is used to limit transmission power (if higher than regulated, the latter will be complied to), while antenna gain is used to calculate to stay within regulations. Setting both is far from optimal (and really makes no sense). In the old days, antenna gain was the only way to have contro...

erlinden

Ok, 23dBm (from 5180) -6dBi Antenna Gain = 17, mikrotik rounds up to 16 ?

That is correct. If you "need" higher TxPower, you will have to set frequency to something between 5490 and 5730.
Antenna gain should only be set on devices with detachable antennas.

erlinden

What output do you get on this command: /interface/wifi/radio/reg-info country="fill in your country" number=0 For me it is: country: Netherlands ranges: 2402-2482/20dBm/40MHz 5170-5250/23dBm/160MHz/indoor 5250-5330/23dBm/160MHz/indoor/dfs 5490-5730/30dBm/160MHz/dfs 5735-5875/14dBm/80MHz

erlinden

Could be channel related, what frequency is used?

erlinden

Nothing odd in regards to security. What CAP do you use? Seems there are some problems with specific Qualcomm chipsets where a new firmware is tested. Could be related to your problem as well. Antenna gain should only be set explicitly in case of external antennas. If you want to reduce transmission...

erlinden

Not the experience...can you please share the config to check for anything unusual?
Especially the before and after situation.

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Couple of things I notice:

Why are you using a bridge on the WAN side?
Where is your firewall?
How do you want to use your different ISP's?
How do you test?

Especially the latter is important.

erlinden

There is a difference in the two screenshots. No visible equals unset, while ft=no it is explicitly set. As "no" is default, the result will be the same.

erlinden

If the virtual interface is using different security settings (without FT), it won't enable 802.11r.
I think you can check this by using a more advanced Wifi scanner.

erlinden

Might have to do with the fact it is an accesspoint acting as router (why?). If you really want to have it acting as accesspoint, just reset it to CAPS Mode and add VLAN as you have done already. That should be it.

erlinden

Doesn't work....

How do you expect it to work and how did you test?

erlinden

You should enable VLAN filtering on the CAP device.

erlinden

You are aware of the radiation pattern of the wAP AX? Sure you are using the correct device in this situation? Mounted correctly?
What is the signal and how did you set it up (yep, indeed we want to see the config)?

erlinden

This RBcAPL-2nD only supports the legacy wireless driver. Only ARM devices have the wifi-qcom-ac driver option. Hence it can only be managed through the legacy CAPsMAN (/caps-man) and not through newer version (/interface wifi capsman). More info: https://help.mikrotik.com/docs/spaces/ROS/pages/1409...

erlinden

Your best starting point with VLAN on MikroTik (also known as the Bible):
viewtopic.php?t=143620

You are probably looking for the term "access port".

erlinden

Remove wifi interfaces from bridge. Also, remove all non essential wifi settings. Only /interface wifi datapath (without vlan id) and /interface wifi cap should be set, besides /interface wifi.

erlinden

Are both wireless interfaces set to the same country, in your case United States? That is the only thing I can think of in your situation.

erlinden

I think you would have to activate VLAN filtering on the CAP device. Can you share your current CAP config?

/export file=cap-device

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Whats going on here? Why its not respecting reg-info and dropping power to 8 TX?

Did you set country to Croatia or to United States (was it set at all)? Can you share your config?

erlinden

https://help.mikrotik.com/docs/spaces/R ... evice-mode
Agree with @loloski

erlinden

Anything in the logging?

erlinden

Is it for all LEDs or just the usr LED? Did you use the reset button?

erlinden

I think this describes how to setup WAN failover:
https://help.mikrotik.com/docs/spaces/R ... WAN+Backup

You are missing the correct route (/ip route).

erlinden

Nevermind...@holvoetn is nailing it.

erlinden

C:\Users\memememe>nslookup amathotspot.net 9.9.9.9
Server:  dns9.quad9.net
Address:  9.9.9.9

