MikroTik

mkx

Show us config of R2 (for starters).

mkx

Disabling IPv6 support on router is definitely a safer option ... with firewall rules it's always possible to screw something up. But as @Sob wrote: IPv6 is here to stay and it's only a matter of time when you'll have to bite into this nut ... so you better crack it open before biting it.

mkx

@jaclaz: I'm not saying that default setup should block everything from LAN as well. I'm just saying that attacks from LAN are possible and one should not dismiss such possibility when doing a pist-mortem (with intent to harden router's config). Yes, I agree that attacks from WAN are whole lot more ...

mkx

I still not understand why ROS does not give any possibility to re-gain access ... Possibly because that would enable users to steal CPEs from ISPs if the method of regaining access would be too straight-forward (such as password printed on a sticker attached to device itself). The basic problem in...

mkx

It's normal to have software release with known issues (even before releasing it), accompanying documentation just has to mention those clearly. On the other hand it's sometimes good (if not necessary) to release new version due to required new functionality ... while keeping to work on resolving kn...

mkx

So are you saying that the other two rules, such as 1 chain=prerouting action=drop dst-port=53 log=no log-prefix="" protocol=udp dst-address=172.16.1.100 src-address-list=!dns are not working? According to packet flow , prerouting is executed before DST-NAT ... which means that for packets...

mkx

We are not in a hurry xD, we only saw that in its official documentation and we were surprised to see v7.17 with green markers. I guess that they are planning to introduce some additional functionality (e.g. " Starting from RouterOS v7.17, DHCP snooping is supported with hardware offloading bo...

mkx

The problem is, that there realy isn't any disconnection, just Caps connection becomes suddenly "interrupted" and after few seconds starts working again. When frame loss happens, links don't disconnect ... in worst case they may renegotiate to lower speed (e.g. 100Mbps instead of 1Gbps) b...

mkx

0 chain=prerouting action=add-dst-to-address-list dst-port=53 log=no log-prefix="" protocol=udp src-address-list=!dns dst-address-list=!dns address-list=dns!!! address-list-timeout=none-dynamic Did you thoroughly think about what this rule does? It says: if dst-port is 53 . AND . if proto...

mkx

Some switches try to be smart (too smart as it turns out) ... and try to detect anomalous traffic. I have a Dlink manged switch and it was messing with NTP traffic (UDP to/from port 123) inside LAN. After disabling that "feature" I have zero problems (since more than a year ago). So check ...

mkx

@User345135: since you're running ubunti, run sudo netstat -ntlp | grep 8888 If you don't have netstat installed, install it using command sudo apt install net-tools The output of netstat command should show you name of process listening on port 8888 ... and that should give you a hint as to what's ...

mkx

Not sure if this is ROS specific. With IPv6 there's some spcific configuration necessary on "client" router to make it work. Sometimes ISPs don't do the right thing and in those cases client has to work with ISP support to get things working.

mkx

Does that mean I cannot make it IPv6-only? or at least IPv6 first then if timed out IPv4? You may ... by using firewall filter rules. Tunneled traffic would appear in chain=output when exiting SSH tunnel. But as @sindy already explained, you would not be able to distinguish tunneled traffic from tr...

mkx

Blaming MikroTik for setting proxy properties in your browser. You need to improve your reading comprehension or be more honest. I did not blame Mikrotik. But since you were stating your problem on Mikrotik forum, it certainly did seem so. And @kleshki simply voiced his doubts ... yeah, he might ha...

mkx

Since the CHR has no switch ASICs, perhaps the same applies to it? The problem with RB4011 (and a few other devices) is that they have more than one switch chip and bridge does L2 HW offload to them. With CHR, there is no L2 HW offload AFAIK, so it's not the same case as in the thread you linked. N...

mkx

The error message doesn't come from Qt, it comes from XCB ... which is (one of) implementation of client side of X11 protocol ... and here 'client side' is, contrary to usual situation, the side where application is running (i.e. your Linux workstation). And it seems that it's Xtightvnc who uses XCP...

mkx

Maybe bug or something else? I seem to remember a discussion about this exact problem a while ago (could be many moths ago) and @Normis acknowledged the bug. I'm pretty sure it was supposed to be fixed since then, but I've no idea in which version this was fixed (if at all). So if the problem happe...

mkx

My guess it operates a "matcher"/selector, not like the firewall "filter"/etc Both here and firewall filter rules have most properties "selectors" and only one property which does something (in both cases it's action ... to whatever it's set for a particular rule). In ...

mkx

I’m surprised you can’t do this using dst-nat rules by looking at dst-ip and dst-port and using those to match and send elsewhere. If DNS A records for server1.domain1.tld and server2.domain2.tld point at same IP address (and standard ports are in use), then L3/L4 firewall (which is what ROS runs[*...

mkx

I had some problems to make VLANs work as expected until I also set the bridge as a tagged port too. Bridge has multiple personalities (and the distinction between them in ROS configuration is not made at all). One of personalities is a "CPU-facing switch port" (and by "switch" ...

mkx

Yes, but the dubitative form is anyway appropriate when the standard power supply is used, the 24V/1.2A are IMHO very "tight" to power both the "main" device and another one via (passive) PoE. Well ... one always has to do power budget calculations when doing any kind of PoE ......

mkx

Whether the Cap Ax can actually be powered with passive PoE at 24V is not written anywhere, it may work or it may not. You're right, the passive PoE-in is rarely mentioned for MT devices with 802.3 af/at PoE-in support. But it was explained multiple times (by MT staff) that all MT's PoE-in capable ...

mkx

1. I cannot access the web-interface of RB5009 (or using WinBox) from ether7 after I add "vlan-filtering=yes" to the config. 2. I still cannot understand what is the right way to change the IP address of RB5009 from 192.168.88.1 to the Base VLAN range. More or less full access to your rou...

mkx

The benefit of having one statically compiled binary is that one can choose to package it as-is as an rpm, deb or flatpak without any further work required by Mikrotik devs. The cost is much bigger installable ... and some (functionality) problems when not using system-wide libc (and possibly some ...

mkx

The only strategy, which is fast enough, is to handle it using dst-nat ... like you're doing it now. Using external DNS servers is no different in this aspect. Doing it directly on main router cones with a benefit: you are not adding another point of failure (router is already there and for differen...

