MikroTik

mkx

Quite many windows NIC drivers automatically strip off (one layer of) 802.1Q headers ... and if running wireshark on such windows machine, lack of outer header is to be expected (in case of your 'tripple header' that would be 802.1Q header with VID set to 3000). Some NIC drivers allow you to properl...

mkx

... or causes random problems (worst case). Judging from the reports I have seen on the forum, the worst case seems to be the normality... Being an optimistic guy I tend to believe that most people, who have this **** enabled, don't see any problems (so they don't report anything on this forum) ......

mkx

Do yourself a favour and disable the detect internet thingy (set list to none). It's only good when one doesn't know which port is supposed to connect internet, otherwise it doesn't do anything (best case) or causes random problems (worst case). UDP flooding seems to be somewhere in between ...

mkx

This combination of rules is dangerous: add action=drop chain=input comment="defconf: drop all not coming from LAN" \ disabled=yes in-interface-list=!LAN ... add action=drop chain=input comment="defconf: drop all not coming from LAN" \ in-interface-list=!LAN port=2000 protocol=tc...

mkx

Any reason for using "arp=proxy-arp" setting on bridge? It does somehow defeat use of VLANs (as means to separate subnets). Can you quantify the "It gets so slow, that I can hardly work anymore." statement? Although hEX is a pretty decent little device, it's not very powerful aft...

mkx

Nope. hAP ax3 supports passive PoE-in ... with allowed voltage range between 18V and 28V. See product info: https://mikrotik.com/product/hap_ax3 Your DLink is most probably a 803.2af/at/... compliant switch which requires proper handshake between PSE (PoE switch) and PD (powered device) ... and PD h...

mkx

I also don't see any high CPU usage, this is a screenshot while doing the upload part of a speedtest (I assume this is what you meant with profiler?):

Yup. But select "CPU: all" to see if one single core gets maxed out (CPU: total gives averages, which are useless in this case).

mkx

Are you sure you need these settings on bridge ports?

internal-path-cost=10 path-cost=10 trusted=yes

They are not set to these values in default config ... and trusted has potential to interfere with traffic.

mkx

Now, it be nice if the REST API support X.509 client certificates to avoid need to store the username/password on the calling machine, but it does not today. If remote side requires any sort of authentication, then it's necessary to store something on local side. If authentication requires username...

mkx

Not sure where you got the performance figures. The number, which seems to resemble reality the best, is listed under "Routing -> 25 ip filter tules -> 512 byte packet size". For CCR2004-16G-2S+PC it's 2767.9 Mbps. For RB5009UG+S+IN it's 3096.2 Mbps. For RB3011UiAS-RM it's 452.6 Mbps. The ...

mkx

My own audience runs fine at 7.15.3. It came with v6, so I netinstalled it to one of early v7 (to get wifiwave2 drivers running). After that ordinary ROS upgrades (using ROS built-in upgrader) did things just fine. So it could be your device is somehow damaged and fit for warranty replacement (I lov...

mkx

Exactly.

mkx

This requires /ip/services/www-ssl to be enabled. Is there any downside? Security risk? As with every ROS service, if enabled it's important to protect it from being available too widely. And that's achieved using firewall. Default firewall allows access to (all) router services from LAN. If firewa...

mkx

A few things to remember: firewall filter rules are evaluated from top to bottom In second case this means that fasttrack rule never gets evaluated because it's "overshadowed" by regular accept rule it's a bit of a mystery as to how fasttrack rules work. One of theories is that fasttrack r...

mkx

Both devices have ample of ports to be used as switches as well. Just beware that CRS2004 has actually 2 switches built in and traffic between both port groups passes CPU. The same is true for both SFP+ ports, tgey are handled directly by CPU. This is not the case with RB5009, all ports (including S...

mkx

... spanning trees protocols is that both RSTP and MSTP are compatible with each other so should it be the problem or part of it ? Various STP protocols may be compatible in a sense that message, created by one of those, can be processed by the others. However the way these protocols work out the h...

mkx

Problems with multi-gig links are at least the following: transmitting more than 1Gbps over UTP is power-ineffective and makes transcievers hot. This is a particularly big problem with SFP+ RJ45 modules because SFP modules don't offer enough cooling. Which is then a problem when quiet operation is w...

mkx

Mixing MSTP and RSTP is at least part (if not the whole) if your problem. RSTP is not VLAN aware and blocks physical link if it detects a loop (the error message, mentioned in this thread's title, does indicate this condition), while with MSTP it's possible to distribute VLANs over multiple physical...

mkx

Try to set MAC of bridge manually ... to MAC different than any of bridge ports. For ideas about proper MAC address "invention", have a look at Universal vs. local (U/L bit) section of MAC address wikipedia article (use MAC address of one of bridge ports as a basis and apply the L bit to i...

mkx

MT staff (I think it was @normis) clearly stated, that ROS v6 is feature-frozen, it'll receive only (some?) security fixes. Support for ellyptic cipher algorithms is IMO not security issue. After all, OpenSSH did not discontinue support for legacy algorithms, they were deprecated ... meaning they ar...

mkx

You will definitely have to troubleshoot the whole path betwern API client and server. Start by running wireshark on both and compare the captured traffic. If captures are identical on both ends, then it's entirely between client and server. If they differ, tgen it's something in between that interf...

mkx

Apart from making configuration as similar to default (as suggested by @tangent) ... I'd start by removing DHCP client from anything but vlan2 interface. If your router manages to obtain DHCP lease on more than one interface, it may get lost as to which default route it should use. removing vlan4 in...

mkx

Mikrotik firewall is L4 firewall ... so it operates up to TCP/UDP - i.e. it blocks traffic passing to/from specific IP address/port combination. It does not look into contents (e.g. HTTP response codes)[*]. ROS might do something about it if you actually managed to (ab)use proxy service on ROS to se...

mkx

When creating ssh connection to your router, define "local port forwarding" with IPv6 address of remote host. Command line example in linux would look like this: ssh 192.168.88.5 -L 20202:[fe80::ae1f:6bff:feb0:26bc]:80 The trick on OpenSSH client is to enclose the IPv6 address in square br...

