MikroTik

Arcee

For wireless clients Take a look at the Mikrotik connect-list and Mikrotik area-prefix I assume you have multiple APs your clients are connection to and the APs all have the same SSID Here is what you can do: On your APs ( all APs have the same SSID ) , configure a unique area-prefix for each AP On...

Arcee

I will gladly pay $500 to anyone who can solve this problem! Over a year and a half later and the issue remains.

--Brian

I believe I have your fix.

Is the bounty still up? $500 USD?

Arcee

I believe the output from this command will tell you why you have that red line in your last image:

ip dhcp-server print

Paste the output from that line here.

Arcee

So... if I'm reading this right, you're saying there is no way to route my internal addresses through the AWS tunnel? I would have to use NAT?

Arcee

I'm using AWS Site to Site VPN with my on-prem Mikrotik Router. I can communicate with the AWS Servers in my VPC from my on-prem servers so I can confirm the Site to Site VPN is working. This issue is, if I turn of NAT on my router, my on-prem servers cannot access the AWS servers; the router itself...

Arcee

Bump...

Arcee

Today I learned that the difference between CSS, CRS and CCR; The Cloud Smart Switch (CSS) series is the only device of the three that cannot use RouterOS. Being so use to RouterOS, I took my new CSS326-24G-2S+ out box, and tried to mac-telnet and even winbox into it only to find out that you can on...

Arcee

Bump...

Sent from my Pixel 2 using Tapatalk

Arcee

If I use a copper module on a router, does the electronic on the next end have to have a copper module? Or can I connect to a regular 1Gb Ethernet port on the electronic? I ask because I am using an inline network appliance that sits between my router and switch and I would prefer to use the SFP mod...

Arcee

I haven't read your thread in full but I can tell you have have been playing with VLAN configurations alot recently and I got frustrated many times along the way. This is the only article that worked for me: https://wiki.mikrotik.com/wiki/Manual:CRS3xx_VLANs_with_Bonds Seems there is conflicting doc...

Arcee

This InterCell is not really for WISP. It is for companies who want to operate LTE cell towers, either for public or private reasons. Yes, you probably need a license from the regulator. These InterCell devices only support data (no voice calls, except whatsapp/skype etc over data connection). The ...

Arcee

You should really rename this thread to "I have been hacked" and try to figure out what you did wrong in the configuration.

Why have winbox open to the world?

Sent from my Pixel 2 using Tapatalk

Arcee

250ft?

Sent from my Pixel 2 using Tapatalk

Arcee

All variables considered... Outdoor elements (Sun/Head/Cold/Rain), what are you guys using for your tower cabling?

This is particularly for a new tower install. I need to this cable to last long... maybe CAT6a?

Thoughts?

Arcee

I have seen this quite a number of times.

The problem is at the physical layer; either your cable/cable ends need to be replaced or your device on the next end has a bad Ethernet port.

Sent from my Pixel 2 using Tapatalk

Arcee

The question is simple: Where are your Mangle and Queue Tree (QoS) rules? In the case of a PtP wireless backhaul and particularly with respect to even sharing of bandwidth to all endpoint systems, is it best to place your mangle and queue tree (with PCQs) at your core router or at the branch router?...

Arcee

So I get it: SPF = 1Gb | SPF+ = 10Gb Seeing that Mikrotik only has one router with a combo (one of each on the CCR1009). Would a Multi SPF+ port CCR speak to another device that only has SPF ports? AND would this matter if the next end of the link is another Manufacture's device (i.e Mikrotik SPF+ c...

Arcee

Firstly I apologize if this was discussed in another post... Maybe I used the wrong search keywords. Please point me to the right thread if this is the case. Even bandwidth sharing for all clients. There are many articles and threads on this topic and it is quick easy to accomplish IF you know the a...

Arcee

Mine in production environment for almost three years now; zero problems. I suggest you reset the configuration with no defaults (blank slate). Then incrementally add and test configurations until you find what is causing the problem. There is also a chance that you just got a faulty device (that ha...

Arcee

I'm reading the Mikrotik Manual but still do no have a really good understanding of this.

Does anyone use this configuration option? OR can anyone give me a good example of when you may want to use this?

Arcee

I'm Excited!

Sent from my Pixel 2 using Tapatalk

Arcee

In your scenario, 24Mbps / 5 = Shared bandwidth. in Wireless (802.11, NV2, Nstream, AIRMAX...) the AP is always sharing bandwidth. The actual AP data rate is the amount of available bandwitdh for everyone connected to it, simple as that! Remember that we're talking about air rate, the wi-fi protoco...

Arcee

Understood.

I would just max out the datarates and MCS options but my recent challenge has been trying to lower latency jitter.

It seem jitter is directly linked to rate switching and if my thoughts are correct, limited the rate options to a select few makes for less jitter. Thoughts?