mkx

With all of your config, even if backup solution doesn't have to be fast, any HW you throw at will struggle if flash and RAM are not large enough. hEX lite with 16MB flash and 64MB RAM is a bit tight. RBM11G with its 256MB RAM should do better but 16MB flash will be equally tight. You may want to ha...

mkx

Creating a flatpak manifest around a statically compiled binary as it is now is no problem at all. In this aspect, cresting deb packets is not much different. Only that executable doesn't have to be statically linked, instead it's possible to declare dependencies and apt/apt-get/... will resolve th...

mkx

I would simply like to know if there is any way to identify each IP on the PiHole server instead of having all queries appear with the IP of the router itself. Curently you're running a thing called "hair-pin NAT" for PiHole DNS service (the src-nat/masquerade is essential part of it). As...

mkx

And all Cyrillic comments are unreadable in WinBox 4 It's a known issue and it'd due zo neglect of properly handling different encoding schemes ... all UIs simply accepted characters as bytecode and didn't interpret them according code page. So it was always a problem if one used different UIs (e.g...

mkx

Broadcast traffic in typical LAN is traffic where devices are looking for others offering certain service. Some examples: DHCP a device sends query about available DHCP server to broadcast address, initial reply is sent unicast (to network interface's MAC address) ARP requests device has to find out...

mkx

Any chance with the next update that will check the model number for example CRS309-1G-8S+, and NOT install any wifi packages and remove wifi from webcfg. Since wifi is not supported. ROS built-in updater never changed list of installed packages ... with notable exception of 7.12.x where updater ma...

mkx

It absolutely makes sense to have those wireless interfaces in bond. Default monitoring mode is mii which relies on undelying interface hardware to announce link failure. Additionally bond will introduce additional delay (default is 100ms) because links status monitoring is done regularly and the de...

mkx

I agree that it's only too confusing to have to configure one functionality in multiple places (VLANs is a good example of this lunacy). Instead here's my proposal: /interface ethernet switch port set ether2 mirroring=egress mirror-targets=ether3 set ether4 mirroring=ingress mirror-targets=ether3 se...

mkx

The proxy service on ROS is not intended to be reverse proxy ... and even though it seems to work for you, it doesn't allow for proper configuration to operate as reverse proxy. You're saying that you have multiple web servers in your LAN. I suggest you to run a proper reverse proxy on one of them (...

mkx

I can't say I understand why there is a need in my case for inventing mac addresses. I understand how ROS needs to invent mac addresses for virtual interfaces. I don't know how Ubiquitis are configuired for additional SSIDs on same radio, but the end result is the same as on Mikrotik. And that is m...

mkx

Here you are:

sorry, but this doesn't scale ... and changes names of properties (to which you opposed).

mkx

It would be inte4resting to see actual configuration from one of LHG-60 devices ... what I'd expect to see is either a bond (possibly active/backup mode) or simple RSTP hierarchy (which would switch over to 5GHz backup a little slower I guess). I thought the LHG-60 has no backup 5GHz?! Sorry, I mea...

mkx

It would be inte4resting to see actual configuration from one of LHG-60 devices ... what I'd expect to see is either a bond (possibly active/backup mode) or simple RSTP hierarchy (which would switch over to 5GHz backup a little slower I guess).

mkx

And in some other post you dare to call others "Nerd" ??
Tjeezz ...

I called others "Mikrotik nerds" specifically

mkx

AA:16:9D is actually A8:16:9D and is a roku tv 1E:1E:E3 is actually 1C:1E:E3 and is also a roku TV 9E:05:D6 is actually 9C:05:D6 and is a U6+ AP The addresses on the left are all "locally administered addresses" (see wiki article on MAC addresses ) where the second most significant value ...

mkx

I know this seems to be related to a license at first, but maybe not. It's interesting to see if the problem persists on another type of hypervisor, especially in Hyper-V since it doesn't use virtio drivers for switches.

Which again points at CHR itself rather than at virtualization platform.

mkx

BSSID is usually MAC address of a particular radio. So if you somehow create an inventory of all (real and virtual) radios in your network, then you should be able to figure out which SSID is transmitted by which AP.

mkx

the new one is (IMHO without reason) stupidly complex The new one is (potentially) flexible, it may allow this scenario: /interface ethernet switch port set ether2 mirror-egress=yes mirror-ingress=no set ether4 mirror-egress=no mirror-ingress=yes set ether5 mirror-egress=yes mirror-ingress=yes /int...

mkx

not sure i really follow that much. just considering a cheapo isp modem (speedport plus) that probably costs a few euro is giving me all 300mbit on wifi on default setup (80mhz channel, it's ac device). What I tried to explain (with perhaps too many words) is that many times less is more ... due to...

mkx

I think that the most important take-away from this thread so far is that throughput drops after applying (high capacity) CHR license ... without changing any of configuration. As documented in post #10 above . Which means that the code, which enforces licensed limits inside CHR somehow misses its t...

mkx

Maybe select another brand for the SFP+ ?? MT devices can be a bit picky when it comes to working with SFP modules ... MT publishes compatibility list , but of course it only contains their own modules (and even there not every box is checked). XS+85LC01D seems to have many checks so it seems to be...

mkx

Which means that somebody configured it to do that. Again, the problem is that it does not do what it is configured to do Sherlock. And I asked you to show us how it's configured, Watson. I don't follow problems of any particular users so I don't know which bug you allegedly "encountered the l...

mkx

The firewall blocks everything except the addresses in the dynamic list.

Which means that somebody configured it to do that.