mkx

@mkx Well, I paid 1.80 for that same cable, so it costs us nothing - combined - we are still ahead, and we can even afford to pay the unjust and unfair duty the Sheriff of Nottingham just imposed on us. If we're still ahead or not depends on tax rate that Sheriff (a.k.a. @anav) is trying to charge ...

mkx

Did you, by any chance, click around QuickSet? Using QuickSet (part of Webfig and Winbox, the "light version of UI") is pretty dangerous if one ever configures anything outside QuickSet (many of us think that when user clicks WebFig button the first time, QuickSet button should simply disa...

mkx

No. PoE-out limit on hEX S is 500mA and if using "stock" power adapter (at 24V), that translates into 12W. Single cAP ac power consumption is rated at 12W (without attachments). Additionally, "stock" pwoer adapter is rated at 1.2A, at 24V this is 28.8W. hEX S own consumption is 6...

mkx

Some devices simply do not support health monitoring. It's not a winbox bug! I can understand @maisondasilva where he'd like to have the "pull out" list of items invariant. So perhaps the items, not feasible for a particular connected device could be present on the list but inactive (and ...

mkx

I'm pretty sure that router, when ND is enabled, sends out packets to broadcast address via all interfaces (which includes lo). And again, as I wrote, sending traffic to broadcast on lo won't yield any response. Which means that dropping such traffic doesn't do any harm. The only issue here is your ...

mkx

/interface bridge add admin-mac=48:A9:8A:XX:YY:ZZ auto-mac=no comment=defconf frame-types=admit-only-vlan-tagged name=bridge vlan-filtering=yes You can check it with either UI or by typing /interface bridge export verbose There is pvid=1 which is not exported since it's default value, but it is sti...

mkx

And that traffic is being sent to broadcast address ... since only device, attached to that "network", is sender itself, it won't get any answer ... like ever. So dropping this traffic doesn't change anything. It would be different, if some service would try to connect another internal ser...

mkx

... VLAN1 ... leave it alone, since it costs nothing.

How can you say that not using VLAN 1 costs us nothing? I paid 1.85€ for an UTP patch cord for use with trunk connection. If I can't use VLAN 1, I'm loosing 0.00045 € due to reduced functionality !!!

mkx

Depends on how you want it to work exactly. Fyi, legacy supports CAPsMAN forwarding, wifi-qcom(-ac) doesn't. Thanks, What I need to do is to add some ax devices in remote site and get the CAPsMAN forwarding work. Is that possibl No, capsman forwarding with new capsman is not possible. Period. You'l...

mkx

I'm guessing then that we installed wifi-qcom-ac above wifi-qcom because its smaller and the settings are practically the same? Adding to post by @jaclaz: yes, you installed wifi-qcom-ac because it's smaller. And that's exactly the reason for its existence, some ac devices have the tiny 16MB flash ...

mkx

You're right, coukd be a bug in android's ifconfig. Another possibility is (again android's) RNDIS stack which erroneously handles ethernet frame checksum ... but doesn't discard frame due to mismatch (could be RNDIS driver on MT to blame as well). But, as you may have guessed by now, I'm just guess...

mkx

Shouldn't there also be 7. add ether5 on both routers to WAN interface list and remove from LAN (if present) Well, my post starts with "in a few words" :wink:. Of course actual list of things to do greatly depends on actual configuration of both routers and wanted end state (from function...

mkx

Rx errors are often not detected on the other (Tx) side ... so the discrepancy in errors statistics is nothing weird. I can think of several reasons for Rx errors to happen ... ranging from "noisy" USB cable to (performance) problems in USB stack (and higher) on the android LTE device. If ...

mkx

this is considered PtP addressing and works fine

Not everybody knows the name for it ... and certainly not everybody knows how to use it properly ... hence post by @TheCat12 (which is, unlike yours, useful)

mkx

In a few words: remove ether5 from list of bridge ports on both routers assign IP addresses to ether5 on both routers. Use e.g. 192.168.42.1/30 on M1 and 192.168.42.2/30 on M2 add static routes to reach other LAN via opposite router. E.g. on M1 do /ip/route/add dst-address=192.168.1.0/24 gateway=192...

mkx

Hey guys, i moved newly from opnsense to CHR ROs setup on proxmox, the concept of vlan seems much harder to wrap the head around. This is de-facto guide to how to VLAN on ROS: https://forum.mikrotik.com/viewtopic.php?t=143620 And, while at it, you might want to wrap your head around bridge and its ...

mkx

The runtime is 20 days, and currently, the DNS cache has grown to 42,375 KiB. The DNS memory leak in RouterOS 7.15.3 is continuously occurring. Why have you set Cache size to 64MB? This. It's not a memory leak if service uses up to amount of RAM assigned. In this particular case, even if some DNS c...

mkx

... on 1 cap AC using wifi-qcom-ac driver...

Oddly enough, no such issue on ac2 with exact same config (same RAM amount so why ??).

hAP ac2 has 3 more ethernet ports, so more buffer on switch chip is in use ... perhaps that's a life saver? LOL

mkx

VLAN and "fully unmanaged" don't go together in same sentence.

