MikroTik

OKNET

Yeah, I'm already doing where possible.
There are weaker RBs hardware where V7 sits them down....

OKNET

Ok as I do it by CLI (script) I can run /system package update set channel=long-term /system package update check-for-updates It returns "system is already up to date" But what if a newer stable version is released ? Does it stuck "already up to date" into long-term old one ?

OKNET

Image is missing. What is the problem? Latest v6 still shows "new version available", but there is no new version?

Yes, Normis
Current 6.49.10 says “new version available “
Download and install
It ends with the same 6.49.10 still saying “new version available “

OKNET

When, after a failure connectivity is back, gre/ipsec tunnel rise time depends on what ?
Between two sites I experience time from 40 seconds to 4 minutes, despite keepalive is at 10s default.

OKNET

Probably I haven't understood Mikrotik intentions but... same behavior with 6.49.10
What's the purpose to have two different versions with the same filename ????

OKNET

Thanks for clarifying.

OKNET

Can we state a MT switch running swos is a L2 switch while the same switch running ros is a L3 one instead ??

OKNET

Ubiquiti AirFiber working principle is a pair of dishes each side, one for TX and one for RX (two radio links)
Is something-like achievable with Mikrotik devices ?
Or also bonding two 802.11ac links together in very different frequencies, using two devices per side ?

OKNET

P.S. I'm talking about PtP link.

OKNET

A radio link , expecially in wi-fi band urban environment is normally subjected to interference expecially with high SNR and weaker signals. I have few ac radio links with roubust signal (less than -50dBm), that are rock-solid stuck H24 at 866Mbps-80MHz/2S/SGI despite the traffic passing by Others w...

OKNET

When TX/RX rate of a wireless interface (i.e. 260Mbps-80MHz/2S/SGI) is changing continously, is it symptom of an unstable radio link ?
Noisy, crowded channel etc ??
Thanks

OKNET

Well... changing wireless protocol from NV2 to 802.11 really does the trick.... Both link stabilized @ 866.6Mbps-80MHz/2S/SGI 95-98% CCQ. Latency drops dramatically and bandwidth really increases. One must forget to use CRS112 as bandwidth server , still 6Mbps@100%cpu Tried from a RB3011 to latest o...

OKNET

Thanks for reply,
Actually I'm doing A---C bandwidth test from inside CRS tool.... being not powerful devices, cpus hits near 100% (middle CRS using HW offload hit nearly 10%) probably this is the bottleneck...
I'll try locally with iperf outside both CRS

OKNET

CRS112_A---911G-5HPacD--------------911G-5HPacD---CRS112_B---911G-5HPacD-------------911G-5HPacD---CRS112_C Bandwidth test from CRS112_A to CRS112_C says 120Mbps receive OR transmit UDP 70Mbps both UDP 12Mbps receive OR transmit TCP 6Mbps both TCP Both radio links claim 300Mbps-40MHz/2S/SGI with 75 ...

OKNET

Well.... my fault: actually RSTP IS configured on bridge anyway logging as-is shows nothing when I connect Vlan20 switch. removing RSTP there are no more disconnections with all interfaces connected and all traffic per vlan is fine. The fact I lose Vlan99 when RSTP is enabled makes me think to a loo...

OKNET

No, the problem is that on the left side there are two physically separated networks, with different switches and subnets, unless there is some closing path I'm not aware of....
Bridge on CRS has no STP configured

OKNET

https://ibin.co/7XeYvgJ1wdiW.jpg Goal : forward tagged Vlan99 across switched and use Vlan99 itself to manage both CRS112 , also tag Vlan20 across switches to let few PC to use a different subnet (untagged traffic) coming from a different switch. I made this configuration in both CRS112 : /interfac...

OKNET

So basically we have the options to: -- simply create a bridge, add an interface as untagged port, and add a Vlan interface bonded to a phisical port with the pvid declared, as "trunk" tagged interface. -- create a bridge , add the untagged port specifying their pvid in adding phase, enabl...

OKNET

So, is V7 definitely a bad choice for this machine ?

OKNET

RB3011 have two switch chips capable of Vlan managing
SFP port is connected to cpu instead.
How should I manage a Vlan having untagged ports on eth switch and tagged on SFP ?

OKNET

Cpu utilization (or at least displayed utilization) is far less with ros6
Anyway , even a simple winbox terminal paste session shot it at 100%
I have to use them for switching but with few tagged vlan, let's see.....

OKNET

Just installed 7.10.2 on CRS112-8P-4S-IN
Cpu is stuck around 50% with ANY configuration yet.
Same on three devices.

Is it better to stay with ros V6 ??

OKNET

I have three crs112 connected via tagged vlan, but winbox on a same vlan PC cannot see them.
How to achieve this ?
Should I add switch1-cpu as untagged member of that vlan on each CRS ?

OKNET

I had to cover about 100m radius in a obstacle-free park.
Is Cap XL ac suitable for this once installed inside a plastic weatherproof box ?
Should I install it horizontally (like ceiling-mount ) or even vertically ? (what's the machine pattern ? )

Thanks

OKNET

Confirm, I update a 6.49.7 to 6.49.8 and this last one (the website one ) has the “new version available” “bug”.
Where can I find the latest ex-stable 6.49.8 npk ??

OKNET

And this whole thread is about... ? :lol: :lol: :lol: :lol: :lol: :lol: Yes , honestly it's the first time in years of automatic updates :) Having the website "choice" between a stable and a long-term version that downloads the same file is samewhat weird.... Honestly I thought to a V6 EO...