*** dns9.quad9.net can't find amathotspot.net: Non-existent domain

Do you have a static entry in this environment for this domain?

erlinden

In the documentation it states: Specifies if peer is intended to be connection initiator or only responder. Should be used on WireGuard devices that are used as "servers" for other devices as clients to connect to. Otherwise router will all repeatedly try to connect "endpoint-address&...

erlinden

Good starting point is the documentation:
https://help.mikrotik.com/docs/display/ ... ionexample:

erlinden

As Chateau 5G R16 is ARM I would expect it to work. Did you first uninstall the wireless package? Anything in the logging?

erlinden

The configs could maybe explain:

/export file=anynameyoulike

Remove serial and any other private info, post between code tags.

Could be something with the tooling as well.

erlinden

According to the documentation: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-Channelproperties Frequency band and wireless standard that will be used by the AP. Defaults to newest supported standard. Note that band support is limited by radio capabilities. In regards to VLAN, ...

erlinden

Sure AdList isn't enabled (while cache size hasn't been increased)?
https://help.mikrotik.com/docs/spaces/R ... listAdlist

erlinden

My best guess would be that you set band=5ghz-ax in either channel or config...correct? If so, just remove it. In regards to VLAN...yeah, some manualy things to do: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample: Best would be if you share you...

erlinden

Can you explain why you want to accomlish this? And is this really a problem? Be aware that DNS requests can travel to port 53 (standard) ,port 853 (DoT, also known as DNS over TLS) and port 443 (DoH, also known as DNS over HTTPS). Don't forget to redirect both TCP (seldomly used) and UDP. And don't...

erlinden

Do you maybe know how to disable local forwarding for Wave2 CAP's?

It's not. Why?

erlinden

Have you tried disabling Band steering on the UniFi controller?

Yeah...or ask this specific question on the Unify forum?

erlinden

What exact hardware is used? So far it looks like a Unify wireless network, therefor it confuses me what the relation with RouterOS is.
In regards to upgrading...check the changelogs to decide wether or not you should upgrade. What is the main reason for you to not upgrade?

erlinden

I think this topic will bring you in the right direction:
viewtopic.php?p=1142438&hilit=vlan+capsman#p1142438

erlinden

The choice is easy...either choose three devices to configure or one device. CAPsMAN is really easy (especially if you understand the DRY concept) and has some great advantages. More info can be found here: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-CAPsMAN-CAPsimpleconfigurationexample: A...

erlinden

Good to hear.

Can you mark this topic as solved?

erlinden

Adjust the existing rule that logs all info topics (by adding !fetch to this rule).

erlinden

According to the documentation you can't turn off ether LEDs:
https://help.mikrotik.com/docs/spaces/R ... oordevices

erlinden

As @holvoetn already mentiond: Upgrade your RB to >= 7.13 https://help.mikrotik.com/docs/spaces/ROS/pages/328142/Upgrading+and+installation#Upgradingandinstallation-Upgrading Then, configure as described in the documentation: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPsMA...

erlinden

1. Yes
2. Yes
3. Certificates is the solution

erlinden

I mean having an understanding of your network.
I regards to the IP addresses...it looks like you are behand NAT (on the outside), is that possible?

erlinden

Context is key...can you explain how you want things to work?

erlinden

Sure you are using the correct IP address? Does the camera have a fixed IP (as well)?
How is your CRS configured?

erlinden

You have both ether1 and vlan80-net added to your WAN interface list. add comment=defconf disabled=yes interface=ether1 list=WAN add interface=vlan80-net list=WAN I assume that Internet is deliverd on ether1 vlan id 80, correct? In that case: Remove ether1 from the bridge: /interface bridge port add...

erlinden

Thanks for letting the forum know...you are welcome.

erlinden

With this extensive guide you will be good to go using VLAN's:
viewtopic.php?t=143620

Once you get the concepts you will never go back.

