MikroTik

mkx

just use your own dns, set up a cname to the ugly domain name and problem solved. Is not. Even if your own DNS server can reply with CNAME record, clients still won't be able to resolve the serial.sn.mynetname.net ... the only way around it is to actually update A record on your DNS server whenever...

mkx

It should match http://youtube.com but not a lot more.

AFAIK not even protocol (http), only host name, e.g. youtube.com ...

mkx

As I already wrote: if those domain names are not sent from client towards server in plain text, then L7 matcher won't be able to match them. You can verify if this is indeed a problem by doing a wireshark recording (on client machine would be fine) and check initial few packets, sent from client to...

mkx

I have mentioned about this problem in 2019, fife years passed and still the same. CRS326 is unusable at all. Do you actually have problems with CRS326 or is only the stats which are worrying you? And an idea: screenshot shows really low port speeds (10Mbps, 100Mbps) for ports with most link downs....

mkx

Only on the bridge, as that's what the IP stack is linked to. The Ethernet interfaces are just member ports of the bridge in this setup. ... which also means that access to other networks (including internet) can be controlled in this way. But: communication between devices on same IP subnet (even ...

mkx

Almost definitely the two rules you showed are not full firewall config. Or is it? Regarding L7: almost everything now days works over encrypted communications (httpS) and almost every server/client combination supports TLS v1.3. In TLS v1.3 also SNI is encrypted, hence L7 regex rule in ROS can not ...

mkx

Unfortunately, one drawback of my setup is that my location data is random. At one point websites think I'm in southern California, and then a day or two later I'm supposedly outside Chicago. AFAIK this has nothing to do with your actual physical location, it's got to do with some GeoIP databases ....

mkx

My experience with Gmail and IMAP is that when there are many messages in inbox (several thousand which in my case translates into a couple of gigabytes of space consumed), then sync rate plummets. IMO nothing to do with router.

mkx

Drawback: you probably can not use MAC access (I'm not even sure you can do that using Wine, never used it myself). It's possible to use winbox over MAC using wine (just tried winbox 3.35 x64 in linux). For CLI over MAC I guess there's no real option now, MT doesn't provide MAC telnet client for wi...

mkx

Can you set one of ISP router ports as trunk port? Routers, provided by Telekom Slovenije, have option to set each port as either "data", "IPTV" or "both" ... the later being trunk mode. This way you'll get IPTV already (natively) VLAN tagged (and internet probably unta...

mkx

Just seeing lots of devices on the interface with torch that should not be there at all, nothing to do with IPTV multicast. If IPTV of Makedonski Telekom is anything similar to same thing of Telekom Slovenije, then VLAN for IPTV is switched for many IPTV customers ... and you will be able to see so...

mkx

... translating it to new CAPsMAN and wave2 will most likely be the next challenge once I've established a working VALN setup. So one step at a time... :) Well ... support for VLANs in wifi-qcom-ac package is next to none (while wireless has pretty good support), so if you're struggling with VLANs ...

mkx

Normally "AP" are strictly AP's. All Mikrotik's APs (all are running ROS) are "wireless router" in parlance of many other vendors. Mikrotik doesn't have any "AP only" device at the moment (and never did so far, can't say anything about future models). However, it's pos...

mkx

OK, post the config of your RB2011. Execute /export file=anynameyouwish from command line (terminal window), fetch resulting file off device, open it with your favourite text editor, redact any sensitive data (such as serial number, WiFi PSK, any other password) and copy-paste it here inside [ quote...

mkx

I'm pretty sure that if you reset your CRS to defaults, it'll come out configured as "dumb switch" even when running ROS. The only item to be done after that is to adjust IP address if you don't like the one used by default. Shouldn't be too hard when using Webfig (just try to avoid Quicks...

mkx

Just edited my previous post ... check addressing, it seems odd.

mkx

The :ffff: notation of IPv4 addresses are not due to router, they are due to web server logging settings (quite usual if web server supports both IPv4 and IPv6). You're saying that communication across sebnets works using NAT? So where is the PC you're using to manage vacuum? And where's vacuum? Qui...

mkx

The text from product page you quoted was there before L3HW became available on CCR2216. It seems that L3HW got broken in latest stable ROS (7.16.2) ... it's likely it runs out of routes memory. And when using device "with several full tables", this likely gets triggered much faster than w...

mkx

Apart from VLAN stuff (@anav already gave you some good advice) ... are you intending to use hAP ac lite as AP as well? If not, then you better remove wireless package and install wifi-qcom-ac on Audience, its wireless will really take off and fly. You'll have to use the new CAPsMAN (available under...

mkx

My concern with this workaround is that when you append this null character to the filename, it's going to change the length and might confuse some PXE clients ("pxelinux.0" has lenght "10", but with null added it's going to be 11 (hex 1A) and I assume some clients might not lik...

mkx

Guess who will be buying a tplink the first sale I see on their wifi7 products.......

No idea. Can you give us a hint?

mkx

What can I do?

By disabling fasttrack, processing gets much more CPU-intensive. Depending on router model used it often means that router is no more capable of routing at high speeds.

mkx

Basic thing is DNS ... and if you want to use domain name globaly, then you need to register your domain and name servers for it globally (through one of domain registrars). Your cloud provider can probably help you with it. This process is not RouterOS specific in any way.

mkx

When running default config, ROS relies on ingress interfaces rather than source or destination address. So when you try to establish connection to any of router's addresses , ROS first determines it's a connection to be handled by router itself ... hence it'll use FW chain=input. And then rules che...

mkx

Is it possible to keep the switch in default Vlan = 1 mode and configure the vlan(10, 20, 30) only to build the network between the cisco ap and mikrotik router. It is possible. If you configure MT with "native VLAN", then VID=1 is used as native VLAN by default. So just don't configure V...

mkx

@anav is saying that RB951U is like 15 years old model and if somebody sold it to you as new, then that business has some seriously old stuff on stock. Never mind that it's not officially declared as EoL, it's old never the less.