OKNET

Automatic updates is risky as well as straightforward pretty useful, there are different way of thinking.
I use it in my machines without issue for now (crossed fingers ), Mikrotik seems quite reliable in this…

OKNET

I’ll give it a try.
I’m asking why this behavior in two machine only, probably they have been updated lately when the long-term was left as the only package available.

OKNET

We're here not to kidding anyone, explaining something that is SO clear in explainer mind, is one of most difficult task when discussing online. You said there are TWO version of 6.49.8 , so I understand two .npk files. On mikrotik "software" V6 section there are two columns: long-term and...

OKNET

Well, I actually select nothing, my script does : /system package update check-for-updates once :if ( [get status] = "New version is available") do={ install } If the "wrong" 6.49.8 is already installed (you said 1684760871 asks to upgrade) where can I get the other 6.49.8 if the...

OKNET

@rextended Not clear: stable and long-term download link point to the same file : https://download.mikrotik.com/routeros/6.49.8/routeros-mipsbe-6.49.8.npk !! Why all my other 6.49.8 machines say "already up to date" ? Do you mean my two RB saying "new version available" have long...

OKNET

As per subject :

A pair of RB951 detect new version despite the same is listed above.

Same behavior checking/updating via script.

Any idea ?

OKNET

Regarding revision 3 of this switch, this is what support said:

"Revision 3 comes with larger flash storage - 32MB."

So I'm sure it's not fixed if that's the only thing that has changed on it.

It would be interesting to know if issue is still present on REV.3

OKNET

I would buy immediately 354 (poe or not) but this issue made me buy Aruba or Ubiquiti units without take the risk of try one. It's still not clear how many 354 have been sold and how many have the issue , how many get issue running ros and how many swos. I can't believe Mikrotik doesn't know about. ...

OKNET

Dropped support In RouterOS v7 has been dropped support for: LCD package KVM package Not a great new when you move to a newer (better) os, expecially for networking x86 appliances in wich ros is installed and still working fine. Not a little loss.... As forum is read by mikrotik staff, can I add ro...

OKNET

Yes character and line delay is very useful in transferring many lines at a time (something like fast-typing by hand), however telnet/ssh is not the issue. I always used to copy-paste from notepad to winbox terminal remotely and locally either, never had any problem. This time I connected my HP note...

OKNET

I met a strange behavior in copying configuration text from a notepad TXT file and paste into winbox terminal windows (right click-paste) in ros 7.10.1 : pasted text put in and out safe mode, often random characters are displayed, causing bad command name. All is fine pasting the same text (from win...

OKNET

Well…my stupid fault Vlan interface as port of a bridge CAN be used as interface to run Dhcp server to. I didn’t assign any ip address to that interface … :? Question: tagged Vlans into Vlan-filtered bridge and simple Vlan interface with declared Ethernet are 802.1q ones , so “classic” tagged vlan c...

OKNET

I'm playing with different ways to manage vlans Let's assume we create a bridge (vlan filtering enabled) with two vlan, LAN and GUEST and two dhcp servers (one per vlan) , this bridge has trunk (tagged) ethernet to other switches and few local untagged ports. I cannot create two interfaces in the br...

OKNET

Well, i’ll give “both addresses” a try as triple-suggested by Holvoetn

My further ask was about some other mechanism other than PCC to achieve load balancing with “easy efficiency”.

OKNET

First Times, using “both addresses and ports” PCC, as single LAN user, a speed test over three 100Mbps wans always given near 300 Mbps result (this is what I mean by “bandwidth aggregation”), and all lan users were spread over three wan. I.e. two concurrent users could reach 150Mbps. Lately, https s...

OKNET

Well , actually “both addresses and ports” breaks https because the same user points to wanted https server by multiple ip addresses sources (our wans) and it doesn’t like it. Src-address is safe as just one wan is used by lan user so multiple users traffic can be spread over available wans but no “...

OKNET

PCC with "both addresses and ports" I used many times works like a charm but breaks https connections. Then I included !port443 into pcc rules but, since almost all traffic today is https, this mechanism is deprecated. What is nowadays the best load balancing/aggregation method to share mu...

OKNET

HP probook gets 1200Mbps on registration table, the "super" iPhone14 pro no more than 580

Both 1mt from AP in a free frequency.
Running 7.9.2

OKNET

Thank you for suggestions. With my "default" configuration I got the 5GHz radio to run AP on 5680/ax/eCee My iPhone14 is registered up to 573Mbps on registration table. A ryzen7 HP probook is connected via eth to hAP ax3 , wifi interfaces are bridged with ethernet. Both machines running ip...

OKNET

Yes, hAP ax3 sorry, I have simply this config now: /interface wifiwave2 security add disabled=no name=sec1 passphrase=######### /interface wifiwave2 configuration add country=Italy disabled=no mode=ap name=cfg1 security=sec1 ssid=SMP-Wave2 /interface wifiwave2 set [ find default-name=wifi1 ] configu...

OKNET

Just unboxed my first wap ax3 and met Wifiwave2 thing..
It seems a configuration approaching like Capsman
I got a basic configuration working, what (bad) does it happen leaving (mostly) settings to default ??
I.e. channels, security encriptions and modes, datapaths, etc etc ?

OKNET

Good, thanks.

OKNET

Can hAP-ax3 be used (in hw capability terms) as firewall other than AP for a small office with 10 wifi/wired client and a 100Mbps FTTH connectivity ?

OKNET

Is L0009 available on the market ??
I see just a lot of advertising but "not in stock"...

OKNET

I own few 600 and 800 too
The problem is to find AC minipci cards that aren't minipciE you can find plenty of those...