The closest to fully unmanaged switch MT switch can get (both SwOS and ROS) is default switch config with xSTP fully disabled (both globally and per-port).

mkx

If i connect directly to my ISP's router the firesticks (2) will work but not if behind the mikrotik

Sometimes wifi stations cache connection failures and refuse even to try to reconnect to AP with MAC remembered as "problematic".

mkx

I'll stick with v7, I believe it's v7.15.3. I don't see v7.5 on routeros download page. On v7 it's generally safest to stick to latest stable release. Indeed there are some problems with newest versions on certain devices and then it's wise to run slightly older (e.g. some people have some problems...

mkx

The problem is power pre-amplifier (PPA) in receive path and its automatic gain control. It gas to amplufy analog received signals so that they enter the analog-digital converter at certain level. The problem is that PPA doesn't know the exact frequency used and amplifies the whole 2.4GHz band ... i...

mkx

It seems that DHCP parameters are not meant to be received from both VLANs by the same routing instance. So now the question: what's the intended layout of your LAN devices (including VoIP devices)? I don't have VoIP, but my ISP delivers IPTV over tagged and multicast. It is possible to terminate th...

mkx

10.50.131.150 does not fit into 10.126.0.0/17 (this one covers range 10.126.0.1 - 10.126.127.254) but you don't have any specific router which would match better than default via pppoe internet interface. You can try to add a route towards 10.50.131.150. Ideally you'd use some gateway address (which...

mkx

I have a problem with czech diacritics. In older version, was all good, but now I can see this: ? and corect is: č So new version doesn't know this diacritics. ěščřžýáíé and write only this ?????? Can you repair this bug, please? Thank you It's probably bug due to not handling non-ASCII characters ...

mkx

PPPoE is a bit nifty for IPv6. One thing is that you don't need to request address from DHCPv6 server, only prefix. (Doesn't hurt requesting one, but it's useless) Another thing is that DHCPv6 server on ROS is not very useful, it can't hand out addresses (only prefixes). Alas, in IPv6 there are Rout...

mkx

Is there perhaps a .fwf file lying around in files area? It's either this or a bug in firmware handling in 7.16rc4 ... I don't have any other explanation for the routerboard anomaly. In any case, having "current firmware" version same as running ROS version js a good sign and you should no...

mkx

Post full config .. from terminal window execute /export filename=anynameyouwish , fetch resulting file, open it in your favourite text editor, redact any renaining srbsitivevdara (serial number, passwords, etc.) and post it inside [ code] [/code] tag pair. Also post output of /system/routerboard/pr...

mkx

The setting for sfp-sfpplus2 (under bridge/port) lacks setting of PVID ... and default is PVID=1 ... OTOH it's set as untagged for VLAN 50 ... so you have a discrepancy here.

mkx

If using webfig, then you have to create a new list when adding first address to it: IP -> firewall -> address lsits -> add new ... in the list field, don't select existing list from a drop down lsit, but rather type in name of new list. Also add (the first) address ... and click apply (or OK). For ...

mkx

Unless bridge has vlan-filtering=yes set, all VLAN-related settings on bridge and member ports are ignored (this includes PVID setting).

mkx

They cost roughly the same....which would be the best solution? Apart from suggestions for some more modern device ... base RB911 is only a board. You need a case (list price $15), power adapter (price around $10), antenna pigtails and antennae them selves (price for all together probably around $2...

mkx

So you have 3 VLAN interfaces /interface/vlan add interface=bridge1 name=vlan88 vlan-id=88 add interface=bridge1 name=vlan10 vlan-id=10 add interface=bridge1 name=vlan20 vlan-id=20 and you have appropriate IP addresses set on all 3 vlan interfaces. Now device will route traffic between the 3 subnets...

mkx

I can't be certain, but you wrote: So I checked my Dude setup and, after *a lot* of testing, I found that I had a function for checking the number of capsman clients that was using a call for the previous version of capsman. If I understand this correctly, then it's not a script, configured in ROS d...

mkx

If observing CPU usage under system resources ... that one is average and single-core tasks won't trigger it to go very high (depending on number of CPU cored in your device). It's better to run CPU profiler to see, if one of CPU cores gets pegged and which process causes it.

mkx

Why the good Mikrotik guys like to potentially alienate a number of their customers over the lack of a copy-paste on each post 7.12.x release docs a single sentence *like*: Yes. But until when? For me this is already obsolete news, all of my devices, which deserve running v7, are already past 7.13....

mkx

How would I go about trying to enable fasttrack and see if that works? It's a firewall filter rule ... like this one: /ip/firewall/filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack" Since firewall filters are processed to...

mkx

This is an absolute joke. To me, your post is joke. Mikrotik''s suggested way of upgrading ROS on devices is to execute ROS-builtin package updater. And this way works just fine. Sure there are other ways of doing it (dropping manually selected package files to device, netinstall), but whrn those w...

mkx

can the frequency be selected with 5mhz step like in non-ax chips, or must follow strict "wifi channels" frequencies? It seems that it requires using proper channel frequencies. Just tried to set frequency to 5205 on my Audience (runing wifi-qcom-ac). CLI does allow to set it, but interfa...

mkx

As long there is a workspace with 🪟 ...

Many datacenters don't ... in which case the box part kocks in.

mkx

If only you'd taken the opportunity to change that meaningless (if not entirely misleading) name, now that its Windoze shackles are finally off :)

Indeed. And here's my suggestion: ROSman

mkx

... at least we have our own default config and password (which is unfortunately still shown in the /system/default-configuration/print). Isn't the default config only shown to user with administrative rights? That is so on my devices. And probably the reason for restriction is exactly this ... So ...

mkx

Though it seems to be working better, VLAN assignment on the wifi-qcom-ac seems to be broken: Yup, that's a known "feature" of wifi-qcom-ac ... the only way to get its interfaces part of a VLAN is to use vlan-enabled bridge and set appropriate PVID to each of wifi interfaces (real and vir...

mkx

It's not strictly necessary to "free port 53" ... DST-NAT (which is required to send traffic to different server) is one of early stages of packet processing ... only at later stage packet gets delivered to router's own service if destination address remains same as one of router's own IP ...

mkx

.. it is hard to say what you did. I just had a quick glance at the page ... the first chapter is titled "Remove all configuration:" .. which makes me turn away from this thread. If @OP follows such a "cook book", then he should trust the author of the cookbook and discuss any m...

mkx

As both variants, if properly set up, work, it's not possible to say which one is right and which one is wrong. It's a matter of personal taste. My way is this: as soon as I start with VLANs, I go with all-tagged within LAN infrastructure. Which includes connections between LAN devices (switches, ro...

mkx

Another difference I notice is that you have switch1-cpu added to all your /interface ethernet switch vlan If using /interface/ethernet/switch config subtree for wired VLANs, then it's necessary to add all VLANs, somehow handled by CPU, to switchX-cpu switch port . Which includes VLANs for wifi int...

mkx

1. Since v7, there are two dtivers for wifi hardware: legacy wireless and new wifi ... New ax hardware is only supported by wifi drivers, pre-ac hardware is only supported by wireless. Ac hardware (including hAP ac2) is supported by either driver, but default being wireless (due to legacy reasons). ...

mkx

The new one is able to hardware accelerate more then one bridge and my problems have ceased.

