MikroTik

erlinden

Is this a copy-paste thing (I'm not familiar with this country)? /caps-man configuration add channel=WLAN50 country="germany 5.8 ap" datapath=datapath1 distance=\ dynamic installation=outdoor max-sta-count=250 mode=ap name=cfg50 \ security=security ssid=SSID Can you also post the config of...

erlinden

Can you please share the config of both CAPsMAN and a working CAP? /export file=anynameyouwish Remove serial and any other info and post between code tags by using the </> button. If the CAPs has default CAP config, you could consider resetting the non working CAP's: https://help.mikrotik.com/docs/s...

erlinden

Block both 53 and 853, both UDP and TCP. Be aware that DoH won't be blocked this way (but probably most IoT devices will only perform "normal" DNS requests). In addition, you could also redirect all outbound DNS requests to your router DNS server (where you have to replace the IP address b...

erlinden

The Cap (RBcAPL-2nD) is managed through the old CAPsMAN, while cAP AX is managed through the latest version. Therefor, you will have to run both versions (the latter is available when you upgrade the CAPsMAN device to 7.13.x or above). Alternatively you can configure the cAP AX manually (instead of ...

erlinden

What do you mean by stencils, are you referring to item templates that can be used with Visio?
The first hit I got on stencils is this:
https://en.wikipedia.org/wiki/Stencil

erlinden

Something isn't working while importing the old config. Hard to say what it is.
You could reset the new device (what exact device do you use) without default config and then import the old config (which device was that).

It should work (at least, DHCP leases are exportable and importable.

erlinden

You have limited Tx power on 2.4GHz channel quite a lot - how to improve it? Just remove (max) tx-power. /interface wifi security add disabled=no name=xxxxxx Sure you want an open wifi network? Could you give this a try: /interface wifi configuration add name=cfg2 country=Poland mode=ap ssid=Wifi c...

erlinden

Ok, anything we can help you with?

erlinden

It wasn't like that on the old Asus, when I connect an access point I don't have this problem, so it's 100% Mikrotik's fault. Often, the real problem is between the chair and the computer 8) If you want it solved, please share your current config so we can check the curren configuration: /export fi...

erlinden

Glad it worked out, you can mark this topic as solved.

erlinden

Can you please share your (wifi) config:

/interface wifi export file=anynameyoulike

Remove any private info, post between code tags by using the </> button

erlinden

Just to be clear, you are not using them as paperweights?

To be honest...they are absolutely terrible...as paperweights

erlinden

Would you be so kind to share that with us, @lmeira? Perhaps an export of the relevant part?
I currently use PPSK, but am looking for a more future proof solution (that supports WPA3 as well).

erlinden

Good job, this will help a lot of people. Very nice to use trunk ports, also on the CAP's! Some suggestions: Place all code parts between code tags, by using the </> button Supply the (config) rsc files as attachments to have a complete example (like used in https://forum.mikrotik.com/viewtopic.php?...

erlinden

Can you give this a try:

/ip firewall raw
add action=drop chain=prerouting disabled=yes dst-port=80 protocol=tcp tls-host=!*diretta*
add action=drop chain=prerouting disabled=yes dst-port=443 protocol=tcp tls-host=!*diretta*

erlinden

This way, you have to make sure that there is no configuration on the new device (/system, reset configuration, no default config).
If you want to have a clue what is happening, copy the rsc file line by line and paste it into a terminal.
Make sure there are no MAC addresses in the commands.

erlinden

I see you have multiple VPN servers enabled, with what VPN server are you connected? To be able to access your local network, you should have an accept rule in the forward chain for this. Do you have access to the router itself (ping while VPN server is up)? Any asterisk in an export is an indicatio...

erlinden

Instead of re-implement PiHole you could have a look at AdList:
https://help.mikrotik.com/docs/spaces/R ... DNS-Adlist

Made me remove all my PiHole/AdGuard instances.

erlinden

Same issue on a CCR2116, GPON SFP makes the health monitoring fail after some time...

Did you create a support ticket for this?
https://mikrotik.com/support

erlinden

When using VLAN's, you should create an /interface/vlan for management purposes. And...the bridge should not have an IP address when using VLAN filtering. My best guess is that it does, but that would require the config for confirmation. Don't know if you are familiar with this great topic: https://...

erlinden

But as I understand it, this mode is not compatible with wpa3-psk? Is there any example of how it is used? You are correct. But I don't mind not using wpa3-psk at the moment. I followed the instructions in this topic (though there isn't any CAPsMAN configuration), it is not really hard. Be aware th...

erlinden

As the documentation states, you can always downgrade. But not below factory installed version.
What does /system/resource/print show?

erlinden

Or, to replace RB2011 with newer router maybe?
Would L009UiGS-2HaxD-IN be a good alternative to my RB2011UiAS-2HnD-IN?