The other option I see is setting client-isolation on an access-list, filtered by SSID. Haven't tried that myself (as I'm using VLAN's).

erlinden

Sure, why not? Out friend @tangent has written a nice blog on it:
https://tangentsoft.com/mikrotik/wiki?n ... Sans+VLANs

Any reason not to use VLAN?

erlinden

Please share your current config:

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Well, creative is not always bad ;-) Well, you did a very good job to make it look bad ;-) yes, I still have to clean up a few little things (upnp on the AP, DHCP client on the bridge, etc.). virtual APs are now dynamically in the bridge via Datapath. But CAP in CAPS mode is then just ‘mikrotik mag...

erlinden

First thing I notice: wifi interfaces should not be added to the bridge manually. I prefer to leave the CAPS as "CAPS Mode" as possible (except for having my ether1 as trunk port and enabling VLAN filtering on the bridge). DHCP client should be on the bridge and not on an interface being p...

erlinden

Config or it didn't happen:

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Using CAPsMAN?

My RB4011 and 3x wAP AX managed by CAPsMAN is working flawless with V7.19RC2.
Can you share your CAPsMAN config together with the CAPS?

erlinden

Can you please provide complete configs? It's really hard to understand.

erlinden

For what?

NV2 no longer exist and QuickSet is not for WISP.

To understand the need(s).

erlinden

- no NV2 Use case please - no WISP AP (Like MantBox AX) Please elaborate? - QuickSet is a horror on AX, you need to put anyhting manually QuickSet is horror on any device...just use command line. When you will fix this? Have you filed a ticket on these items? https://help.mikrotik.com/servicedesk/s...

erlinden

Seems the only way is ax2.

If you are referring to the hAP AX2, I would like to advice you to get the wAP AX. It's better than the hAP.

erlinden

Though not being @holvoetn:

Yes, roaming is drastically improved by using the wifi-qcom(-ac) driver.

erlinden

2. Why interfaces wifi1 and wifi2 do not connected to CAPsMAN?

By default, local wifi intercases can't be provisioned. Two options: set config on wifi1 and wifi2 or use the provision button on the Radios tab (after selecting the local interfaces).

erlinden

I have best experience with RB selecting the best channels (from the list 2412, 2437 and 2462) in combination with reselect-interval: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-Channelproperties: /interface wifi channel add disabled=no frequency=2412,2437,2462 name=CHAN-2G r...

erlinden

Why allow DNS traffic to the router, while clients will use "dns-server=1.1.1.1,8.8.8.8"? Though not being incorrect, you can change this: add action=drop chain=input comment="Drop other LAN traffic to Router" \ in-interface-list=LAN_Interfaces add action=drop chain=input comment...

erlinden

That brings you to either netinstall the device (if the reset button is working) or RMA the device.

https://help.mikrotik.com/docs/spaces/R ... Netinstall

Are you 100% sure the reset button is properly pressed befor powering the RB?

erlinden

My RB5009 cannot enter the routing system You don't have access to the router? Or is there another problem? after the script automatically restarted last night. Why do you run a script? Has anyone encountered this situation? For me, the situation is unclear... I tried using the Reset Button, but th...

erlinden

If you set ether2 to pvid=1000 (instead of 1000), do you also get an IP address?

erlinden

I have a dedicated DNS server in my LAN which I already propagate via DHCP to clients. However, that DNS server is not aware of the DHCP clients (and their hostnames) of the Mikrotik router. My DNS server should be able to use the routers DNS server to resolve these hostnames, but only those. Is th...

erlinden

DNS Client uses /ip dns
LAN Client uses /ip dhcp-server network

Both can be set to mutliple DNS servers.