You still didn't tell us about ROS version running on your RB.

mkx

It could be other reasons as well ... @OP did not start with too many details, e.g. he did not mention exact model (there are 951U and 951G ... not that it matters in this case). Neither he mentioned ROS version and if it's an old one, it may have some vulnerabilities (fixed in last few years) which...

mkx

Of course it's always possible that router was compromised from LAN side (some computer running malware) so if things happen again, check your LAN clients (or restrict access to router management to a dedicated management port). That would mean a real weak passwd was used or someone in the 'trust' ...

mkx

I noticed that the "Total HDD size" is now reported as 16.0 MiB while I am sure it was like 15.2 MiB before, so that has changed in some recent release. Seeing your post I went to check my hAP ac2 running 7.16.2 ... and my hAP ac2 also shows 16.0MB total flash size. So this flash size inc...

mkx

But just out of curiosity, what router would you recommend? Have a look at hAP ax2 (or hAP ax3). They have decent CPU built in and are not too expensive (wifi is a bonus, if you don't need it, you can completely disable it which reduces ROS footprint). Definitely come with one of best price/perform...

mkx

3l I cannot backup, or change admin group permissions, I get not permitted (9). This item from your symptom list is consistent with several reports of router being compromised (atrackers created another account with full permissions whike permissions of admin account are reduced). The only proper w...

mkx

That's ambient temperature.

mkx

While waiting for a CRS in this form factor: L009 makes a decent switch with 8 ports (ether2-7+sfp) and with out-of-band management port (ether1). Its MSRP is the same as CSS610. Indeed CSS offers one ethernet port and one SFP+ port more ... and both SFP+ ports are 10Gbps (SFP on L009 is 2.5Gbps onl...

mkx

Are you sure that all of your devices actually support use of DHCPv6? Android, for example, doesn't.

mkx

Some recent versions of some browsers use their own DoH ... ignoring system-wide DNS settings. So could it be a browser problem? If thus turns to be the case, then ... it's not a problem, it's a feature ... because it works around whatever limitations any ISP (or home owner) - possibly driven by ma...

mkx

If UTP cable doesn't affect bits passing too much (i.e. if it doesn't drop or invent bits or whole frames), then both link partners should see identical frames. So it shouldn't matter which side of UTP cable captures traffic.

mkx

That's mostly what I had in mind ... plus setting frame-types the same way as it's done for ether1

mkx

Some recent versions of some browsers use their own DoH ... ignoring system-wide DNS settings.

mkx

Your device can not run v6, it's limited to v7. So you'll have to take tutorials with a few grains of salt. And while starting to think about your way forward, upgrade your device to latest v7 (7.16.2 at the time of writing this post) ... I recommend using built-in updater (webfig or winbox or CLI) ...

mkx

While ROS is based on linux kernel, it0s pretty trimmed down to fit tight storage and RAM. So typucally it ships with very few device drivers. And knowing name of device doesn't have anything with driver availability. Having written that: it's highly likely that your gadget is not supported in ROS. ...

mkx

I guess you could.

mkx

You have ether1 on hAP ac2 configured as trunk port. If you want to connect additional cAP ac to ether5 of hAP ac2, then you can simply configure ether5 identically to ether1 ... add it to bridge and set the same VLAN properties.

mkx

Netinstall is your next step.

mkx

The "active address" in that row seems to be assigned to MAC address 00:00:00:00:00:00, so maybe the base issue is not the missing client id, but the (empty) MAC. I can't imagine how could this happen. DHCP server does receive "DHCP discover" and "DHCP request" packets...

mkx

It is more an issue with its routing speed, that may be too slow for your requirements, it should be in the 150-200 Mbit range. And how are you going to do that with only 100Mb ports ??? :lol: There are 2 ethernet interfaces and WiFi being (in theory) faster than 100Mbps. And ethernet ports are (ac...

mkx

"Or" is not an "exclusive or" so you can use "one of two" as well as "two of two" inputs. No, it's "use the one with higher voltage". Only if both supply voltages are almost exactly the same, then device will draw power from both (not necessarily ex...

mkx

Client ID is something DHCP clients supply to server (and not the other way around). When DHCP server decides on which lease to offer, it first checks "Client ID" ... and only if that value was not provided by client, it falls back to using client MAC address (as identifier). Indeed most D...

mkx

In CLI you can get radio link details by running command /interface wireless registration-table print stats IMO, signal strength of around -60dBm is pretty decent. Ideally signal-to-noise value will be as high as possible (30dB or more) which then should offer good service. One value which does show...

mkx

I don't have any CSS, but I'd expect it to have mirror functionality. However, since those frames break CSS, they might not come out of CSS via mirror port. Which means you'd have to use another managed switch between CSS and one of connected servers and configure mirror port on that switch.

mkx

Connecting USB hub to Mikrotik should work, so you should be able to connect multiple USB devices (mind the power output capability, MT devices usually don't allow much more than standard 500mA, you may have to use powered USB hub). I'm not sure though how many serial ports are supported in ROS ... ...

mkx

AFAIK nv2 and nstreme are supported on all radios which run (now legacy) wireless driver. These protocols are not supported by new wifi driver (wifi-qcom and wifi-qcom-ac), which is required on AX devices (and supported on many AC devices). So in short: nstreme and nv2 work on older Mikrotik wifi de...

mkx

CRS devices are essentially switches ... as in L2 devices. Yes, running ROS on them does add L3 (routing), but without careful configuration those functions will be done by (slow) CPU. But: there's L3HW offload and it might work for you. Further reading: https://help.mikrotik.com/docs/spaces/ROS/pag...

