MikroTik

scampbell

I'm testing a connected Relay Board from Bestep connected via Knot Modbus running on RoS 7.13 I can control the board OK via TCP from Windows QModMaster and have confirmed the Boards ID is 255. I'm monitoring the Modbus via Oscilloscope to confirm output from the Knot is occuring. Commands from Qmod...

scampbell

I have received my hAP AX2 - only 80Mhz channel width as far as I can see ?

You can set 160MHz but no supported channel message........

scampbell

Exciting news ! - web based, so the controller can be accessed from nearly any device or platform and eventually phase out winbox. ideally the controller should not be based on java but static binaries deployment or open source ? - better graphing and analytics, time to move away from mrtg. rrdtool...

scampbell

** SOLVED ** I've found the issue - LDP Loop Detect - this had been enabled on some upstream routers and worked (despite not all routers having it set) on a pure RoS6 network. NB - All LSR's should have it enabled or none according to the Wiki and not to use it on TTL networks, only ATM. As soon as ...

scampbell

Same here running RoS7.3b40 - getting from Ros6 OSPF recieved wrong LS ack for inter-area prefix x.x.x.x y.y.y.y 0x80000013 expected 0x80000014 The last numbers of 0x800000xx were always received x, expected x+1 - looks like a simple numerical bug ??? Not feasible to upgrade all routers to RoS7 on a...

scampbell

Scenario - Tower 5 connecting to new Tower 6 - MPLS back to the core, all working under RoS6 fine. I'm looking to use an RB5009 (7.2.3) in place of an RB4011 passing MPLS and LDP in an RoS6 (6.48.6) environment on Tower 6 talking back to Tower 5 (and beyond) and connecting the AP's of Tower 6. T5-R1...

scampbell

From both the wiki.mikroitk.com and help.mikrotik.com: https://wiki.mikrotik.com/wiki/Manual:Tools/RoMON#Secrets https://help.mikrotik.com/docs/display/ROS/RoMON#RoMON-Secrets - configure each router one by one with secrets="","mysecret" yet when you do that...... RoS7.1.1 [admin...

scampbell

I am still seeing this issue on an older Powerbox - "Failed to upgrade poe FW on /dev/poe, diag code -778/0"

Is this a bug or simply unsupported H/W please ??

scampbell

RB750UP (PowerBOX) still not upgrading POE F/W

Failed to upgrade poe FW on /dev/poe, diag code 80/0

scampbell

I have been using Apple and Mikrotik for years and there are only a few things needed to get a stable result..... all have been mentioned here in various locations before..... The below assumes starting with all default Wireless AP/Bridge settings - if you have been tinkering I'd reset the wireless ...

scampbell

PowerBOX v7.1rc1 fails to update poe module.

time=aug/28 01:25:39 topics=poe-out,warning message=Failed to upgrade poe FW on /
dev/poe, diag code 80/0

scampbell

With 5 minutes on hand I have setup a quick example application for a KNOT with DC Relay's attached to work as an access control system using Bluetooth Dongles w/button. The dongle is a generic one from Ali Express with button push feature. BT Dongle.JPG The objective was to be able to toggle the re...

scampbell

Have you tried using SNMP to monitor your throughput on the EdgeRouter with PRTG, Zabbix, Mikrotik Dude etc ? It might save you some work :-) https://help.ui.com/hc/en-us/articles/205223500-EdgeRouter-SNMP But do consider Mikrotik for your routing needs - I believe they are much more programmable th...

scampbell

Can you please also post an export of your wireless security profile please ?

Also you may want to try the new RoS 7.1 Beta 6 with wifiwave2 package.......https://help.mikrotik.com/docs/display/ROS/WifiWave2

scampbell

Yes - 7.1beta6 feature.

Proof:

Also on RoS 6.48.3 and earlier

sntp.png

scampbell

It would be useful when adding a src-address or dst-address to an address-list automatically in the firewall to also be able to include a comment on the address-list entry.

This would allow you to see what rule created the entry.

scampbell

If ISP gave you this for your Mikrotik: x.x.x.31/31 with a gateway of x.x.x.30

Configure it this way: /ip address add address=x.x.x.31/32 network=x.x.x.30 interface=ether1 (say) and manually add static route /ip route add gateway=x.x.x.30

That should also work for you.

scampbell

Plus 1 !! I have a script I use on hAP AC Lite's to create an account and add a skin which works faultlessly - except on the hAP AC3. Even creating a skin under webfig will not allow you to then select it. Still unable to use a skin in webfig under RoS 6.48. I tried manually creating the skins dire...

scampbell

Plus 1 !!

I have a script I use on hAP AC Lite's to create an account and add a skin which works faultlessly - except on the hAP AC3.

Even creating a skin under webfig will not allow you to then select it.

scampbell

Temperature and voltage sensors are gone in this version on Hex POE (RB960PGS). downgrade to 6.46.7 works! This is what I see : MikroTik RouterOS 6.46.8 (c) 1999-2020 http://www.mikrotik.com/ /command Use command at the base level [admin@MikroTik] > sys health [admin@MikroTik] /system health> pr vo...

scampbell

@Paternot I 4 1 do NOT believe that It will do routing at wire-speed ... why I do not believe that .... because for L3 wire-speed requires an ASIC and non of the hardware specs I see have that L3 ASIC in the gear. Yes there will be an improvement in performance but nowhere near wire-speed. https://...

scampbell

Did you find a solution to this ?

scampbell

Winbox already lists only unicast and unreachable for IPv6 routes the same as CLI. Good point - under /ipv6 route in Winbox you are 100% correct. I had been looking under /route filters in the action set-route type which listed all 4 types (IPV4) - any chance Blackhole and Prohibit could show as IP...

scampbell

20 MHz 2.4 signals go 2 channels over. So 1 interferes on 2 and 3. 5 would interfere on 4 and 3. 6 and 7. 1 6 11. Repeat with geographic boundaries. Setting the power levels is the next step. (After physical placement again) Then the reject rules. Totally agree with Gotsprings. Clients have a tende...