Which is the "new modil" that can HW offload more than ond bridge? AFAIK there are models that could do it, but with series of gotchas ... so I wonder.

mkx

So can HAP AX2 / AX3 be configured with Bridge VLAN Filtering (even without HW) - will they work with such configuration ? Will HAP AX2 be enough CPU power for that or better to buy AX3 for VLANs without HW? Yes and yes. And no, there is no other way of configuring VLANs on hAP ax2. My experience w...

mkx

Your SXT should work fine with v7. There's a gotcha when netinstalling v7: you have to install optional package wireless, since 7.13 none of wireless driver packages are parts of base package (routeros). There are some funny details when it comes to netinstall ... e.g. sometimes some certain version...

mkx

I understand AX does not allow for NV2, but the radios does also support AC and N and i would think it possible to port NV2 at least for these standards that is compattable with NV2. AFAIK it's not radio hardware in AX devices which is incompatible with NV2, it's drivers issue: on AX devices it's o...

mkx

It is possible that the one (or the other) Ros version and/or the one or the other configuration takes up a little bit or a little more RAM ... ... and that's what I'd expect to see when both (identical) devices run different versions of ROS. The next question is whether they both have identical se...

mkx

You already have implemented the first rule (two in your case, one per port). You still need the second one (one will cover all the dst-nat rules), but with correct addresses ... You can actually make it even more general and it likely won't bite your back: /ip firewall nat add action=masquerade cha...

mkx

OT: You can't imagine what happens when you have to block DNS by law and use your own... Do you know how many Chinese things call home?... Korean things as well (I've got a Samsung smart TV which is constantly trying to call home). And probably things conceived elsewhere as well (I don't believe th...

mkx

Apart from understanding the topic, mentioned by @erlinden, the only issue is to make a modem pass-trough configuration in each of RBM33G ... each using different VLAN ID for its "modem traffic" (article, linked below, uses plain ethernet port as passthrough interface, I guess you can crea...

mkx

At least some really widely used one support this indeed: - ISC DHCP by using a "host" declaration - see https://kb.isc.org/docs/isc-dhcp-41-manual-pages-dhcpdconf From the cited document: It should be noted here that most DHCP clients completely ignore the host-name option sent by the DH...

mkx

As long as you can pull additional IP address (e.g. using MACVLAN interface), you can use that additional IP address simply for NAT ... both dst-nat (i.e. public clients can connect to secondary_address:port and those connections get NATed to internal server) and src-nat (for server's outgoing conne...

mkx

In another words - been there, seen that.

OMG Sindy, you're truly one of a kind. The rest of us would be "been there, done that."

mkx

IPv6 addresses are set without prefix length, they should have /64 included. Without it, it's taken to be /128 (just like in IPv4 it's assumed to be /32). This also caught my eye so I've made a test, and the default behavior in IPv6 indeed differs from the one in IPv4, at least in 7.15.3: That's in...

mkx

Your setup currently uses ether2, ether3 and ether4 in a "switch group" for LAN purpose. Your setup also uses ether6 as WAN interface. The rest of ports seem to not be in use, but there are some remains of config (it seems that ether5 was used as WAN interface in some past). I'd use ether5...

mkx

In @kobuki's configuration there's an error in LAN interface setting: IPv6 addresses are set without prefix length, they should have /64 included. Without it, it's taken to be /128 (just like in IPv4 it's assumed to be /32).

mkx

https://neal.fun/password-game/

mkx

... and the 2024 award for the most inaccurate package name goes to ... :lol: Actually it shouldn't surprise us. After all, we have a thread, dedicated to the meaning of "C" in names of certain product families (and discussion about "R" in name of certain product family is not f...

mkx

And this new MikroTik ROSE... "MikroTik Enterprise" WHY?! Sorry, but ROSE is clearly not enterprise feature ... every decent enterprise will have some kind of specialized NAS or SAN ... probably any QNAP, Synology or <insert name of your favourite low-cost NAS vendor here> will do better ...

mkx

I do not expect to get theoretical 867 Mbit/s but I have expected something around 300Mbit/s. I have merely half of it. With legacy wireless driver in use, it's impossible to get more than around half of theoretical throughput ... in ideal radio conditions (that would be around 430Mbps). And then n...

mkx

The problem with roadmaps is that after you publish dates, you damn well stick to them. My impression is that MT has hard time when negotiating with manufacturers of MT's designs (because, let's face it, MT is a small vendor compared to some other well known low-end brands). And it might be that MT'...

mkx

I have a Mikrotik Hex S, on its 4th and 5th port I have 2 Trunk ports (vlans 8, 100, 200, 999). The configuration of the vlans is done through Bridge. My question is why it is not showing me traffic on a particular VLAN in the interfaces? Is it because the switch-chip is taking care of it? Correct,...

mkx

Post current config in full: open terminal window execute /export file=anynameyouwish hide-sensitive (the last command line option is necessary in ROS v6, in v7 that's default copy resulting file over to your management computer open it using favourite text editor, redact any remaining sensitive dat...

mkx

Probably you don't have to set protocol=tcp src-address=10.227.4.10 src-port=443 in mark-routing configuration ... if you properly apply connection mark. You'd probably have to add the route to 10.227.4.0/24 to the alternative routing table though to allow forward packets to reach their destination....

mkx

There is no "initial connection" to change password. They never connect to it. Perhaps devices should ship with default config with internet connection (whichever it is) disabled. This would force users to connect at least once. During this initial connection, user would be forced to set ...