Arcee

If you limit the AP to lets say, MCS 1 which gives you 13Mbps @ 20MHz, this is the air rate you are going to be sharing with eveyone! 13Mbps for x amount of clients you have on the AP. Leave it at auto if you don't know what you're doing or limit it to the MCS rate which gives you the best overall ...

Arcee

Reviving an old thread. New question: What affect does lower data-rates have on the overall throughput performance of an PtMP access point (i.e. using just 24mbps and 36mbps rates without any MCS being selected)? I ask because I recently came to the realization that if none of my end-points need mor...

Arcee

Bump.

Sent from my Pixel 2 using Tapatalk

Arcee

I have two Wireless Access Points, same SSID, but different frequency. Both APs have access lists enforced and I use this to ensure that the load is properly balanced across the two APs. What I'm seeing from time to time is that a station would repeatedly attempt to connect to an AP even if rejected...

Arcee

I guess I will monitor more closely and get some WireShark captures.

What I find most odd about this is the fact that I never saw this at all until a month or two ago. Now, I see it multiple times a day and it's all with communication between my Mikrotik AP and Mikrotik CPE.

Arcee

This is a "wellknown" problem. You have masked the actual MAC address, show us the first 3 bytes! When you look that up in one of the published assigned MAC address ranges, you will likely see it is an Apple device. There appears to be incompatibility between Apple devices and RouterOS DH...

Arcee

So I went from never seeing this error to seeing it a few times a day. 06:21:18 dhcp,warning DeviceName offering lease 10.1.3.4 for xx:xx:xx:xx:xx:x without success Model: RouterBOARD 3011UiAS ROS Version: 6.40 Firmware Version: 3.35 Running a WISP. Seeing this with multiple devices not just the one...

Arcee

sad to say but we have to accept that mikrotik has lost the wireless isp market

Sell me your CPEs

Sent from my Pixel 2 using Tapatalk

Arcee

Then there is logging... Following the above steps is good, but having logging configurations in place that notify you when an event occurs (ie. Failed logon attempts/port scanning) AND *sending your logs off site* is invaluable; of someone gets in, they will probably delete the logs. Sent from my P...

Arcee

I believe you're right, a "short term" fix. However, isn't the fix by the higher up protocols: re-transmit until acknowledge and eventually timeout? If this is the case, re-transmission over a wireless link can be expensive, no? Thank you for your input. Can't wait to get more feedback fro...

Arcee

So I read a few articles recently that talk about Flow Control and it's importance in the WISP industry. If I was to sum it all up in a single line, what I learned is that Flow Control provides additional traffic management by pausing and resuming traffic as queues are full to allow for more efficie...

Arcee

What equipment are you guys using for surveillance on your towers? I'm in the early stages of researching solutions.

Key features would be:
- Ethernet Connection
- Onsite NVR

Arcee

Haven't tested Dynadish 6 but what distances for PTP's? Almost 9 miles. 99% of the shot is over water. Over water can have additional issues with reflection(s) causing signal variation, i would check that this will not be an issue before purchasing expensive links? Hence my quest to try 6ghz spectr...

Arcee

Haven't tested Dynadish 6 but what distances for PTP's?

Almost 9 miles.

99% of the shot is over water.

Arcee

Anyone tested this product? Comments?

Considering this before I jump to the expensive 11Ghz products for PtP links.

I have to get out of the 5Ghz band for PtP.

Arcee

So in my first instance, I purchased directly from a distributor listed on the Mikrotik site. In the second instance, I purchase from Amazon.com, but that vendor was also from your list. I'm giving both distributors (official Mikrotik distributors) a second chance before I report to you guys their n...

Arcee

I don't think that you will ever found any international version in the US. So why are you trying? Anyway it's not Mikrotik fault and your statement it's ridiculous. I'm not shopping in the US (at least not on purpose). I'm ordering through Amazon.com with distributors that have the product listed ...

Arcee

This is now my third attempt at ordering international version of your equipment and the vendors send the US version (despite their product description saying international version). It is very frustrating shipping items out of the US then having to ship back because of this! Sent from my Pixel 2 us...

Arcee

Open Terminal Type "Interface Wireless" And then "export" # model = 922UAGS-5HPacD /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik add authentication-types=wpa2-psk,wpa2-eap eap-methods="" \ management-protection=allowed mode...

Arcee

Here is my config:

Config.png

Arcee

Oh no, I'm limiting with queues at the branch router.

Im not asking how to limit data rates or bandwidth. I'm asking how to optimize latency.

Sent from my Pixel 2 using Tapatalk

Arcee

I'm not concerned bandwidth so much as the clients are reaching the speeds required for my network. I'm mainly concerned with latency and overall jitter. I'm thinking the culprits are data-rate flapping and clients with low signal strength (>70dB). The subject of data-rates was brought up because I ...