So do you want us to start the guessing game? Otherwise post full config for review.

mkx

Base article to truly understand my answer that follows: viewtopic.php?t=173692

Setting of properties pvid and frame-types are settings for the router-facing port of the switch.

mkx

One (relatively radical) possibility is to disable/re-enable capsman on hAP ac2. It should trigger all CAP devices to re-provision (CAPs get un-provisioned if they loose connection with CAPsMAN). You can also go around CAP devices and individually disable/re-enable cap client. And probably there are...

mkx

Well, wifi in 5GHz sucks (almost as much as 2.4GHz). According to wifi channel allocations, there are only 3 160MHz channels available: channel 50 ranging from 5170 MHz to 5330 MHz (in ROS parlance that's center frequency 5180 with Ceeeeeee channels) channel 114 ranging from 5490 MHz to 5650 MHz (th...

mkx

I'm looking for a small version of the Model CRS328-24P-48+RM for testing configs for a customer. I don't care about speed/sfp or dual boot. I only need switch OS. Would the CRS106-1C-5S work? I couldnt find a comparison guide. Depends on how similar the testing switch should be to the "real&q...

mkx

But if there is only 1 wace2 device, why bother ? As far as info in this thread goes, @OP runs a few RBD22UGS-5HPacD2HnD (which are ac devices) and now he threw an L22UGS-5HaxD2HaxD into the mix ... which is ax device. All of these are capable of running wifi drivers (L22 only this one), so @OP wou...

mkx

If device is fully bridged it doesn't matter if ether1 and 2 are connected

Agree to that. I was just explaining to @OP why he can't manage device via ether1 if they're running factory default config (which doesn't bridge ether1 with the rest of ports AFAIK).

mkx

Thank you for the suggestion, Amm0. Added to wishlist. Behaviour should adhere to system settings. I don't use Mac, but on Windows and Linux I prefer not to have apps groupped ... and there's system-wide setting for that both in Windows and KDE (which is what I use on Linux if I can choose). In nor...

mkx

It's been a while since my devices were pushed in storage starvation ... but I don't remember seeing anything in the log. Specially so not after reboot (since by default all logging goes into RAM and even if one set up logging to built-in flash, that would be unsuccessfull as well due to same reason).

mkx

Why can't I connect to the CAPs using Winbox from the router? Why do I have to physically go to each CAP just to apply my configuration? Because out of factory, default config for most MT models is "home router" mode ... in which first ether port (ether1) is used as WAN port and to protec...

mkx

While it's preferable to make MTU of all interfaces the same (i.e. 1500) and while it seems that @OPs ISP allows to play with these values, it could be that there's some segment in ISP's network which doesn't support full 1500 byte packets over PPPoE ... and fragmentation happens there (and also spe...

mkx

Not much to take care of. One major thing is to set priority on bridge of switch you want to use as "master" in STP hiearchy to value, lower than default (which is 0x8000) ... 0x2000 would be a safe value. This way you won't see topology changes if some switch changes its MAC address (if p...

mkx

If would be nice, if Winbox had told me about the full disk when saving a configuration.

I agree to that. AFAIK none of GUIs actually warn user about storage being depleted ...

mkx

1. I uninstalled wireless package from CCR1036, but now I don't have an option for Capsman anymore. You do. It's under /interface/wifi (you have to use a few subtrees there from, capsman uses profiles). On devices with ac/ax radio and with wifi-qcom (or wifi-qcom-ac) drivers installed, one configur...

mkx

Be carefull with the fast (sponsored) answer of the Google (AI based?) search.

Gosh ... doesn't everybody (and their favourite pet) skip top results from search engines?

mkx

Which GUI do you use? There are WebFig (web based UI), Winbox3 (very stable) and new Winbox4 (early beta, so likely buggy) If you change detect-internet (to "none") in CLI, does it stick? And when you open that setting in GUI (which flips its setting) ... and close it without applying ... ...

mkx

AND the hex is losing it's configuration, comments and also files I created. What is going on?! Doesn't it store those things on an internal device? Check hEX for flash utilization. If it's (almost) full, then configuration changes can get lost. But that happens after reboot, running copy of config...

mkx

When I close the dialog the value I get in the CLI is wrong again.
I just leave it at "LAN", that seems to work for me.

Why don't you change it via CLI if you've gotten that far? (big thumbs up for that!)

mkx

RBD53iG-5HacD2HnD = hAP AC3

How to tell a Mikrotik nerd from normal people: the former can recite product codes together with their marketing model names

(while the later have to use their favourite internet search engine)

mkx

I think we can go back to "do NOT use quickset" ... if user comes to @holvoetn asking him about rules, then that user is already way past the IFs and BUTs which would potentially allow to use quickset.

mkx

As for those two NAT rules - It's been a while since I set this up but if I remember correctly (and I can certainly test this..) without those DNS breaks and nothing resolves. From context of device config posted these rules are useless ... the TCP rule has potential to rewrite dst-port but actuall...

mkx

Avoiding it in total may be for most the wiser option. Exactly. If there were enough quickset profiles/schemes to cover like 98% of use cases, then I'd be all for quickset ... it is a corner stone for offering MT devices to people without ROS knowledge. However since many profiles are missing (and ...

mkx

As I already hinted: does device, connected to ether7, expect tagged VLAN 200 or not? Required configuration on switch entirely depends on this "design decision". From your observation in last line of previous post it seems that device doesn't talk VLANs ... in which case you do need the i...

mkx

Why would I need TWO (2) SFP? Future expansions? Or some other similar excuse. See answer to your last question. anything in particular that I should watch out for when ordering the fiber? I have seen a bunch of different ones on Amazon just not sure which one to get. Just keep in mind that general...

mkx

4. Do NOT use quickset

This one should be made rule number -1 ... or whatever takes to make it to very top of rules.

mkx

These two settings are not coherent: /interface ethernet switch egress-vlan-tag add tagged-ports =ether2, ether7 vlan-id=200 /interface ethernet switch ingress-vlan-translation add customer-vid=0 new-customer-vid=200 new-service-vid=0 ports= ether7 The first one says that VLAN 200 has to remain tagg...

mkx

I can see one problem: /ip dhcp-server network add address=10.172.13.0/24 comment=defconf dns-server=10.172.12.1 gateway=10.172.12.1 In principle, gateway address has to be within device's subnet ... so when using 10.172.13.0/24, gw address should be e.g. 10.172.13.1. Mind that DNS server address ca...

mkx

Quite many windows NIC drivers automatically strip off (one layer of) 802.1Q headers ... and if running wireshark on such windows machine, lack of outer header is to be expected (in case of your 'tripple header' that would be 802.1Q header with VID set to 3000). Some NIC drivers allow you to properl...

mkx

... or causes random problems (worst case). Judging from the reports I have seen on the forum, the worst case seems to be the normality... Being an optimistic guy I tend to believe that most people, who have this **** enabled, don't see any problems (so they don't report anything on this forum) ......