mkx

It would be great if you could post also configuration of the other end (the one you can't get into). While looking at config of "this end", I see a few things: there's some firewall, but with a few errors (like using interface which is "enslaved" to bridge as in- or out-interfac...

mkx

It's encryption of the password. Password is always encrypted. If not set, default encryption is used: ccmp https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-SecurityProperties in here it is said, that it is - A list of ciphers to support for encrypting unicast traffic. Correct: e...

mkx

When checking with CLI: note that setting property to empty string (i.e. "") is not the same as not setting it at all. Ok, and then what happens if it is set to empty string (i.e. "") and what happens if it is not set at all? When this property is not set at all, default (ccmp) ...

mkx

If nothing is set in encryption property (but check in CLI if that's actually the case), then default will apply ... which is "CCMP" (good old AES in WPA2). When checking with CLI: note that setting property to empty string (i.e. "") is not the same as not setting it at all. You ...

mkx

According to SFP diagnostics, it seems that Rx works ... One can not be sure if Tx is fine as well without checking on the other side of fiber, but on your side seems to be fine as well.

mkx

@jfreak53: if you can pinpoint the problem to certain packet contents, then you'd make MT (and humanity) a favour if you could sniff off those frames and send MT the capture file. IMO this is the only way allowing MT to actually fix it. Unless they see those packets and analyze which combination of ...

mkx

By whoever manages cisco ... Or, if it's really ISP (I'm surprised you can see config of your upstream router), let them explain to you how you're supposed to use the /56 they are assigning to you. I suspect that they expect your router to do proxy ARP thingie on WAN port ... which is, IMO, wrong.

mkx

Screenshots are (mostly) useless, you can remove it as well. Open terminal window and execute /export file=aynnameyouwish ... fetch resulting file to your management computer, open it with your favourite text editor, redact any sensitive information (such as serial number, public IP address, wireles...

mkx

How exactly is your SFP port configured? Post outputs of commands /interface/ethernet/export /interface/ethernet/monitor [ find default-name=sfp-sfpplus1 ] once My guess so far: since MT SFP is without "+" (i.e. 1Gbps) and RB5009 SFP port is SFP+ (i.e. 10Gbps), you'll have to disable auto ...

mkx

... MSTP is the most universally compatible one.

I thought RSTP was the most common one?

mkx

Unfortunately, that is what I was doing, and it wasn't working. As in: I disabled wifi interfaces via UI (of any kind) but wifi signal was still being transmitted? Or is it you expected the button magically dissable/enable wifi interfaces without you configuring anything special? Or something compl...

mkx

What I don't understand is how these IoT devices' packets are being heard, received, and repeated by the AP onto the wired network when there is no established wireless connection between the IoT device and the AP. You said that APs are Unifi ... so the question is for Ubiquiti support ... to verif...

mkx

In this case, the configuration no longer takes place on the physical switch but on the virtual switch which is spanned over the physical switch. (At least in the world of HPE/Aruba) Therefore it is also a kind of virtualisation. The only difference is that the switch itself becomes virtual, not th...

mkx

Since packets are broadcast, you'll always see them on hEX, passing in any possible direction ... whether they are getting received somewhere or not. And it's up to anyone's guess as to what's their purpose (and if they would cease to flow if all IoT gadgets would be happy with their connectivity to...

mkx

If you insist that management VLAN resides on VID 1, then it's a). Reason: default config uses VID=1 for all sorts of configuration (e.g. PVID on all ports, including bridge CPU-facing port ). It is possible to get it going as tagged (which is where VLAN interfaces come into play), but it's a tediou...

mkx

something like an entry in the context menu Of which menu? You are surely aware that when device is in sleep mode, it doesn't transmit anything and all caches (e.g. ARP cache, list of DHCP leases, etc.) will forget about it probably long before you'd want to send WoL packet to it, aren't you? Which...

mkx

Since these frames are some kind of broadcasts, you may want to set multicast-enhance=enabled on wifi interface of your AP ... it may or may not help with the problem.

mkx

I can't say about user manager, but usually it should work something like this: set [ find customer=admin username=123456789 password="" ] password="verySecretStuff" Not sure about how to go around 1350 users other than having external script which creates ROS script (with comman...

mkx

Stickers already exist:

They are nice. But let's see what proper W considers as improvement to WAF ... I somehow expect that it's not MT logo stickers no matter what color they are

mkx

Any reason not to upgrade your CRS to ROS version 7.16.2 ?

mkx

Mikrotik supports MLAG. Would that fit at least minimum requirements?

BTW, this doesn't seem to have anything to do with topic of this forum section (virtualization) which is running ROS on virtual machines.

mkx

The MIPSBE devices would be great if they added it ... When they first released wifiwave2 package, it's been said that wave2 requires lots of CPU power and lots of RAM. Old hAP ac lacks both (yeah, hAP ac2 with 128MB RAM can run wifi drivers, but barely so ... minimum RAM for wifiwave2 was set at 2...

mkx

I just said anything but some kind of metallic sticker Now who knows what will arrive from Temu...

Definitely post some photos after WAFization of wAP ax ... Ws tend to have similar views on such matters.

mkx

Since your "project" involves some calculations ... just for comparison: when calculating signal coverage of mobile networks using professional RF propagation tools and then comparing it to reality (measured on the field using professional measurement equipment, such as PN scanners and wha...

mkx

yes, it should.