As it misses 5GHz (as far as it is required?), I would prefer hAP AX3 personally.
But it depends on requirements. Sure you will do just fine

erlinden

This weekend I setup CAPsMAN using PPSK (which is part of the security settings: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-SecurityProperties) and I absolutely love it! I had a guest network, configured OWE (https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiF...

erlinden

RB2011 is wireless (driver) only Therefor, you can't install any other driver. If you want to have it manage the cAP AX, you have to upgrade to at least RouterOS version 7.13.x and up. But, as @holvoetn mentioned, you won't really benefit from it as you have to do the settings twice (wireless and w...

erlinden

(Seamless) roaming requires identical SSID, password, encryption and network segments. It would make sense to use CAPsMAN for having roaming available in the best way (at least for the MikroTiks). What made you choose to have different SSID's? Have you enabled DHCP debug logging? This might give som...

erlinden

RB2011 is wireless (driver) only, while cAP AX is wifi-qcom (driver) only. If you want to manage the cAP AX from the RB2011, you need to upgrade the latter to 7.13.x (or above, current stable is 7.16.2). Then you need to run both the old CAPsMAN (for wireless) and the new CAPsMAN (for wifi-qcom, whi...

erlinden

Mixing different security profiles (while having the equal SSID) could give a problem. Can you start by setting both security profiles identical, so wpa2-psk only (and aes as you already did).
Also, 802.11 k/r/v are not supported on the old wireless driver, so it makes no sense to activate it.

erlinden

There is documentation:
https://help.mikrotik.com/docs/spaces/R ... Parameters

If I may ask: why ZeroTier?

erlinden

Because of this rule, all incoming tcp traffic to port 443 is answered by the router: add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp The input chain is used for traffic to the router, the forward chain for traffice between networks (like WAN and LAN). Next thi...

erlinden

In terminal, execute:

/export file=anynameyoulike

This will produce a text file (rsc extension) containing most of the config.
Download it, edit it (remove serial and any other private info) and post here between code tags by using the </> button.

erlinden

Yes they are in ROS v7 (where IPv6 is not optional any more). And yes they are if ipv6 optional package in v6 is installed and enabled when ROS config is reset to factory default. Wasn't aware of this... TS: Can you reboot whatever is in front of the Audience and perform another test again? And sup...

erlinden

It is not (completely) default config. I.e. the IPv6 rules are not there by default. No problem... As mentioned, the overlap could cause strange behavior (if there is a client using .253 as well). Can you check DHCP leases? Do you see any errors/retries on the WAN interface? Could you perform a spee...

erlinden

I wonder why it is to hard for MT to write the fundamental things clear in their help-documentation... I know not all possible situations and scenarios are described, but basic things like opening ports you can find here: https://help.mikrotik.com/docs/spaces/ROS/pages/250708066/Firewall Why are su...

erlinden

At first sight it looks like a nearly default config. Just a few NAT rules and the fasttrack rule as first rule. Is this rule hit? What is the cpu usage while performing a test? Have you performed a test when connected directly wired to the Audience? What does the speed test exactly consist of? Spee...

erlinden

Instead of setting antenna gain (which is fixed), set tx-power (which is part of the configuration). The first option is a hack (in my opinion), while the latter is how you should do it. The correct documentation reference: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-Property...

erlinden

Please share your current config, otherwise this will remain a riddle:

From terminal (or SSH):

/export file=anynameyoulike

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

Half (give or take) actually. 2.4GHz band (for anything newer than 802.11B) is 70MHz wide (in NA and related parts of universe) or 80MHz wide (elsewhere) ... and 2462/n/eC channel is 40MHz wide. Yeah yeah, I know. There is more bandwidth. Let me try it in a different way: Frequency 2462, Control ch...

erlinden

I have a hap ac2(AP mode) with wifi-qcom-ac connected wirelessly(2.4gHz) to another hap ac2(station bridge mode) every several days it goes through a period of connection disconnection cycle (up to 15 minutes) for no apparent reason signal is between -70 and -74, reason code 1 is given on station b...

erlinden

Does this mean I will have 2 CAPsMAN configurations on the router? Correct One under Wifi (new AX devices) and one under Wireless (for old AC devices)? Isn't there a CAPsMAN menu item? For the old CAPsMAN. I see both menus on the router (without running wifi-qcom-ac package on the router). Should I...

erlinden

The problem doesn't occur only with Intel network cards.

I think he didn't mention that, he just informed us about an updated Intel driver that seems to give him better stability.

erlinden

You don't, CAPsMAN is automatically installed with version 7.13.x and up. It has moved, can be configured on /interface wifi (or the wifi menu item). Here is a link to the official documentation: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-WiFiCAPsMAN And...if you don't use t...

erlinden

/interface wifi configuration add channel.band=2ghz-ax .skip-dfs-channels=10min-cac .width=20/40mhz country=Portugal datapath=data-main disabled=no mode=ap name=cfg-2-main-ax security=security-main security.authentication-types=wpa2-psk .encryption=ccmp .ft=yes .ft-over-ds=yes ssid=Wifi@Casinha add...

erlinden

Still could help to have a look at that topic.