mkx

Do yourself a favour and disable the detect internet thingy (set list to none). It's only good when one doesn't know which port is supposed to connect internet, otherwise it doesn't do anything (best case) or causes random problems (worst case). UDP flooding seems to be somewhere in between ...

mkx

This combination of rules is dangerous: add action=drop chain=input comment="defconf: drop all not coming from LAN" \ disabled=yes in-interface-list=!LAN ... add action=drop chain=input comment="defconf: drop all not coming from LAN" \ in-interface-list=!LAN port=2000 protocol=tc...

mkx

Any reason for using "arp=proxy-arp" setting on bridge? It does somehow defeat use of VLANs (as means to separate subnets). Can you quantify the "It gets so slow, that I can hardly work anymore." statement? Although hEX is a pretty decent little device, it's not very powerful aft...

mkx

Nope. hAP ax3 supports passive PoE-in ... with allowed voltage range between 18V and 28V. See product info: https://mikrotik.com/product/hap_ax3 Your DLink is most probably a 803.2af/at/... compliant switch which requires proper handshake between PSE (PoE switch) and PD (powered device) ... and PD h...

mkx

I also don't see any high CPU usage, this is a screenshot while doing the upload part of a speedtest (I assume this is what you meant with profiler?):

Yup. But select "CPU: all" to see if one single core gets maxed out (CPU: total gives averages, which are useless in this case).

mkx

Are you sure you need these settings on bridge ports?

internal-path-cost=10 path-cost=10 trusted=yes

They are not set to these values in default config ... and trusted has potential to interfere with traffic.

mkx

Now, it be nice if the REST API support X.509 client certificates to avoid need to store the username/password on the calling machine, but it does not today. If remote side requires any sort of authentication, then it's necessary to store something on local side. If authentication requires username...

mkx

Not sure where you got the performance figures. The number, which seems to resemble reality the best, is listed under "Routing -> 25 ip filter tules -> 512 byte packet size". For CCR2004-16G-2S+PC it's 2767.9 Mbps. For RB5009UG+S+IN it's 3096.2 Mbps. For RB3011UiAS-RM it's 452.6 Mbps. The ...

mkx

My own audience runs fine at 7.15.3. It came with v6, so I netinstalled it to one of early v7 (to get wifiwave2 drivers running). After that ordinary ROS upgrades (using ROS built-in upgrader) did things just fine. So it could be your device is somehow damaged and fit for warranty replacement (I lov...

mkx

Exactly.

mkx

This requires /ip/services/www-ssl to be enabled. Is there any downside? Security risk? As with every ROS service, if enabled it's important to protect it from being available too widely. And that's achieved using firewall. Default firewall allows access to (all) router services from LAN. If firewa...

mkx

A few things to remember: firewall filter rules are evaluated from top to bottom In second case this means that fasttrack rule never gets evaluated because it's "overshadowed" by regular accept rule it's a bit of a mystery as to how fasttrack rules work. One of theories is that fasttrack r...

mkx

Both devices have ample of ports to be used as switches as well. Just beware that CRS2004 has actually 2 switches built in and traffic between both port groups passes CPU. The same is true for both SFP+ ports, tgey are handled directly by CPU. This is not the case with RB5009, all ports (including S...

mkx

... spanning trees protocols is that both RSTP and MSTP are compatible with each other so should it be the problem or part of it ? Various STP protocols may be compatible in a sense that message, created by one of those, can be processed by the others. However the way these protocols work out the h...

mkx

Problems with multi-gig links are at least the following: transmitting more than 1Gbps over UTP is power-ineffective and makes transcievers hot. This is a particularly big problem with SFP+ RJ45 modules because SFP modules don't offer enough cooling. Which is then a problem when quiet operation is w...

mkx

Mixing MSTP and RSTP is at least part (if not the whole) if your problem. RSTP is not VLAN aware and blocks physical link if it detects a loop (the error message, mentioned in this thread's title, does indicate this condition), while with MSTP it's possible to distribute VLANs over multiple physical...

mkx

Try to set MAC of bridge manually ... to MAC different than any of bridge ports. For ideas about proper MAC address "invention", have a look at Universal vs. local (U/L bit) section of MAC address wikipedia article (use MAC address of one of bridge ports as a basis and apply the L bit to i...

mkx

MT staff (I think it was @normis) clearly stated, that ROS v6 is feature-frozen, it'll receive only (some?) security fixes. Support for ellyptic cipher algorithms is IMO not security issue. After all, OpenSSH did not discontinue support for legacy algorithms, they were deprecated ... meaning they ar...

mkx

You will definitely have to troubleshoot the whole path betwern API client and server. Start by running wireshark on both and compare the captured traffic. If captures are identical on both ends, then it's entirely between client and server. If they differ, tgen it's something in between that interf...

mkx

Apart from making configuration as similar to default (as suggested by @tangent) ... I'd start by removing DHCP client from anything but vlan2 interface. If your router manages to obtain DHCP lease on more than one interface, it may get lost as to which default route it should use. removing vlan4 in...

mkx

Mikrotik firewall is L4 firewall ... so it operates up to TCP/UDP - i.e. it blocks traffic passing to/from specific IP address/port combination. It does not look into contents (e.g. HTTP response codes)[*]. ROS might do something about it if you actually managed to (ab)use proxy service on ROS to se...

mkx

When creating ssh connection to your router, define "local port forwarding" with IPv6 address of remote host. Command line example in linux would look like this: ssh 192.168.88.5 -L 20202:[fe80::ae1f:6bff:feb0:26bc]:80 The trick on OpenSSH client is to enclose the IPv6 address in square br...

mkx

@mkx Well, I paid 1.80 for that same cable, so it costs us nothing - combined - we are still ahead, and we can even afford to pay the unjust and unfair duty the Sheriff of Nottingham just imposed on us. If we're still ahead or not depends on tax rate that Sheriff (a.k.a. @anav) is trying to charge ...

mkx

Did you, by any chance, click around QuickSet? Using QuickSet (part of Webfig and Winbox, the "light version of UI") is pretty dangerous if one ever configures anything outside QuickSet (many of us think that when user clicks WebFig button the first time, QuickSet button should simply disa...

mkx

No. PoE-out limit on hEX S is 500mA and if using "stock" power adapter (at 24V), that translates into 12W. Single cAP ac power consumption is rated at 12W (without attachments). Additionally, "stock" pwoer adapter is rated at 1.2A, at 24V this is 28.8W. hEX S own consumption is 6...