If you want your RB to act as DNS server for LAN clients, you should set its IP at /ip dhcp-server network.

erlinden

On the product page it is referring to this "SFP compatibility list":
https://help.mikrotik.com/docs/spaces/R ... patibility

erlinden

I resselect every 2-3 hours. It will perform a background scan and if there is a better frequency it will set it. But be aware that this can interrupt on DFS channels. It depends on your situation and surroundings.

erlinden

If one does not specify anything about "save selected" and no re-select interval (as the wireless Capsman allows this) what would happen? Are there default reelection processes going on or what is the case? AFAIK it will remain on the selected channel. That is, as long as there is no rada...

erlinden

Show what you did:

/export file=anymameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Didn't have a good look, but noticed you are running 2.4GHz radios on 40MHz bandwidth. Can you give it a try by disabling extension channel? Then you might have less interference (if that is causing the problems).

erlinden

That sounds like the old CAPsMAN version...the router should have wireless driver installed (can be found in the extra package) and then you are good to go: https://wiki.mikrotik.com/Manual:CAPsMAN But I can "understand" ChatGPT...your question is hard to understand: I would like to ask yo...

erlinden

Preferably use wires to interconnect. Indeed this is a basic use case for CAPsMAN:
https://help.mikrotik.com/docs/spaces/R ... iFiCAPsMAN
https://www.youtube.com/watch?v=bHotZT41w3E&t=89s

erlinden

allow firewall on udp 15252, 53 and 123 to enable the router can received data, but still didn't work. Does this mean your DNS server is publically available? That could explain the high rtt. You might want to share your config: /export file=anynameyoulike Remove serial and any other private info, ...

erlinden

To me it looks like your CAP is acting as a lot more than CAP only. I.e. there are security profiles, while all you need are interfaces that are managed by CAPsMAN. Also, there is no need to have multiple bridges and afaik wireless interfaces are added to the bridge dynamically. And why is the CAP r...

erlinden

Please provide configs of all devices involved:

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

it is working, but is it correct? This is correct. You don't have to set vlan-id on the datapath. Unless you want to work with VLAN's, but then there is a lot more to change. I have set the guest config as slave to both provisioning rules, what I expect is that GUEST is for client to decide the fre...

erlinden

Guest network can be added by using a slave (besides the master) config in CAPsMAN (no need to change the CAP):
https://help.mikrotik.com/docs/spaces/R ... einterface

erlinden

If you set the hw-supported-modes on the provision rule, the correct config is provisioned to the radio. Especially because you have a distinction in channels. Something like: /caps-man provisioning add action=create-dynamic-enabled hw-supported-modes=ac master-configuration=cfg-5g name-format=ident...

erlinden

In addition to @gigabyte091, hereby the documentation: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-Securitymulti-passphraseproperties Alternatively you can use access-list to set VLAN ID (depending on the MAC address). This is not in line with your requirements, I prefer it a...

erlinden

Official documentation:
https://help.mikrotik.com/docs/spaces/R ... 59120/WiFi
If you show how you would do it in the pre-wifi6 era, perhaps we can advice you?

erlinden

You can't downgrade below factory firmware. What is the version?
Besides, from the website:
https://mikrotik.com/product/hex_2024

Why would you want to downgrade?

erlinden

Could it be a radar detection incident? That should be reported in the logging. I noticed you didn't set channel width on 5GHz, running 160MHz might give some interference. And a personal note...running anything different from encryption=ccmp gave me lots of problems. But the radio should still be a...

erlinden

How do you know it is not working?
Can you add the CAPsMAN config as well (just the /interface wifi part)?

erlinden

Press the provision button on CAPsMAN on the wifi - remote cap
Also check log on both CAPsMAN and CAP.

erlinden

Have you tried a (re)provision?

erlinden

From a DRY perspective, could you please try the below (just edit: /interface wifi security add authentication-types=wpa2-psk,wpa3-psk name=main_sec ft=yes ft-over-ds=yes passphrase=HaveAg00dDay add authentication-types=wpa2-psk,wpa3-psk name=guest_sec ft=yes ft-over-ds=yes passphrase=HaveAg00dDay /...

erlinden

Unless you are able to find the wifi-qcom-ac driver in any V6 package, you are restricted to use V7

erlinden

Just to rule out everything, can you please share the config?