Not really ... wifi-qcom-ac is only available for routers with ARM architecture ... AC devices of other architectures are "doomed" to run legacy wireless driver ... which doesn't support any new functionality (like PPSK) and I believe it never will.

mkx

This is exactly the same on all servers that support LetsEncrypt. It doesn't have to be. On servers which offer more configuration flexibility one can allow only URLs with path names starting with /.well-known/acme-challenge/ and send 404 for the rest ... or 301 redirecting to https ... or tarpit r...

mkx

Ideally there would be 0 dropped packets (because nobody would be trying to anything bad to you). In reality there's always some bots scanning internet for new victims of their deeds. I guess there will be more dropped packets if bots "smell the blood" (there are many reasons for that, one...

mkx

Show us configuration of both devices ... and mention IP address of management PC (running Winbox or web browser) and where it's connected (physically). Without seeing exact configuration it's impossible to tell the reason why it doesn't work the way you wanted it to.

mkx

It’s about wider compatibility: a DHCP client on the physical interface that connects to the modem and a static route to <MODEM-IP>/32 through the said interface applies to both scenarios (ISP with DHCP and ISP with PPP). A static IP in the LAN of the modem applies “cleanly” only to the ISP with PP...

mkx

... and I still wanted several VLANs untagged on the same port (because my WiFi APs are not VLAN aware).

But does this really work for you? Only one VLAN can have bidirectional traffic (single PVID per port).

mkx

In my case, accept (fasttrack counter) is at 2TB and another 2TB for "slow track"... 32MB drop invalid on input and 32MB drop invalid on forward ... and 178MB drop all else (on input ... nothing on forward).

mkx

It does make sense to drop "invalid" packets early, they might match some allow rule down the chain.

mkx

Configure port on router as trunk with all VLANs needed ... here's how to do VLANs in ROS: https://forum.mikrotik.com/viewtopic.php?f=23&t=143620 ... Tutorial may be geared towards switch-like configs, but is usable also for routers (even router-on-a-stick variety). And a suggestion: upgrade you...

mkx

So why bother with a dual IPv4 when you can just have a route that works in either setup? Adding a /32 route doesn't work with peer which uses "normal" /24 addressing ... And, again, doesn't add to security. One has to treat modem as being hostile and adding interface, connecting modem, t...

mkx

I don't think rotating drvices at angle would be a problem by itself. However there are at least two (minor?) issues to think about: wAP60G uses beam forming, so it can direct main lobe in "optimal" direction. But not in any direction, range span is 60° in horizontal direction and only 30°...

mkx

Don't know if this has been discussed already ...

There's such a feature already: port extender. Not many devices are compatible ... and it comes with some serious gotchas. But it's here.

mkx

I didn't manage to get IPv6 addresses not leaking across VLANs when using SLAAC to assign addresses. Did you fix the switch VLAN settings according to @anav's instructions? If port is untagged member of multiple VLANs, then broadcasts of all VLANs will egress through that port (and being untagged o...

mkx

To better understand the process, could you clarify where exactly the packets get tagged in the WireGuard setup? :mrgreen: The smiley you used makes me wonder whether you expect an answer or not. But anyway, here it is: wireguard is IP tunnel so natively it doesn't carry (nor care about) VLAN tags....

mkx

Again (and read my lips:) there's RouterOS version and Routerboot version. Both are distinct.

mkx

RouterOS (as in windows OS) is at 7.16.2. But: RouterBoot (as in BIOS / UEFI) is at 7.16.1. RouterBoot upgrade files are shipped to device along with RouterOS but it's not installed automatically. Hit that "Upgrade" button and reboot device.

mkx

In that case, the Linux kernel is GPL licensed code and as such we should be able to see the sources with modifications from MT ... I don't think that MT linux kernel contains many changes ... apart from some specific device drivers and some patches. I think it's more about missing features. E.g. d...

mkx

The ROS uses Linux kernel underneath anyway and I assume the very same tools underneath as any usual Linux distro ... Here you assume wrong, so nothing you wrote after this point doesn't necessarily reflect reality. ROS indeed runs linux kernel ... but if we can believe MT guys around here (and I d...

mkx

Yes DHCP client sends out broadcast packets when doing DHCP discover and bridge will send these frames out via all member ports. In principle only one DHCP server is necessary per L2 broadcast domain and if there are multiple servers in given L2 broadcast domain (not wrong by itself), it's expected...

mkx

This gbic is working fine with a Ubiquiti Edgerouter X which i'm using right now. ROS is a bit notorious for not supporting properly just any SFP module, thrown at. So the positive experience when using same SFP in different device brand means very little in this case (it only proves that SFP can t...

mkx

Try to check in depth what's going on with SFP+ port and module. ROS is a bit notorious for not supporting just any SFP/SFP+ module properly ...

Also verify as to which physical port corresponds to MAC address, set as bridge MAC address.

mkx

Well, anyway. Logs don't show anything related to hardware issues (link downs or whatever) ... which likely means some L3 problem. In that case you'll have to troubleshoot the issue while problem persists ... like running traceroute (on a LAN PC) towards e.g. 8.8.8.8 and see where things break ... i...

mkx

Errmm ... that's an article from 2014 ?!

That was my point exactly

mkx

With default logging config, ethernet port link-downs are logged. Also PPPoE client outages are logged (and as far as my experience goes, they correlate 100% when there are problems with ethernet port connectivity). With logs you showed (and assuming you didn't filter any events ... either by reconf...

mkx

Even with "plain" file systems (e.g. ext4) it's sometimes necessary to reformat drive (possibly due to lack of support for some type of partition table or some such). But with encrypted drives I'd say it's even more necessary to reformat drive ... it would be logical to me that encryption ...

mkx

Looked at cisco config and I think the problem lies there: interface GigabitEthernet0/1 description ** LAN ** ip address 201.201.201.201 255.255.255.240 no ip redirects no ip unreachables no ip proxy-arp duplex auto speed auto ipv6 address 2001:db8:20a0::1/56 anycast no cdp enable It effectively say...

mkx

IMO the problem is this:

advertising: 1G-baseX
link-partner-advertising:

Note the empty field "link-partner-advertising". Which means that autonegotiation doesn't happen. Try to set port speed to 1Gbps and disable autonegotiation on sfp-sfpplus1 port (under ethernet configuration).