scampbell

In that case it would be useful in Winbox to not list invalid route types - as it is in the CLI ??

scampbell

Sorry for taking so long to reply, been crazy busy. The installation was fine, I did try thru winbox thru the IP Address and thru the MAC address, although sometimes I could not even see those. I tried three different computers and a phone. I did make some progress. Doing a manual reset allowed me ...

scampbell

Thank you Mikrotik !! RoS 6.47.1 [admin@crs112-8p-test] /system health gauges> print oid 0 name=.1.3.6.1.4.1.14988.1.1.3.100.1.2.7201 value=.1.3.6.1.4.1.14988.1.1.3.100.1.3.7201 type=.1.3.6.1.4.1.14988.1.1.3.100.1.4.7201 1 name=.1.3.6.1.4.1.14988.1.1.3.100.1.2.7202 value=.1.3.6.1.4.1.14988.1.1.3.100...

scampbell

Any progress on the SNMP Health moniroring please ? Still no Voltage OID's....... 2 years 3 months I reckon since this was first requested ??? [admin@CRS112] /system health> pr temperature: 34C psu1-voltage: 24.3V psu2-voltage: 48.6V [admin@CRS112] /system health> print oid temperature: .1.3.6.1.4.1...

scampbell

Tried v7.0 Beta 4 and that loaded fine so I assume there is an issue with the ARM files on the Mikrotik site.....

scampbell

I tried upgrading a hAP AC2 from 6.45.8 to v7 beta5 by using /system package upgrade and that reports missing npk so downloaded the file and copied to hAP AC2 and rebooted. That reports in the log it upgraded but the router is still showing v6.45.8 :-) ( file used was routeros-7.0beta5-arm.npk 11.5M...

scampbell

Technically you could use both with unequal load balancing if you use OSPF and the method outlined below. We've done this on a number of networks with a lot of success. It's certainly not the simplest way to go, but it's reliable and will use all the bandwidth available. https://stubarea51.net/2016...

scampbell

Thanks @schadom, @R1st0 . We will try to fix SNMP reporting for combo interfaces in the next RouterOS version. Any chance we could PLEASE get the PSU1 and PSU2 OID for the CRS112-8P-4S. They are visible in Winbox and /system health but no OID - only temperature :-( https://forum.mikrotik.com/viewto...

scampbell

[ Normis, Can you please tell us: What is the reason for hiding the files? Because you dont need it. You dont need access to Kernel, you dont need access to Filesystem. I hope mikrotik will never Listen to guys like you. This will Not improve the OS. Note that update packages up/downloaded to the r...

scampbell

Thank you, so weatherproof. But it seems not to be able to assign it downwards. And I did not find a spot diagram. The mounting point of the main building is approx. 10-15m higher than the one of the holiday house. Are there really small masts that can be nicked or will it be no problem not to assi...

scampbell

@scampbell JUST test bridge ARM<=>ARM still works like crap even pure 802.11 in LAB. U need ONE MIPS BE MIPSBE<=>ARM for works but this speed .

I agree NV2 and ARM are not best friends but here is a quick Btest across a pair of SXTsq AC's running NV2:

sxtsqac.jpg

scampbell

1. http://www.hsnetworkmanager.com/pages/index.php
2. https://wiki.mikrotik.com/wiki/User_Man ... r_payments

scampbell

Guys I am mikrotik fun we are on the same sinking boat we have to talk about real world where mikrotik losses in both scenarios PtP and PtMP and where other vendors outperforms it We still use mikrotik for PtMP on new towers but we have to split a 60° AP in 2 or 3 QRT ac to have the same performace...

scampbell

A real example please scampel. If we don't believe it. we are art theory See my last post for an example of an LHG XL 5 set to a 5MHz Channel :-) Unfortunately I am guilty of oversharing my knowledge on some of the things Mikrotik's are capable of. I shouldn't have mentioned the 30Mhz feature as th...

scampbell

Welcome, there is nothing wrong on your Setup, Limit transmit Power would possible gives a Bit more speed (you are about -34, this is to much, -50 ist ideal) But for real ac Speed you Choose the wrong vendor I agree on the TX-Power. Also what method of speed test is being used and are you running i...

scampbell

I am not sure what is wrong in your config but I agree the signal strength is too high (devices yelling at each other) - please publish your wireless config so we can see what country, regulatory settings, tx-power and aerial gain you are using. Below is a shot of a NetMetal running Ceee AC with con...

scampbell

A real example please scampel. If we don't believe it. we are art theory See my last post for an example of an LHG XL 5 set to a 5MHz Channel :-) Unfortunately I am guilty of oversharing my knowledge on some of the things Mikrotik's are capable of. I shouldn't have mentioned the 30Mhz feature as th...

scampbell

https://wiki.mikrotik.com/wiki/Manual:Wireless_Advanced_Channels @scampbell, Wireless Advanced Channels feature has a rather limited applicability, meaning just a small number of (mostly outdated) boards support it. Just check this out: Wireless hardware table . Hi Andriys, Thank you for your feedb...

scampbell

before the easy 500-700 megabytes and now 5-10-30 mhz are you sure you are talking about mikrotik or other sellers?

https://wiki.mikrotik.com/wiki/Manual:W ... d_Channels

scampbell

it is not clear to me if mikrotik is still betting on the wisp or not ... Mikrotik have many advantages for small WISP's - their low cost CPE and low cost AP's are great. 120 Degree sectors work really well for low density rural sites, Ive been involved in deploying many mANT15's and we get 20-50Mb...

scampbell

This is my configuration. I have asked you to recommend a firware and they have not done so I consider that anyone is good and I do not think I have to change that, right ?, On the other hand that accuses me of spaner. I will not stop telling the truth because others like you deny reality. To the o...

scampbell

Hi Nathan, While counter-intuitive it seems Clearing Priority of a packet as it passes through a bridge has been a "default" in RoS for a long time. Logically setting priority from ingress would make more sense as a default action to me too...... For any QoS structure we use both ingress p...

scampbell

Please post your dst-nat rule.