/export file=anythingyouwant

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Is downgrading an option? I.e. LTS 6.49.18?
I prefer to have my older hardware running V6, but it depends what functionality is required.

erlinden

You can always reset the CAP to CAPS Mode and add VLAN settings. Firewall seems unnecessary afaik. Hope it helps...
There is nothing I can see that could cause your problems.

erlinden

EDIT: I just tried that config on a cap ac and i get both masters as "slave" and "master". Seems like a bug Could that be due to the fact that you didn't set a name? I didn't check the statements... @Qbaakr, if you want to have a clean starting point, just reset both wireless in...

erlinden

I think it is only available on RouterOS V6, where it is part of the extra package (just checked, but you probably did that already as well...). Strangely enough it is shown on the help.mikrotik.com documentation site. AFAIK, that is the V7 documentation site. What RouterOS version are you running? ...

erlinden

What do you exactly mean by "best setting"? Are you only interested in single device throughput? In regards to the settings (assuming it is with the wireless driver): Is 802.11a required? How is the frequency usage on 5260MHz? Did you set country code? What is the connection rate while per...

erlinden

https://help.mikrotik.com/docs/spaces/R ... listAdlist
viewtopic.php?t=215594

You can compare it to AdGuard and PiHole, it's a way to prefend users from accessing all kind of content through DNS.

erlinden

On CAPsMAN I see you have multiple datapaths. A single datapath is sufficient, VLAN filtering is handled by the bridge:

/interface wifi datapath
add bridge=bridge-LAN disabled=no name=DP_AC

erlinden

I'm using AdList in combination with a social media list I gathered. During a specific time (I enable/disable the list with scheduler) these (social media) names are resolved to 0.0.0.0. This way you can target names instead of IP addresses. Disadvantage is the TTL and caching you have to take into ...

erlinden

viewtopic.php?p=1125951#p1125951

erlinden

i got feeling that the stable version will come very very so0n

Not so fast, first there will be a release candidate.

erlinden

You don't have anything that should be restricted from asccessing Internet? Like IoT (my Chinese camera's don't have access to Internet).

erlinden

When RouterOS on the CAPsMAN is up to date (currently stable is 7.18.2), CAPsMAN (new) is available and can manage the hAP AX2. It can be found in /interface wifi capsman You can reset the CAP (of the cAP ac) to CAPS Mode, either by using the reset button, or through cli: /system reset-configuration...

erlinden

It should. Have you checked logging? Did you reset the CAP (just to make sure)? Did you do anything manual on the CAP?
From your CAPsMAN config, I would not expect the /caps-man interface part (but it has been long time since I worked with the old CAPsMAN). Can you remove it and try again?

erlinden

@melectronics, what is your actual question? Can you explain what you are trying to accomplish?

erlinden

Sounds like multiple problems. Did you uninstall the wireless driver prior to installing the wifi-qcom-ac driver? Why are you referring to the 5GHz interface, while both interfaces are missing under WiFi? Interfaces should always be shown on devices with wifi interface. From the cAP ac, can you post...

erlinden

cAP ac supports two drivers: wireless and wifi-qcom-ac. If you want to fully integrate and cooperate with the wifi-qcom driver (included with the hAP AX2), you are limited to the latter. And in that case, you have to add virtual interfaces to the cAP ac manually. Another approach would be using both...

erlinden

Is it right that I must add every slave interface on every master interface what I have manually? That makes not much sense when I have a centralised manager for WiFi?