What IP address do you have on the client when managing this routerboard? Is it in the same network segment as where the routers mgt IP is in?

erlinden

You currently have your ap configured as router, what would you like it to be and how would you like it to work?
If you want to know more about VLAN, have a look at this great topic:
viewtopic.php?t=143620

erlinden

TLDR, this doesn't really answer my question.. are there supposed to be hits on DST NAT rules for traffic that is not permitted by the FW?

It depends on the order of rules, if the rule I mentioned is above the others you mentioned it makes perfect sense.
But you would have to answer that.

erlinden

Can you share your complete firewall filter rules?
You don't have this default rule?

/ip/firewall/filter/
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN

Besides this...why would you want to open port 22?

erlinden

Why introduce bridge1? There are many reasons not to have multiple bridges.
But if necessary to have an additional bridge, can you set interface for DHCP-client to bridge1?

erlinden

Without a config it will be very hard to say something, can you therefor share both configs:

/export file=anynameyoulike

Remover serial and any other private info and share between code tags by using the </> button.

erlinden

The WAN port definitely is not part of the bridge. It's sfp-sfplus1 and its by itself.

Indeed, sfp1 is not the same as sfp-plus1...

erlinden

You are making it hard for us as well... Can you please provide the config of the CRS326? /export file=anynameyoulike Remove serial and any other private info and post the result between code tags by using the </> button. Next, please describe all ports of the Dell switch (tagged/untagged/bonded/etc).

erlinden

Looks like you have triple NAT-ting, if the Edgerouter is an additional device. In the end, the CRS is not a router, though it can be configured as a router. But performance will be very poor. Can you supply us with a networkdiagram that also contains the VLAN's? Can you also have a look at my remar...

erlinden

Start from scratch and keep it DRY (Don't repeat yourself): /interface wifi configuration add name=conf2 country=Denmark mode=ap ssid=My_Mgmt_2 channel=chan2 add name=conf5 country=Denmark mode=ap ssid=My_Mgmt_5 channel=chan5 /interface wifi channel add name=chan2 skip-dfs-channels=10min-cac band=2g...

erlinden

Also, clients won't connect to 127.0.0.1 as DNS server, remove that IP from /ip dhcp-server network: /ip dhcp-server network add address=80.144.1.0/24 comment="Network for VLAN600" dns-server=100.48.48.1,127.0.0.1,8.8.8.8 gateway=80.144.1.1 netmask=24 add address=80.144.10.0/24 comment=&qu...

erlinden

/ip dns set allow-remote-requests=yes cache-size=4096KiB max-concurrent-queries=200 max-udp-packet-size=8192 servers=127.0.0.1,31.22.13.211 By setting 127.0.01. you are referring the router to itself, and that is incorrect. Just remove it and leave 31.22.13.211: /ip dns set allow-remote-requests=ye...

erlinden

/interface wifi configuration add channel=channel24 country=Sweden disabled=no mode=ap multicast-enhance=enabled name=cfg24 security=sec24 security.connect-priority=0 .ft=no .ft-over-ds=yes ssid=\ Topp14 steering.rrm=no .wpm=no I prefer to keep things DRY: all security settings can (and should) be ...

erlinden

Anyway - I will update my ticket and revert.

/interface wifi export please (to make sure all is fine).

erlinden

Kid control is not really intuitive, can you explain functionally when users are allowed and when not? Have you followed the example from the documentation: https://help.mikrotik.com/docs/spaces/ROS/pages/129531911/Kid+Control#KidControl-Applicationexample Are you sure the routers firewall rules are...

erlinden

Error message says it clearly.

Oops...

erlinden

Can you try a different power supply? Or is it powered through PoE, @qwertykolea?

erlinden

Here is the part in the documentation mentioning this:
https://help.mikrotik.com/docs/spaces/R ... i-Overview

erlinden

Thanks @Marvitex, new functionality makes perfect sense.
Afaik MikroTik upgraded the Qualcom(?) driver, which seems to have influence for some users (for me only more logging is profided but no problems with stability).

erlinden

What kind of CAPs are you using, @pekulse? Did you upgrade firmware as well as RouterOS?
I have better experience with 7.17RC than 7.16.x.

Did the clients get a (error) message?

erlinden

I agree, except for this part: 2. open port for DNS in firewall /ip/firewall/filter add action=accept protocol=udp port=53 Apart from a missing chain, you don't want to provide access to your DNS server from the internet. And there is a default rule in place that implicitely provides access to the r...

erlinden

Not sure (haven't tried it), but it sounds like something you should be able to do with VLAN's, simple queues and scheduler. But it depends on your use case. What policies should be in place?

erlinden

Welcome to the forum. Anything in the log? Have you tried replacing the power supply? Is the device/rack grounded? What does the network look like? Any information (apart from the model name) might be relevant.
What RouterOS version? What bootloader/firmware version?

erlinden

Security reasons?