Hikvision works fine with Mikrotik, both for web and IVMS client

scampbell

Hi Dirks, The aerial for the WAP60AD is a 8x8 multi-sector array starting at top left 0 ending bottom right 63 (think in terms of a 8x8 grid or table) so sector 27 or 35 is roughly in the middle while sector 34 is meaning a little to the left and perhaps down a bit. This is indicated in the client t...

scampbell

I comment on simple for any future readers like me (Correct me if I'm wrong). 1. OSPF interface [network type] from broadcast change to point to point , do this in Routers . 2. OSPF interface , enable Use BFD 3. Wlan interface , [Multicast Helper] from default to full . Hi ViREnG, Network type=poin...

scampbell

Even if VPLS tunnels go down for some reason, they typically only take 10 seconds to come back, not 60. The 60 seconds makes me suspect that it is actually something else that is going down, most likely something like OSPF, or possibly LDP neighbor. You should be prioritizing OSPF and LDP over the ...

scampbell

bump please

scampbell

LDF5 (802.11n) is available in Germany

LDF5 is in stock in New Zealand too - we can ship worldwide

scampbell

I would like to see an "add comment" feature on any rule that allows you to add an address to an address list so the created address list entry has info about why it was added. e.g /ip firewall filter add action=add-src-to-address-list address-list=Blacklist address-list-timeout=5d chain=i...

scampbell

CAPsMAN v2 is included within the Wireless package. Just make sure you have the latest RoS and you are running the latest CAPsMAN

scampbell

We distribute the Metanoia V5311-T-R in New Zealand and are working on this with the manufacturers. We have the V5311-T-R working now on NZ EUBA ADSL in a test environment currently. Once all tests are done we will contact customers directly with the necessary updates. What method do you use to rea...

scampbell

I've recently purchased this to use with ADSL, but I can't seem to get it working. The LED is green which seems to indicate SHOWTIME. I've set up an interface on my CPE as VLAN 6 (matching VCI/VPI 0/100 which is what I need) and used a PPPoE client, but it doesn't receive any packets on the interfa...

scampbell

On your AP I would suggest disabling the bridge vlan features and try again. Here is a sample config that supports VLAN's on an wAP AC with management on VLAN 1001 /interface bridge add name=bridge-trunk /interface wireless set [ find ] disabled=no /interface vlan add interface=bridge-trunk name=vla...

scampbell

If you are logging into your LAN via PPTP and assigning your remote connection an IP address from the local LAN range then you will not be able to see devices in the local LAN like you report. The reason is due to your subnet and ARP. Your remote device gets an ip address like 192.168.88.77 with a n...

scampbell

There should be no further action on the Mikrotik needed (assuming no restrictive firewall rules). It should show two routes with flags DAC for both 172.30.30.0/30 and 172.29.29.0/30 When routing traffic your source device need a route to your destination and your destination device needs a route ba...

scampbell

For 2.4GHz only use 20MHz and channels 2412, 2437 or 2462. Also add in two access list rules, one to accept connections between -80..120 and another to reject signals -120..120. This aids handoff from one AP to the other and feel free to alter the -80 threshhold. Also you may want to reduce the tx-p...

scampbell

In addition to what R1CH says, TKIP and/or WPA (not WPA2) if used, will drop performance on Wireless N networks to no more than 54Mbps - if we see TKIP and/or WPA-PSK anywhere we disable it :-) If a device requires TKIP that represents a sales opportunity to replace the device ..... Here is an inter...

scampbell

I have upgraded a CRS125, wAP AC and RB751U all to 6.41 on the same network. All devices upgraded OK and are working but only two devices showed the new 6.41 Routerboard F/W. The RB751U interestingly shows a blank where you would expect to see the new F/W (6.41). Is this a limtitation of the older h...

scampbell

You state you want to redirect the destination ip address (subnet) 172.16.0.0/24 to the ether1 port 172.16.0.0/24. I beleive in this example ether1 should already have an IP address in the 172.16.0.0/24 network (and not 172,16.0.1/24 presumably) ? If this is the case a dynamic route to the 172.16.0....

scampbell

If you do not have any registered clients on your WLAN1 interface it will not show a Running Flag (R). Consequently any IP Address and DHCP-Server will be in an inactive state. As soon as a client registers the DHCP Server should change colour and start working. If you were to create a bridge, add t...

scampbell

I haven't tried these but may do the job ?

http://www.l-com.com/bandpass-filter-rf ... an-systems

scampbell

Hi Tommy, Have you tried 802.11 protocol instead of NV2 for the backhauls ? I have found this can outperform NV2 in a P2P situation - let me know if it helps :-) Set station end protocol to "nv2-nstreme-802.11" first then change the bridge end to 802.11 for the test. Don't forget to create...

scampbell

Also consider that as the gain of an Omni aerial increases the vertical coverage decreases i.e coverage below the horizontal plane of the aerial. So if you have a 3 dB Omni you get not so much distance but coverage is good below the aerial. As this gain increases the distance improves but coverage b...

scampbell

Auto settings on 20/40MHz in area with 30+ 2.4Ghz network works just fine with mine rb951, so it should for him For sure it should work, but currently it does not. So to fault find it is best to go to basic methods and settings, check frequency usage and other AP's in the area and get stability. On...

scampbell

Try this.... the resultant file "sniffer.cap" can be viewed in Wireshark and shows mac and signal strength. I couldn't set the duration of the test (interval only allows up to 5 seconds) so some trial and error required. [admin@test] /interface wireless sniffer> sniff wlan1 append as-valu...

scampbell

Try this.... the resultant file "sniffer.cap"can be viewed in Wireshark and shows mac and signal strength. I couldn't set the duration of the test (interval only allows up to 5 seconds) so some trial and error required. [admin@test] /interface wireless sniffer> sniff wlan1 append as-value ...

scampbell

I would not use "auto" frequency. Do a scan and choose the best channel (ideally 2412,2437 or 2462) .