AFAIK this is only necessary when running wifi-qcom-ac driver AND configuring VLAN's.

erlinden

Nice finding, I hope it helps! AFAIK there is no need to create these groups manually, as they are dynamically created automatically.
But setting things explicitely is always a good idea!

erlinden

Third option: ISP issue.

erlinden

Open Dev Tools (F12) and check on the network tab if there are any problems.

erlinden

Can you add: /interface wifi capsman export Or even better: /export file=anynameyoulike My best guess is that interfaces is set to all (is that an option), meaning the CAPsMAN service is available through the WAN interface. Your firewall needs soms improvements, you'll probably get some feedback soon.

erlinden

How is this client connected, ft-wpaX-psk or wpaX-psk? I had to add the connect-priority=0/1to get better experience, can you give that a try (it is part of security). While I'm at it: settings can be overwritten. Configuration is the highest level, hence if you set things like security.ft=yes it wi...

erlinden

Some newbies dislike CAPsMAN...I actually love it :lol: Let me be clear...I've learned a lot from @anav! It's a bit difficult to analyse by lack of info...how are the cAP AX's configured? AFAIK, when they are reset to CAPS Mode, it should work. I think by sharing the config from CAPsMAN and both CAP...

erlinden

Be aware that any ax device is not able to run the old CAPsMAN (which requires the wireless driver). In this case, you would have to upgrade the cAP ac to wifi-qcom-ac driver. Assuming they are currently running the wireless driver. Just my guts feeling: I wouldn't rely on the cheapest device and wo...

erlinden

Please share your public IP besides the config, so we can watch the camera as well

Meaning...are you sure you want to have a camera publically available? Have you considered a more secure solution like VPN?

erlinden

Are you familiair with Netwatch?
https://help.mikrotik.com/docs/spaces/R ... 8/Netwatch

erlinden

Sure you want to have Internet access to these camera's? And that you want to make them available to the entire world? What are the camera's connected to? Is there a DVR? Or what do you mean by server? Where is this "server" located? UPnP, for me, is the equivalent for people not knowing e...

erlinden

Have you performed a "Freq. Usage" scan? Especially when this is happening?

erlinden

Could you share your dns settings?

/ip dns export

Make sure to remove anything non relevant (like static dns entries).

erlinden

With the wifi-qcom-ac driver, it is necessary to create the virtual interfaces on the CAP manually. Not sure if you did that? The config is different from the wifi-qcom driver: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPusing%22wifi-qcom-ac%22package: Can you please share...

erlinden

Have you already tried playing with the cache-max-ttl? I have set it to 1d (instead of your 1w).

Sure your DNS server is only used internally (and its ports aren't open to the world)?

erlinden

I think it is good when having these problems, please also include firewall and dns settings:

/ip/firewall export
/ip/dns export

# or complete export:

/export file=anynameyoulike

Make sure te remove any private information (like serial), post between code tags by using the </> button.

erlinden

Not sure if it works, but there seems to be a way to make CAPsMAN redundant:
viewtopic.php?p=760970

erlinden

Looks like the bridge is deleted on the wAP.

erlinden

I have found myself in a similar situation where the old Winbox version would work (while v4 indeed gives the similar error).

erlinden

To get some insights, can you please share your config?

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

Btw, disabling the firewall is a terrible idea. Not being able to find it is even worse.

erlinden

Running newest CAPsMAN requires AX device (using wifi-qcom as only option) or AC device (using ARM processor and wifi-qcom-ac driver).

If you want to support the older CAPsMAN (ac or older devices), you have to use the wireless driver.

There are lots of topics and documentation on this topic.

erlinden

mAP Lite requires the CAPsMAN supplied with the wireless driver. If it is only for testing, you better get an AX device (or a wifi-qcom-ac supported device).

erlinden

I have had the same issue, there is a topic here on the forum that solved it. You would have to search for PPSK on the forum.

erlinden

Change this: add action=masquerade chain=srcnat out-interface-list=WAN src-address=192.168.250.0/24 Into this: add action=masquerade chain=srcnat out-interface-list=WAN With this change you will get Internet on both networks. Yes, I read it and read it again :lol: thanks You might want to have anoth...

erlinden

Sure, no problem.

erlinden

What made you decide to have both multiple bridges and multiple VLAN's? While you could handle all with VLAN's alone. Why run PiHole while you can use AdList: https://help.mikrotik.com/docs/spaces/ROS/pages/37748767/DNS#DNS-adlistAdlist Don't play with antenna gain, just set TX Power. There are some...

erlinden

But will the roaming work well if local wifi1/2 are not included in CAPSMAN?