mkx

Some devices simply do not support health monitoring. It's not a winbox bug! I can understand @maisondasilva where he'd like to have the "pull out" list of items invariant. So perhaps the items, not feasible for a particular connected device could be present on the list but inactive (and ...

mkx

I'm pretty sure that router, when ND is enabled, sends out packets to broadcast address via all interfaces (which includes lo). And again, as I wrote, sending traffic to broadcast on lo won't yield any response. Which means that dropping such traffic doesn't do any harm. The only issue here is your ...

mkx

/interface bridge add admin-mac=48:A9:8A:XX:YY:ZZ auto-mac=no comment=defconf frame-types=admit-only-vlan-tagged name=bridge vlan-filtering=yes You can check it with either UI or by typing /interface bridge export verbose There is pvid=1 which is not exported since it's default value, but it is sti...

mkx

And that traffic is being sent to broadcast address ... since only device, attached to that "network", is sender itself, it won't get any answer ... like ever. So dropping this traffic doesn't change anything. It would be different, if some service would try to connect another internal ser...

mkx

... VLAN1 ... leave it alone, since it costs nothing.

How can you say that not using VLAN 1 costs us nothing? I paid 1.85€ for an UTP patch cord for use with trunk connection. If I can't use VLAN 1, I'm loosing 0.00045 € due to reduced functionality !!!

mkx

Depends on how you want it to work exactly. Fyi, legacy supports CAPsMAN forwarding, wifi-qcom(-ac) doesn't. Thanks, What I need to do is to add some ax devices in remote site and get the CAPsMAN forwarding work. Is that possibl No, capsman forwarding with new capsman is not possible. Period. You'l...

mkx

I'm guessing then that we installed wifi-qcom-ac above wifi-qcom because its smaller and the settings are practically the same? Adding to post by @jaclaz: yes, you installed wifi-qcom-ac because it's smaller. And that's exactly the reason for its existence, some ac devices have the tiny 16MB flash ...

mkx

You're right, coukd be a bug in android's ifconfig. Another possibility is (again android's) RNDIS stack which erroneously handles ethernet frame checksum ... but doesn't discard frame due to mismatch (could be RNDIS driver on MT to blame as well). But, as you may have guessed by now, I'm just guess...

mkx

Shouldn't there also be 7. add ether5 on both routers to WAN interface list and remove from LAN (if present) Well, my post starts with "in a few words" :wink:. Of course actual list of things to do greatly depends on actual configuration of both routers and wanted end state (from function...

mkx

Rx errors are often not detected on the other (Tx) side ... so the discrepancy in errors statistics is nothing weird. I can think of several reasons for Rx errors to happen ... ranging from "noisy" USB cable to (performance) problems in USB stack (and higher) on the android LTE device. If ...

mkx

this is considered PtP addressing and works fine

Not everybody knows the name for it ... and certainly not everybody knows how to use it properly ... hence post by @TheCat12 (which is, unlike yours, useful)

mkx

In a few words: remove ether5 from list of bridge ports on both routers assign IP addresses to ether5 on both routers. Use e.g. 192.168.42.1/30 on M1 and 192.168.42.2/30 on M2 add static routes to reach other LAN via opposite router. E.g. on M1 do /ip/route/add dst-address=192.168.1.0/24 gateway=192...

mkx

Hey guys, i moved newly from opnsense to CHR ROs setup on proxmox, the concept of vlan seems much harder to wrap the head around. This is de-facto guide to how to VLAN on ROS: https://forum.mikrotik.com/viewtopic.php?t=143620 And, while at it, you might want to wrap your head around bridge and its ...

mkx

The runtime is 20 days, and currently, the DNS cache has grown to 42,375 KiB. The DNS memory leak in RouterOS 7.15.3 is continuously occurring. Why have you set Cache size to 64MB? This. It's not a memory leak if service uses up to amount of RAM assigned. In this particular case, even if some DNS c...

mkx

... on 1 cap AC using wifi-qcom-ac driver...

Oddly enough, no such issue on ac2 with exact same config (same RAM amount so why ??).

hAP ac2 has 3 more ethernet ports, so more buffer on switch chip is in use ... perhaps that's a life saver? LOL

mkx

VLAN and "fully unmanaged" don't go together in same sentence.

The closest to fully unmanaged switch MT switch can get (both SwOS and ROS) is default switch config with xSTP fully disabled (both globally and per-port).

mkx

If i connect directly to my ISP's router the firesticks (2) will work but not if behind the mikrotik

Sometimes wifi stations cache connection failures and refuse even to try to reconnect to AP with MAC remembered as "problematic".

mkx

I'll stick with v7, I believe it's v7.15.3. I don't see v7.5 on routeros download page. On v7 it's generally safest to stick to latest stable release. Indeed there are some problems with newest versions on certain devices and then it's wise to run slightly older (e.g. some people have some problems...

mkx

The problem is power pre-amplifier (PPA) in receive path and its automatic gain control. It gas to amplufy analog received signals so that they enter the analog-digital converter at certain level. The problem is that PPA doesn't know the exact frequency used and amplifies the whole 2.4GHz band ... i...

mkx

It seems that DHCP parameters are not meant to be received from both VLANs by the same routing instance. So now the question: what's the intended layout of your LAN devices (including VoIP devices)? I don't have VoIP, but my ISP delivers IPTV over tagged and multicast. It is possible to terminate th...

mkx

10.50.131.150 does not fit into 10.126.0.0/17 (this one covers range 10.126.0.1 - 10.126.127.254) but you don't have any specific router which would match better than default via pppoe internet interface. You can try to add a route towards 10.50.131.150. Ideally you'd use some gateway address (which...

mkx

I have a problem with czech diacritics. In older version, was all good, but now I can see this: ? and corect is: č So new version doesn't know this diacritics. ěščřžýáíé and write only this ?????? Can you repair this bug, please? Thank you It's probably bug due to not handling non-ASCII characters ...

mkx

PPPoE is a bit nifty for IPv6. One thing is that you don't need to request address from DHCPv6 server, only prefix. (Doesn't hurt requesting one, but it's useless) Another thing is that DHCPv6 server on ROS is not very useful, it can't hand out addresses (only prefixes). Alas, in IPv6 there are Rout...