I would also recommend not to use 20/40MHz - try 20MHz only, especially if you are in an urban area with many adjacent AP's.

scampbell

In a hotel situation for 2.4GHz be sure to only use 20MHz channels, protocol=802.11, set distance=indoors, ht-guard-interval=long and only use channels 1,6 & 11 (2412,2437 and 2462). The access rules you already know about. Why to use 20 Mhz and why 1,6 and 11 channel? Can you please explain? I...

scampbell

The connect list controls what ap’s the wireless card can connect to. It allows you to specify multiple ssid’s and security profiles. On an Ap using WDS it can be used to control which other ap’s it will link with.

scampbell

So a new CRS326 running SWoS 2.5 against an RoS Router DHCP does send through the port info on first connect of a client device.... But if I pull the cable and then reconnect via a different port it does not always send through the Relay-Agent-Info through to the DHCP-Server. So this feature works b...

scampbell

In a hotel situation for 2.4GHz be sure to only use 20MHz channels, protocol=802.11, set distance=indoors, ht-guard-interval=long and only use channels 1,6 & 11 (2412,2437 and 2462).

The access rules you already know about.

scampbell

Easiest way is by having someone monitor the registration for you while you adjust - this can be done from either radio - just watch the CH0 and CH1 registration and adjust for best signal. You will need to do both ends of the link to get the best result. You could do it your self if you can juggle ...

scampbell

You have 16dB difference between your chain 0 and chain 1 settings - I would resolve that first.

Check alignment and clear line of sight.

scampbell

Any of the 5GHz SXT's would do the job - if you want more than 100Mbps make sure you choose one with a Gigabit ethernet interface.

You can configure them as a bridge or routers - that is the flexibility of Mikrotik

scampbell

You might also wish to set the Wireless Protocol to 802.11 instead of "any"

scampbell

Capsman can set the TX power but does not automatically adjust the TX power. Typically we set TX power to 17-20 dBM for all AP's

scampbell

Multicast package must be installed

I do not believe this is correct - Multicast package is for PIM and IGMP Snooping.

This topic is relating to OSPF Multicasts and Wireless handling of the packets.

In Winbox under Wireless you need to enable the advanced button to see the Multicast settings.

scampbell

You can redirect on login to a specific site - and then users can go to whichever site they wish. https://aacable.wordpress.com/tag/mikro ... ful-login/

scampbell

Use only source subnet in your rules should resolve that.

You can use in-interface as well but from your earlier post I thought test.wlan was an SSID not an interface ?

scampbell

On your RB2011 if your ethernet ports are either bridged or switched together then the vlans will be passed between them transparently - same as in the wireless config. In respect to the mangle Priority tags are not passed through a bridge so you need a Mangle rule to achieve that on the QRT (and RB...

scampbell

Access lists will allow you to control what device connects to which AP but you have to manually decide. Perhaps you could do some OUI lookup to determine 5GHZ capable devices or deny access for a while and see if they connect to 5GHz and if not then allow 2GHz ? It would be a good trick if we could...

scampbell

in-interface must be an actual interface e.g wlan1, wlan2 etc. It cannot be an ssid. Also you can only redirect to one DNS server, so one rule for UDP and one rule for TCP. add action=dst-nat chain=dstnat dst-port=53 in-interface=wlan1 protocol=udp to-addresses=DNS1 to-ports=53 add action=dst-nat ch...

scampbell

The biggest issue I can see with WiFi is it only works line of site. If it were me I would install an omnidirectional AP on the car (assumes a racetrack or similar) with client devices connected to it (sector aerials) and use mesh (HWMP+) to get you access to the camera stream. There was a presentat...

scampbell

In marketing terms how does the hAP AC compare to D-links etc? I mean in terms of AC1900, AC3200 and so on. The hAP AC is a 2 chain 2.4 Ghz and 3 chain 5 GHz router, so 2 x 150 + 3 x 433.3 = 1600 which would be AC1600 The hAP AC lite is a 2 chain 2.4 GHz and 1 chain 5 GHz router, so 2 x 150 + 433.3...

scampbell

The new Wireless Wire would be perfect for that - even supposed to work through windows......https://download2.mikrotik.com/news/news_78.pdf

scampbell

For EoIP on Public interfaces do not forget to allow GRE (47) on your input rules.

scampbell

I am looking at the config and it seems you shouldn't need all these VLAN's and bridges - in Bridge<->Station-Bridge mode the QRT's will pass all the VLAN's directly (i.e transparent bridge.) to your RB2011's. /interface bridge add name=bridge-trunk /interface bridge ports add interface=ether1 bridg...

scampbell

If you compare your Tx and Rx rates in the registration table they are approx 60% different which matches your real world result. Antenna polarisation may be influencing this - perhaps use an extension USB and adjust position of the adapter to get a better registration. Also data rate of wireless is...

scampbell

1. Use a current RoS 2. Set tx power to 17dBm 3. Use Channel width=20MHz - 20/40MHz is not universally accepted by all devices and uses a lot of spectrum 4. Set distance=indoors 5. Disable TKIP in your security profiles - it limits speed to 54Mbps 6. Set ht-tx-chain=0,1 and ht-rx-chain=0,1 where su...

scampbell

Currently the map appears to start in Riga (not sure why ?? hehe ) but it would be nice to have it default to the users default location ? Or allow passing start point via URL so we could add a link on our website and have it default to our own country ? +1 for change default location to user curre...

scampbell

Currently the map appears to start in Riga (not sure why ?? hehe ) but it would be nice to have it default to the users default location ? Or allow passing start point via URL so we could add a link on our website and have it default to our own country ? +1 for change default location to user curre...

scampbell

You need two unique datapaths configured in capsman, one for each SSID. On the CAPsMAN Controller create two bridges, apply unique IP and DHCP combo on each bridge. Then create two datapaths, one for each bridge. Specify which datapath to use with which ssid (done in CAPsMAN Configuration) CAPsMAN w...

scampbell

If you are testing SXT's in one room I would recommend reducing Tx Power on all radios so they perform better. Default Tx power in one room gives terrible results. Make sure you choose different non-conflicting channels for each radio pair, use scan or frequency usage to choose the best two channels...

scampbell

Start point - Well I guess I now live in Wellington - where ever that is or what country it is in.