OKNET

Well, I have many of them (various 411, 333, 600, 800)
It would be fine to have them on AC mode
Unless AC performances are cut down by rb performance itself....

OKNET

Do minipci 802.11ac cards (not minipci-e) exixst, to be installed in older routerboard equipped with minipci slot ?
(i.e. RB411, RB433 etc.)

OKNET

Well, in brief on my RB800 : /system routerboard print look for firmware type firmware-type: mpc8544 Download 7.8 (current) .npk for ppc from Mikrotik site Open .npk with 7-zip and look for mpc8544-7.8.fwf file into etc folder. Extract and copy it into "files" section of your RB800 /system...

OKNET

Thank you for your work and video link (https://www.youtube.com/watch?v=eTmpBAAW_pQ) , absolutely clear. So it's a target scope = scope issue. I'm try to understand why in my previous V6 config, the default route points to an arbitrary dummy IP (10.17.13.1) that points itself (two instances) to remo...

OKNET

Great ! In short, Zerotier bridging simply creates "wires" between your rOS devices as if it were a switch.... Thanks for example. Is perhaps possible to bridge two MT devices Zerotier interfaces without assign an IP address to central controller but only on MT side ? A simple unnumbered L...

OKNET

This is my working routing table in rOS V6: add comment="Failover host2" disabled=no distance=1 dst-address=1.1.1.1/32 gateway=192.168.200.1 pref-src="" routing-table=main scope=10 suppress-hw-offload=no target-scope=10 add comment="Failover host1" disabled=no distance=...

OKNET

Wow, a lot to be read

As said , I'm absolutely new to Zerotier, does bridging allow L2 bridge between Zerotier rOS members ??

OKNET

Well, adding "allow-managed=yes" to zerotier interface makes it to have the ip address assigned and work !

It is not documented anywhere.

OKNET

I followed this guide : https://help.mikrotik.com/docs/display/ROS/ZeroTier as well as Normis video. It looks straightforward , anyway after both rOS(7.8 ) and iPhone are up and authorized on my zerotier page, I see no dynamic IP address released to MT zerotier interface I placed the two zerotier ac...

OKNET

Larsa, it's my first Zerotier attempt.
However, despite the two distinct tunneled networks have its own gateway, there isn't any route to allow each one to use the other's gateway, unless some fault in configuration is present.
I'll double check and stay tuned for further suggestions...

OKNET

I installed Zerotier into v7.8 rOS
This routerboard is connected via GRE-IPSec tunnel to a second 6.49.7 routerboard (both 3011)
On my Zerotier account page, the routerboard "Physical IP" changes continuously between public IP of two routerboards !!

Why is this ?
What's wrong ?

OKNET

RB4011iGS+5HacQ2HnD-IN just connected behind an ISP FTTH router equipped with AX wifi While with ISP router I can reach 700+ Mbps WiFi speed , with RB4011 WiFi I can reach just 350Mbps Does AX vs AC justify this speed difference ?? 4011 wireless interface is configured in 20/40/80 XXXX and it just s...

OKNET

I experienced l2tp/ipsec clients malfunctioning ( connection loss, packet loss) unless I realized to have two connections from different public ip using the same username/password. Why is this ? Why a second connection with same username (thus same private ip release by l2tp server) is allowed inste...

OKNET

Those models refuse to boot after netinstall V7.6
I suppose there is an issue with bootloader firmware

Any hint or howto ?
Is it possible anyway ?

Thanks

OKNET

Just figured out one must upgrade 3 to 4, 4 asks to renew automatically the license online (RB connected to internet).
Then 4 to 5 and 5 to 6 is straightforward.
Thanks

OKNET

As in ROS 4.4 there is no /system>routerboard>settings command, is there any other way to put the board in etherboot mode from CLI/winbox ?

OKNET

I own few unused RB600A
Once updated (i.e. ros 3 to 4) they loose license
Is it possible to use these devices with level 3 or 4 license and upgrade to latest ROS without purchase one (they're old discontinued devices) ??

Thank you

OKNET

I have two GRE/IPsec ccr1009 tunneled over 100/100 ftth Sometimes (1-2 times per minute) I experience Flood Ping test to hang, stay freezed for 10 seconds then keep running again. Each time it hangs,up to three times in the 1000 packets cycle, a packet is counted as lost in the total 1000 packets co...

OKNET

First of all I find disrespectful answer to a point of view not directed to you with an offense. CRS328-24p is a little masterpiece , it can power-up both voltages devices with a single power supply ,and better with mains one, not ac to dc then dc to switch. I still find silly , in projecting phase,...

OKNET

CRS112-8p needs secondary 48V2A power supplpy for powering PoE devices. With two power supply connected, if I remove the primary one (in-the-box 28V) the router remains powered. Is the ONLY second one (48V) enough to provide router+PoE supply or I need both connected anyway ?? However, the dual powe...

OKNET

Maybe I'm wrong but...

What can one do with a 2,5 Gb Eth ??

Which MT switch (or router , other brands too) is capable of 2,5Gb Eth ports ?

Why not a 10Gb ethernet (looking towards 802.11ax bandwidth) ??

OKNET

Pfff the problem exists also on SwOS finally. Can something be done soon enough?

So no OS issue (swos or ros) ??
Definitely an hardware issue ?

OKNET

What about SWos behavior ? Same issue ?

OKNET

Any official, or not, news on this behavior ?

Problem solved with ros7 ??

Can anyone confirm they are absolutely reliable when used in SWOS ??