Arcee

1. How many Clients on that AP?

2. What's the max bandwidth per client?

Arcee

What about the HT MCS?

If I don't need more than 7mb on any given client, doesn't it make sense to deselect all of the MCS options?

Arcee

I'm also interested in the Wifi Data Rates question in general. However, your issue does not appear to be a Wireless Client/Access Point issue (you have good signal strengths and data rates). My bet is there is a problem with the local network of the client. Can you get a bandwidth usage analysis fo...

Arcee

I will keep it simple with my first question but I'm sure this will evolve into a much larger conversation: If my highest subscription level as an ISP is 7mb, what should my highest date rate be on my AP? Key point to note here is that no client will need more than 7mb of bandwidth. Sent from my Pix...

Arcee

Did you upgrade packages/firmware recently? If so, go back a step maybe?

I have also seen this problem when I mess with datarates, power levels and MCS rates.

If all else fails, reset configuration with no defaults and rebuild.

Sent from my Pixel 2 using Tapatalk

Arcee

Did you upgrade packages/firmware recently? If so, go back a step maybe?

I have also seen this problem when I mess with datarates, power levels and MCS rates.

If all else fails, reset configuration with no defaults and rebuild.

Sent from my Pixel 2 using Tapatalk

Arcee

Very interesting topic.

I would like to see feedback and examples on this.

Sent from my Pixel 2 using Tapatalk

Arcee

Is the SSID being broadcast? Is it even available to enable in the configuration?

If not, download the latest wireless package and manually install it.

I saw a problem once where after an full system update the wireless package did not update properly.

Sent from my Pixel 2 using Tapatalk

Arcee

Any testers? Share results.

Arcee

This is driving me nuts! I can get OID information and SNMP to work for almost every attribute my devices have -except- the traffic on an interface (i.e. Download/Upload speeds). I have been using PRTG for network monitoring for a while (https://www.paessler.com/). This tool does a scan on my networ...

Arcee

Try to manually install the latest packages.

Sent from my SM-G935F using Tapatalk

Arcee

As the subject states, does a Country settings of 'no_country_set' paired with an antenna gain setting of '0dbi' mean that my radio will be pushing max power at all times? Does it make a difference if I keep the same country settings but change my antenna gain to 30dbi? I'm trying to understand what...

Arcee

We are testing some GSM/IP enabled power monitoring equipment, too bad the one on that site died in one day

Brand/model info?

Sent from my SM-G935F using Tapatalk

Arcee

Invest in a Smart PDU. You can remote power cycle this way. Dataloggers has some inexpensive stuff.

Sent from my SM-G935F using Tapatalk

Arcee

BUMP on original question.

Still not sure on the definition of 'auto'.

Arcee

So I'm considering using the loop protection feature instead of a dynamic routing protocol like OSPF. Here's the scenario: -Site#1 Router has a Wireless PtP link to Site#2 (AP Mode). -Site#2 Router has two (primary and backup) PtP wireless links to Site#1 (both in Station Mode). -Under normal operat...

Arcee

Or just rename the Admin account and set a password

Sent from my SM-G935F using Tapatalk

Arcee

Arcee

Your observations are correct but it seems you have drawn the wrong conclusion. You should absolutely refuse service to -85 customers. Actually, you should refuse service to even -75 customers where possible. With point to multipoint and TDMA you have shared air time, talking to bad connections (at...

Arcee

Manually download the latest packages for your device, dump the in the root of the file system and reboot. Next you can go to the packages and ensure that wireless is enabled. Odd that this happened out of the box but it is very likely that the wireless packages are not installed/enabled. I almost t...

Arcee

Bump

Sent from my SM-G920I using Tapatalk

Arcee

Bump

Sent from my SM-G920I using Tapatalk

Arcee

I'm sure this has been discussed before. Can someone explain how the various signal strengths of registered clients affect the overall performance of a Point-to-Multi-point link? My understand is that 10 clients all registering -60dbm would have a better overall service than 1 of 10 having a signal ...

Arcee

Bump.

Really need some help with this

Arcee

Are you getting signal strength from the station end of the link using that OID?

I'm not sure what direction you are pointing me here...

Arcee

Yes. The exact same OID set.

In fact, I run the snmpwalk command and get results.

I am requesting the info from a CPE (station) with one registered client; not the Access Point.

Can you screenshot your item configuration from Zabbix? Maybe there are some other configuration details I'm missing...

Arcee

Bump.

Very annoying issue.

Sent from my SM-G920I using Tapatalk

Arcee

So... I have experience with signal strength monitoring via SNMP. I have the OID details and I can monitor with other SNMP monitoring apps (i.e. PRTG). I can also monitor memory and CPU information using the OID/SNMP. Signal Strength just does not work. I would love to do this with Zabbix; has anyon...