Out of missile range we hope

scampbell

Currently the map appears to start in Riga (not sure why ?? hehe ) but it would be nice to have it default to the users default location ? Or allow passing start point via URL so we could add a link on our website and have it default to our own country ? UPDATE: It actually does this now e.g: https...

scampbell

Currently the map appears to start in Riga (not sure why ?? hehe ) but it would be nice to have it default to the users default location ? Or allow passing start point via URL so we could add a link on our website and have it default to our own country ?

scampbell

Nice work. Thank you

scampbell

NV2 Sync appears to be working ok on my trial site, but... While you can only configure it with CLI to work, if you change anything else in Winbox relating to Wireless it loses the CLI configured NV2 settings on close. Can we get this fixed ASAP please ? Also /interface wireless monitor 0 shows the ...

scampbell

Sorry - I thought they were proposing including WLAN in the bridge ? 2) proposed change: put the management ether1 port also into the same bridge with wireless and rest of the ethernet interfaces and place the dhcp-client on the bridge interface. Agree the rest of what I want is the same as the prop...

scampbell

My preferred config would be : 1. ether1 in BridgeLocal only (no WLAN - leave that for Capsman Datapath to sort) 2. Cap enable, Bridge=BridgeLocal, Discovery Interface=BridgeLocal 3. DHCP-Client on BridgeLocal And my biggest wish - this be the Factory Default for all wAP and cAP products. Have E1 fi...

scampbell

If the first radius returns it will revert back to responding first.

See viewtopic.php?t=85474

scampbell

I found one site (W10 Desktop) required additional parentheses (as below) - not sure why but it sorted a file not found error.

Windows ????

"%HOMEPATH%\Desktop\winbox.exe" [Device.FirstAddress] "[Device.UserName]" "[Device.Password]"

scampbell

There is a setting under system ports to disable firmware. I tried this followed by a reboot but no joy on lte devices.....

Sent from my iPhone using Tapatalk

scampbell

I tried this today and no lte device could send Sms but 3G devices that show as ppp could send or receive Sms provided the ppp interface was disabled. I think it is a limitation of LTE ? I even tried an sxt lte from
Mikrotik [emoji3]

Sent from my iPhone using Tapatalk

scampbell

Mangle can work in prerouting, input, forward, output or postrouting chains.....

Sent from my iPhone using Tapatalk

scampbell

Mikrotik will check ppp secret then radius. So you can either duplicate your accounts and activate them using net watch or set up a backup radius server

Sent from my iPhone using Tapatalk

scampbell

Check no av, firewall or virtual box on pc. Also try a fixed IP address....

Sent from my iPhone using Tapatalk

scampbell

Try accessing via another router using ip neighbour and then right-click to open with Mac-telnet

Sent from my iPhone using Tapatalk

scampbell

Named interfaces only work on interfaces point to point (ppp) addresses otherwise there are too many possible valid hosts to know which one is the next hop.

Sent from my iPhone using Tapatalk

scampbell

Also note the PoE out port is Passive 24v PoE not 802.3af/at PoE (48V). What standard does your device use ?

scampbell

The example was so Winbox could be accessed via either WAN. Note also a Remote VPN can connect via either WAN (subject to firewall rules) and then any VPN traffic will automatically flow over the correct WAN. If you are doing a site to site VPN that's another issue that will require routes or IPSEC....

scampbell

Hi Farshad, If you use connection-marks to identify traffic FROM a specific WAN t0 allow the response to then return through the correct WAN then passthrough=yes is required. So for just Winbox and VPN you would say: /ip mangle /ip firewall mangle add action=mark-connection chain=input comment=In-Ne...

scampbell

Could you have a solution for multi WAN enviromment? Can I choose what WAN interface would be bind to that service? IP Cloud will use the WAN with the smallest distance by default. If you want to specifically use a different WAN then you would need to use a Mangle Rule on the Output Chain to captur...

scampbell

Please post an export e.g "/ip firewall export" and paste the results in here.

Here is an excellent article on how to set up dual wan that may also assist

https://aacable.wordpress.com/2013/12/0 ... oe-server/

scampbell

I think that this version has problems with: - Winbox session can't be established - The Dude has massive Datastore usage - There is no way to upload file in "The Dude -> Files" Copying files across via Winbox drag 'n drop seems to work ok. I recall reading that is the way forward now. No...

scampbell

Try setting channel to 20MHz Ceee and protocol=802.11. Also check no other wireless devices are using 5180 Ceee.

Ensure your wireless security profile does not use TKIP. Just AES is best and wpa2-psk only.

Sent from my iPhone using Tapatalk

scampbell

If you are sure firewall is not stopping any packets then enable IPSec in the logs and see what is happening.

Sent from my iPhone using Tapatalk

scampbell

If you enable IPSec you also need to allow Protocol 50 and UDP 500 & 4500 in the Input chain on both routers. Hope this helps.

Sent from my iPhone using Tapatalk

scampbell

I understand this topic is roaming, but I also get asked a lot about band steering on Capsman ? This would also be a nice feature to have ?