I have to buy some PoE units, as Mikrotik fan, I wouldn't switch to Unifi or some other brand because of this , it's NOT just a price matter....

Thank you

OKNET

I'm interested on this as my windows10 HP laptop has MiniPci-e slot with hspa+ module I would replace with a LTE module.
It seems the only european bands capable minipci-e card is r11e-LTE indeed.

What about ?

OKNET

Mikrotik announces frequently new products , yet in these semiconductor crisis times.
Good, but on the other side , there is still a lack of one of the best PoE switch ever on the market , the CRS328-24P .
It's still a real bargain product.
Any plan to see them again on regular market ?

OKNET

I need to allow just few mac addresses wi-fi devices to be able to use internet There are two possible scenarios: 1- The actual different brands access points on the LAN , thus mac-address filtering on routerboard acting as router for already wifi-registered clients 2- Replace all APs with mikrotik ...

OKNET

Well ... I have these port closed now in favour of l2tp/ipsec vpn when needed
I'm asking myself if to have port-forwarding active for any type of service is however a threat nowadays.....

OKNET

I have few rdp ports opened from wan to lan machines. Looking to ip connections I've noted two public ip trying to connect (forcing?) to these ports/machines using many source ports Is there a script to add these ip to filrewall filter (forward, drop) automatically after a number of connections or t...

OKNET

FYI we've had this problem on ports 9-16 for some time and had it on 6.48.1 a few weeks back. Then we tried upgrading to 6.48.3 (the current release) and within an hour and a half of being on the new RouterBoard + OS the same problem happened on ports 9-16. So from our perspective it has not been f...

OKNET

The router will decide which has the shortest route and yes it may change randomly. In any case your question is baseless without context. Its not what you think the router will do that counts. Its what you want the router to do. So state your requirements and will assist. Theoretically it's just a...

OKNET

Newbie question : what if I have three 0.0.0.0/0 routes (WANs) with the same distance set ?
How are packet routed to internet, randomly ?
Thanks

OKNET

Is there any workaround to set and keep updated a route entry for www.mydomain.net that use a dynamic IP ?
"/ip route" accepts only IP address as DST address....

OKNET

Well, seven years old post but still actual.... The most efficient splitting PCC way is both addresses and port, but we know , it breaks HTTPS Source port !443 avoid https packet to be handled by PCC but......nowadays most of traffic is HTTPS so you'll end with 90% of packets not being marked for sp...

OKNET

The goal is to allow some clients to use most bandwidth as possible available by three WAN In the past I've used succesfully PCC marking with the "both addresses and port" method This is known to break HTTPS connections so "dst-port !443" was added to each PCC mangle rule. Nowada...

OKNET

Well about second question, I've realized also "Reply dst. address" (wich returns router ip address:port) can be used as parameter to skim connections using a particular route (marked or not) What syntax must I use to remove those connections indistinctly specifying the only IP address wit...

OKNET

I always used recursive (virtual) gateway check against multiple internet hosts per route to determine its fail. This works fine except connections currently using that route hang when route is inactive. Another method is to use netwatch script to both disable route and flush connections, but it wor...

OKNET

I 'upgraded' one of the switches to swos.. It booted. I need to do some testing..

sam

Assuming ROS isn't needed, is the issue solved switching to SWOS ?

OKNET

I have a bunch of POE and non POE version and none of them have this problem after 6.48.1 update... I don't see this like HW problem. I mean that multiple users with multiple machines still report issue after 6.48.1 At that point, what's the difference between theirs and yours machines ? That makes...

OKNET

I have 18 of these (4 POE and the rest non POE) and only 2 of them are having the problem.

It seems an hardware related problem, then....

OKNET

I'm planning to buy some of these units, what's the issue status ?
Are there different hardware versions ??
I know this isn't a support forum but some guys like Normis &co. are reading :
Will switchOS ever be implemented in this model ?

Thank you

OKNET

The ISP device is a silly Vodafone Station with MT PPtP server (RB3011) in its DMZ address. I'm able to connect my RB3011 from my iPhone L2TP/ipsec client as well as bring up a GRE/ipsec static tunnel from a remote RB3011 No luck with third 3011 running PPTP client stuck in situation reported..... I...

OKNET

Tried also to work with /ip firewall service-port pptp helper, nothing changed (perhaps service-port is used for forward ?)
Don't know what else to try....

OKNET

I have a MT pptp-client with static public ip address on its wan, trying to connect a MT pptp-server behind a 1:1 natted ISP router. https://ibin.co/5pUg36iYGFBz.jpg Client hangs on "link established" After first data exchange, client hangs in sent LCP ConfReq id=0x20 <mru 1450> <magic 0x3...

OKNET

I'm experiencing a problem with my Vodafone LTE USB key connected to RB3011 (6.47.8) Suddenly Lte interface disappears as well the modem from the USB device list. USB power reset works (leds on usb modem shut off and light up again) but no modem back on USB devices list. Removing hardware and plug i...

OKNET

Thanks for feedback,
I would expect a wireless improvement or at least other improvements with no wireless one, rather than a step back.....
Old wapACs were very good in 5GHz performances, let's see these new ones...

OKNET

Just realized of the new version of wapAC
Two Gb ethernet, more RAm, powerful quad-core cpu, well done !

I noted a dual chain 5GHz wireless instead of old triple chain, any disavantage ?
Any review about new model ?

Thanks

OKNET

I refresh this old thread to ask: using a double boot machine (swOS-routerOS) when using it as a simple L2 switch, are there real pros or cons in running each OS ? Choosing i.e. to run RouterOS with a future L3 managing in mind or to use minor scripting/supervision inside a switch is switching-perfo...

