MikroTik

Spirch

for me i decided to wait a week or 2 after it got released and when i saw all the bad thing i just decided to wait

i will do the same thing with 4.8.1, i'm in no rush to update my device

Spirch

here it is, i didnt think other stuff were needed other that wifi config MMM MMM KKK TTTTTTTTTTT KKK MMMM MMMM KKK TTTTTTTTTTT KKK MMM MMMM MMM III KKK KKK RRRRRR OOOOOO TTT III KKK KKK MMM MM MMM III KKKKK RRR RRR OOO OOO TTT III KKKKK MMM MMM III KKK KKK RRRRRR OOO OOO TTT III KKK KKK MMM MMM III ...

Spirch

hello it seem sometime i have higher upload than download depending where i am in the house, mostly on the 2.4 band do you see any issue with this config? if anything missing, ask # dec/07/2020 13:43:46 by RouterOS 6.47.7 # model = RouterBOARD cAP Gi-5acD2nD /interface wireless set [ find default-na...

Spirch

i have a drop by default behaviour, i create rules to allow traffics I have now switched to 1 rule per camera and allow one packet per minute instead of one connection. so far this seem to be working, which mean you might be right that a connection was kept open and it might be sending multiple emai...

Spirch

hello i have this simple firewall rule (for cameras); add action =accept chain =forward dst-limit =1/1m,0,src-address/1m40s dst-port =587 protocol =tcp src-address-list =support-CAM my assumption is 1 camera can send 1 email per minute what i am seeing is that there is a lot of email received per mi...

Spirch

ok, i will take a look at vlan any recommended link (other the mikrotik wiki)? text or video. link that can be useful for me, having cAP and hAP, hAP being the main device like link for beginner with kind of best practice, i don't want to follow a guide that will leave security or performance on the...

Spirch

i'm not sure how to create a network diagram but mostly; on the cAP: wireless access point lan1 connected to hAP lan2 connected to dumb switch that provide POE power / access to multiple security camera on the hAP: second wireless access point, main device, dhcp server lan1 connected to isp lan2 con...

Spirch

after testing around with capsman, i made it work ok but after searching online, i can see that the issue of slowness that affect me, affect a lot other people i went back to what it was for now and i will continue looking into a way to route the wireless data/connection from the cAP into the hAP so...

Spirch

Would the best solution be to use CAPsMAN on the hAP to manage all the wireless interfaces and set the datapath to disable local forwarding? thanks this was it i think. i never looked into capsman, tookme 30-45 minutes to get it up and working, nice to see that all 4 wireless (2 per device) are now...

Spirch

i will look into capsman, thanks

Spirch

So, you re telling that up to now you were using a Dynamic Address List to block Wireless clients accessing Local Resources (Layer 2 Traffic )using the Firewall... And now you want to extend that on CAP... You know that this is possible only by using Bridge Firewall right ? Otherwise you blocked no...

Spirch

The "other device connected to cAP" is connected also wirelessly or to the remaining Ethernet port?

both but to be more specific, i want to make sure some wireless client doesn't get to the remaining port, the other way around for now is not important (would be a nice to have i guess)

Spirch

i want all traffic to go through the hAP The traffic anyways will go through the HAP when it must go through the HAP... HAP is your Router, when traffic needs to be routed will go through it... Other than that, HAP can handle Layer 2 traffic and CAP can do it as well... For example, when 2 wireless...

Spirch

if what i'm trying to do is not possible, my next question would be how to bring dynamic address list from the hAP to the cAP

bringing static address list are easy and firewall rule is easy, just not fun to maintain when thing changes, this is what i'm trying to avoid.

Spirch

I have removed hardware offload on both I don't see the reason to do that... You miss one important thing, the devices within the same Broadcast Domain are communicating to each other in the Layer 2, using MAC addresses. Layer 2 Traffic, does not pass through the Firewall. Layer 3 Traffic on the ot...