I can think of a thousand and more reasons...want to know from @Marvitex.

erlinden

Honestly, for WiFi I'm starting to evaluate something else.

dtim-period=1 is the default, you could try a bit higher, like 3.
Why evaluate something else, if 7.14.3 is working for you. Why upgrade at all?

erlinden

It is strongly recommended to upgrade the bootloader after RouterOS update. To upgrade the bootloader, execute command "/system routerboard upgrade" in CLI, followed by a reboot. Alternatively, navigate to the GUI System → RouterBOARD menu and click the "Upgrade" button, then re...

erlinden

Did you upgrade both RouterOS and firmware?
Did you manually set interface speed?

erlinden

The question is what the actual value is. I only trust the config (through cli export). Can you check what the value is through export?

By the way, I use dtim-period=3

erlinden

I checked the documentation (haven't used IPSEC befor), and found this: https://wiki.mikrotik.com/Manual:IP/IPsec#Site_2_configuration /ip ipsec profile add dh-group=ecp256 enc-algorithm=aes-256 name=ike2-gre /ip ipsec proposal add auth-algorithms=null enc-algorithms=aes-128-gcm name=ike2-gre pfs-gr...

erlinden

I have never changed the dtim-period setting, and currently its value is 0 on both wireless interfaces. With this value, I have clients constantly disconnecting on router OS versions greater than 7.14.3. That's strange as the range is from 1 to 255 (according to the documentation): dtim-period (int...

erlinden

Please share the config to get some relevant feedback:

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Have you upgraded firmware as well as RouterOS?
Have you tested with different LAN cables?

erlinden

There is only one driver for AX devices: wifi-qcom Because you refer to AC device(s), the hAP ax3 isn't the only device, correct? If the AC device is able to run the wifi-qcom-ac driver (it has to be an ARM device), you can use CAPsMAN from the the wifi menu item. Please have a look at the official ...

erlinden

If you replace the hEX with the Synology, do you get higher wireless speeds?
From the information you supply, the hEX doesn't seem to be the problem.

erlinden

You could consider turning on logging (temporarily) to find out what the source IP address is. Unfortunately it is not possible to do anything about DDOS, you would need your ISP. AFAIK the firewall is properly configured and DNS traffic from the WAN site is already blocked without the pre-routing r...

erlinden

do you set VLAN ID in Datapath in capsman

You could have found the information in the supplied links. Just to help you out, AX: yes and AC: no.

erlinden

can you please explain the steps on how to exactly? Just follow the official documentation on this: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample: And in regards to basic VLAN information, there is a great topic: https://forum.mikrotik.com/v...

erlinden

Best wishes, @normis and MikroTik team!

erlinden

With all 7.17 version both beta and rc, when dns adlist was downloaded and applied one cpu stucks at 100% and dns service is unresponsive. After about one minute cpu usage become normal and dns works as expected. I experienced this both on 4011 and 5009 Haven't seen this myself. Can you share your ...

erlinden

Hmmmm perhaps join the latest century............. take advantage of wireguard and other features.........

Assumption is the mother...
Though I totally agree with your arguments, I really want to know from the TS.

erlinden

What "clients"? What "time"?

erlinden

My best guess would be that the Admin MAC address is not set. That would explain some of the mentioned behavior. Could you please share the current config: /export file=anynameyoulike Remove serial and any other private info, post between code tags by using the </> button. Did you, besides RouterOS ...

erlinden

It made me smile... Instead of channels, MikroTik uses frequencies. To get an indication of how you can us it: /interface wifi channel add band=2ghz-ax disabled=no frequency=2412 name=CHAN-1 width=20mhz add band=2ghz-ax disabled=no frequency=2437 name=CHAN-6 width=20mhz add band=2ghz-ax disabled=no ...

erlinden

Don't use VLAN ID 1...ever!

Want to read more:
viewtopic.php?t=143620

erlinden

A good starting point is to read this topic:
viewtopic.php?t=143620

erlinden

I did a bit of rewriting, assuming that your CAPsMAN is the HEX Refresh and you have multiple CAP's: /interface wifi channel add band=2ghz-n frequency=2412,2437,2462 width=20mhz disabled=no name="CH2G" add band=5ghz-ac .frequency=5180,5260,5500,5660 width=20/40/80mhz disabled=no name="...

erlinden

One of the symptoms I would get is that the Stations would not roam from AX to AC and on the interface I would get the error: client was disconnected because could not assign vlan.

Turned out (for me) that by setting ft-preserve-vlanid=no explicitely on the ac devices, roaming worked fine.

erlinden

Exactly, I have switched from ip behind na to public ip on my main mikrotik router and I forget that Allow remote request is enabling requests not only for LAN but also for WAN! It shouldn't as the default firewall rules only allows calls from LAN (interace list). Perhaps have a good look at your c...

erlinden

Why do you want to upgrade?
Any reason not sticking to V6 and upgrade to 6.49.13 (which is current LTS)?

erlinden

You are probably bound to 2 devices.

erlinden

What private IP address does the Windows machine have?
Can you post a route print?
Can you "see" the traffic to this subnet?

erlinden

Can you please share your config:

/export file=anynameyoulike

Remove serial and any other private info.