mkx

Is there perhaps a .fwf file lying around in files area? It's either this or a bug in firmware handling in 7.16rc4 ... I don't have any other explanation for the routerboard anomaly. In any case, having "current firmware" version same as running ROS version js a good sign and you should no...

mkx

Post full config .. from terminal window execute /export filename=anynameyouwish , fetch resulting file, open it in your favourite text editor, redact any renaining srbsitivevdara (serial number, passwords, etc.) and post it inside [ code] [/code] tag pair. Also post output of /system/routerboard/pr...

mkx

The setting for sfp-sfpplus2 (under bridge/port) lacks setting of PVID ... and default is PVID=1 ... OTOH it's set as untagged for VLAN 50 ... so you have a discrepancy here.

mkx

If using webfig, then you have to create a new list when adding first address to it: IP -> firewall -> address lsits -> add new ... in the list field, don't select existing list from a drop down lsit, but rather type in name of new list. Also add (the first) address ... and click apply (or OK). For ...

mkx

Unless bridge has vlan-filtering=yes set, all VLAN-related settings on bridge and member ports are ignored (this includes PVID setting).

mkx

They cost roughly the same....which would be the best solution? Apart from suggestions for some more modern device ... base RB911 is only a board. You need a case (list price $15), power adapter (price around $10), antenna pigtails and antennae them selves (price for all together probably around $2...

mkx

So you have 3 VLAN interfaces /interface/vlan add interface=bridge1 name=vlan88 vlan-id=88 add interface=bridge1 name=vlan10 vlan-id=10 add interface=bridge1 name=vlan20 vlan-id=20 and you have appropriate IP addresses set on all 3 vlan interfaces. Now device will route traffic between the 3 subnets...

mkx

I can't be certain, but you wrote: So I checked my Dude setup and, after *a lot* of testing, I found that I had a function for checking the number of capsman clients that was using a call for the previous version of capsman. If I understand this correctly, then it's not a script, configured in ROS d...

mkx

If observing CPU usage under system resources ... that one is average and single-core tasks won't trigger it to go very high (depending on number of CPU cored in your device). It's better to run CPU profiler to see, if one of CPU cores gets pegged and which process causes it.

mkx

Why the good Mikrotik guys like to potentially alienate a number of their customers over the lack of a copy-paste on each post 7.12.x release docs a single sentence *like*: Yes. But until when? For me this is already obsolete news, all of my devices, which deserve running v7, are already past 7.13....

mkx

How would I go about trying to enable fasttrack and see if that works? It's a firewall filter rule ... like this one: /ip/firewall/filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack" Since firewall filters are processed to...

mkx

This is an absolute joke. To me, your post is joke. Mikrotik''s suggested way of upgrading ROS on devices is to execute ROS-builtin package updater. And this way works just fine. Sure there are other ways of doing it (dropping manually selected package files to device, netinstall), but whrn those w...

mkx

can the frequency be selected with 5mhz step like in non-ax chips, or must follow strict "wifi channels" frequencies? It seems that it requires using proper channel frequencies. Just tried to set frequency to 5205 on my Audience (runing wifi-qcom-ac). CLI does allow to set it, but interfa...

mkx

As long there is a workspace with 🪟 ...

Many datacenters don't ... in which case the box part kocks in.

mkx

If only you'd taken the opportunity to change that meaningless (if not entirely misleading) name, now that its Windoze shackles are finally off :)

Indeed. And here's my suggestion: ROSman

mkx

... at least we have our own default config and password (which is unfortunately still shown in the /system/default-configuration/print). Isn't the default config only shown to user with administrative rights? That is so on my devices. And probably the reason for restriction is exactly this ... So ...

mkx

Though it seems to be working better, VLAN assignment on the wifi-qcom-ac seems to be broken: Yup, that's a known "feature" of wifi-qcom-ac ... the only way to get its interfaces part of a VLAN is to use vlan-enabled bridge and set appropriate PVID to each of wifi interfaces (real and vir...

mkx

It's not strictly necessary to "free port 53" ... DST-NAT (which is required to send traffic to different server) is one of early stages of packet processing ... only at later stage packet gets delivered to router's own service if destination address remains same as one of router's own IP ...

mkx

.. it is hard to say what you did. I just had a quick glance at the page ... the first chapter is titled "Remove all configuration:" .. which makes me turn away from this thread. If @OP follows such a "cook book", then he should trust the author of the cookbook and discuss any m...

mkx

As both variants, if properly set up, work, it's not possible to say which one is right and which one is wrong. It's a matter of personal taste. My way is this: as soon as I start with VLANs, I go with all-tagged within LAN infrastructure. Which includes connections between LAN devices (switches, ro...

mkx

Another difference I notice is that you have switch1-cpu added to all your /interface ethernet switch vlan If using /interface/ethernet/switch config subtree for wired VLANs, then it's necessary to add all VLANs, somehow handled by CPU, to switchX-cpu switch port . Which includes VLANs for wifi int...

mkx

1. Since v7, there are two dtivers for wifi hardware: legacy wireless and new wifi ... New ax hardware is only supported by wifi drivers, pre-ac hardware is only supported by wireless. Ac hardware (including hAP ac2) is supported by either driver, but default being wireless (due to legacy reasons). ...

mkx

The new one is able to hardware accelerate more then one bridge and my problems have ceased.

Which is the "new modil" that can HW offload more than ond bridge? AFAIK there are models that could do it, but with series of gotchas ... so I wonder.

mkx

So can HAP AX2 / AX3 be configured with Bridge VLAN Filtering (even without HW) - will they work with such configuration ? Will HAP AX2 be enough CPU power for that or better to buy AX3 for VLANs without HW? Yes and yes. And no, there is no other way of configuring VLANs on hAP ax2. My experience w...

mkx

Your SXT should work fine with v7. There's a gotcha when netinstalling v7: you have to install optional package wireless, since 7.13 none of wireless driver packages are parts of base package (routeros). There are some funny details when it comes to netinstall ... e.g. sometimes some certain version...

mkx

I understand AX does not allow for NV2, but the radios does also support AC and N and i would think it possible to port NV2 at least for these standards that is compattable with NV2. AFAIK it's not radio hardware in AX devices which is incompatible with NV2, it's drivers issue: on AX devices it's o...