mkx

You have to mark connections, coming in via WAN2 ... then use connection mark to set routing mark ... and then use that routing mark to use alternate routing over WAN2 interface. Yes, it has to be connections marked, so that return packets (belonging to same connection) will get properly marked for ...

mkx

Maybe ETSI TS 103 645? This is ETSI standard, not EC legislation. Standards may get into legislation (in which case laws/rules/directives/... don't have to go into technical details but rather refer to certain standard), but without some kind of regulation they are not mandatory. So my rant about E...

mkx

The problem with EC legislation is that there are two kinds (actually there are more, but in this case two are relevant): regulations and directives. Regulations apply in all member states immediately after they enter in force, equally in whole EU. Directives, however, need to be transposed into nat...

mkx

wave2 CAPsMAN settings are shared with local wifi settings (if device supports it and has one of wifi-qcom* packets installed) under /interface/wifi ... and you have to configure things using corresponding profiles (i.e. under ./channel/, ./security/, etc.). All devices, running ROS 7.13 and newer, ...

mkx

I often like to cite the checklist on the original instruction manual of the Volkswagen T1: It's a very good checklist, too good to be useful nowdays. The thing is that when some kind of engineering marvel hits the mass market, everyone is wary of new thing and have to learn how to properly use it....

mkx

It seems that @OP created another user System with full permissions. So he has to use that user to perform certain tasks. Which is exactly the point of creating non-default user with full permissions (as means of strenghtening security of a device).

mkx

"Password after reset that is printed on the device." - Devices are sometimes in public area's, like CUBE 60 are. - Password versus box table is stored in distributed databases. Those who are genuinely concerned about device security (I'm pretty sure you are as are most regulars on this f...

mkx

Direct attach cable generally only works when interfaces on both ends are the same generation, i.e. both are SFP (1Gbps) or both are SFP+ (10Gbps) or both are SFP28 (25Gbps). Sometimes it's possible to use DAC even if interfaces are different ... if both devices dupport setting interface rate manual...

mkx

Sorry, one more thing: Yes, this one ... unset default-vlan-id (i.e. set it to "auto") which will make CPU port (i.e. bridge) tagged for VLAN 88 as well. but I have only untagged traffic for VLAN88 - how does this "auto" setting set VLAN88 in such case - I thought that default-v...

mkx

/interface ethernet switch port set switch1-cpu vlan-mode=secure vlan-header=leave-as-is default-vlan-id=88 Yes, this one ... unset default-vlan-id (i.e. set it to "auto") which will make CPU port (i.e. bridge) tagged for VLAN 88 as well. 2. Can I use only VLANs (without bridge or ether i...

mkx

The config is more or less fine. I have things configured only slightly differently on my RB951G, something like this: /interface ethernet switch port set ether2 vlan-mode=secure vlan-header= always-strip default-vlan-id=88 set ether3 vlan-mode=secure vlan-header= always-strip default-vlan-id=88 set...

mkx

Can you configure first wavelink as AP in mesh mode? Configuring it as router (mesh mode or not) is what causes all devices behind it to appear as wavelink to MT. As long as it's possible to mesh wireless and wired ports this should be possible ... even more, all mesh nodes can be set-up equally, bu...

mkx

... total HDD space is 15.3 MiB and free HDD space is 4296 KiB. Since ROS is about 12.3 MiB by itself without packages, normal upgrade does not seem possible. How exactly are you trying to upgrade ROS and what exactly does log say after it fails to upgrade? How exactly are you uploading the npk fil...

mkx

The default route setting on station brdige is wrong. It should be like this: /ip route add distance=1 gateway=192.168.88.1 Using interface name as gateway doesn't work too well for non-PtP interfaces. Other problems on station-bride device: you shouldn't run DHCP server on station bridge, DHCP serv...

mkx

If station bridge device can ping your gateway, then it should be able to connect beyond gateway if default route is configured properly (and gateway doesn't block it somehow). You can post full config of station bridge device (in terminal window execute /export file=anynameyouwish hide-sensitive - ...

mkx

Is there some particular setup needed on the ‘station bridge’ to get internet connectivity for the RouterOS on that wAP AC itself? Or is it possible at all in this mode?

Nothing special, just IP address, default route and DNS server address ... just like any other IP device in your network.

mkx

On MT devices it's possible to use any port as WAN port. Reconfiguration is not trivial, but not too hard either.

Port, marked as internet, is on hEX special because it's PoE in as well ... so it's slightly different than the rest of ports. Perhaps this makes it more sensible to voltage surges?

mkx

In PtMP setups you can have different values on different nodes: The value should reflect the distance to the AP or station that is furthest from the device. So on hub node (PtMP AP) you need to have e.g. 3km, on station nodes whatever needed (on the farthest node 3km, on nearer nodes something lowe...

mkx

add action=dst-nat chain=dstnat comment="Apache 80" dst-address=<PUBLIC IP> \ protocol=tcp src dst -port=80 to-addresses=192.168.88.22 to-ports=80 add action=dst-nat chain=dstnat comment="Apache 443" dst-address=\ <PUBLIC IP> protocol=tcp src dst -port=443 to-addresses=192.168.8...

mkx

But as you probably understand: It is the responsibility of the customer or the customer's representative (the tech) to config the devices properly. A parallel from transportation industry: it's drivers' responsibility to avoid other parties in traffic. But this didn't work too well after a short w...

mkx

So I would leave hAP ac2 ... Personally I'd avoid using any of ARM devices with 16MB flash space as "core" router ... because 16MB is tight specially when running ROS v7 (and eventually we all will run it). I know that with recent ROS version one can completely remove any of wireless driv...

mkx

So we're guessing ... until @OP provides exported config as per instructions in post by @rplant ... I'm guessing that the "dst-address" property setting (which seems to be set, but @OP blacked it out) is wrong. The thing with DST-NAT is that dst-address property normally doesn't have to be...