mkx

You actually need to set advertise=yes on addresses on interfaces where there are devices which should use your router as their gateway ... without it, router will not send out RAs and SLAAC then doesn't work. In your opening post, you write "When I try to configure the LAN and define new prefi...

mkx

I just had a quick look at HUB configuration and it seems to me that routing configuration is flawed: /ip address # You probably don't need this: add address=192.168.0.223/24 comment=defconf interface=BR1 network=192.168.0.0 # and you probably don't need this either: add address=192.168.0.223/24 int...

mkx

Is there anything related in logs?

mkx

Can you post configuration from your MT router, at least the /ipv6 part? You can omit firewall part, it probably isn't important in the context of problems you're seeing.

mkx

Can you post the link to tutorial you're referring to? It's quite likely outdated, master port configuration style was abandoned in ROS 6.41 (quite a few years ago) and was replaced by bridge. And before you proceed, I recommend you to upgrade ROS to latest v6 stable (6.49.something), v7 is probably...

mkx

Show us config of switch (text export)..

mkx

At least pist the exact rule which doesn't work for you. And a detail, it might be a hint: firewall rules may be executed before egress interface is known, routing decission is made after most firewall processing is done. Also: screenshot in opening post also hints that ping is originated from route...

mkx

Metarouter is R.I.P. on RouterOS since many moons ago (at least in reality if not officially). It's replaced with container functionality ... but this functionality is not available on all platforms and if one seriously wants to use it (or wants to seriously use it) one better uses a very decent RB ...

mkx

Actualy ax hardware I tested on 7.16.2 on MikroTik have only fixed channels, example 5500 but not 5510 Yup, that's pretty normal on today's mainstream wireless stations (e.g. smart phones) ... they only support standard channel center frequencies. When creating MT-MT point-to-(multi)point link, thi...

mkx

You can't block specific URLs (chosen between different URLs targeting same FQDN host or IP address). Generic reason is that there's no guarantee that whole URL will fit single IP packet. And FW (L7 as well) works with IP packet granularity. So if one uses IP packets with MTU size of 40 bytes, then ...

mkx

In the meantime your devices probably have restarted ...

... or remained in some undefined state if the brief moment without power flowing lasted just the right duration. And in this case one has to reboot device.

mkx

But do think using default 20/40/80Mhz channel width might be cause of at least some of the frequent AX complaints... I don't think that 20/40/80MHz is causing complaints. After all, this kind of channel arrangement is (supposed to be) backwards compatible with devices supporting only narrower chan...

mkx

If considering RB4011 and RB5009 ... then RB4011 is technically inferior in many aspects (slower CPU, uses 2 switch chips and SFP is connected directly to CPU, doesn't have USB port, etc.). Just thought to mention this to contrast higher WAF of RB4011 :wink: Regarding hEX S performance: that rule of...

mkx

about downgrades, there is ZERO logical reason to knowingly downgrade to a version with a known CVE, possibly allowing easy access to the device by a hacker. Zero. Do not try to find it. This is new to me ... that ROS upgrader has built in function to check certain ROS package against database of C...

mkx

You may want to look at output of command /interface/wifi/print and /interface/wifi/security/print (run them in terminal window ... you can start one from WinBox or connect to device using ssh) ... and look for "encryption" property in both outputs. Only then you'll see what is actually co...

mkx

After you uninstall wireless package and install wifi-qcom-ac package - verify that it's actually installed, cAP ac XL has only 16MB storage space which is really tight - (and upgrade routerboard firmware for good measure ... and cold boot device for another good measure), it may be good to reset de...

mkx

I just NEVER see anyone recommend narrowing channel width for AX... which got me questioning physics. My guess: none of the vocal AX supporters considers 2.4GHz band as viable WiFi band any more (everybody is looking at 6GHz now days). I've thought of a reason to go with 20MHz channels (instead of ...

mkx

The problem with communication pausing and/or packets being dropped when there's speed change (most notably from faster to slower, e.g. ingress port is 10Gbps and egress port is 2.5Gbps) is buffering. A switch has only certain amount of buffer and if there's a burst of frames, switch needs to buffer...

mkx

I know AX uses OFDMA to better handle this ... ... so do G and N (and A) ... actually only B uses DSSS with 22MHz-wide channels. So in this respect AX is nothing new. What AX adds is 1024QAM (N stops at 64QAM) so it can reach higher speeds when SINR is great. And reduces subcarrier spacing by facto...

mkx

When doing L2 stuff, it's responsibility of device sending frame (can be originating host, can be router) to find out destination MAC address. And L2 entity (switch) then passes frame to correct port. If sender doesn't know destination MAC address, it can send it to broadcast MAC address. Both when ...

mkx

Problem with using public servers (including iperf3 servers) is that there might be bottlenecks other than "last mile". I tried iperf3 server from the screenshots of @CGGXANNX and I got shitty performance in both directions. In both directions I see fair amount of retransmissions ... and f...

mkx

Anything in logs regarding bridge or its ports?

Are ports, marked as "not running", connected to devices which are powered up?

mkx

And you're entirely sure that <public IP> is the exactly the same that browser uses when trying to connect to your web site?

mkx

Switch Configuration (Port 7 - AP): - Member of VLAN 1,100 - Tagged on VLAN 100 (WiFi) - Untagged on VLAN 1 (default) - PVID 100 The last two bullets contradict each other. Setting PVID on port means that anything untagged on physical media outside the device (e.g. ethernet cable), connected to thi...

mkx

Now here's my main question: do source ports matter? Generally source ports don't matter ... unless they do. As you found out, some ISPs block some well known ports and UDP 123 is often one of them (it used to be abused by some DDoS amplification attacks), UDP 53 is another one. Vast majority servi...

mkx

mANTbox has a pretty narrow-beam antenna. Have a look at diagrams, published in product's quick guide . Since Tx power is generally limited by country regulations, this means that decent signal strength is only available in directions with maximum antenna gain and elsewhere signal strength is pretty...