OKNET

Mikrotik launched some interesting new hardware.
Anyway , there is still a lack of a 16 x Gigabit ports-PoE with SFP+ switch (when a netPower16P however has ben released for outdoor use)
CRS328-24P is too big in depth , where CRS112-8P has too few ports.
Still waiting for a mid-solution....

OKNET

....I could set a daily "schedule1" to check if new version is availale, if yes, enable "schedule2" with interval 2days ,who launches update script. This script also disables "schedule2" itself, stopping updates unless "schedule1" finds a new version available...

OKNET

I use a simple scheduled script to update my RB : /system package update check-for-updates once :if ( [get status] = "New version is available") do={ install etc etc How can I delay the update after i.e. two days the new version has been detected ? I.e. making the script to collect current...

OKNET

So, it seems common and safe.....

OKNET

https://i.ibb.co/4TGZnLq/rbcli.jpg RB serving as gateway for a hundred smartphone clients RB is DNS/DHCP server In few hours I end up with many hundreds DNS cache entries like these : https://i.ibb.co/pv1TnrN/dns.jpg AP are WiFi routers indeed, and I continuously have dns queries from their ip addr...

OKNET

I've understood that private RSA key of client must be copied into ~/.ssh/authorized_key of server Just proven this works for a passwordless login from debian client to debian server. Now, what RSA key of mikrotik should I use to be copied into server authorized_key ?? If I cannot issue a RSA key fr...

OKNET

I need to login from routerboard (ssh client or ssh-exec) into a debian system without password. I have generated a RSA key pair into Debian system and copied both into ./ssh/authorized_keys I have copied those keys into routerboard and correctly imported When I try to login into Debian it still ask...

OKNET

Not any direct method to access to flash neither ?

OKNET

hAP lite has 32MB ram 16MB flash No way to update after deleting all files and rebooted more than once (had to try netinstall yet). The winbox method system->packages>CheckForUpdates, finds new version but "download and install button" refuses to appear (likely because of space issue). Pr...

OKNET

hAP lite has 32MB ram 16MB flash No way to update after deleting all files and rebooted more than once (had to try netinstall yet). The winbox method system->packages>CheckForUpdates, finds new version but "download and install button" refuses to appear (likely because of space issue).

OKNET

Looking at filter rules after 6.45.2 hAP lite has been conf-resetted : 0 D comment=special dummy rule to show fasttrack counters chain=forward action=passthrough 1 comment=defconf: accept established,related,untracked chain=input action=accept connection-state=established,related,untracked 2 comment...

OKNET

Ok for manual extracting and install packages for hAP lite but....... what about next releases ? no more npk-upgradable ?

Is it ok to have 7,4 MB available out of 16 total ?

OKNET

As per https://wiki.mikrotik.com/wiki/Advanced_Routing_Failover_without_Scripting : My actual routes: 0 A S comment=Failover gwa dst-address=0.0.0.0/0 gateway=10.17.13.1 gateway-status=10.17.13.1 recursive via 172.16.217.254 ether1 distance=1 scope=30 target-scope=10 routing-mark=to_WAN1 1 S comment...

OKNET

A LAN device makes DDNS updates (www.noip.com)
Routerboard has two WAN (two ISP) , how can I force calls to www.noip.com to use a specific WAN ?
I cannot route by domain name...

OKNET

Actually, it seems to have not a great effect....
In which position should I place it among forward chain rules ?

Rather than notify client, shouldn't be more effective to cut out dead connections ?

OKNET

Usual failover without scripting: https://wiki.mikrotik.com/wiki/Advanced_Routing_Failover_without_Scripting Once a virtual gateway is down due to loss of internet connectivity, the second gateway is immediately available but all old tcp connections (as seen in /ip firewall connection) are still up ...

OKNET

https://wiki.mikrotik.com/wiki/Advanced ... _Scripting

OKNET

Just installed 6.43.4 into a X700 64MB CompactFlash and enabled LCD Nothing easier..... for an old unused HW X700 comes with a miniPCI slot equipped with an AV-SFB160 VPN accelerator card , once replaced with a Routerboard R52 found on my toolbox, it was immediately recognized and running .... Works...

OKNET

Once the 60 days runs out there is no detriment to the OS, it carries on working fine apart from you cannot upgrade the software package any further. New to CHR, do you mean after trial period CHR still works at full speed and full capabilities but no more way to upgrade ?? I hope nobody choose thi...

OKNET

Thank you for replies, So the issue is the double nat, and it doesn't happen in pppoe as the public IP is directly assigned to MT WAN interface Yes , all ports from public ip address are natted from router (10.0.10.1) to routerboard WAN (10.0.10.254) Connection mark for dual wan already done this wa...

OKNET

FTP to port 2121 of both public ip addresses of two ISP connections , points to LAN ftp server, port 21 : add action=dst-nat chain=dstnat dst-port=2121 in-interface-list=WANs protocol=tcp to-addresses=192.168.1.100 to-ports=21 The connection works over a pppoe WAN with public ip address released to ...

OKNET

As described in https://forum.mikrotik.com/viewtopic.php?f=7&t=131039 I'm using this line to downlad new npk files into CAPs manager to be available to APs update (as "require same version") : /tool fetch address="download.mikrotik.com" mode=https src-path="/routeros/$ne...

OKNET

I don't have any channel configuration. The fact you have an SSID configuration that matches a RADIO MAC address, means that configuration, thus that SSID will be used only on THAT radio. So 5GHz radio = aa:bb:cc:dd:ee:01 = config01 = SSID_A 2.4GHz radio = aa:bb:cc:dd:ee:02 = config02 = SSID_B simpl...