Arcee

Narrow beam as AP I'm guessing? That would be SXT.

I am even suggesting this more so from a security perspective. Less visibility to the outside world.

Looking forward to some expert advice.

Sent from my SM-G920I using Tapatalk

Arcee

(you'll just use srcnat with specific address instead of usual masquerade)

This was the key. I got it working

Thanks Sob.

Arcee

So assign your 43.x network on loopbacks, use whatever you want on your LAN, and nat it? There's nothing strange and/or complicated about this. With the shortage of IPv4 space, I'm not surprised at the "private" /30 they allocated. It won't break anything and everything will work fine. So...

Arcee

Bump...

No comments?

Arcee

So I requested a new service from my ISP and they supplied me with a network diagram that is very weird and unorthodox in my opinion. They are asking for me to apply a private address to my router which is connected to their Ethernet hand-off then on my LAN side, apply my public IP addresses. Additi...

Arcee

So I have multiple upstream providers (multiple IPs/Public interfaces). Is there a way to choose which IP/interface I want to run my bandwidth test from *without changing my default route*? I got a new upstream link and I need to test it remotely using the public bandwidth test servers listed on the...

Arcee

Option B (VRRP on the WAN) worked like a charm!

Arcee

So I want to know if this is possible. I have one static IP from my upstream provider and I want to implement some redundancy at my core. Here is the proposed configuration: VRRPDiagram.jpg So essentially the two routers have the same WAN address (1.2.3.4) and the PC will use 1.1.1.1 internal as its...

Arcee

Clarity. Thanks!

Sent from my SM-G920I using Tapatalk

Arcee

If I'm reading the documentation correctly, it seems I lose whatever port I choose as the master port.

In the above example, I lose two ports. Is this the case?

Sent from my SM-G920I using Tapatalk

Arcee

@czolo I'm sorry. I'm having a very hard time understanding how this all works. So I get it, VLANs use a switch chip, bridges use the CPU; VLANs make better use of the hardware. Let's use an exact scenario: Let's say I want to split a 24 ports CRS into two VLANs. VLAN1 (Ports 1 thru 12) - Department...

Arcee

So the rule of thumb is always use vlans where possible even if there is only one network device involved. Vlans perform better.

Next question: When do you make an exception? When do you use bridges?

Sent from my SM-G920I using Tapatalk

Arcee

I am trying to wrap my head around the subject. Are VLANS only required when you need to trunk between two or more network devices (i.e. share networks across multiple switches/routers)? I guess another way of asking this question is: Do I need to use VLANs if I have only one switch and I need to cr...

Arcee

What are you guys using with respect to the subject? The Rohn brand seems to be the most popular.

I'm looking for a self-supporting tower in the range of 40-60 foot. Let me know what you guys think; I hate to reinvent the wheel.

Arcee

I bet he didn't transfer the IP configuration from the wlan interface to the bridge interface...

Sent from my SM-G920I using Tapatalk

Arcee

Firewall rules are what's missing. You need to allow traffic between networks. That won't happen on its own.

Recognize that you will always be able to ping a network host that is physically connected from the terminal.

Sent from my SM-G920I using Tapatalk

Arcee

To answer your question, no it will not work. Do not bridge the two interfaces. Just ensure that there is a route between the two and you should be good. What you're asking is like saying you plugged two different networks into a dumb hub or switch and expect them to communicate. Sent from my SM-G92...

Arcee

All about risk management.

Four letters... VRRP.

Sent from my SM-G920I using Tapatalk

Arcee

With those results, latency can't be your issue.

Database queries should he fine with averages of 30ms... You're way below that...

Another persective: VoIP depends on latency way more than your DB app and you can easily make calls with what you're showing us.

Arcee

Is this possible? :| Seems to me like these two concepts conflict each other. Fasttrack - Expedite ALL traffic. CPU load is reduced significantly as a result. QOS - Inspect every connection based on mangle rules and prioritize accordingly. So I created some QOS rules which basically take this approa...

Arcee

Very help advice! Note however that I am not relying on my systems to auto-ban any suspected malicious host.. What I am doing instead is having addressed added to an address-list, and upon review (most times a query to abuseipdb.com) I then decide where or not to add the host to my ban address list....

Arcee

I'm sure this is something simple that I am overlooking. So inside my (all RouterOS) network, I want to be able to communicate with my various devices using their hostname which I thought was their identity (i.e. [/system identity get name]). What is needed for this to work? All of my devices point ...

Arcee

So I now how a much better understanding.

One remaining part to the puzzle... what is unit of measurement, or what metric is used for 'weight'? Is the packets in bits/bytes? Not sure what this means...