Yes!

erlinden

Your vlan config is incorrect.

Please read this topic carefully:
viewtopic.php?t=143620

erlinden

Instead of using vlan filtering, you should configure vlan on the switch menu.

https://help.mikrotik.com/docs/spaces/R ... s+examples

erlinden

Perhaps you can reset the wifi1 and then do a reconfigure. Something like /interface wifi reset numbers=0 It makes absolutely no sense why it would take ages. Nothing in the logging? Is the interface up in a fashionable time (according to Winbox or SSH or whatever you use)? Now that you mention abou...

erlinden

Can you please supply all hardware involved (CAPsMAN/CAPS), RouterOS and firmware version and configs?

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Change this: /interface wifi security add authentication-types=wpa2-psk,wpa3-psk connect-priority=0/1 \ disable-pmkid=yes disabled=no encryption=ccmp,gcmp,ccmp-256,gcmp-256 ft=\ yes ft-over-ds=yes name=harf_security wps=disable Into this: add authentication-types=wpa2-psk,wpa3-psk disabled=no encryp...

erlinden

Don't forget to increase the number of parallel streams (try 8 stream) to get higher throughput.

erlinden

viewtopic.php?t=215763
viewtopic.php?t=213269

What RouterOS and firmware version are you running?

erlinden

Anything in the logging?

erlinden

First step would be creating a topic

Would like to see the config of both CAPsMAN as CAP:

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

Anything in the logging (both CAPsMAN and CAPS)?

erlinden

So the best way is to replace the network cable and use iperf test, is that right?

Yes!

erlinden

At what rate are the devices connected? Aah, you just added a post, 2.4Gbps.
BTest is a great tool, just not for this purpose. It is CPU heavy, have you checked cpu load during test?

Get two pc's, connect them with wire to the RB's and perform a test with iperf:
https://iperf.fr/iperf-download.php

erlinden

For comparison reason it would be helpfull to get your config for both old and new:

/caps-man export
/interface wifi export

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Can you please share configs?

erlinden

Have you tried all suggestions mentioned in this topic?
You might want to consider either adding your config or opening an new topic.

erlinden

Can you please share your current config of the CAPsMAN?

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Could you try with Winbox 4.0Beta18?

erlinden

/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan

Change to correct subnet

You know this is a static DNS entry?

erlinden

Could it be that you used "create enabled" at some point? Otherwise, there shouldn't be any static slaves (especially they should not remain any after a reboot).

Glad it is solved! And welcome to the mysteries of CAPsMAN

erlinden

You might want to share your current config again. There must be a reason why it's not working. Can clients ping the WISP router? And can they ping 1.1.1.1? Getting two devices is probably making it more complex. And be aware that, while using the WISP router there is no reason to get a second route...

erlinden

Perform: /interface wifi reset numbers=1 /interface wifi channel add band=2ghz-ax disabled=no frequency=2412,2437,2460 name=CHAN-2G reselect-interval=1d..1d12h width=20mhz /interface wifi set [ find default-name=wifi2 ] channel=CHAN-2G configuration.country=Ukraine .mode=ap .ssid=M2 \ security.authe...

erlinden

Your network makes no sense. If you want the MikroTik to work as switch/AP, do:

Remove default settings
Create bridge, add all interfaces to it
Configure wifi as you did
Add DHCP client to bridge

Let your ISP's router handle DHCP

erlinden

Go to wifi, open the wifi interface, select traffic tab.

erlinden

Change your gateway to .254

erlinden

erlinden

Can you share the complete config of both wAP AX and cAP AX? Are all devices running the same RouterOS version? And is firmware upgraded as well? Apart from the problems (have you tried a re-provision of the radio?): /interface wifi channel add band=5ghz-ax disabled=no frequency=5180,5260,5500,5580,...