OKNET

That was, basically, what I suggested you to do...... :o You have chosen two provisioning rules , based on hw-supported-modes rather than mac-address of each radio.... Mine was: add action=create-dynamic-enabled master-configuration=cfg_5g name-format=identity radio-mac=6C:3B:6B:xx:xx:xx add action=...

OKNET

You must set a frequency for that channel, and make sure the relative extension channels don't fall in a restricted portion of band denied by your country regulatory domain (if set) or out of band at all.

OKNET

I have simply created two provisioning rules that match each Radio MAC (thus each band inside the same AP)

Each rule points to a different Master Configuration with its own SSID (no need for slave configuration, I use them for multiple SSID inside the same band if needed)

OKNET

In Registration Table you will find the connected clients , not the APs.

OKNET

Completely different subnets. However, I found a simple workaround: Since recent Ros versions, hostnames are allowed as L2TP client target, I've set an arbitrary domain name pointing to both addresses : /ip dns static add address=<ISP1_public_address> name=myl2tpserver.fail add address=<ISP2_public_...

OKNET

My MT L2TP server has tho different ip addresses from different ISP

How can the second ip address be used as failover from MT L2TP client ?

OKNET

ROs 6.42.5 : w60g - improved maximum achievable distance;

how much, generally, in percentage ?

OKNET

I wonder how many distortion reflections and attenuation has 1Km path in between modern buildings , and with bad weather conditions.... Probably something better can be expected in a longer unobstructed path (i.e. mountain to mountain , mountain to lowland, skyscrape to mountain etc...) manuzoli sai...

OKNET

Is it an unobstructed path ?

2,4Km link is a very short distance for clear path , unless 60GHz devices have some intrinsic limitation (they are 802.11ad devices).....

OKNET

I have to do it in CRS125 but is confusing me: I have a bridge1 bonding all switch ports together as replacement of old master-port I have three vlan to bridge1: add interface=bridge1 name=vlan10 vlan-id=10 add interface=bridge1 name=vlan20 vlan-id=20 add interface=bridge1 name=vlan30 vlan-id=30 The...

OKNET

Is PoE switch used for cameras purpose only ?
If so , you can assign a different LAN subnet (included the routerboard ethernet port it connects to) and filter its outgoing traffic in firewall.

OKNET

It would be interesting to know if other products using LCD are affected this way.....

OKNET

Always good to know about others experience
So hap-ac2 is comparable if not better with 3011 ??
So it should be better than HEX or HEXs ?

Or is it quality vs price involved in your comparation ?

OKNET

Sindy, I admit CAPsMAN philosophy is a little tricky for unexperienced like me. I always used NO local forwarding, just all traffic controlled by manager (mostly wifi for some hotels) But they don't need VLANs yet, I'm doing some experiment in laboratory where are four VLANs I need a pair of SSID (m...

OKNET

Squeeze,
What about RB3011 in the list ?

OKNET

From what I understood, NO-local forwarding (or manager forwarding) causes the system to create new interfaces that pratically reflect the wireless interfaces of each AP. This requires a bridge (and only a bridge) to be declared as datapath in manager configuration. As I use VLANs , how can I set da...

OKNET

Thank you Artz, One thing is not clear to me from that wiki, look at "Port based VLAN" and "InterVLAN Routing" examples: The bridge, the ingress-vlan-translation and the egress-vlan-tag are the same. They differ in Vlan membership declaration. Port based VLAN uses "/interfac...

OKNET

Thank you for link In wiki , switch1-cpu port is added to /interface ethernet switch egress-vlan-tag in each desired vlan Should I do the same for all ethernet ports intended to be vlan trunks carrying tagged vlans to other switches ? Should those ethernet ports be added to bridge anyway ? Thanks

OKNET

I followed https://wiki.mikrotik.com/wiki/Manual:CRS1xx/2xx_series_switches_examples , expecially inter-vlan routing On my CRS125 ports 1-21-22 are trunks carrying tagged vlans to three switches , ports 23 and 24 are WANs, the remaining ports (2 to 20) are members of VLAN10 untagged. As per wiki I s...

OKNET

Mikrotik devices simply are NOT fully 802.11af/at compliant. They might be compatible to some switches, yes. But they lack the support of all requirements. It seems they are missing galvanic isolation. wAP ac is an older product. New products are fully compatible. What do you mean for "new pro...

OKNET

I'm still stuck and confused on PoE power requirement of wap-ac specifications say : PoE in 802.3af/at Some 802.3af switches can easily handle them, where other ones fail When running , wap-ac draws a ridiculos 4to8W any af PoE should be capable of....... Nobody has been able to tell me if PoE budge...

OKNET

Since both are already used and I need a pair more (a pair for first wan and a pair for the second one) , what else do you suggest ??

OKNET

Sindy; thanks for clear explanation.
RoadkillX : so what's the entire rule ?

OKNET

I need to do a prot forwarding between machines on the same lan: packets from 192.168.1.0/24 machines to 192.168.1.1 on port 8080 (routerboard lan ip address) must be redirected to 192.168.1.10 on port 80 , so I tried add chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=80 protocol=tcp...

OKNET

https://wiki.mikrotik.com/wiki/Advanced_Routing_Failover_without_Scripting Which internet hosts do you choose for ping check ?? (often, big companies change ip address or ping policies....resulting unreachable) Do you experience , sometimes, routes become "unreachable" despite you can ping...