And in addition to @holvoetn:
https://help.mikrotik.com/docs/spaces/R ... figuration

erlinden

Why would you prefer copper over fiber?

erlinden

VLAN: viewtopic.php?t=143620

erlinden

GOTO: viewtopic.php?p=1114852#p1114852

erlinden

Can you please point me where are the defaults firewall rules? /ip firewall filter add action=accept chain=input comment="accept established,related,untracked" connection-state=established,related,untracked add action=drop chain=input comment="drop invalid" connection-state=inva...

erlinden

You are aware that roaming is between radios as well? Therefor it might help (as clients can roam from 5G to2.4G, or vice verse). You can play with bandwidth to test if that is more stable: 20MHz on 2.4G and 40MHz on 5G. Have you checked with wifi debug logging enabled? Is the firmware upgraded as w...

erlinden

Anyone with a suggestion on what I can change are welcome to comment freely :). What I already haven't tested I will test :). For me setting connect-priority to 0/1 made roaming work for all devices (i.e. the iPhone 11 didn't roam). Furthermore, I prefer to add security and refer to it in configura...

erlinden

Would you care to make a network diagram?
Have you considered using VLAN (because of the remark about bridges, while one should be used)?

erlinden

At least supply the complete config (minus serial and any other private info):

/export file=anynameyoulike

erlinden

Changing channel with did not help, but disabling ft seems to do the trick. Thanks. Guess, I need a new SSID for it? Or a new iPad 8) Because I want to set in future for each wAP own channel for 2.4 Ghz and 5 GHz for non overlapping. (This isn't yet configured) That make perfect sense...while these...

erlinden

Mikrotik 7.17 - band steering does not work even neighborhood group is selected

You could show your config just to make sure that all settings are correct.

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Can you give it a try when channel width is 20MHz (2.4GHz) and 20/40MHz (5GHz).
Another option to test with is disable FT.
Just for testing purposes.

Can you explain why you have multi provision rules (while two are, in your case, enough)?

erlinden

Both installation and country is there to comply with regulations.
It has, afaik, nothing to do with scan results.

Is it possible there are no radios in the neighbourhood transmitting at those frequencies?

erlinden

Why you say, hope not?!?!?

You firewall rules set isn't complete. What made you decide to change it?
Can you please provide a complete config? Remove serial and any other private info.

erlinden

Does your RB get a public IP address? Hope not...

erlinden

Have you enabled debug wifi logging? There might be something showing.

Perhaps this topic is giving some clue?
viewtopic.php?t=174140

erlinden

As well as lots of frustated users, there are also a lot of users that don't experience the problems. For sure, settings does a lot. Might be interresting to see your config(s) to give some tweaks and suggestions. And when it comes to wifi, environment is of great influence. And please have a look a...

erlinden

/interface bridge port add bridge=bridge1 interface=ether1 add bridge=bridge1 interface=ether2 add bridge=bridge1 interface=wifi1 add bridge=bridge1 interface=wifi2 Your wifi interfaces should not be manually added to the bridge. Only have ether1 and ether2 as part of the bridge: /interface bridge ...

erlinden

To learn a bit (more) about VLAN, please have a good look at this (great) topic:
viewtopic.php?t=143620

erlinden

Congratz, nice to hear! The wAP AX is consuming a bit over 6 Watt at my place, according to my PoE switch.

erlinden

I got the Capsman to work in the setup, but only one client at the time can connect out on the internet. Any ideas? Definitely misconfuguration. Mhy best guess (on currently provided information): your L009 is configured as switch and the client gets the public IP address. As @gigabyte091 requested...

erlinden

RB951 is a device I used over 10 years ago. Great device, but very outdated especially with your ISP supplied Internet speed. But...that is not really ontopic... Can you export the configuration (using termin)? /export file=anynameyoulike Remove serial and any other private info and post between cod...

erlinden

Well, you set the first step. Can you show your config, so we can have a look at your current settings? /export file=anynameyoulike Run above command from a terminal, after executing there will be a file. Copy the content, remove serial and any other private info and post here between code tags by u...

erlinden

From the logging I get the feeling that SSH is publically available. Why?
Is this MikroTik behind NAT? As the IP address it is showing is a private IP? Cam you supply a network diagram including IP addressing in it?

erlinden

Welcome, @gftjhnk. Have you red all comments and changed configuration accordingly? Being able to replicate the problem isn't difficult.

erlinden

If it works for you...well done.

erlinden

Remove on CAP: /interface bridge port add bridge=TRUNK frame-types=admit-only-untagged-and-priority-tagged interface=VLAN10 pvid=10 add bridge=TRUNK frame-types=admit-only-untagged-and-priority-tagged interface=VLAN20 pvid=20 /interface vlan add interface=TRUNK loop-protect=on loop-protect-disable-t...