Sent from my iPhone using Tapatalk

scampbell

http://wiki.mikrotik.com/wiki/User_Manager/Introduction#What_is_User_Manager "The MikroTik User Manager works on x86, MIPS, PowerPC and TILE processor based routers and CHR devices" UM is not supported on ARM, MMIPS and SMIPS currently. Is there a timeframe please ? The RB3011 or RB750GR3...

scampbell

please check the out put of "/queue simple export" ?

scampbell

Please check your cisco will actually reply to an ICMP Ping ? Also check if the interface the IP address 22.22.22.1/24 is attached to is active. If not then the IP may also not be active. What about pinging 22.22.22.2 ? does this work ? What about traceroute ? The cisco is physically attached to bot...

scampbell

Here is a presntation from one of the MUM's - check out page 11 onwards -it describes most of the limitations and benefits of the different methods

http://mum.mikrotik.com/presentations/P ... 012-PL.pdf

scampbell

The current rule set works. You are correct it works - but I would still recommend removing that section of the rule as it is not required WithTcpFlag.PNG It is common when rules have been checked in Winbox and options opened but not actually filled in for entries like that to get left behind as or...

scampbell

You cannot bridge mode-station. You can't, but you can bridge an EoIP tunnel layered over it. You can, true, but it is not as efficient as a simple bridge. If you really wanted to layer a tunnel over that type of link vpls offers a 60% faster solution than eoip and full unfragmented Mtu of 1500 or ...

scampbell

DHCP is a layer2 function so connect clients to specific client interface/vlan with a suitable DHCP-server and pool.

Sent from my iPhone using Tapatalk

scampbell

DHCP is a layer2 function so connect clients to specific client interface/vlan with a suitable DHCP-server and pool.

Sent from my iPhone using Tapatalk

scampbell

Check /ip services http is still enabled on port 80 ? Also firewall for http traffic ?

Perhaps Somone has disabled these ?

Sent from my iPhone using Tapatalk

scampbell

Thanks for your feedback, that is really appreciated. The area I need to cover is a harbour of about 120 x 260 meters. In the harbour their are a lot of boats (obviously) with masts (sailboats) as wel as metal boats. The requirement is that there is good WIFI reception inside the boat. Cabling is n...

scampbell

Sounds like the switch chip is still working but routeros has hung. I'd suggest sending a supout to Mikrotik.......

Sent from my iPhone using Tapatalk

scampbell

Station-wds is not optimal in an 802.11n environment as it does not work well with packet aggregation ampdu etc which gives the higher speeds

Sent from my iPhone using Tapatalk

scampbell

You cannot bridge mode-station. If mikrotik to mikrotik wireless use mode=station-bridge to connect to mode=bridge or mode=Ap/bridge

Sent from my iPhone using Tapatalk

scampbell

Your default input drop rule has a setting of tcp-flags=""

This is probably the problem. Remove any reference to tcp-flags and it should then catch anything not specifically allowed before that.

Sent from my iPhone using Tapatalk

scampbell

I would enable rules 3 and 8. These will block all internet access to your router and protect your LAN.

Do check that e1 is your wan interface as it may not be if you run pppoe or a vlan to get to the internet.

Sent from my iPhone using Tapatalk

scampbell

If you want the system to fail over should one or the other WAN stop then you need to add a backup route for each WAN (being the other WAN and a higher distance. You have done this for the main routing table but not for the to_WAN1 or to_WAN2 tables. #Main Routes add check-gateway=ping comment=Telne...

scampbell

I just had a really strange problem with the upgrade from 6.36 to 6.37 When I did the upgrade (using the Mikrotik check-for-upgrade via winbox), the Mikrotik (RB435G) did the upgrade to 6.37 however in Winbox, there was no Wireless section In packages there were two wireless packages, one was 6.37 ...

scampbell

I just had a really strange problem with the upgrade from 6.36 to 6.37 When I did the upgrade (using the Mikrotik check-for-upgrade via winbox), the Mikrotik (RB435G) did the upgrade to 6.37 however in Winbox, there was no Wireless section In packages there were two wireless packages, one was 6.37 ...

scampbell

I can also confirm the wireless upgrade problem when upgrading to 6.37. In this case going from 6.24 using wireless-fp, the upgrade went through but afterward I had wireless 6.37, wireless 6.24 and wireless-fp 6.24 all present and disabled. Uninistalling via CLI did not remove them. Downgrading to B...

scampbell

Hello Folks! We have been running an wireless enterprise environment for many years, we had to fully stop the update of all our devices since it has been announced that DFS mode has been put on based on which country you set. But how can I see if DFS is activated on my devices which I tested to upg...

scampbell

Beware of mtu's though. if you push multiple vlans through an eoip tunnel you decrease the mtu as the vlan headers take up 8 bytes.

Sent from my iPhone using Tapatalk

scampbell

There is a Winbox packaged up for Mac on this forum which works nicely

Makes sure initial connection is not via ether1 as this is fire walled by default.

Sent from my iPhone using Tapatalk

scampbell

Enable PPTP logging in /system logging add topic=PPTP and see if that gives better information. Also make sure your input firewall rules are allowing PPTP or setup etc. ensure no dst-nat rule is redirecting the traffic too [emoji12] Allow tcp 1723 and gre in the input chain. MikroTik PPTP is pretty ...

scampbell

MikroTik web proxy does not support 443

Sent from my iPhone using Tapatalk

scampbell

Well I found the problem it was related to a third party firewall in the network which was causing some issues and its now resolved. Apparently it was blocking all traffic to Port 89, as soon as I had put an exception everything started working normally

That'll do it

scampbell

enable wireless-cm2 and reboot - WPS should be back.

scampbell

Would this include access to /tool sms and /tool e-mail for example ?? :-) Pretty much that. However email tool is already accessible for use with notifications. http://wiki.mikrotik.com/images/f/fc/Dude-email-notif.PNG Haha - of course e-mail is there - sorry. How long until we may see access to t...

scampbell

Yup,

we also have lots of inquirys about 24port poe switch...

+1 !!

scampbell

@dimsoft

That is not possible at the moment. However we do intend to add some access to server host ROS side for better notification options.

Would this include access to /tool sms and /tool e-mail for example ??

scampbell

I concur with BlackVS.

