MikroTik

mkx

There's a general standard caveat in documentation saying only one ROS bridge can do hardware offloading, and default best-practice is "only one bridge total unless you know you need more". I actually kinda wonder if that's an accurate description of ROS software limitation, or is it a bi...

mkx

NAT is connection tracking thing and as long as connection is active, NAT will do its job. And will do the inverse for return packets if they get delivered to router. There are two possibilities for SRC NAT: action=src-nat and action=masquerade. There are two important differences between both possi...

mkx

Haven't seen it yet, you should be using CAPsMAN to get this to work seamlessly.

Indeed to get roaming between different APs one needs CAPsMAN up and running. But to get roaming between radios of same AP one doesn't need CAPsMAN, relatively default config should suffice.

mkx

It's not OK to force devices to roam to certain APs. The problem is that whatever is configured (including the whole 802.11 r/k/v), it's still device which decides to move to another AP. The only difference between simply using same SSID and using the whole mobility suite is that in later case devic...

mkx

I remember a couple of reports of people that needed to reset the unit before being able to access it, you can try that, you have nothing to lose. Or it may be the opposite. I've received my brand new wAP ax and initially the password from the sticker worked, I've used it to log in using winbox 3.x...

mkx

Well, I got it working. For some reason, setting the prefix hint to 0 fixed it. Nice to read that you have it now working ... I'm very curiouse as to the prefix size they actually gave you because a prefix hint to 0 in the IPv6 prefix field indicates that the requesting router has no preference for...

mkx

Yup. Product page says

(emphasis is mine)
In addition to emphasis, can you also translate from Mikrotikish?

What (the heck) is a cross cable?

I've no idea ... perhaps @OP should ask MT support directly (and post their answer here, it should be interesting).

mkx

And on certain models of AC devices ... those which can run wifi-qcom-ac driver. As to how it works: mobility works between radios, controlled by same entity. Basic setup is single dual-radio device which controls both/all radios and mobility works between those radios. Advanced setup is network of ...

mkx

Question on the Atheros 8237 switch chip that is in my hap2ac (rdb52G). The documentation at this page https://help.mikrotik.com/docs/spaces/ROS/pages/15302988/Switch+Chip+Features#SwitchChipFeatures-Introduction indicates that you can change the advertised speed of an interface to multip different...

mkx

You have vlan-filtering=yes on bridge and CRS1xx can't offload such bridge to underlying switch chip. So all traffic passes CPU. This was the case since forever, nothing changed with 7.17 ... so you can consider yourself lucky that it didn't bite you earlier. You have to configure VLAN stuff on swit...

mkx

In theory a 802.3af/at compliant PD should accept both Mode A and mode B (it is the PSE that decides on which pins to apply power). Your Cisco most probably uses mode A (1,2+/3,6-). It is possible that either the thingy is not fully 802.3af/at compatible or that (for whatever reasons) it is defecti...

mkx

Is hAP AC2 free of the "ether1 as uplink" problem?

I stand by @holvoetn and his answer.

And a spoiler: hAP ac2 doesn't suffer from same problem, all of its wired ports are equal, all are controlled by (same) switch chip.

mkx

You can verify that USB port works and that USB device attached does present to RouterOS kernel by running command /system/resource/usb/print It should shown your attached device along with a few devices with name xHCI Host Controller . Yet another thing is to get USB device working ... and with ROS...

mkx

@jaclaz: even if that was possible, how would you do it for architecture you don't have at home (e.g. ampere)?

mkx

running 2 hAP ac2 (one with the 256MB and one with the 128MB flash storage) this model is supposed to have 16MB of flash, how did you get 128 or 256MB? I guess poster is confusing flash and RAM (early units came with 256MB RAM, the rest came with 128MB RAM as it was always advertised). All units AF...

mkx

New pool won't be created automatically. So if you expect to have more than around 200 devices in your network, then you have to make subnet larger than /24 ... /23 allows for 510 addresses, /22 adds another 512, etc. Increasing subnet requires some dilligence (selecting the right DHCP address range...

mkx

Ah, when looking at /interface/wifi/cap I wasn't looking good enough ... and didn't see the slaves-static setting. Thank you for pointing it out.

mkx

1×RB5009 as main router and CAPsMAN + 3×hAP ac² as APs and bridges,

So how do you handle slave wifi interfaces in this scenario?

mkx

I believe your guess-work is far more educated than mine. I've no idea about how ROS works around such cases.

mkx

After upgrade-induced reboot, log usually has something about upgrade process outcome ... if it fails, log tells the reason (insufficient storage space is one of reasons, various problems with optional packages are showstoppers ad well).

mkx

So I've got this scenario: my LAN is fully VLAN tagged, all MT gear is running 7.16.2 except wAP ax which is running 7.17 I have hAP ac2 configured as main router and lately CAPsMAN. It doesn't have wifi-qcom-ac drivers installed, so it's wired-only I have wAP ax which runs wifi-qcom and can, thus, ...

mkx

@mkx, let me disagree - it is actually not the same ...