mkx

a switch and a router - generally speaking, are the same devices ... While we're generally speaking, switch and router are very different devices. (Ethernet) Switch does ethernet frame forwarding between ethernet ports based on SRC and DST MAC addresses and FDB (Forwarding DataBase). And router doe...

mkx

Hmmm ... the way I read OP's screenshot is that WAN Rx is considerably larger than LAN Tx .... which means that router is dropping some of traffic comming to router from internet. Which means that firewall is doing its thing.

mkx

If AP can add/remove VLAN tags as needed, then the switch in between doesn't have to know about VLAN tags at all. The only (minimum) requirement for that switch is that is supports using "baby jumbo frames" ... that is ethernet frames with payload size of 1504 bytes (VLAN header adds 4 byt...

mkx

Now, if the off-center ball with a flat bottom shape is correct, if you mount a wAP in the center of the ceiling, the apartment below your room should enjoy better coverage than you? :shock: Probably not ... because apart from "back side" (where signal level is supposed to be like 20dB lo...

mkx

For play use a cable, any other consideration is useless ... My guess: @OP doesn't have any wired network infrastructure available ... and/or he fell for "use wireless, it's better than fresh bread" motto of sellers of wireless equipment. Now his multi-player experience suffers but he'd p...

mkx

The ancient ROS version is only supported by (almost) equally ancient versions of WinBox ... I'd go for something older than 3.20 (I don't remember exactly when ROS and winbox changed in this respect). Download link is e.g. https://download.mikrotik.com/routeros/winbox/3.20/winbox.exe (change "...

mkx

Why does the Winbox client share the same JSON file with the web interface? I can't understand this design choice. It is possible to create a "skin" ... like hiding certain interface items. And at least winbox 3 did conform to those skin settings. Which probably means that winbox is suppo...

mkx

- 60db is a pretty good signal already. @OP is not saying he's getting - 60 db , he's saying he's getting 60 % of signal. And only <insert your favourite deity here> knows what kind of signal that means. My experience with 3G and 4G phones says that some vendors set 100% at values where service onl...

mkx

Here's an article, somehow explaining different STP options: https://help.mikrotik.com/docs/spaces/ROS/pages/328068/Bridging+and+Switching#BridgingandSwitching-Per-portSTP According to my understanding, BPDU-guard is almost exactly opposite from setting port as edge: BPDU-guard disables port if it d...

mkx

Depending on setup, MAC addresses of "neighbouring" devices can be in different places: /ip/arp/print As already mentioned, this table contains MAC addresses and IP addresses of devices, which somehow communicated with RB device on IP layer. Values in Status column are explained in this ar...

mkx

It seems fine. It's on a paranoid side, I'd do two more things: for performance reasons I'd enable fasttrack: /ip firewall filter add action=fasttrack-connection chain=forward comment="fasttrack established,related" connection-state=established,related It should be pushed to the top of rul...

mkx

The config you posted seems to be old one ... with capsman settings still under /caps-man ... but to provision your hAP ax2 you need to configure CAPsMAN under /interface/wifi ... e.g. /interface/wifi/capsman/set enabled=yes . Etc. I missed that your CAP device is hAP ax2 in your previous post. So y...

mkx

MTU is L3 setting ... which means at least these two things: switches (as L2 entities) don't have much to do with it, they just have to be able to pass those jumbo frames (L2MTU has to be at least MTU+ethernet overhead+VLAN overhead isf used) whole IP subnet has to use same MTU ... all devices and r...

mkx

In addition: does any of LAN infratructure devices have proxy-ARP enabled? I see many people enable it without understanding what it does and then run into problems caused by it.

mkx

There's been some kind of confusing situation. It doesn't make any sense. I have two 4011s with firmware 7.16.1 that were fine a week ago. Today I noticed that DHCPv6 client on both devices stopped working normally. I have not made any changes to the settings. Did devices reboot in between by any c...

mkx

Assuming that ISP device (modem? GPON ONT?) is working as untagged ... you'll have to create something like this: switch port, connecting to ISP, needs to be configured as untagged/access port with PVID / native VLAN set to 41 switch port, connecting to router, has to be configured as tagged/trunk a...

mkx

Two things: you are running the new "wifi" driver on cAP (optional package wifi-qcom-ac installed I presume), so you'll have to configure the matching CAPsMAN on RB4011 ... and for that, you'll have to focus on /interface/wifi and its subtree (that's the place to configure new CAPsMAN). It...

mkx

L2 devices (switches) don't fragment large frames, they silently discard them. And all devices inside same broadcast domain (most commonly this means same IP subnet) have to be set up with same MTU (traffic from small MTU towards large MTU is fine, traffic in opposite direction will get dropped). Th...

mkx

Apparently, I speak truth.

Don't know about that ... your post was around 244 lines too long for me to even start reading it at full attentiveness.

mkx

If I understand DDM he's trying to set frequency to "auto" ... which is default since around 6.47.

@DDM: read about device mode ... in particular, you'll have to enable routerboard property (i.e. set it to yes).