Spirch

So export the configuration of the cAP to get a useful advice. Check my automatic signature below before posting it. here it is [admin@MikroTik-W] > export hide-sensitive # apr/26/2020 15:52:08 by RouterOS 6.46.4 # model = RouterBOARD cAP Gi-5acD2nD /interface wireless set [ find default-name=wlan1...

Spirch

hello my setup is pretty straightforward I have a cAP ac connected to a hAP ac^2 by cable the hAP is the main router the cAP is just redirecting all dhcp request to the hAP, cAP mostly behave a like a switch I have removed hardware offload on both and I activated tracking connection in the ip firewa...

Spirch

thanks i will see if i can manage to do that, i never used vlan before so it's a good opportunity to learn

just to be 100% sure; vlan in firewall work with hardware offloading, right?

Spirch

I have this diagram working as of now, i would like to add some restriction / security to it the cAP ac is connected by LAN to the hAP ac^2, the hAP handle all dhcp request I have a bridge in the hAP for all port except the WAN, that bridge got hardware offloading ON because of the NAS because of th...

Spirch

You are missing most of your config in the above posting! Of course you should at least post config of switch, bridge, and IP addresses. As it is now it is impossible to see if this traffic is switched, bridged or routed. sorry i misread your text, here is the relevant section /interface bridge add...

Spirch

You are missing most of your config in the above posting! Of course you should at least post config of switch, bridge, and IP addresses. As it is now it is impossible to see if this traffic is switched, bridged or routed. which part of the config you are interested in? i don't really want to manual...

Spirch

one thing i'm noticing is that i can see it in the raw prerouting firewall but not in the input/forward/output

something tell me that I am missing something here ...

Spirch

I might be doing it all wrong but I'm trying to send switch packet to the firewall and it seem that the only way i'm able to do that is to use the switch rule redirect to CPU (everything is in one bridge under hardware offloading) when I create this rule; /interface ethernet switch rule add ports=in...

Spirch

wow 4 pages already, i'm happy to always wait a few days before installing things that can bring down my network or make thing difficult.

people still deploy stuff in mass without testing them?

time to wait a little bit longer and see the evolution of this thread

Spirch

it might be a stupid question but what would be the recommended installation for the cAP ac?

vertical? horizontal? doesn't matter?

thanks

Spirch

I currently have this setup: RB951G-2HnD (6.43.7 (stable)) in switch mode, wifi in station-bridge connected to cAP ac (6.43.4 (stable)) in switch mode, wifi in ap bridge connected by LAN to hAP ac^2 (6.43.4 (stable)) in router mode, acting as dhcp server I have a device connected by lan to RB951G-2H...

Spirch

i can confirm that the cAP ac can't power on the camera.

Spirch

i'm reading that passive poe could be an issue with ip camera poe, i'm not really interested to get one and having to figure out how to send power to it

if you have one that work, which one it is?

Spirch

I just want to confirm ... the cAP ac that I got have came with DC rated for 24v 1.2A which mean about 28.8 watt max, right? so the cAP ac use for itself 13W (based on https://mikrotik.com/product/cap_ac ) it say also that the maximum is 24W does it mean that the maximum POE out is 11W ? I want to p...

Spirch

What you've set using limit=1,5:packet is a limit of not more than 1 packet per second where 5 packets may come initially and still be accepted. If the idea was to permit one packet every 5 seconds, the correct syntax is limit=1/5s,1:packet . Every interval , netwatch sends icmp echo requests 1 sec...

Spirch

I got a hAP ac and cAP ac each one have this specific netwatch rule hAP: add host=192.168.175.125 interval=5s down-script="/interface wireless set interface-WLAN1 disabled=no /interface wireless set interface-WLAN2 disabled=no" up-script="/interface wireless set interface-WLAN1 disabl...

Spirch

Have you tried netinstall using the ARM main package instead? https://download.mikrotik.com/routeros/6.43.1/routeros-arm-6.43.1.npk Also, make sure you are using the newer netinstall 6.43.1 and not an older version. Each time there is a new ROS release, there is a new netinstall version, and using ...