erlinden

/interface/wifi/radio/reg-info country="Australia" number=0 ranges: 2402-2482/36dBm/40MHz 5170-5250/23dBm/160MHz/indoor 5250-5330/23dBm/160MHz/indoor/dfs 5490-5590/30dBm/80MHz/dfs 5650-5730/30dBm/80MHz/dfs 5735-5835/36dBm/80MHz This is from a wAP AX cli.

erlinden

The standard way is: /export file=anynameyoulike Remove serial and any other private info and post between code tags by using the </> button. Always good to have more eyes watching. Can you als supply all involved (MikroTik) hardware? Did you also upgrade firmware besides the RouterOS upgrade?

erlinden

Can you share your config, @epkulse? And anything in the logging that could explain the situation?

erlinden

How is the wireless wire configured? And does the cable modem do any routing?

erlinden

Thanks! My wAP ax now arrived and I did a first test with one device. Works fine with CAPsMAN :-) I have a small question about that. On my RB5009, "cap-wifi1" and "cap-wifi2" do show up. Is there any way to rename the name? As those interface are auto generated on RB5009 and ma...

erlinden

Apart from upgrading RouterOS, did you also upgrade firmware (/system/routerboard)?
Anything in the logging that could be helpfull?
Can you share your current config?

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

As far as I know it is a binary clone. So it should contain everything.

erlinden

From the documentation: https://help.mikrotik.com/docs/spaces/ROS/pages/40992852/Backup (RouterOS V7.x) https://wiki.mikrotik.com/Manual:System/Backup (RouterOS V6.x) Quote from the latter: RouterOS backup feature allows you to save your current device's configuration, which then can be re-applied o...

erlinden

Weren't you on the "My Mikrotik wifi6 works like a charm"-train all the time?

It does

Have done a lot of tweaking finding out I already had best settings.

erlinden

Out of everything I tested, enabling both FT and FT over DS and setting Connect Priority to 0/1 is the solution that made the errors stop. For me, specifically adding the connect-priority=0/1 (in combination with default settings mostl) made my Samsung S21+ and iPhone 11 roam without disconnecting ...

erlinden

It is still not able to receive ip from the isp1 router.

Where is your DHCP client?

erlinden

Any reason you haven't updated the RB5009 to version 7.16.2 (which is currently the latest stable release)?
Make sure to upgrade firmware as well...

erlinden

One needs to know what factory firmware version is installed.
My guess would be version V7.x, which does not have a LTS version up till now.

Is it necessary to have an LTS?

erlinden

This is the correct documentation, assuming that the accesspoints are running wifi-qcom(-ac):
https://help.mikrotik.com/docs/spaces/R ... iFiCAPsMAN

erlinden

Please share the current configuration to help you:

/export file=anynameyoulike

This will create a file (which can be found at files) that you can download.
Remove serial and any other private info and post between code tags by using the </> button.

erlinden

You know the difference between RouterOS and firmware?

erlinden

Just attempted to upgrade to 7.17 RC - have to rollback immediately. No devices will connect to 5 GHz - have no time to spend on further investigation, but something appears not to be OK for sure... Next time choose a moment where you can do some investigation. There could be a perfect good reason ...

erlinden

Allow VPN connections to router( from public internet)?
Why would it be safer than secured ssh access?

An additional layer of security?
Bit worried you asking this question.

erlinden

Could you please share your config, at least the wifi part?

/interface wifi export

Remove serial and any other provate info.
With this config we can provide you with some tips and tricks.

erlinden

https://help.mikrotik.com/docs/spaces/ROS/overview

erlinden

Good to hear, Netinstall requires some patience (but always has worked for me).
I like to buy second hand (as well), and will always perform a netinstall....just in case.

erlinden

The config would really help:

/export file=anynameyoulike

Remove serial and any other provate info, post between code tags by using the </> button.

erlinden

Have you tried swapping the power supply? That would be my best guess...

erlinden

Do some testing with an accesspoint (if you have one laying around). Then you get the best indication on attenuation.

Furthermore, what are your requirements? What will WiFi be used for?

erlinden

If the deivce isn't shown in Neighbors using Winbox (either connected to one of the ethernet ports or via wifi if available) I would do a netinstall: https://help.mikrotik.com/docs/spaces/RKB/pages/1409054/Problems+with+Netinstall Make sure to follow it by the letter. Btw: You can either connect usi...

erlinden

Aah, thanks @infabo! That makes sense (from the quote I posted).

erlinden

Local wifi interfaces aren't provisioned as CAPS: CAPsMAN cannot manage it's own wifi interfaces using configuration.manager=capsman, it is enough to just set the same configuration profile on local interfaces manually as you would with provisioning rules, and the end result will be the same as if t...

erlinden

Yes I use cap ax APs, I have made the changes still getting loads of disconnects and very poor WiFi performance. When I bought the mikrotik kit I understood that wireless might not be top of the line, but I did not expect it to be so bad... Hopefully they can resolve it... Can you post the current ...