We often create a scheduler to reboot router at midnight with just "/system reboot" as the only command - it works well and is only "interactive" when run from a console.

scampbell

False alarm. I have installed new Win10, and now everything working great. The question is what peace of software killed netinstall last time. I will do step by step app install... This is going to sound stupid... but have you tried changing its name? No joke! After installing Windows 10, I had the...

scampbell

/interface wireless set [ find default-name=wlan1 ] band=5ghz-a/n Perhaps setting wireless mode to 5GHz-onlyac or 5ghz-a/n/ac might also help (on both ends) ? My bench testing with registration signal of -50dB is giving 450-500 Mbps UDP - but only 120Mbps TCP on 802.11 80Mhz Ceee WPA2-PSK I'll be t...

scampbell

deleted - off topic

scampbell

Mikrotik. I have to say, this is one of the nicest pieces of hardware you have designed. My only real feedback is that a LED visible from the outside would be welcome. This way we can see at a glance if the unit is operational. We use the LED all the time on our Motorola, AeroHive and Ubiquity AP's...

scampbell

Also try /system package print

You may be using wireless-fp which does not support WPS anyway

scampbell

Did you get anywhere with this ?

I just tried to link a CRS226 via SFP1 and S-RJ45 to ether25 on a CRS125 and no traffic would pass.

Going to look into this further and will see what I find

scampbell

This installation is for a hotel, therefore I dont think that enabling local forwarding would make any sense

We use these in hotels with local forwarding. If you use managed switches then it shouldn't be an issue and you can use VLAN's if necessary for isolation.

scampbell

Local forwarding has been disabled in the CAPsMAN settings, for all APs All RB912 on the same network are configured with a bridge containing both ether1 and wlan1, and they are functionning quite nicely; it is only the wAPs that seem to have a problem with this setup Lastly, I don't see the purpos...

scampbell

Input is to the router and output is from the router. If you want to stop dhcp from
Goin through the bridge the forward chain would be where I place those rules on the bridge filter

Sent from my iPhone using Tapatalk

scampbell

Tx/Rx Signal Strength: When aligning the endpoints you want this as high as possible ( -40 to -65 dBm say) Tx/Rx CCQ: This shows how many packets get through , so 50% means half are getting dropped. Good TX/RX Signal and poor CCQ is a sign of interference - try a different channel Signal To Noise: T...

scampbell

Google is your friend - https://en.wikipedia.org/wiki/List_of_WLAN_channels :D Ce or Ceee mean centre channel plus next channel (or channels). So 2412 Ce would be 2412 + 2432 - note on 2.4GHz we recommedn only 1 (2412), 6 (2437) & 11 (2462) with 20Mhz Channel widths to avoid overlapping coverage...

scampbell

You can use the connect list on your WDS AP's to establish which devices form WDS links - http://wiki.mikrotik.com/wiki/Manual:In ... nnect_List

scampbell

Thanks for your response Uldis On the wAPs the bridge systematically ends up using wlan1's MAC address. I did try to set the bridge's admin MAC address but as with the wireless' MAC address, the interface isn't reachable via layer 3. I don't understand why it works at the moment, that is, by not ad...

scampbell

It would be good if wireless-rep became the default and they deprecated all the other wireless packages :) Mikrotik confirmed to me last night wireless-cm2 would be the default on the next batch which is something. No doubt wireless-rep will become the only package at some point but hopefully they ...

scampbell

When they arrive they have the default config with firewall on ethernet and open wireless. So if you want to manage them you need to connect to the wifi, or reset them into CAP mode. To reset into CAP mode, power them up whilst holding the reset button in. The wireless lan lights will flash, and af...

scampbell

Is it possible to add more information about connected user to CAPSMAN view with wireless-rep package? e.g. user name being used, auto-translation of vendor part of MAC (well it´s a gimmick) http://fs5.directupload.net/images/160414/nfdarvre.png If your were to create access lists based on the OUI ...

scampbell

Show your config for ether5 and the VLAN. my config on ether5 and vlan is exactly like my 1st post. Interface vlan40 add to ether5 and i created dhcp server for vlan40. Unless your PC is using inserting Vlan Tags it will be looking for DHCP on ether5. Use the Torch function with all options enabled...

scampbell

Assuming this router is running OSPF it is strange there are no known OSPF routes at all in the routing table ? They should show with a flag of "o" ? Perhaps "/route ospf export" and "/ip add pr" from the router with the default route and the one wishing to receive it p...

scampbell

If you mean can you receive and process a PPTP connection request from multiple clients masqueraded behind one remote public IP then yes that should work as each connection will have a unique src-port. For example 10 of your staff are staying in a hotel and all want to connect back to the office via...

scampbell

Mikrotik offer a scripted method of blocking sites here :- http://wiki.mikrotik.com/wiki/Manual:Sc ... c_websites

scampbell

Did someone try to this new feature? >> wireless background scan I wanted to script a background scan for known Wifi-APs and if found, connect to it automatically. The Microtik is in a car, and I know several Wifi along the road (while stopping the car!). The Idea was: Scan for known ssid's (or MAC...

scampbell

It is sometimes worth disabling RSTP on the bridge as well...... for whatever reason I have noticed RSTP sometimes incorrectly disables ethernet ports on the newer versions of RoS. I've not been able to "pin" this down but by disabling it when I am getting ethernet issues the performance h...

scampbell

Hi SSI, I would suggest following this example http://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Relay#Example_setup Also check your HP Switches support L2MTU 1594 ? From what I can see your example is pretty much like the above except that you are using an MS server as primary DHCP. Here is my interprea...

scampbell

Thanks for the help! Here are the results for mturoute: http://imgur.com/8Iqq4ar.jpg And here is the mtupath results: http://imgur.com/jjnmK64.jpg I would check the MTU and MSS of your WAN too - just to be sure...... 1. download MTUPATH.EXE ( http://www.iea-software.com/products/mtupath.cfm ) and s...

scampbell

I would check the MTU and MSS of your WAN too - just to be sure...... 1. download MTUPATH.EXE ( http://www.iea-software.com/products/mtupath.cfm ) and see what the results for MSS are; 2. download MTUROUTE.EXE (http://www.elifulkerson.com/projects/mturoute.php ) and see what it finds It may be a VLA...

scampbell

Quick work !!