Spirch

Have you tried netinstall using the ARM main package instead? https://download.mikrotik.com/routeros/6.43.1/routeros-arm-6.43.1.npk Also, make sure you are using the newer netinstall 6.43.1 and not an older version. Each time there is a new ROS release, there is a new netinstall version, and using ...

Spirch

for a cAP AC i'm trying to do a netinstall from a windows xp laptop that have nothing else activated than the lan local (old laptop with 10/100) netinstall.exe advanced-tools-6.43.1-arm.npk dhcp-6.43.1-arm.npk ntp-6.43.1-arm.npk ppp-6.43.1-arm.npk security-6.43.1-arm.npk system-6.43.1-arm.npk wirele...

Spirch

i figured everything out and i didnt needed dhcp relay in the end for what i wanted to do.

Spirch

The default protocol mode is RSTP on the bridge interface. It is kind of buggy, so I would change to none...
Code: Select all
/interface bridge
add admin-mac=*** auto-mac=no name=bridge-Relay protocol-mode=none
Other than that, looks good!

thanks a lot, i appreciate!

Spirch

if i transfers a file by LAN it max out the ethernet (1gig), it is under switch mode (0% cpu utilization) my winbox connection drop or get very laggy I assume it is because there is no more resource to the winbox connection, I would like to make a simple queue to give some priority to the winbox con...

Spirch

Actually what you created is a simple bridge. You can remove the dhcp-relay as it is not doing anything. DHCP and Firewall will be handled by your Router. If you want a dhcp-relay, you might start here. https://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Relay hmm good to know one less thing to have in t...

Spirch

this is a very simple setup, dhcp relay to the router connected by LAN, nothing else firewall is handled at the router level (i assume this is ok, im right?) is there any tweak or missing recommended setup or mistake here? thanks [admin@MikroTik] > export # apr/18/2018 19:18:24 by RouterOS 6.42 # mo...

Spirch

WIFI on the cAP ac is WAY better, i dont need to update my hAP ac2 for now since the wifi on it only turn on when the hAP is down and that shouldn't happen often or never if you can tweak it more, that would be nice but for now this local speed is more than my internet which is all i can ask for now...

Spirch

Everyone - We are working on improvements for ARM devices wireless performance within 6.42rc version. Such fixes/improvements can not be backported to older versions and will be included in RouterOS current versions only starting from 6.42 release. Spirch - Most likely you have, for example, DHCP s...

Spirch

im not going to play with rc version or stable version but the h/cAP ac have a wireless issue for sure, i prefer to stick with bugfix for now so im not going to install the other one i got a NAS connected to my hAP ac2 by LAN my computer connected to the hAP ac2 by LAN the cAP ac connected to the hA...

Spirch

i'm not knowledgeable enough but two weird thing happen to me i have a hAP ac2 and cAP ac connected by lan, the hAP is the dhcp server 1. somehow creating a bridge on the cAP took over all the interface of the hAP, i lost internet and when connecting to the hAP ip address, i was in fact going to the...

Spirch

i have a cAP ac and hAP ac2, the cAP is connected by lan to the hAP I want to transfer all dhcp request from the cAP to the hAP and I have followed the wiki on how to create a dhcp relay but i can't seem to make it work (is the the proper way for what i want to do?) both device got no configuration ...

Spirch

the netinstall link on the download page doesnt work

Spirch

so between the 2 bugfix releases this is the actual difference if i understand properly What's new in 6.40.6 (2018-Feb-20 11:04): *) btest - fixed TCP test accuracy when low TX/RX rates are used; *) certificate - do not use UTF-8 for SCEP challenge password; *) certificate - fixed PKCS#10 version; *...

Spirch

availability in Canada for

* new hAP ac² Dual Band Desktop AP, $69
* new cAP ac Dual Band Wall/Ceiling AP, $69

???

Spirch

what do I need to know before i upgrade from 6.37.5 (bugfix) to this one?

is there a place where i can see the whole changelog from 6.37.5 (bugfix) to this one?