mkx

It is possible that the one (or the other) Ros version and/or the one or the other configuration takes up a little bit or a little more RAM ... ... and that's what I'd expect to see when both (identical) devices run different versions of ROS. The next question is whether they both have identical se...

mkx

You already have implemented the first rule (two in your case, one per port). You still need the second one (one will cover all the dst-nat rules), but with correct addresses ... You can actually make it even more general and it likely won't bite your back: /ip firewall nat add action=masquerade cha...

mkx

OT: You can't imagine what happens when you have to block DNS by law and use your own... Do you know how many Chinese things call home?... Korean things as well (I've got a Samsung smart TV which is constantly trying to call home). And probably things conceived elsewhere as well (I don't believe th...

mkx

Apart from understanding the topic, mentioned by @erlinden, the only issue is to make a modem pass-trough configuration in each of RBM33G ... each using different VLAN ID for its "modem traffic" (article, linked below, uses plain ethernet port as passthrough interface, I guess you can crea...

mkx

At least some really widely used one support this indeed: - ISC DHCP by using a "host" declaration - see https://kb.isc.org/docs/isc-dhcp-41-manual-pages-dhcpdconf From the cited document: It should be noted here that most DHCP clients completely ignore the host-name option sent by the DH...

mkx

As long as you can pull additional IP address (e.g. using MACVLAN interface), you can use that additional IP address simply for NAT ... both dst-nat (i.e. public clients can connect to secondary_address:port and those connections get NATed to internal server) and src-nat (for server's outgoing conne...

mkx

In another words - been there, seen that.

OMG Sindy, you're truly one of a kind. The rest of us would be "been there, done that."

mkx

IPv6 addresses are set without prefix length, they should have /64 included. Without it, it's taken to be /128 (just like in IPv4 it's assumed to be /32). This also caught my eye so I've made a test, and the default behavior in IPv6 indeed differs from the one in IPv4, at least in 7.15.3: That's in...

mkx

Your setup currently uses ether2, ether3 and ether4 in a "switch group" for LAN purpose. Your setup also uses ether6 as WAN interface. The rest of ports seem to not be in use, but there are some remains of config (it seems that ether5 was used as WAN interface in some past). I'd use ether5...

mkx

In @kobuki's configuration there's an error in LAN interface setting: IPv6 addresses are set without prefix length, they should have /64 included. Without it, it's taken to be /128 (just like in IPv4 it's assumed to be /32).

mkx

https://neal.fun/password-game/

mkx

... and the 2024 award for the most inaccurate package name goes to ... :lol: Actually it shouldn't surprise us. After all, we have a thread, dedicated to the meaning of "C" in names of certain product families (and discussion about "R" in name of certain product family is not f...

mkx

And this new MikroTik ROSE... "MikroTik Enterprise" WHY?! Sorry, but ROSE is clearly not enterprise feature ... every decent enterprise will have some kind of specialized NAS or SAN ... probably any QNAP, Synology or <insert name of your favourite low-cost NAS vendor here> will do better ...

mkx

I do not expect to get theoretical 867 Mbit/s but I have expected something around 300Mbit/s. I have merely half of it. With legacy wireless driver in use, it's impossible to get more than around half of theoretical throughput ... in ideal radio conditions (that would be around 430Mbps). And then n...

mkx

The problem with roadmaps is that after you publish dates, you damn well stick to them. My impression is that MT has hard time when negotiating with manufacturers of MT's designs (because, let's face it, MT is a small vendor compared to some other well known low-end brands). And it might be that MT'...

mkx

I have a Mikrotik Hex S, on its 4th and 5th port I have 2 Trunk ports (vlans 8, 100, 200, 999). The configuration of the vlans is done through Bridge. My question is why it is not showing me traffic on a particular VLAN in the interfaces? Is it because the switch-chip is taking care of it? Correct,...

mkx

Post current config in full: open terminal window execute /export file=anynameyouwish hide-sensitive (the last command line option is necessary in ROS v6, in v7 that's default copy resulting file over to your management computer open it using favourite text editor, redact any remaining sensitive dat...

mkx

Probably you don't have to set protocol=tcp src-address=10.227.4.10 src-port=443 in mark-routing configuration ... if you properly apply connection mark. You'd probably have to add the route to 10.227.4.0/24 to the alternative routing table though to allow forward packets to reach their destination....

mkx

There is no "initial connection" to change password. They never connect to it. Perhaps devices should ship with default config with internet connection (whichever it is) disabled. This would force users to connect at least once. During this initial connection, user would be forced to set ...

mkx

You have to mark connections, coming in via WAN2 ... then use connection mark to set routing mark ... and then use that routing mark to use alternate routing over WAN2 interface. Yes, it has to be connections marked, so that return packets (belonging to same connection) will get properly marked for ...

mkx

Maybe ETSI TS 103 645? This is ETSI standard, not EC legislation. Standards may get into legislation (in which case laws/rules/directives/... don't have to go into technical details but rather refer to certain standard), but without some kind of regulation they are not mandatory. So my rant about E...

mkx

The problem with EC legislation is that there are two kinds (actually there are more, but in this case two are relevant): regulations and directives. Regulations apply in all member states immediately after they enter in force, equally in whole EU. Directives, however, need to be transposed into nat...

mkx

wave2 CAPsMAN settings are shared with local wifi settings (if device supports it and has one of wifi-qcom* packets installed) under /interface/wifi ... and you have to configure things using corresponding profiles (i.e. under ./channel/, ./security/, etc.). All devices, running ROS 7.13 and newer, ...

mkx

I often like to cite the checklist on the original instruction manual of the Volkswagen T1: It's a very good checklist, too good to be useful nowdays. The thing is that when some kind of engineering marvel hits the mass market, everyone is wary of new thing and have to learn how to properly use it....

mkx

It seems that @OP created another user System with full permissions. So he has to use that user to perform certain tasks. Which is exactly the point of creating non-default user with full permissions (as means of strenghtening security of a device).

mkx

"Password after reset that is printed on the device." - Devices are sometimes in public area's, like CUBE 60 are. - Password versus box table is stored in distributed databases. Those who are genuinely concerned about device security (I'm pretty sure you are as are most regulars on this f...