mkx

The bridge is offloaded to hardware switch chip (MT7621) ... which according to switch chip features table doesn't support rules. So if you want your bridge filter rules to actually work, you have to disable HW offload ... on all bridge ports set hw=no . This will, alas, cause all traffic to pass vi...

mkx

Almost seems like I need to manually increase the size of the Flash/directory so that it can hold more capacity for an update to be processed. That way remote updates could be feasible again. Does that sound correct to you? No. I'm pretty sure that flash disk is at its maximum (15.something MB) and...

mkx

Any other thoughts? No, not without (near) hands-on diagnosis. It might be, that netinstall will be necessary ... yeah, I'd hate it too, but sometimes there's some hidden trash which can only be cleaned using netinstall ... and after that, drvice is healthy and ready for series of normal upgrades.

mkx

Just add sfp-sfpplus1 interface to WAN interface list:

/interface list member
add comment=defconf interface=sfp-sfpplus1 list=WAN

And you should be fine.

mkx

The log entry is more likely about updater checking free space and finding out that it isn't sufficient. If there are any fikes under flash/ directory, you can possibly remove them (but come back and ask if they are safe to remove beforehand). Excessive config (e.g. bigger address lists or bigger st...

mkx

Any device (be it Mikrotik or TPlink) can only filter traffic passing between its own ports. If only a part of traffic is passing Mikrotik (because devices, connected to TPlink, can communicate without MT ever knowing about it), then possibilities to filter traffic are limited. If your TPlink allows...

mkx

Your LHG 60G has more than 64MB RAM, which means its "root" of storage (as you can see it) is on RAM disk. Just don't upload upgrade npks to flash/ subdir, they belong to root (and that's where ROS upgrader expects to find them). Did you actually try to upgrade ROS (and failed ... and if s...

mkx

Post your current config (output of /export file=anynameyouwish, redact sensitive data such as serial number, public IP address, passwords, etc.). Because proper advice can only be made after we see the rest of config.

mkx

You can't block access to printer using router's firewall because printer is part of same LAN subnet and other drvices talk to printer directly. However, if that printer is connected directly to your router using dedicated network port (none other device is using it), then you could filter traffic. ...

mkx

please explain me how to setup the route thanks That entirely depends on SFP+ module management interface. If your router's firewall and NAT config is still more or less default (as in: small MT RB devices' default), then it should be enough to add sfp-sfpplus1 interface to WAN interface list and t...

mkx

And how are thresholds set and which one doesn't pass?

mkx

Because you're using /32 addresses with wrong network address. Do yourself a favour and use /28 or less. If you don't know what I'm talking about, then use /24.

Another issue is setup of SFP+ module ... it needs a route back to your PC. If that can't be setup, then you have to perform SRC-NAT ...

mkx

So you're saying that tunnel terminates directly on Hemeroid (sorry, Android) device? In that case I'm affraid you'll have to deal with lots of pain in the back.

mkx

Basically you can't rely on having control over how applications work with DNS (e.g. some apps may use their own DNS over HTTPS connection to their own preferred servers). So if you want to force client's traffic through IPv4 tunnel, disable IPv6 on that site altogether.

mkx

Look at official test results: https://mikrotik.com/product/crs305_1g_ ... estresults

Look at ethernet trst results, routing 25 ip filter rules, 512 byte packet size. The number stated there represents real-life performance the best.
And individual interface speed doesn't change it.

mkx

mkx

So the "background" scan is clearly not a background one. It is clearly interrupting. Perhaps it's intended to be in background but it messes with timing of beacon frames? The only way of doing background scan with single radio is to transmit what's essential (beacons) but use the rest of...

mkx

To continue where @neki stopped: even if both capsmans run on same device, they don't share config. And since support for better mobility (as in 802.11 r/k/v) is tied to wifi capsman, legacy cap devices don't benefit from that either. Which means that running legacy capsman for sake of single legacy...

mkx

Port number is yet another variable. So I wonder what exactly seems to be the problem?

mkx

If you use built-in ROS updater, then you have to change channel to "upgrade". It'll then upgrade version to (I guess) 7.12.x (and revert channel to "stable"). After upgrading to 7.12.x, you can further upgrade to newer version (7.15.x) by simply re-running upgrade). If you follo...

mkx

L2 comes with its own overhead (ethernet frame headers and whatnot) and inter-frame gaps ... which take up relatively larger proportion of total capacity with smaller frame sizes (payload) compared to using larger frame sizes.

After all, that 1Gbps speed is L1 speed...

mkx

what is the intention or goal? The goal is to boo-boo. AFAIK the most optimistic feedback provided by support is "the issue was reproduced, it'll be fixed but we can't give any ETA". Except when the fix was already done and has passed whatever internal check points, in which case they'll ...

mkx

Probably it writes new value for "last logged in" (or whatever it's called) so it can print critical logs which will happen between now and next login at next login.

mkx

A rural legend goes that CAPsMAN can offer own installed packages to CAPs ... if architecture is the same and installed packages are superset of what's necessary on CAPs. I never ran a setup where this could work, so for me this is just a legend. But a safer way forward is to upload packages, needed...

mkx

Sorry for OT, just remark on this (fasttrack and mangle are uncompatible). Depends on config, it can work in combination... I'm not saying that fasttrack can not be used ... I'm saying that mangling and fasttrack are uncompatible (or is it incompatible?) ... with addition: one connection can either...

mkx

Beginner question: Do I need to set up an interface list to make your firewall config effective ... Yes, if you largely re-use firewall, then you have to setup and maintain both interface lists. Your own approach (if executed carefully) works as well, but lacks flexibility (e.g. if your LAN is more...

mkx

Packet sniffer disables fasttrack ... which in turn means that your mangle rules actually apply to all your traffic (fasttrack and mangle are uncompatible).

mkx

First off, you should go through this tutorial if you haven't already. Even though your device comes with two switch chips, the single bridge config should work mostly fine with two potential gotchas (one is concerning CPU load and one VLAN switching between both port groups). But I suggest to deal ...

mkx

Does your linux run any kind of firewall or SElinux? These two may interfere with winbox and mac connectivity.

mkx

The 3rd party linux mactelnet client ia reportedly incompatible with recent (like: last few years) ROS versions.

mkx

Is it possible to create VLANs directly on the Switch Chip without creating a bridge?