Arcee

So I found some good firewall rules online that detect port scanners...etc. The most popular rule seems to be: add action=add-src-to-address-list address-list=Suspect_Port_Scanner address-list-timeout=14w2d chain=input comment="Port Scanner Detect" fragment=no protocol=tcp psd=21,3s,3,1 Ca...

Arcee

Last question: What site are you guys using for IP lookups? OR are you just doing general Google searches?

Sent from my SM-G920I using Tapatalk

Arcee

pptp: ,info MyRouter: TCP connection established from 123.151.42.61
Drop all connections from 123.151.42..0/24 in a Banned List. That site is continually scanning.

Are you seeing this host also on your network?

Arcee

So, I might be a bit paranoid but how secure is the VPN authentication and logging process on RouterOS. While reviewing logs, I noticed this: pptp: ,info MyRouter: TCP connection established from 123.151.42.61 What I gather here is that a host as successfully authenticated and connected to my router...

Arcee

So you are saying this was definitely an attack... Also, you saying block a connection state of 'new' only? What I did after I learned of this DNS issue, I manually added input rules from the outside for legitimate services (i.e pptp and ssh), then I ended the filter list with a deny all. Should thi...

Arcee

I had the same problem a few days ago. Torch feature shed light on the situation for me (pun intended). Most traffic was to port 53 from the public. When I turned off the DNS feature of the router it stopped. I then found that while tcp port 53 was closed to the public, udp port 54 wasn't. Can someo...

Arcee

Yes. It should work. I think the sg300 is 48v PoE. You will need a something to step down to 24v.

Sent from my SM-G920I using Tapatalk

Arcee

Is this a good idea? Are we trading in security for a convenience here?

Love the fasttrack idea, but is this recommended on public facing router? I will always use it downstream.

Thoughts?

Arcee

OK.

Not a HUGE deal I guess. Just a 10+ lines in my logs every few minutes... noisy.

Arcee

I wish it was that simple... It's an outdoor Wireless Access Point. [admin@FB-WAP01] > system package update check-for-updates channel: current current-version: 6.35 latest-version: 6.35.2 status: New version is available I'm updating to 6.35.2... but note that I was already in the 6.35 range...

Arcee

Any idea what I might be getting these so frequently? May 09 16:01:48 ******* ,info FB-WAP01: sntp change time May/09/2016 16:01:50 => May/09/2016 16:01:47 May 09 16:16:45 ******* ,info FB-WAP01: sntp change time May/09/2016 16:16:47 => May/09/2016 16:16:45 May 09 16:31:43 ******* ,info FB-WAP01: sn...

Arcee

On e benefit would be portability with respect to the configuration.

Sent from my SM-G920I using Tapatalk

Arcee

It appears if you take the route of placing your WAN/Upstream service IP address on a bridge interface and the upstream ISP device loses power, the router does not register the service as down. This being said, is it better to place your WAN/Upstream service IP address on an Ethernet interface direc...

Arcee

What are the logs saying?

I seen this before when I copied the configuration from another router and accidentally copied the MAC addresses.

The router closes the loop (flaps the port) thinking there is a loop.

Might not be your case... Just a thought.

Sent from my SM-G920I using Tapatalk

Arcee

Then why are other vendors grounding from the power cord?

Arcee

Agreed. But wouldn't it be a good standard?

Low end devices maybe should be sold with it, but not with netmetals...

Perfect segway to my next question; what are you guys using for PoE? Are you guys sticking to a particular brand of gear?

Passive/active? Thoughts?

Arcee

I might be overthinking this a bit... but why is the seemingly critical 'ground pin' missing from most Mikrotik PoE setups?

Arcee

What I see is:

1- Shut the front door and lock it.
2 - Leave the front door open \ unlocked because all of my other (internal) room doors are locked or empty.

Sent from my SM-G920I using Tapatalk

Arcee

He's using a switch as a router.

Wouldn't he run into performance issues later down the road?

Sent from my SM-G920I using Tapatalk

Arcee

I understand that, but don't the devices have routing capabilities? I know the are configured on both ends to bridge the network wirelessly, but what about taking the layer 3 functions to the wireless routers? Wouldn't this make vrrp a viable option? Just thinking out loud... Sorry if this sounds li...

Arcee

Why not set the antenna gain properly? It seems everyone has mix interpretations of this.

I have been adjusting power for a long time and there are post here that say don't touch the power setting, use antenna gain instead.

Thoughts?

Sent from my SM-G920I using Tapatalk

Arcee

If it's all RoutersOS, why not just use VRRP?

Sent from my SM-G920I using Tapatalk

Arcee

I would love to know the answer for the mikrotik ap/cpe scenario.