erlinden

The only way to do this, is to uninstall the qqireless package and install the wifi-qcom-ac package on the cAP ac. More info can be found here: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-Advancedexamples And here: https://help.mikrotik.com/docs/spaces/ROS/pages/40992872/Pack...

erlinden

I would expect that the VLAN's are configured, specifically per port. Can you share the config, so that we kow what you are talking about? Assuming it is configuraed with RouterOS: /export file=anynameyoulike Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Can someone look through my config too, as I am getting loads of SA Query timeout/ "not responding" errors in the log. Also extremely poor network performance of WiFi.. Can you add/change a couple of things: /interface wifi channel add band=2ghz-ax disabled=no frequency=2412,2437,2462 nam...

erlinden

Couple of things in regard to VLAN are going wrong. First of all, when going VLAN, please go VLAN all the way. So that every network has its VLAN ID (other then 1). Next, you want to have a trunk port configured to which the cAP AX is connected to. This requires VLAN configuring on both RB4011 as we...

erlinden

Also consider replacing with the cAP AX, depending on how the current accesspoints are mounted.
What is the main reason of the upgrade? What are you expecting?

erlinden

If you want to go that way, don't forget to increase transmission power of your mobile devices as well.
The power used is restricted by regulations. Only (correct, in my opinion) way to solve this is add an accesspoint.

erlinden

What is the purpose of having this VLAN? From your config (quick scan) you seem to have a single VLAN on the LAN side. Can you give an explanation of your network? Or better, a network diagram?

erlinden

Nothing special, just a different WAN interface. Can you share your current config?

/export hide-sensitive file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

First get your requirements, as smart as possible. Both technical and functional. Make a network diagram with all devices involved. In regards to your questions: 1. It depends on what you want and how you configure it. 2. It depends. 3. Sure. 4. My RB951 I have had since 2004(?) is still supported. ...

erlinden

I would at least start only supporting wpa2-psk (with aes). Just out of security perspective.

erlinden

Anything about this stand out to you as clearly wrong? Not clearly wrong (at first sight), I totally love the concept of DRY. So, something like this: /interface wifi configuration add name=homeapcfg country="United Kingdom" mode=ap ssid="HOME" add name=iotapcfg country="Un...

erlinden

Did you update both RouterOS and firmware?

Pretty sure support would like to have your supout file. If you have the chance...

erlinden

Could you give these settings a try, @Jef61: /interface wifi configuration add name=homeapcfg country="Netherlands" mode=ap \ ssid="Kraailook" channel.skip-dfs-channels=10min-cac \ security.authentication-types=wpa2-psk,wpa3-psk \ .passphrase="[Moet je nog even zelf invullen...

erlinden

how come be so dificult

To be honost...the administrator is crap or the router is crap. Because the latter is supporting port forwards I would bet my money on the first.

This is pretty much basic networking stuff.

erlinden

Setting it fixed will most probably cause IP conflicts, the router will not be happy about it. Only options I can think of: Select an IP address outside of the DHCP scope Set that IP address in /ip address (make sure to fill in all relevant information) Forward to that IP address You will always nee...

erlinden

Different approach: why do you want it?

erlinden

Why not ask the administator of the router?
You might get into lots of problems when you configure an IP address yourself. And by asking how to do it...you will.

erlinden

Never ever touch QuickSet (unless the device is reset to defaults).

erlinden

My appologies, I have never seen that eth1 is a combined port. No LAN entries with ether1 or ether 2. Shall I delete the marked line with ether1? Change ether1 to ether2 No entry for ether1. Shall I just delete that marked entry for ether2? Change ether2 to ether1 DHCP Client is not enabled and poin...

erlinden

Befor you follow these steps (which are explained quit well!):

The eth1 is a PoE in port, you will have to connect the cAP AX to eth5 of the hAP AX3 to have it powering the cAP AX.

erlinden

Anything in the logging?
Why version 7.6?

erlinden

How do I configure new forwarders in my DNS server settings?

Please check the documentation:
https://help.mikrotik.com/docs/spaces/R ... 748767/DNS

erlinden

FFS, creating a profile just to make fun.

@mndtrip:
*) wifi - added station-roaming support (additional fixes);

In addition, I used the config supplied by @tangent:
https://tangentsoft.com/mikrotik/wiki?n ... ome+WiFi&p

You may want to try this to see if it helps.

erlinden

I have made all the changed you mentioned but still have the same issue.

Please post the updated config.

erlinden

Still No solution for this problem.... An ideas how can solve it? Can you share your config? I read a lot of people running into problems, while others have perfectly stable connections. It might be config related, at least that is pretty easy to analyse. /interface wifi export Remove serial and an...

erlinden

Not only will it do the trick, there is a MikroTik video on YouTube explaining how to do it (though it uses a hAP AX2 as CAP):

https://www.youtube.com/watch?v=bHotZT41w3E

The hAP AX3 is able to provide PoE to the CAP.

erlinden

Can you share your current wifi settings?