Edit: meh, have slow fingers

mkx

There are a few places where DNS servers are mentioned: /ip/dns/set servers=<list of IP addresses> This one is used for DNS process in router itself to be able to do any queries. If not for other things, it's important to be working for ROS update checks (and downloads). Or anything else that ROS ne...

mkx

It could be some rogue device somewhere on the edge of your network which initiates STP topology changes. And there are plenty of devices which can do it, e.g. any server running VMs can do it (they tend to run bridges for connecting VMs to network) or servers running any containers, etc. I'd start ...

mkx

First off: CRS354 (the whole CRS family of devices as a matter of fact) is a switch not a router. Yes, if running RouterOS, it can route and if carefully configured, it can route at wirespeed (if not carefully configured, it can route at very low speeds, like 200 M bps cumulative between any combina...

mkx

By setting an IP address on the WAN interface you negatively affect setups where upstream uses DHCP or static assignment as the interface will end up with multiple addresses. I don't exactly understand your argument. I guess that vast majority of devices use static IP subnet for LAN (just like ROS ...

mkx

1) it entirely depends on DNS clients. But mostly they operate like this: start using first DNS server. As long as replies are getting back (even if negative answers), client will use same DNS server. If DNS server fails to reply, then client switches over to using second DNS server. And keeps using...

mkx

This is mission "nearly impossible". One issue is DHCPv6 server on ROS ... it doesn't support giving out IPv6 addresses, it only hands out prefixes (there are some recent activities which may improve DHCPv6 server by adding address assignment functionality). And the big issue is client sup...

mkx

Well, why not just mention that in changelog?

When did MT make changelogs easily understandable?

mkx

Perhaps some of those v6-only hardware got R2 (with some slight HW changes, requiring minor changes in some device driver?) Since such change doesn't apply to already shipped hardware, ROS change can be factory-only (and it doesn't have to be publicly available since new devices can not be downgrade...

mkx

On both switches: if you're using VLAN Interface, anchored off bridge, then bridge CPU-facing port has to be tagged member of corresponging VLAN:

E.g.:

/interface bridge vlan
add bridge=SW1 tagged=SW1,ether8 vlan-ids=40
/ip dhcp-client
add interface=Management

mkx

Do any ISPs still use squid proxy/cache servers ? Can't speak about ISPs, but in my company (with a few remote offices) we're forced to use proxy server (squid) for remote offices to be able to exit to internet (the connection between remote offices and main office is over some MAN which offers the...

mkx

There is any Mikrotik modem (only modem) that suports this 3 bands? If you're thinking of attaching modem directly to RB5009, then the only option would be USB modem ... and no, MT doesn't offer any USB modems what so ever. So the only option would be to go with models, mentioned by @gigabyte091 .....

mkx

So I added IP address (from modem's "LAN" IP subnet) to my ether port linking with modem. Any particular reason you chose this approach rather than adding <IP>/32 route? The latter should work for both PPPoE and bridged Simplicity. BTW, adding /32 route doesn't make it any more secure (th...

mkx

Depending on requirements (WAN speed being one of more important ones) ... but hAP ax3 is generally one of better choices.

mkx

It is possible to netinstall (older version, 7.17beta4) while keeping configuration. You can try this and see if it works out.

mkx

Thanks for the image. So wAP AX seems to be directional. Correct antenna gains seem to be around ~7dBi in the frontal direction. Around 7 dBi for 2.4GHz band and around 5 dBi for 5GHz band. There's definition about "directionality": antenna beam width is angle where antenna gain drops by 3...

mkx

Your company switch most likely works as "802.3 af/at" and provides around 48V. Which is pretty much incompatible with RB260GSP PoE-in requirements. Provided power adapter is almost certainly 24V and RB260GSP only works as "passive PoE". Which is, again, completely incompatible w...

mkx

Try disabling LCD altogether. It's known that updating LCD contents affects router's performance quite signifficantly. You posted terse (or verbose?) expirt which includes all sorts of default settings making it much less readable ... at least zo me. So if you do another export (a "normal"...

mkx

As the complete bandwidth of 2.4GHz radio is 40MHz wide.... Not exactly true. WiFi 2.4GHz band extends from 2401MHz (lower boundary of channel 1) to 2473MHz (upper boundary of channel 11, relevant in NA) or 2483MHz (upper boundary of channel 13, relevant in EU and almost everywhere else than NA). W...

mkx

Port extender functionality (either CB or PE) has to be run by switch chip to be effective. So there are 3 possibilities: switch chip used in CRS310 doesn't support this feature support is not yet implemented in ROS documentation is outdated Whichever it is, you could get a definitive answer only di...

mkx

"off-topic": Why you should add the eth port that is connected to the isp modem to the WAN list? (I'm using PPPoE) It depends. In my case ISP's modem has management interface (Web-based UI) and for that it has "LAN" IP address. Even though I put it in bridge mode and run PPPoE c...

mkx

My question is: In short: interface is the thing which delivers frame to RouterOS. Most often it has IP address set. This "property" is not passed to parent entities. E.g. if you have a few ether ports members of a bridge and teaffuc is tagged so there's also a VLAN interface anchored off...

mkx

If bridge configuration on SXT doesn't have any VKSN-related config, then its IP layer communicates strictly vua untagged frames. Diagram mentions VID 2 as being used as native on trunk between cisco snd SXT (at least the upper-left pair), which means that 192.168.2.0/24 should be used in VLAN 2 on ...

mkx

Commenting on config from attached rsc file ... You shouldn't set use-service-tag=yes , it switches over to different type of VLAN headers. And no tag stacking. All in all device config is a mess. So I suggest you to start over: install ROS 7.16.1 on your hAP ac2, it'll improve wifi performance quit...

mkx

What does "D" mean in Current Channel?

I'd say it means DFS.

mkx

However not knowing where they come from is troubling us, we only see the LAN ip and mac address of the source.