Sent from my SM-G920I using Tapatalk

Arcee

Any US based vendors? :/

Arcee

Ah... Where do I find these?
http://routerboard.com/Sleeve30

I need to buy some like right away....

Arcee

try to check reflections

How do you check reflections?

Arcee

Try the test in one direction with UDP. Let us know the results. Also, what is your signal strength readings like? I personally have not seen more than 100mb udp, one direction on a 11mile (17km) link. Note that the devices are not made for speed tests. Particularly tcp (heavy overhead). Can you tes...

Arcee

Have your router behind the firewall VPN out to he router you have access to If all else fails.

Sent from my SM-G920I using Tapatalk

Arcee

Isn't the rbgroove SISO? I say go with a MIMO device. Get an SXT or one of those Dynadish antennas.

Sent from my SM-G920I using Tapatalk

Arcee

What type of service is your upstream?

Sent from my SM-G920I using Tapatalk

Arcee

I would like to see the answer for this also.

I'm thinking there is no way to capture it all as users have an option to encrypt the traffic. Encrypted looks the same for all applications.

Sent from my SM-G920I using Tapatalk

Arcee

Let's see the speed test command for the CHR test.

Speedtest is obviously using multiple tcp streams. Is your CHR test using udp or tcp? Udp throughput is usually greater as there is less overhead.

Sent from my SM-G920I using Tapatalk

Arcee

Yup. That's the way I do it.... VPN in and give the VPN pool access to the graphs.

Sent from my SM-G920I using Tapatalk

Arcee

I did some testing with it... PPPOE and RADIUS.

What are your concerns?

Sent from my SM-G920I using Tapatalk

Arcee

Is something connected to ether10 port?

Yes, I do have a device on this port.

What are you thinking?

Sent from my SM-G920I using Tapatalk

Arcee

That's a relief to hear.

Still would be good to hear am explanation.

Also... The rb2011 might not be able to take the same temps as the board you mentioned...

Sent from my SM-G920I using Tapatalk

Arcee

I get this every other day. I can't seem to find a common factor. ***Air Conditioned Room ~65F temperature: 62C NAME CPU USAGE firewall-mgmt all 0% p2p-matcher all 1% wireless all 4% spi all 0% ethernet all 3% console all 1% flash all 0% ssh all 0% dns all 0.5% firewall all 4% networking all 5.5% wi...

Arcee

Has this been resolved?

I have a similar problem; I would like to know what the issue was.

Arcee

One thing Normis neglected to mention is that it is only listed in the "Release Candidate" repository.

You will not see the Dude package otherwise. Took me quite a while to recognize this... I suggest the documentation be updated to point users in the right direction :/

Arcee

I was able to accomplish this (public IP to subscriber) using MPLS with VPLS. I suggest you look it up.

Sent from my SM-G920I using Tapatalk

Arcee

Bump.

Very interested in this topic.

Sent from my SM-G920I using Tapatalk

Arcee

Understood. Thanks guys.

Arcee

My question is... Will two APs on a pole interfere with each other just as much as an AP and Station on the same pole. All other variables remaining the same... Spacing, weather...etc.

Sent from my SM-G920I using Tapatalk

Arcee

Tough question?

Arcee

So, imagine three sites. A, B and C; Site B connects to both Site A and C. Will I have less interference issues is I put a AP and a Station at Site B? That is, Site A will have an AP and Site C will have a Station. I'm comparing this to: Two APs at Site B and a station at Site A and Site C. Hope my ...

Arcee

I'm also interested in an answer here.

Sent from my SM-G920I using Tapatalk

Arcee

Here are two ways: 1. Connect a pc to the routers on both ends and run a ftp or Windows file transfer. 2. Connect a pc to routers on both ends and run an iperf test. I prefer the latter. Go look up iperf. You can perform basic bandwidth tests from the routers but don't expect them to be able to crea...

Arcee

Ahh.. That's a total throughput of 120mbps; 60mbps in each direction. Search the forums and you will see that the Mikrotik bandwidth test is not the best test for bandwidth. Let your routers, switches and WAPs do their job of routing and bridging. Get another device to test through the infrastructur...

Arcee

There's a little secret that not much people know... If a connection or packet does not get mark by a rule you created, it gets marked as "no mark".

Unless I'm mistaken, you don't need that second mangle rule.

Sent from my SM-G920I using Tapatalk

Arcee

Two acronyms: MPLS VPLS.

Look it up.

Sent from my SM-G920I using Tapatalk

Arcee

So... I got a 4g/LTE USB Dongle with a SIM card in it. The problem is whenever I reboot my router or disable/re-enable the LTE interface, it adds a default route with it's address as the gateway. This overrides my default routes and screws up everything for me. Anyone familiar with this issue? I don...

Arcee

Your interface number.

You can have a device with multiple wireless interfaces; the OS is asking you to be more specific.