OKNET

Very probably I'm less expert in scripting than you... :D A said , I've copied some sources, and that sequence was done that way , probably , yes , it can be modified to do a firmware check and upgrade once routerboard has rebooted after a package upgrade (so I don't bother so much....new package to...

OKNET

Look here : viewtopic.php?f=7&t=131039

OKNET

Basically I need to update .npk file for APs AUTOMATICALLY before Manager upgrade. Copying and mixing parts from some sources and wiki I'm ended with this simple working script : ############# create ap file directory: "apdir" ############# create the update schedule: /system scheduler add...

OKNET

As per wiki : /system package update check-for-updates once :delay 1s; :if ( [get status] = "New version is available") do={ install } running manually it says : channel: current current-version: 6.42 status: finding out latest version... input does not match any value of value-name Alread...

OKNET

Ok for WDS, But I was surprised by wiki saying : The MPLS/VPLS approach has some advantages: VPLS tunnel is about 60% faster and less overhead than EoIP tunnel 802.11n speed is limited over WDS bridges, this method doesn't have such limitations It should be interesting to know which configuration ha...

OKNET

I'm again on this old post , thinking at this method over the "new" 802.11ac protocol: still valid for bridging the same subnet or something better is available ?

Thank you

OKNET

After latest discussions about NV2 quality for a Point to Point link, is it still the best protocol to be used ?
Thank you

OKNET

Yes , I'm using L2TP with IPsec

No tests made with plain L2TP

OKNET

Thank you
Hoping MikroTik staff take this in consideration for next firmwares

OKNET

I have two routerboard behind the same ISP dsl router Each of them is configured to build an l2tp connection to THE SAME server (another routerboard device) so both come from with the same public ip address Each l2tp is configured with its own name, secret and remote address When the first l2tp sess...

OKNET

Sindy, this have somewhat to do with my other post referring to USB port....

Do you mean that a generic USBtoSERIAL adapter (i.e. prolific2303) can be used for this scope and hardware flow control is still available ??

OKNET

But I suppose the purpose is for the only USB to serial data exchange. I would like to manage a smart device (a printer, an Arduino-like, etc etc ) connected to routerboard USB port , as if it was connected to my PC USB port (via a local virtual USB port client emulator ) I.e. I connect a printer to...

OKNET

I mean as per wiki : (e.g., some RouterBOARD models have reduced serial port functionality) My rb2011, rb3011, crs125-24g etc say "port does not support hardware flow control" : is it an "hardware" limitation of these machines ?? I need to control some devices that need hardware ...

OKNET

As interestingly proposed in https://wiki.mikrotik.com/wiki/Serial_Port_Usage , "Accessing a serial device as if it were physically connected to your PCs' COM port" section,
is it possible to achieve the same with a device connected to routerboard USB port ???
Thank you

OKNET

Which routerboard models support hardware flow control on Serial0 ??
Thank you

OKNET

With CAP "require same version" upgrade policy, how can I keep .npk files for APs, AUTOMATICALLY updated to same version (latest) before I update manager ?

Thanks

OKNET

OK, Fill your "users wishlist"

OKNET

Of RB3011 or unworking powered device ?

OKNET

It works !! Keys pair generated without passphrase, public+private imported into client with empty passphrase, public imported into server associated to desired user et voila' straight getting of remote router prompt without password. There is just a last insurmountable obstacle for now : the /syste...

OKNET

Thank you for answering, Let me understand: I should export public key from CLIENT RouterOS to be imported into SERVER RouterOS, but exporting of public key is not possible So I have tried to export the private key ( ip ssh export-host-key ) converted into a public key by a linux machine (ssh-keygen...

OKNET

No ideas ? I know forums behaviour so I can't pretend an answer, but I'm asking myself if : 1 my question is so simple that I should find myself the answer or 2 my question is too hard and very few know the answer for solution or 3 my question has no solutions At least a little answer for second or ...

OKNET

I have succesfully established a SSH PASSWORDLESS connection from a linux client to a routerboard (server) using RSA key method.

Can I do the same from Mikrotik SSH client to Mikrotik SSH server ?

If yes, how to export keys from client machine ?

Thank you

OKNET

I have solved issue by replacing the SXT unit powered by 3011 Note that "suspected faulty" SXT is OK with its own injector, and powers up OK with few 3011 but KO with other 3011 units. It seems an edge situation where , anyway, 3011 PoE capability is at its limit. Unfortunately I can try n...

OKNET

Let me ask it this way:

When admin@myrouterboard starts an ssh session to an external server, which private/public key is used ?

Thanks

OKNET

Almost 2018 After years and years same issue (no single line ssh client connecting automatically to remote ssh server by script) At least , someone from mikrotik staff should clearly say : "it is not possible and it will be not possible because we don't want it to be possible" People still...

OKNET

Which is the biggest routerboard based system you know of ?

OKNET

No one ? Let me explain better: First of all , is it possible to run ssh CLIENT commands from inside a routeros script ? If yes, assuming it is not possible to automate the ssh username/password mechanism, can routeros perform a passwordless client session to a remote linux machine using RSA key Is ...

OKNET

thanks !

OKNET

I need to execute a script on a remote linux machine when a netwatch event is detected
Something like :
on up ,
/system ssh user=myuser password=mypassword command= /home/myuser/myscript.sh

It seems automated ssh login via script doesn't work

Any idea ?

OKNET

I'm trying to sen e-mail from within routeros with these parameters : address: <smtp_address> port: 587 start-tls: yes from: Mikrotik_Router user: <myusername> password: <mypassword> AUTH fails , smtp server answers back : Nov 30 14:39:33 mail postfix/submission/smtpd[9383]: connect from unknown[rou...