Find them ... as per advice by @tdw. Yes, it's manual work, but if you want to catch plaintiff, you need to do some detective work before you send out the guns.

mkx

Not sure about the branding bloat ... it might be necessary to install different branding ... https://help.mikrotik.com/docs/spaces/R ... 4/Branding

mkx

Viktors says wAP stands for "wireless access point". 😉 I think that that is only to distinguish it from wired access points :roll: :wink: :lol: I don't know about you, but I have my Audience wired ... both for PoE and for backhaul. And it only works as AP (no routing or anything else). Wh...

mkx

I kindly ask for some official answer will it be possible to receive updates for this device in future? You won't get any official answer. But experience with MT so far is that they are doing anything possible to provide software upgrades way beyond EOL date. The only problem with 16MB flash device...

mkx

There's another path (possibly a tad easier) instead of netinstalling ... available from ROS version 7.13 onwards: mark package wireless / wifi-qcom / wifi-qcom-ac driver (whichever is installed on device, in case of @OP it may be wifi-qcom-ac or wireless) for uninstallation reboot device upgrade de...

mkx

Those values are correct and same for me, but there are 3 issues: 1) In case of 5490-5710 I have only maximal power 26 dBm with 2.5 dBi antenna. 2) I can not set up manually or automatically any of frequencies beyond 5600 with 20 MHz channel or beyond 5580 with 20/40 MHz channel or beyond 5560 with...

mkx

The intention is that local wifi interfaces are not provisiobed by CAPsMAN (running on same device). With new wifi, CAPsMAN and local wifi setup share same configuration profiles, one can apply same profile (e.g. security) both to CAPsMAN and local interfaces. Local radios will still work with other...

mkx

Just guessing: you have to set address-pool to some existing pool for DHCPv6 server to hand out addresses (seems like it uses prefix-pool only to hand out prefixes). And quite likely you have to provide a pool with same prefix length as is used on interface (and probably router's address on that int...

mkx

I have the same problem. I once used a netinstall a few months ago and after flashing a different version of RouterOS, it left this flash folder (disk) and I can't remove it. It takes up all the space - 16MB and I can't install new certificates due to lack of space. Normally the root of storage, as...

mkx

Hmmm ... what does /interface/wifi/radio/reg-info country=Czech show on your device? On my audience (running 7.15.3) it says ranges: 2402-2482/20 5170-5250/23/indoor 5250-5330/23/indoor/dfs 5490-5710/30/dfs Which more or less corresponds with limits from "your" document). BTW numbers in ab...

mkx

Two things which poke my eyes: disable detect-internet at least on PtMP devices ... I'd disable it on all devices since you're trying to configure things properly yourself. Function detect-internet may help in case when user connects WAN to a wrong ether port. But it also have potential to royally m...

mkx

According to my experience, Tx hash policies on both ends of bond don't have to be the same. Receiver will accept frames no matter via which bond link they arrive. It'll only use Tx hash policy (as configured locally) when selecting between (working) links members of same bond for Tx. So it will be ...

mkx

The problem is that Sonos mesh obviously doesn't care about hetwork loops (neither do unmanaged switches). All managed switches know about xSTP (most have it enabled by default) and those can block one of links creating a loop.

mkx

Any SFP with DDC plugged in (and being queried about their state)? IIRC it's been mentioned that there's a I2C bus which connects all internal monitored parts (power supplies and fans) as well as DDC buses of SFP cages. And if any of those devices block I2C bus for too long, ROS can not poll statuse...

mkx

Indeed MT PoE offering is pretty inconsistent ... but there are a few rare devices which fare a tad better: CRS328-24P-4S+ has internal dual-voltage power supply and offers per-port selectable voltage (24V passive PoE or 48V 802.3 af/at) ... unfortunately it has limit if around 24W per port CRS320-8...

mkx

Check settings in Cloud ... since you have NTP client running (hopefully it shows status synchronized), you should disable time option in cloud settings.

BTW, if you're running NTP only to keep time on router current, you can disable NTP server function.

mkx

Yes. CRS doesn't regulate voltage internally, it only passes whatever supplied. CRS112 is one of few MT devices with dual power input, allowing to select voltage for PoE-out. If one of inputs is missing, corresponding PoE-out voltage is missing as well.

mkx

Contrast this to the RB3011 where the only way to have hardware offloaded VLANs is to perform the configuration directly on the switch chips. But because each of the two switch chips of the RB3011 has no knowledge of the other one, there is no mechanism in the switch chip configuration to refer to ...

mkx

When bond does hash (and based on hash value selects bond link to transmit frame), it takes whatever info configured: L2 - MAC address of source and destination L3 - IP address of source and destination L4 - source and destination port (if L4 protocol, e.g TCP or UDP) uses them. So with L2+L3 any pa...

mkx

Bridge port has to be tagged member of any VLANs which there are corresponding vlan interfaces.

mkx

L3+L4 is less common tho, but it should work good between two mikrotiks L3+L4 can spread traffic between one pair of devices to both bond links ... if devices use multiple connections in parallel. However, a single connection (e.g. single file transfer using SMB - windows file sharing) will still o...

mkx

You haven't mentioned what the log is currently mentioning.
Code: Select all
/system logging action
...

We are actually waiting to see output of /log/print (anything which looks weird and a few lines before weird lines to get some context).

mkx

It boils down to this: interface lists work for interfaces ... and interfaces are the L3 entities (anything with IP address set). In case when one creates a bridge, adds a few L2 entities (ethernet ports, wifi interfaces, etc.), those L2 entities should never be used directly as L3 stuff (this is th...

mkx

It's actually shooting under / between the branches.

Good. So the problem won't happen in Spring of 2025, it'll happen in Spring of 2026

mkx

In case when I connect AP's as a wireless bridge with trunk - no questions about it. I would put specific wlan interface in "admit all" mode. But for users WiFi I would like to avoid it. Well ... what you'd like in this case doesn't correspond with what you can. And since it's up to perso...

mkx

2 - check LAN interface list, both ether1 and ether2 should be there 3 - add all interfaces to bridge (ether1/2 and wifi itf) Actually ... bridge interface should be member of interface list. Individual ports (ether1 and ether2), members of bridge, don't have to be members of any interface list.

mkx

Brief comments: # FIXME: Do I need to explicitly set this? # /interface/ethernet/switch set 0 l3-hw-offloading=yes No. Where did you get this from ? Certainly not from the VLAN guide... I think it's default with recent v7 ... even if device actually doesn't support L3HW which makes this setting irr...

Search found 13409 matches