Your answer is most likely 0. You should type:

interface wireless print

From here you can see your interface numbers.

Sent from my SM-G920I using Tapatalk

Arcee

Old post but I'm not sure what that last answer means?

Can one CPE connect at 802.11n and another at 802.11ac both to the same sector?

Arcee

Anyone else?

What are you guys using out there... what's tried and proven?

Arcee

Question on the subject. I'm finding that one day a TDMA period size of 3 works best, then the other day it's unstable and I have to switch to... say 2. My question is, does the 'auto' setting change dynamically with an active link OR does it just find a good setting once and not change even if that...

Arcee

What are you guys using for sector antennas? I'm hoping to push 300mbps max (total) to 30 odd clients per sector. Any insight as to what a new WISP should stay away from? What do you think about RF element's symmetrical (horn) antennas? What do you think about triple chain antenna (H V V / H H V)? T...

Arcee

Ok, this looks very similar to what I'm doing with SSH only that uses L7.

Any other firewall tips you can throw in?

Arcee

Put on your security hats! So, obviously a L2TP/IPSEC VPN provides pretty good security, once the link is established... but I've been wondering, what stops a users from getting into your system with a brute force/dictionary attack on your ppp secret username/password combination? I found a way to l...

Arcee

Make sure 'chain0' and 'chain1' are enabled for both 'Tx Chains' and 'Rx Chains' on the wireless intereface settings.

After a clean reset on the device I have found that only one chain for Tx and Rx was on for me.

Arcee

Looks like only one Chain is setup on ch1. Ch0 has two.

Activate the second chain and let's see the difference?

Sent from my SM-G920I using Tapatalk

Arcee

I dunno what to say... I've tried matching the settings that Ginsu has above... Tried channel after channel (mind you, there is hardly any interference)... Still nothing above 100mb with a 40-50mb average. Tell me, what are the symptoms of a bad rp-sma cable? Or what happens if my fresnel zone is ob...

Arcee

I can't get more than 70mb with a 50mb average. I would really like some help with this topic.

11km link... Testing from wireless AP interface directly to the wireless station interface.

-55 to -60 signal strength.
Nv2 1ms
802.11AC Only

Sent from my SM-G920I using Tapatalk

Arcee

This might sound wierd... but set your antenna gain to 0. I have found this setting to allow for the radios to push out the most power (within safe limits). This then allows for better signal strength. Let me know what your findings are. I'm getting 130mb+ with this setting over a 17km link. I think...

Arcee

Noted! I must say though, on the flip side, I would still like to know how I can tweak an AP/Client that has a marginally good connection (maybe not as bad as this one). This information is also very useful for... "not so bad" intentions. I'm sure many will read this post as they face the ...

Arcee

Physical options were not exhausted. You just have not taken care about them. You cannot beat physics just by some field value settings in winbox. It is not almighty. If you do not have signal and Ap does not see your client enough you have to do what I wrote last time. jarda: I completely respect ...

Arcee

Ok. So I know that I reached my physical limitations because I had an omni antenna and I had no idea where the actual AP was. I had a very general idea but I could not pin-point it.

Assuming all physical options have been exhausted...let's talk wireless configuration parameters.

Arcee

So I'm sure we have all been in this situation before... This past weekend I was stuck at a location where I had no access to the internet. Equipped with my GrooveA 52HPn and a laptop, I started wireless scans for an open network in the area. I manage to find an open network barely in range, "G...

Arcee

Reset configuration with no defaults. Then rebuild.

Arcee

These antennas seem to be the only sectors that utilize three chains...

I wonder why UBNT doesn't have any sector antennas with three chains.

In my research, it seems more chains equals better resolution in the communications...

Arcee

Does the same go for the 802.11x protocols?

In other words: Two CPEs are connecting to the same PtMP sector, if I have one CPE using 802.11ac, can I have another using 802.11n?

Arcee

Markpap - if it's just recon... There's no harm in it. Perhaps you should focus more on protecting yourself from stage two of an attack?

Arcee

What do you guys think of these:
http://sectorcc.rfelements.com

Arcee

Does this mean the ap-bridge will stick with whatever protocol the first station associates with?

Yikes, this means a WISP tower would need a radio per protocol.

Arcee

So... as it relates to setting a wireless protocol, if I set this parameter to "nv2-nstreme-802.11", does this mean I can have three different stations connected simultaneously using each of the protocols? OR will my bridge only allow one protocol at a time?

Arcee

What's the release date?

Arcee

Noted. Thanks!

Arcee

Really? More amperage is safe?

I guess the rule of thumb then is to match the voltage and match or go higher on the amperage?