Spirch

with current version, is is good to have these or are they completely useless/noise? add action=jump chain=input comment="Drop INPUT Invalid TCP flags" jump-target=BADFLAGS protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg add action=jump chain=input comment="Drop INPUT Invalid TCP...

Spirch

- RB962UiGS-5HacT2HnT-US (USA) is factory locked for 2412-2462MHz, 5170-5250MHz and 5725-5835MHz frequencies. This lock can not be removed. - RB962UiGS-5HacT2HnT (International) supports 2412-2484MHz and 5150MHz-5875MHz range. which one will be available for Canada? and also when is it normally ava...

Spirch

Oh. You maybe meant the client received 127 as its address... If so, set the pool like "192.168.175.2-192.168.175.126".

really?

i was under the impression that the dhcp server would know not to give some ip

Spirch

I have this setup: address: address = 192.168.175.1/25 network = 192.168.175.0 pool: addresses = 192.168.175.0/25 dhcp-server - networks: address=192.168.175.0/25 gateway 192.168.175.1 somehow the dhcp server gave to a client the broadcast address 192.168.175.127 i'm using 6.33.3 where is my mistake...

Spirch

Seems like "/ip cloud" auto time set, or "/system clock" auto time-zone detection.

You can disable both.

I unchecked both and now the "connect" doesn't happen so it was one of them or both

thanks!

Spirch

I just upgraded from 6.30.4 to 6.32.3

Untitled.png

can anyone tell me what this is? i never had that before

Spirch

does mikrotik router support that?

if not is there a plan for it?

Spirch

i'm talking about new generation that that would replace

http://routerboard.com/RB951G-2HnD

and / or

http://routerboard.com/RB2011UiAS-2HnD-IN

something that would include let say "ac" into the wireless by default (and anything else that would help)

target: home and office product

Spirch

I have a RB951G-2HnD with v6.13 and firmware v3.14

is there any reason for me to update to 6.27 if I currently have no issue?

this is a simple home router setup

Spirch

http://www.mikrotik.com/download/share/ ... evnote.txt

thanks

Spirch

is it possible to get current changelog of 6.14, all rc?

Spirch

hmmm this is interesting, going to read the wiki about script this weekend

Spirch

thanks, that thread, from you

, was one that i found while searching on google to have hints while creating my firewall filters

i forgot about it since i looked at like more than 100 links (wiki/forum/page)

Spirch

is there a way to add dhcp-client dns server to an address list?

Spirch

should I add that list that i found or the connection-state=invalid would take care of these? i did a few test with this Nmap Online Scanner to test a few combination(maybe 2-3) and it seem that connection-state=invalid is taking care of these. should i add that list anyway? my understanding is that...

Spirch

simply put the wireless interface to arp=reply-only then add a dhcp-server /ip dhcp-server add add-arp=yes disabled=no interface=interface-WLAN lease-time=10m name=dhcp-server-WLAN then add some lease /ip dhcp-server lease add address=192.168.100.130 address-list=support client-id=1:***** comment=&q...

Spirch

i finally did what i wanted, i'm not a network guy so it took me a while, here is what i did /ip address add address=192.168.100.1/29 interface=interface-LAN1 network=192.168.100.0 add address=192.168.100.81/29 interface=interface-bridge network=192.168.100.80 add address=192.168.100.129/27 interfac...

Spirch

i already have a firewall filter on a specific list for winbox-ip, if you look at the /ip dhcp-server lease, you can see that i'm adding these 3 in a list, which have access to winbox-ip the only thing so far that i would like to do and i'm not sure how is to only have 1 subnet 192.168.10.xxx so i w...

Spirch

I have 3 interfaces LAN1 which is ether2 bridge which is ether3,4,5 WLAN which is wlan1 I want winbox to be available only on LAN1 so i have this /tool mac-server mac-winbox set [ find default=yes ] disabled=yes add interface=interface-LAN1 I have LAN1 and WLAN setup so ip is assigned by reply-only,...

Search found 67 matches