/interface wifi export

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

Can you share the CAP config as well?

From the log I understand that the connection between the CAPsMAN and the CAP's is interrupted. Which explains the behavior. Any idea why this is happening? Are all devices connected with network cable? Are the cables tested? What is the number of link downs?

erlinden

Can you share your config?

/export file=anynameyoulike

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

So sad to read that PCUnite's topic is not sufficient. That is absolutely straight forward.
Can you share your current config and explain what you exactly want?

erlinden

Can you add lease-time to dhcp-server:

/ip dhcp-server
add address-pool=dhcp_pool1 interface=bridge name=dhcp1 lease-time=8h

By default it is 10m, which can cause problems.

erlinden

Is quad9 DoH ever going to work properly on Mikrotik ? Has been running pretty stable for some time (think at least 6 hours), but then all of a sudden: DoH server connection error: remote disconnected while in HTTP exchange DoH server response not OK: 403: dns query not allowed DoH server response ...

erlinden

Do some manual VLAN filtering on the CAP, like this: /interface bridge add admin-mac=xxxxxxxxxxxx auto-mac=no frame-types=admit-only-vlan-tagged name=bridgeLocal vlan-filtering=yes /interface vlan add interface=bridgeLocal name=vlan99_base vlan-id=99 /interface wifi datapath add bridge=bridgeLocal c...

erlinden

How does your router know the IP adress of dns.quad9.net?

/ip dns
set allow-remote-requests=yes cache-size=409600KiB servers=9.9.9.9 use-doh-server=https://dns.quad9.net/dns-query verify-doh-cert=yes

Mostly default settings, no DNS entries in the log so far.

erlinden

Is quad9 DoH ever going to work properly on Mikrotik ?

Can't reproduce this behavior.
Can you share your /ip dns export?

erlinden

Personally I would start with one and do some testing. By the number you mention I assume this is a live environment? While doing the upgrade, you might want to consider upgrading to wifi-qcom-ac instead of the wireless driver. But that would be the next step and requires some more investigation. Ha...

erlinden

You prefer ICQ ?

BBS?

erlinden

As the complete bandwidth of 2.4GHz radio is 40MHz wide, I would advise to use bandwidth=20mhz. Roaming works better when you use non overlapping channels. Don't use vlan id=1, instead use something above 1. Don't set antenna-gain to 0, leave it default or set correctly. Missing country, which makes...

erlinden

VLAN filtering should be done on a single bridge:

/interface bridge
add name=GUEST-LAN vlan-filtering=yes
add name=LAN vlan-filtering=yes

Now you have two bridges.

Please read this great topic about VLAN's:
viewtopic.php?t=143620

erlinden

The cAP ac is both with wireless and with wifi-qcom-ac ridicoulisly stable. Though I do prefer the wifi-qcom-ac driver. Has been running for years and years without problems. But it requires some good configuring and tiny tweaking.

erlinden

So extensive they missed 2 reboot steps to make it clear, as shown by the last posts in this thread

Part of the uninstall process is a reboot.

And that is explained here:
https://help.mikrotik.com/docs/spaces/R ... 2/Packages

erlinden

Are you trying to corrupt seniors??

We need to get on a skype/discord chat so we can discuss losing my capsman virginity.

Never too old to lose one's virginity.

And I would call myself...ehm...senior (as well?).

But...Skype? Really!?

erlinden

Was able to upgrade through the App of both my RB4011 and cAP AX. The (two) wAP AX's do not upgrade (hangs on "Download in progress", nothing else happens). Nothing in the logging. Will try with Winbox tonight (currently off site). Anyone else having the same issue? For who is interested, ...

erlinden

There is extensive documentation, also on replacing:

https://help.mikrotik.com/docs/spaces/R ... ss'package

erlinden

From the documentation: Hold this button during boot time and release after LED light stops flashing to reset SwOS configuration and load primary backup firmware. Access to primary firmware allows the reinstallation of the main firmware. Did you perform the reset like this? Netinstall is RouterOS on...

erlinden

Have you tried with a different browser (or at least tried in-private)?

erlinden

Totally agree (except for the 2.4GHz preference, haven't seen that).
And you can run CAPsMAN (new style), @anav! The object oriented implementation

erlinden

Honestly, maybe it's just my opinion but i have a feeling that cAP ac works better than all of this ax stuff...

I wouldn't want to go back (from cAP ac to cAP AX to wAP AX). But that is just my opinion

erlinden

Hey, which logs I could enable to see more detail in the moment it happens. I want to be able to see more detail to be sure if this could be a threat or not.

You haven't mentioned what the log is currently mentioning.
And still waiting for the config...

erlinden

The official documentation (including examples) can be found here:
https://help.mikrotik.com/docs/spaces/R ... ionexample:

erlinden

You want multi VLAN's untagged on a port? Can you explain why?

Search found 2833 matches