erlinden

This part: add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp You are accepting all DNS requests, either from LAN or WAN. Next, you are mixing input and forward chain. In itse...

erlinden

Traffic on the interface tab.

erlinden

Seems that you did just fine. What I did (near similar config) is this: interface bridge add admin-mac=XX:XX:XX:XX:XX auto-mac=no frame-types=admit-only-vlan-tagged name=bridgeLocal protocol-mode=none \ vlan-filtering=yes /interface vlan add interface=bridgeLocal name=MGT-VLAN vlan-id=99 /interface ...

erlinden

Log to disk? It has to be (temporarily) stored somewhere.

erlinden

Can you please share your current config:

/export file=anynameyoulike

Remove serial and ny other private info, post between code tags by using the </> button.

erlinden

What filter rule do you assume to allow access from Winbox?
By far the easiest way to grant access is to add the wireguard interface to your LAN interface list.

erlinden

Indeed, debug logging can add something. Please do these steps as test (make sure everything from wifi is removed befor hand): # reset both wifi interfaces: /interface/wifi reset wifi1 /interface/wifi reset wifi2 # verufy they are part of the bridge (or add them): /interface bridge port add bridge=b...

erlinden

CAPsMAN is indeed intended as central management. If your only problem is frequencies, you could either make a configuration per radio (with a fixed frequency) or start using releselect-interval. The latter will (background) scan if the frequency is the best choice: https://help.mikrotik.com/docs/sp...

erlinden

Did you hit the provision button? I assume that the wifi interfaces are added to the bridge dynamically (as well for the CAP).
Does this problem also occur when you leave names untouched?
Have you checked the log?

erlinden

Import can be done if there is no default config in place. Otherwise, you get conflicts.

Something like:

/system reset-configuration no-defaults=yes  run-after-reset="your-config.rsc"

erlinden

You are correct. Documentation in regards to your situation:
https://help.mikrotik.com/docs/spaces/R ... %22package:

erlinden

Stats are only available on the CAP itself, not on the CAPsMAN. The "RED error messsage" is actually not an error, you can ignore it. If you provide your CAPsMAN's config, you can get some feedback on it: /export file=anynameyoulike Remove serial and any other private info, post between co...

erlinden

This is a problem: /interface bridge port add bridge=bridge comment=defconf ingress-filtering=no interface=*1 internal-path-cost=10 path-cost=10 /interface bridge port add bridge=bridge comment=defconf ingress-filtering=no interface=*2 internal-path-cost=10 path-cost=10 Probably the two wifi interfa...

erlinden

Firmware upgraded as well as RouterOS?
At what speed (rate) is the wireless device connected to the RB?
Is this the same for all wireless devices?

Can you start fresh:

/interface/wifi reset wifi1
/interface/wifi reset wifi2

Set country, ssid and passphrase and try testing again.

erlinden

If you open a rule (just tested this with the App, also works in Winbox), you can copy that rule.
In CLI, you can do an export and copy a specific line. If you execute that line (with some adjustments) you can execute it.

Not sure why you think it is missing.

erlinden

Only one topic you have to follow: https://forum.mikrotik.com/viewtopic.php?t=143620 I'm missing the "frame-types=admit-only-vlan-tagged" on the /Interface bridge port Just for VLAN security. But that doesn't explain the problems tou encounter. Could you please share a complete config of b...

erlinden

For (nearly) any VLAN question please read this great topic:
viewtopic.php?t=143620

erlinden

You might want to introduce something like:
https://help.mikrotik.com/docs/spaces/R ... prevention

This is for SSH, but can probably be used for OpenVPN as well.

erlinden

i want to block all traffic/ports that come via OpenVPN from WAN that should not be. As i noticed if i disable OpenVPN server that the logs also stop.. So you are running an OpenVPN server and if you disable that, there are no more log entries. What is your problem in the first place...having entri...

Search found 3300 matches