No, not on CRS3xx devices (if you want wirespeed operations).

mkx

I am now thinking about activating L3 Hw Offloading, any suggestions?

Which device are you using?

mkx

Almost as much as the second word (Smart or Router ... neither hold much essence in them).

So the only true one is the third one - Switch.

mkx

Sorry. Here it is: viewtopic.php?t=143446

mkx

Standards are there mostly for inter-vendor interoperability. In your case you have single vendor (one for SFPs and one for routers) so use whatever works for you.
Just keep a (mental) note just in case you have to replace any piece of equipment and things break then.

mkx

I'd netinstall device now. ROS doesn't create any user (apart from admin) which means your debice might be tempered with. And you don't want that, do you?

mkx

Are you sure it's not TR-069 "server" or some firewall in between that cuts TCP connection due to inactivity?

mkx

That's probable, that single ethernet port may be configured as WAN by default.

Have a look a this thread, it explains how to make device a simple switch/ap (no routing). You may have to add DHCP server configuration though.

mkx

It seems to me like mtest001 is not blaming anyone.

And I didn't imply that. However, posting something about own disappointment on vendor's discussion forum may imply something (and it's everybody's guess what the implication might be).

mkx

Such are risks when using second hand gear.

Do you blame car manufacturer if your second-hand car has a failed cat?

mkx

My link is 10ft apart at 7 feet height, unobstructed line of sight. In short I am connecting one side of the my office with the other side.

You must have some serious WAF problems if you can't pull a CAT6 UTP cable (even CAT5e would do for this kind of distance) accross / around the office.

mkx

In the Protected Bootloader section, it shows v7 and v6, but I have version v3.41. What version should I add to the device? It doesn't matter which version your device currently shows, what matters is which version you want to have. If you plan to run ROS v7, then start with 7.6 ... first ROS (unde...

mkx

So far, "alien" hardware with ARM architecture is not really supported. There's ARM CHR) AFAIK geared towards some particular cloud provider. And there are MT devices with ARM processors.

mkx

The principle should be identical on both devices.

Your problem description is pretty vague, so that's how explicit advice I can provide. Anybody with working crystall ball around?

mkx

Can I come up with some kind of MAC address or how do I make sure I don't have a duplicate? Read about Locally Adminiatered address (LAA) in article on MAC addresses . In short: take MAC address of ether1 and make the second digit from the left either 2, 6, A or E (which means you can construct 4 s...

mkx

... connected a pc to port 1 but after connecting new device to port 1 also new device can connected to network How exactly do you connect the new device to same port? Do you disconnect the first device? In which case the feature works as intended (it's designed against connecting a downstream swit...

mkx

... the backhaul traffic is somehow dropped in the switch. And the only explanation that I can come up with is that switch disables all backhaul ports (except one) due to detected loops (an STP feature). Perhaps you have to reboot CSS after disabling STP. If you know your network doesn't have loops...

mkx

as you can see from the post I used the least used frequency but by running the speedtest I always get to 30mpbs Chart is clipped off at 30Mbps, text under it says that max was 42Mbps. So did your speedtest result also came back at 30Mbps? Are you sure there isn't sone other bottleneck beyond wifi ...

mkx

Nice ...

... but: "Maximum Firewall Port to Port Throughput" is 21Gbps ... a bit less than wirespeed.

mkx

Pretty simple config ... so just go ahead and change IP addresses on both devices. As I already warned, don0t torget to set subnet mask in address property ... just like it is now (the "/24" part). And if you're going to use GUI (ether winbox or webui), don't use quickset, use "normal...

mkx

Your CRS can do wirespeed routing between different VLANs ... the only limitation (when you're talking about large network) is number of connected hosts (total in all VLANs) ... if networks are IPv4 only, then limit is at 16.000 hosts. If networks are IPv6 only, then limit is at 8.000 hosts. If netw...

mkx

No, what you describe won't do: NIC is SFP28, linked DAC is QSFP28 and CRS is SFP+. And all of them don't mix. If you really want to spend more money on server's NIC (to have 25Gbps intetface), then you'll have to go with SFP28 module which can work at 10Gbps ... and a 10Gbps SFP+ module (for CRS) ....

mkx

Use black self-adhesive tape and cover all the leds.

mkx

It can get nasty for the LTE part, read the note 3) for the RG502Q-EA Cellular Antenna Mapping table. I'm not sure what exactly it means, but it might mean that it's either A1 or A7, depending on whether N78 5G NSA is used or not.

mkx

> scp ./routeros-7.15.3-mipsbe.npk username@192.0.2.1:/flash

No need to push files into flash subfolder. IIRC it's actually required to put NPK files to storage root (even if it's a RAM disk) for updater to act on them.

mkx

I'm not sure if it's possible in SwOS, but try to disable STP snd RSTP on all ports connecting mesh system. Mesh will mess with topology (wired interconnects, wireless interconnects, one or both at the same time), possibly in ways which upset STP-enabled network.

mkx

No, it won't work ... regardless the DC jack voltage. When one cuts power on a port on PSE (RB5009), L009 will simply switch over to draw power from the source with lower voltage. It's very useful feature when one wants to have power source redundancy. And /system/shutdown doesn't actually power dow...

mkx

Just googled up this page: https://confusedbird.com/thread-119.html If I understand things correctly, then for N78 device uses external antennas. But for LTE B7, which is a MHB (2600MHz), it uses internal antennas (A0-top right and A7-lower left). Which explains the signal strength difference you see.

mkx

... it is 5G NSA (not stand alone). Exactly ... 5G NSA requires connection zo LTE cell for signalling. So in essence, 5G NSA is simply another CA carrier (with distinction that it can't be serving cell). As to the weak B7 LTE cell signal ... can you verify signal strength of both cells (LTE and 5G)...