mkx

Direct attach cable generally only works when interfaces on both ends are the same generation, i.e. both are SFP (1Gbps) or both are SFP+ (10Gbps) or both are SFP28 (25Gbps). Sometimes it's possible to use DAC even if interfaces are different ... if both devices dupport setting interface rate manual...

mkx

Sorry, one more thing: Yes, this one ... unset default-vlan-id (i.e. set it to "auto") which will make CPU port (i.e. bridge) tagged for VLAN 88 as well. but I have only untagged traffic for VLAN88 - how does this "auto" setting set VLAN88 in such case - I thought that default-v...

mkx

/interface ethernet switch port set switch1-cpu vlan-mode=secure vlan-header=leave-as-is default-vlan-id=88 Yes, this one ... unset default-vlan-id (i.e. set it to "auto") which will make CPU port (i.e. bridge) tagged for VLAN 88 as well. 2. Can I use only VLANs (without bridge or ether i...

mkx

The config is more or less fine. I have things configured only slightly differently on my RB951G, something like this: /interface ethernet switch port set ether2 vlan-mode=secure vlan-header= always-strip default-vlan-id=88 set ether3 vlan-mode=secure vlan-header= always-strip default-vlan-id=88 set...

mkx

Can you configure first wavelink as AP in mesh mode? Configuring it as router (mesh mode or not) is what causes all devices behind it to appear as wavelink to MT. As long as it's possible to mesh wireless and wired ports this should be possible ... even more, all mesh nodes can be set-up equally, bu...

mkx

... total HDD space is 15.3 MiB and free HDD space is 4296 KiB. Since ROS is about 12.3 MiB by itself without packages, normal upgrade does not seem possible. How exactly are you trying to upgrade ROS and what exactly does log say after it fails to upgrade? How exactly are you uploading the npk fil...

mkx

The default route setting on station brdige is wrong. It should be like this: /ip route add distance=1 gateway=192.168.88.1 Using interface name as gateway doesn't work too well for non-PtP interfaces. Other problems on station-bride device: you shouldn't run DHCP server on station bridge, DHCP serv...

mkx

If station bridge device can ping your gateway, then it should be able to connect beyond gateway if default route is configured properly (and gateway doesn't block it somehow). You can post full config of station bridge device (in terminal window execute /export file=anynameyouwish hide-sensitive - ...

mkx

Is there some particular setup needed on the ‘station bridge’ to get internet connectivity for the RouterOS on that wAP AC itself? Or is it possible at all in this mode?

Nothing special, just IP address, default route and DNS server address ... just like any other IP device in your network.

mkx

On MT devices it's possible to use any port as WAN port. Reconfiguration is not trivial, but not too hard either.

Port, marked as internet, is on hEX special because it's PoE in as well ... so it's slightly different than the rest of ports. Perhaps this makes it more sensible to voltage surges?

mkx

In PtMP setups you can have different values on different nodes: The value should reflect the distance to the AP or station that is furthest from the device. So on hub node (PtMP AP) you need to have e.g. 3km, on station nodes whatever needed (on the farthest node 3km, on nearer nodes something lowe...

mkx

add action=dst-nat chain=dstnat comment="Apache 80" dst-address=<PUBLIC IP> \ protocol=tcp src dst -port=80 to-addresses=192.168.88.22 to-ports=80 add action=dst-nat chain=dstnat comment="Apache 443" dst-address=\ <PUBLIC IP> protocol=tcp src dst -port=443 to-addresses=192.168.8...

mkx

But as you probably understand: It is the responsibility of the customer or the customer's representative (the tech) to config the devices properly. A parallel from transportation industry: it's drivers' responsibility to avoid other parties in traffic. But this didn't work too well after a short w...

mkx

So I would leave hAP ac2 ... Personally I'd avoid using any of ARM devices with 16MB flash space as "core" router ... because 16MB is tight specially when running ROS v7 (and eventually we all will run it). I know that with recent ROS version one can completely remove any of wireless driv...

mkx

So we're guessing ... until @OP provides exported config as per instructions in post by @rplant ... I'm guessing that the "dst-address" property setting (which seems to be set, but @OP blacked it out) is wrong. The thing with DST-NAT is that dst-address property normally doesn't have to be...

mkx

The bridge is offloaded to hardware switch chip (MT7621) ... which according to switch chip features table doesn't support rules. So if you want your bridge filter rules to actually work, you have to disable HW offload ... on all bridge ports set hw=no . This will, alas, cause all traffic to pass vi...

mkx

Almost seems like I need to manually increase the size of the Flash/directory so that it can hold more capacity for an update to be processed. That way remote updates could be feasible again. Does that sound correct to you? No. I'm pretty sure that flash disk is at its maximum (15.something MB) and...

mkx

Any other thoughts? No, not without (near) hands-on diagnosis. It might be, that netinstall will be necessary ... yeah, I'd hate it too, but sometimes there's some hidden trash which can only be cleaned using netinstall ... and after that, drvice is healthy and ready for series of normal upgrades.

mkx

Just add sfp-sfpplus1 interface to WAN interface list:

/interface list member
add comment=defconf interface=sfp-sfpplus1 list=WAN

And you should be fine.

mkx

The log entry is more likely about updater checking free space and finding out that it isn't sufficient. If there are any fikes under flash/ directory, you can possibly remove them (but come back and ask if they are safe to remove beforehand). Excessive config (e.g. bigger address lists or bigger st...

mkx

Any device (be it Mikrotik or TPlink) can only filter traffic passing between its own ports. If only a part of traffic is passing Mikrotik (because devices, connected to TPlink, can communicate without MT ever knowing about it), then possibilities to filter traffic are limited. If your TPlink allows...

mkx

Your LHG 60G has more than 64MB RAM, which means its "root" of storage (as you can see it) is on RAM disk. Just don't upload upgrade npks to flash/ subdir, they belong to root (and that's where ROS upgrader expects to find them). Did you actually try to upgrade ROS (and failed ... and if s...

mkx

Post your current config (output of /export file=anynameyouwish, redact sensitive data such as serial number, public IP address, passwords, etc.). Because proper advice can only be made after we see the rest of config.

mkx

You can't block access to printer using router's firewall because printer is part of same LAN subnet and other drvices talk to printer directly. However, if that printer is connected directly to your router using dedicated network port (none other device is using it), then you could filter traffic. ...

Search found 12786 matches