Arcee

So, when it comes to POE adapters for access points, is it safer using an adapter that is under powered adapter (from an amperage perspective) than an over powered adapter? OR is neither 'safe'? I ask because I can't find the adapter for my RBGrooveA-52Hpn: http://routerboard.com/RBGrooveA-52HPn Thi...

Arcee

Does the usage time overlap for these connections?

In other words, does the AP have multiple simultaneous connections to a client to allow for more bandwidth?

Arcee

Ok so now I'm a bit more confused.

My image shows a wireless router that has five (5) readings to a single wireless client.

Why would I have five readings for a router that has two chains...2x2?

Arcee

Can someone help me understand why there are multiple signals listed for registered wireless clients? See attached image.

Arcee

I want to say Firewall and QoS. Both these processes have to monitor connections/packets as they zip through your hardware and perform a task with them. If you're looking for a hardware choice for your home, I think almost anything will do. State your particular application here and I think you can ...

Arcee

I'm keeping a close eye on this thread as I have the same radio with a mANT30 that I'm about to install.

I would really like to know the final conclusion here...

Arcee

+1
Current bandwidth test feature seems very basic.

Arcee

I guess all this really says then is that Nv2 theoretically should be better. But really, in practice, it's best to test every protocol for every application; it might not be the best in your situation.

Arcee

Gotcha. Thanks!

Arcee

Two acronyms: MPLS and VPLS

http://wiki.mikrotik.com/wiki/Manual:MP ... n_bridging

I guess an EoIP or IPIP tunnel can also do.

Arcee

I think someone made an interesting point early... the answer to this is simple.

If you find rebooting fixes your problem, then reboot. Otherwise, there is no need to.

Even better; if you can set a script to detect said problem, script the reboot.

Arcee

There is no diference wich one is H or V because the radio doesn't care, you can put two vertical pol. antennas and the radio will not "know". Diferent polarisations are only implemented in the antennas.

Why would UBNT feel the need to put H/V markings on their antenna?

Arcee

So... I got this UBNT sector antenna that I've been testing with for a few days now. I noticed that the sector antenna has a "V" and "H" marking on the antenna connection points. My Mikrotik Netmetal 5 which I connect to this antenna does not have a V/H marking on it; it instead ...

Arcee

Ah... I don't think this is possible.

If a device is not associated with your equipment in anyway (i.e. ap/station association), there is no way you can get any details from the device. This would be a huge security problem I would imagine...

But of course, I think it's best a guru confirm this

Arcee

Watching this thread as I'm about to purchase one of these switches.

Arcee

Does anyone have any objections to the RB260GSP as a POE injector for a WISP POP site? Here's my planned POP site setup: RB2011UiAS-2HnD-IN - Router at POP site with a designated trunk port RB260GSP - Switch/POE Injector for all tower radios. Port one would be a trunk port and all remaining ports wi...

Arcee

No one wants to talk about their security measures?

This is a security measure in itself I guess :/

Arcee

I'm not an expert, but I'm sure the first step here is they will ask to see your configuration.

Run:

ip firewall nat export

Copy/Paste your output here.

Arcee

How could I forget... basic DOS protection is also a must:

http://wiki.mikrotik.com/wiki/DoS_attack_protection

Arcee

Layer 7 filtering perhaps?

Maybe if you inspect the packets you can find a common link and regex it?

Arcee

Is there any disadvantages to using a bridge interface when there is only one port slaved? I know obviously it adds some flexibility so that you can add more ports to a bridge in the future and it also keeps the address up even if the slaved physical interface goes down. Doesn't a bridge interface u...

Arcee

"which support may give you"

Do you guys mean Mikrotik Support? Aren't they all on this forum?

Also, why would this have to be a "special request"?

Arcee

Ah... that depends... :/

Arcee

I was able to fix the "Error: File not found" issue by manually updating the OS myself. You can do this by downloading the latest package: http://download2.mikrotik.com/routeros/6.24/all_packages-mipsbe-6.24.zip Then dumping the uncompressed files into your file structure (i.e. using the u...

Arcee

Here's your mangle rules: /ip firewall mangle add action=mark-packet chain=prerouting new-packet-mark=FileServer-Packets dst-addess=10.0.0.0/24 passthrough=yes /ip firewall mangle add action=mark-packet chain=prerouting new-packet-mark=Internet-Packets dst-addess=!10.0.0.0/24 Again, more resource in...

Arcee

like I stated in my first post, I've read tons of threads and how-to's, even some outside the mikrotik community, (that's how I've managed to get it working). But they generally aren't dumbed down enough or aren't detailed enough for me to get what I want to know. I just want some answers now to be...

Arcee

Very good question... I'd like to know the answer also. It's crazy how that type of service was open to the public when you don't even need it... Or maybe there is legitimate use for this? I think the best approach is to drop all packets on the input chain with the exception of SSH (maybe HTTP) and ...

Search found 272 matches