mkx

What reasons could there be for the “Link downs” of a 5Ghz meter to trigger? If you want some feedback, just share the config: /export file=anynameyoulike Remove serial and any other private info. And output of /log/print ... it just might tell something about those "link downs".

mkx

Fasttrack and mangle are mutually exclusive. Now, you can keep using fasttrack for traffic which doesn't have to be mangledmby adding accept rule (which accepts traffic to be mangled) and place it above fasttrack rule. This way traffic to be mangled won't escape being mangled via fasttrack, instead ...

mkx

So be careful because traffic going from gigabit port to fast ethernet port must pass trough CPU. I know that can be a problem on RB4011 so i believe it's a problem on RB2011. RB2011 doesn't have the same problem as 4011 does ... it's a problem when there are VLANs in the mix ... and it's not a pro...

mkx

So which one would be more representative of a real world traffic bandwidth test? None. Because it depends way too much on router's CPU power. Always use testing through routers. IMO bandwidth test is yet another feature which shouldn't be made available in ROS ... because it's most often misleading.

mkx

Just to ammend my previous answer: My question is, can I safely change the ip range of the devices to fit into my LAN's IP range without messing up the factory config? Or is it supposed to be this way to work properly? Yes. But try not to use QuickSet GUI option, it tends to mess with any custom con...

mkx

If I'm not much mistaken, RBwAPG-60ad wireless wire kit comes preconfigured so that it serves as a transparent bridge between both wired ends (as if they were switches, connected with a high-delay cable). So IP addresses used in both wired ends doesn't matter, traffic between devices on both ends sh...

mkx

RouterOS is a complete OS (including jernel and drivers) so it's not intended to be run inside a container. CHR is RouterOS variant intended to be run inside a VM (like Proxmox or Virtualization station) but expects to see certain type of (virtualized) hardware ... if virtualization engine can provi...

mkx

Bridge mysteries explained: https://forum.mikrotik.com/viewtopic.php?t=173692 How to deal with VLANs: https://forum.mikrotik.com/viewtopic.php?t=143620 Inter-VLAN routing is just a (not so special) case of routing. L3HW offload: https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading (I al...

mkx

I have devices connected to a bridge. DHCP is set up correctly. When I ping 8.8.8.8 from the ether1 (internet) in Tools-> Ping it works, but when I ping from bridge interface, it shows timeout. Do I need to add a firewall rule, or a NAT translation? Do I understand you correctly that you're trying ...

mkx

If RB5009 does the same (and I don't see why it wouldn't) Yeah, it should but it does not (unless poe is forced) Well, as already mentioned, that's up to PoE communication between PSE and RB5009 ... if PSE doesn't provide power (even if it's just because RB5009 doesn't request it), then for power c...

mkx

Are you sure that B7 cell (FDD 2600MHz) and N78 cell (TDD 3500MHz) are actually served from the same cell tower? They could actually be two different towers in different directions and your P62 antennas are directed at the N78 cell tower?

mkx

No.

Basic idea of routing is that different interfaces have IP addresses belonging to different subnets.

Why do you want to keep IP addresses unchanged both on ISP router's LAN interface and in your actual LAN?

mkx

Modems are pretty dumb devices, do what you want to do is beyond modems' intelligence. You can script things in RouterOS, but IMO scripting is not very flexible and you can't add nifty little tools which can help. Personally I'd go with a small general-purpose computer (e.g. raspberry PI) running li...

mkx

Never mind. I'm afraid that's not a solution, It's a poorly worded excuse for post which didn't make much sense ... but couldn't be deleted by post author. So I fully agree it's not a solution ... not for everybody at least. To the topic: I don't think it's possible not to log only particular conne...

mkx

For full performance, configure a single Bridge and put all ports in it, with Bridge VLAN filtering enable. Right? I just have some VLANs with Inter VLAN Routing. No other requirement. Correct, single bridge with VLANs ... and appropriate routing rules so that this part can be L3HW offloaded. And, ...

mkx

Have a look at this help page, it lists features offered by devices with advanced switch chips, including CRS326: https://help.mikrotik.com/docs/display/ROS/CRS3xx%2C+CRS5xx%2C+CCR2116%2C+CCR2216+switch+chip+features Your switch can also do some IP routing in hardware, check this help page: https://...

mkx

My doubt is that, even if the good guys at Mikrotik were willing to change the way the RB5009 behaves as PD, after the "initial lie" the RB5009 must draw some (little) power from the PoE to "keep alive" the power from the PSE ... The way most MT devices with multiple power input...

mkx

You already solved this, but for completeness sake ... - is there anyone who has already made an ax3 work as a CAP of itself? While technically local wifi interfaces can not be provisioned by CAPsMAN, the integration is possible never the less: both local provisioning and CAPsMAN can share same conf...

mkx

With that being said looking at the restore script from Mikrotik even if they manually set the admin mac they still pick the first available mac from the device itself. What exactly is that you're after? Your script explicitly sets bridge MAC address to address of first listed ethernet port (even i...

mkx

You could create EOIP tunnels from CAPs to CAPsMAN and bridge wifi interfaces with those tunnels.

mkx

Just wondering why you want to run ROS in your storage device though

Because this way he'll be able to install ROSE package and turn his CHR into NAS

.

mkx

Looks like the 88E6393X switch chip used in the 5009 can do basic L3 hardware routing. Hence the second paragraph in my post #2 above. In ROS nothing can be taken for granted until it's actually implemented. For example, allegedly MT7621A (SoC, used in Hex RB750Gr3) can do some L3 in hardware, ther...

mkx

So for RB5009 it is a pure software NAT router. I mean it doing NAT in Linux Kernel without using hardware accelerator in the soc,right?

Yes. So far.

mkx

Is FastPath/FastTrack a pure software acceleration solution? Fastpath/fasttrack is in principle software feature. Some devices are capable of offloading, have a look at L3HW offloading , it has a section about which devices can offload what. There are devices which are supposedly to offer similar f...

Search found 12712 matches