Windows Smartscreen does not like it though - reports it as an unrecognised app from an unknown publisher on Windows10. You have to force Windows to run anyway.....

scampbell

Try disabling any simple queues and changing the WAN port interface queue type as per http://forum.mikrotik.com/viewtopic.php?t=103542

scampbell

AVG again !!! Grrr. Why does this keep happening I wonder ? Perhaps AVG have some shares in another vendor starting with U

scampbell

For port 80 traffic from anywhere /ip firewall add action=dst-nat chain=dstnat comment="Web Server" disabled=no dst-port=80 protocol=tcp in-interface=ether1-gateway to-addresses=192.168.1.50 For remote router access via external Port 9000 /ip firewall add action=redirect chain=dstnat comme...

scampbell

It looks like something is stealing 4 bytes :-) Your client bridge shows only 1496 actual bytes so I suspect an interface involved in the bridging is dragging it down. Try removong wlan1 from the client bridge (assuming you have local access of course) and see if the bridge actual-MTU increases. Per...

scampbell

6.35rc19 has been released! *) winbox - added /interface wireless setup-repeater; Nice feature !! When you use this setup repeater button it currently creates a new bridge (called bridge1) and adds WLAN1 plus the new Virtual WLAN into it. Perhaps this could be modified to ask for a bridge to use (i...

scampbell

Hi , it's a 3 years posts but i'm going to answer it !! it's not so easy , but you can do it with OSPF routing protocol !! that's all if you are not friend;t with OSPF , use static routing , but in this case you will loose redundancy , with OSPF you could have full duplex and redundancy in case of ...

scampbell

/ip firewall nat add chain=dstnat action=dst-nat to-address=proxyIP to-ports=8080 protocol=TCP, dst-port=80,443 in-interface=bridge-lan This will redirect any HTTP and HTTPS to your proxy on port 8080. Doesn't transparent proxy give certificate issues with SSL? I am on a network that requires the u...

scampbell

I've seen that before :-) When an EOIP tunnel is added to the bridge the bridge MTU automatically drops to equal the smallest MTU of the interface in it.. There is a setting on the bridge to "not" automatically adjust MTU but this can lead to fragmentation. Soemtimes the best solution for ...

scampbell

If you are connecting via PPPoE ensure your profile is set to allow MSS Clamping. The quick way to check if this is active is to see if there are two Dynamic Forward Mangles rules. If not then it's not running. Here is a link to another forum post on the subject - http://forum.mikrotik.com/viewtopic...

scampbell

FASTTRACK!!!! Disable it and packets pass. Web Pages load. Grrrrr. Spent all day messing with this. I have not gone back to EOIP yet. Just standard IPSec config and its working. Finally. Some progress then :-) Yeah, Fasttrack breaks all kinds of things as the packets bypass the routing engine as su...

scampbell

For simple DDNS requirements there is the built in DDNS under /ip cloud ? It's free and it works

It's url is serial_numer.sn.mynetname.net

scampbell

I have 4 LAN's that I need to access on the other end, as you can see in my previous post. How can I add the 4 LAN's in the route field?

You can add multiple routes in the secret :-

/ppp secret
add name=changeme password=changeme routes=192.168.1.0/24,192.168.7.0/24,192.168.5.0/24,........

scampbell

You need to create a dstnat rule with

/ip firewall nat
add chain=dstnat action=dst-nat to-address=proxyIP to-ports=8080 protocol=TCP, dst-port=80,443 in-interface=bridge-lan

This will redirect any HTTP and HTTPS to your proxy on port 8080.

Change settings to suit your proxy

scampbell

Hi Geeko, If you are behind NAT'ed routers then that is the correct way to do it. It also enables a more complex check than just next-hop :-) If you only need to check next-hop then there is also a setting in the default route called "check-gateway" which can use ping. No use if you are co...

scampbell

Hmmm, ok well you have the basics right it seems. I did some looking around and found this link which may help - http://forum.mikrotik.com/viewtopic.php?t=88033 I wonder if you have some peer settings left over from earlier attempts. Try the following and see if it helps... 1. Disable IPSEC in the E...

scampbell

To get rid of fasttrack there is a firewall rule created by default directly below the two rules to allow established and related with an action=fasttrack-connection. The rule looks like this:- "add action=fasttrack-connection chain=forward comment="default configuration" \ connection...

scampbell

I've noticed an issue running 6.34.1 and Winbox 3.1. If I set the email server in Winbox > Tools > Email > Server to either the fqdn or ip of my mail server then try send an email I get an error connecting entry in the logs. "/tool e-mail print" didn't show a server address entry. "/...

scampbell

I can't seem to get this to work. The "easier" EOIP. I setup EoIP selected a secret. Made sure the tunnel IDs were the same. All I see it this in my logs 10:28:18 ipsec,error failed to pre-process ph2 packet. Do I need additions to the firewall filter and nat too? Ensure your firewall is ...

scampbell

Could you not have used src-nat to fool the pbx that any packets received from a remote network were instead locally sent ? This would eliminate the need for eoip Eric and possibly simpler ? Also where we see sip issues the packet sniffer is the best tool as you can save to a file, called sip.cap fo...

scampbell

It appeared in v6.34 and is already fixed in v6.35rc. It is just a cosmetic bug that aes-256 is displayed as aes-128 Maybe cosmetic but I have just wasted an hour on it migrating a router and wondering why my scripts dont work. If I specify in CLI to add a peer with enc-algorythm=aes-128 and then r...

scampbell

Pasted from Uldis slide pg 34: http://mum.mikrotik.com/presentations/PL12/workshop-wireless-2012-PL.pdf 802.11n and WDS • 802.11n frame aggregation can’t be used together with WDS • Max transmit speed drops from 220Mbps to 160Mbps using WDS (UDP traffic) • Station-bridge has the same speed limitatio...

Search found 486 matches