OKNET

I need for a script to be triggered each time a MAC address is listed , even for few seconds , in "wireless > registration" table
Netwatch works for ip addresses only, how to accomplish this ??
Thank you,

OKNET

I'm using the original wall-power supply on my 3011 I do not understand if it is a local hardware issue, I'm checking now a new 3011 with a new sxt5ac on laboratory , and all is working fine , sxt is powered up at every cable connection..... The cable I'm using in faulty installation has been checke...

OKNET

Same issue, I've bought a RB3011 to power my sxt 5 ac (RBSXTG-5HPacDr2) via eth10 PoE It has powered up correctly just one time after a lot of poe reset and cable disconnect and reconnect, it has lasted correctly up for days unless a package upgrade reboot has occourred No more became alive ! Ether1...

OKNET

Yes , it was an unsupported channel choice..... not an A/N/AC problem...

OKNET

in capsman u can set signal limit if its gets too low that ap automatically kicks out that device and eventually device will connect to another ap with a better signal The downside is , on the area edge APs, clients kicked out but with no better AP to choose , are kicked out until they come back to...

OKNET

While checking, I have found three boot timing 1- Release button when ap/cap and wireless leds blink alternate , mAp starts in out-of-the-box mode: no access from lan , only unsecured wireless enabled 2- Release button when ap/cap led blinks fast , mAp starts in capsman mode (access anyway allowed f...

OKNET

What is the button timing procedure to reset mAp to nodefaults=yes without connecting to wireless ?
Thanks

OKNET

It seems feasible..... thank you

OKNET

Sorry, I mean automatically rewrite those two rules into this machine (running dhcp client), each time a new IP LAN subnet has been released to it.
Without human operation.

OKNET

Consider these two firewall/nat rules : chain=srcnat action=netmap to-addresses=10.10.0.0/24 src-address= 192.168.1.0/24 out-interface=l2tp-out1 chain=dstnat action=netmap to-addresses= 192.168.1.0/24 dst-address=10.10.0.0/24 in-interface=l2tp-out1 192.168.1.0/24 is lan subnet address released to de...

OKNET

Already tried.... doesn't work...

Errata:

It works ! ( I forgot to reset active connections while activating rule.....)

Thank you

OKNET

Scenario: http://www.digiteltlc.com/public/mask.jpg Machines on 192.168.0.0/24 network must reach network 10.10.10.0/0 with a "virtual" address 192.168.5.X I.e. to connect to 10.10.10.100 I will enter 192.168.5.100 I have routed 192.168.5.0/24 through 10.0.0.2 endpoint and addedd two NetMa...

OKNET

I set wlan2 on my wap-ac to 5ghz-a/n/ac

A non-AC capable client cannot see its SSID.
On MT wlan status window, it is running channel 5180/20/ac

All ok if Band is set to 5ghz-A/N

How should I configure wlan in a wireless environment where older devices are present ???

OKNET

Not able to solve the issue : I need trial users to have no time/bandwidth limits for 10-15 days (hotel guests) I have set up hotspot with these parameters : SERVER IdleTimeout 5 min. Server profile - Login by Cookie, Http Chap, Trial Http Cookie Lifetime 3 days Trial Uptime Limit 0 Trial Uptime Res...

OKNET

Sorry for this "up"

I've solved reloading the old backup (same identical configuration)

Probably some time limit expired and but cleared by restore ??

Any idea ??

OKNET

A bigger problem: Suddenly hotspot users (trial authentication) cannot get the login page thus they cannot turn into active user and navigate internet. They can get login page typing hotspot server ip address on web browser, after trial login, the hotspot user is created as well its cookie and it is...

OKNET

I need some explanations on hotspot and trial user settings: How does HTTP Cookie Lifetime work ? What does it happens when this timer expire ? On Hotspot server profile, a pair of timers where used , as per manual ; trial-uptime (time/time; Default: 30m/1d) Are they replaced now by two fields "...

OKNET

Idlemind, a great Thank You

OKNET

Some way solved...... Replaced DGS1210-28P switch with DGS1100-26 M P (where MP stands for Max PoE) It has all ports 30W PoE capable ( 802.3at ) despite the fact wap-ac is a 12w max. device Once connected to this switch they drawn from 4 to 8 W each but Dlink DGS1210-28P 802.3af gigabit switch go ma...

OKNET

About WHY, I think the cause is described in wiki: Nexthops cannot be resolved through interface routes (i.e. routes that have interface index instead of gateway address as nexthop). Nexthops also cannot be resolved through unreachable routes (with type B, U, or P) even when they are active. They al...

OKNET

I always used this method with natted DSL routers : As earlier, first we need routes to our checking hosts: /ip route add dst-address=Host1A gateway=GW1 scope=10 add dst-address=Host1B gateway=GW1 scope=10 add dst-address=Host2A gateway=GW2 scope=10 add dst-address=Host2B gateway=GW2 scope=10 Then, ...

OKNET

I have created a new skin for a user "test" of a group "test" that loads its own skin "test". How can I allow this user to change its own password from webfig in system->users while denying the view/modify of other users settings (expecially passwords) ??? I'm not able ...

OKNET

nz_monkey: is 2520-24 POE a gigabit switch ? This make me think about this: my wap-ac work correctly if connected to a pair of 802.3af switches (des1316 and srw224P) here in my lab , but they are 10/100 switches and poe supply involves 1,2,3,6 pins (checked , they power up with only these pins) Giga...

Search found 341 matches