I agree it's not the same, I used word "similar" ...

mkx

It's similar problem to having two devices with same IPv4 address (albeit with different MAC addresses) ... it's possible to have it but involves NAT and multiple routing tables. Since NAT in IPv6 is a different beast, I'm not sure if (and how) your problem can be solved.

mkx

Just to be precise:

edit: I figured it out, I'm routing my traffic through nginx proxy manager that handles the domain based routing

nginx doesn't "domain route" traffic, it (reverse) proxies it. Which is L7 operation - contrasted to routing which is L3 operation.

mkx

It can only be an issue when: IMO none of ifs help with OP's considerations ... because they're out of device admin's hands. But there's an up side: netinstall is not triggered without doing a few things and all involve physical access to device at some point: button press while cold booting device...

mkx

The problem with using capsman is that checking config locally doesn't actually have to reflect running values. One thing that CAPsMAN definitely doesn't do is overwrite configuration stored on CAP devices. So running export doesn't show any of CAPsMAN-provisioned settings. Running "monitor&quo...

mkx

But the only reason I have that is because I can't remember which South American country is better :D Was it Panama? Brazil is better than ETSI most of times: 30dBm vs 20dBm on 2.4GHz, 30dBm vs. 14dBm on 5735-5875 MHz ... but not always: ETSI has 30dBm vs. 24dBm on 5490-5730 MHz. According to reg-i...

mkx

Have you been handed over a 7.18 nightly build amongst whose feature the aim was to fix this issue you also faced? No, @timemaster seems to have received it this time. And I know it happened before (although rarely). So you have nothing to worry, there are no 'exceptional' forum members which recei...

mkx

Can we get v7.17 out the door and move to v7.18 beta so we can see what's new..... this version dragging now. I do appreciate stability and rigorous testing but I also want movement and new features as there are stuff I'm waiting for which may or may not be in next version. A counter proposal: can ...

mkx

Where do you got your source then that 7.18 would feature a fix for this issue?

See my second paragraph (add while you were posting your latest post).

mkx

Would you happen to have a link to the changelog to expectat in 7.18? Nightly builds are alpha/developers' versions and nothing is guaranteed to enter to beta of same version. So there's never any changelog for nightly builds. We've seen stuff removed from beta versions (rarely, but it did happen) ...

mkx

UniFi: vlan 1, 400, 401 (tagged) Mikrotik port 4: tagged with vlan 1,400,401. vlan 400 and vlan 401 works fine (seperated dhcp servers on Mikrotik interfaces) But vlan 1 does not work - i I bind the ip address on Mikrotik to vlan 1 interface, the connection to the Unifi will be lost. Unifi expects ...

mkx

Everything works except VLANs.

Without posting your config nobody will be able to help you. So either post it or, if you know better, go ask help somewhere else (yes, it sounds rude, but that's how it is).

mkx

At least wireless config can't be applied in any of two mentiobed ways. hAP ax3 runs wifi-qcom driver while your old hAP lite runs wireless driver ... and configuration of both is completely different.

mkx

All employees have a cell phone......

How about using good ole public announcement system incude office building to announce internet outages? Those announcements will automatically reach only people physically present inside offices without them being stalked.

mkx

Simple captive portals (almost) never work for intercepting anything encrypted. They work nicely when "a friendly" device first obrains connectivity and starts to check if it can access (certain servers on) internet. Captive portals appropriately block connectivity and direct client to ope...

mkx

Are you, otherwise, able to access internet sites from router?

And another consideration: right now this forum feels sluggish to me (with 500 errors as well) which likely means that MT servers are under some kind of DDoS attack. And that likely includes DDNS servers as well.

mkx

Your Brocade config indicates that Brocade will do the routing between VLANs. Are you sure about it? If yes, then you'll have to configure DHCP relay on Brocade. If not, then Brocade needs "router interface" only on management VLAN.

mkx

I expected NAT rule with action dst-nat not to catch any connection from my local network unless it is changed to src-nat. So I guess connections outside goes thru both src-nat and then dst-nat? SRC-NAT and DST-NAT are very distinct operations, they happen at very different times (dst-nat is pretty...

mkx

a dstnat port remapping seems like a possible solution, it should be something *like*: Very likely full hair-pin NAT is required as well if the non-standard port is to mapped to standard one for LAN access as well. And hair-pin NAT comes with a bag of annoyances (e.g. "why don't I see real cli...

mkx

Not really (@OP is asking how to instruct browser to connect to non-standard port). Whenever client app needs to access server app, it has to know which port to use. In your case client app is browser and they assume standard port for http (80) and lately they assume https (443). Browsers are perfec...

mkx

It's strange some ISPs hold on to 20 year old concepts. I guess it suits them well for a few purposes ... one of them is user management (less fuss to e.g. assign static IP address and IPv6 prefix). And obviously they don't bother about (under)performance of 3rd party routers, they just care about ...

mkx

If you want to use hAP ax as client to hotel's wireless network, then wifi interface has to be running in mode=station. Also channel settings have to be on default (auto) settings. And then there are higher-level settings which are wrong/missing, e.g. DHCP client tunning on wifi1 interface (now it's...

mkx

You have to set pvid=99 on ether8 ... currently these are not correctly related: /interface bridge port add bridge=Bridge interface=ether8 /interface bridge vlan add bridge=Bridge comment=MGMT tagged=ether23,Bridge,ether1 untagged=ether8 \ vlan-ids=99 Default pvid setting (and thus not shown in expo...

mkx

the adapter is OK (24V). Idle or under load? Marginal power adapter might output close to 24V when idle but drop voltage under load. And failing capacitors also mean very uneven output voltage which isn't shown by normal voltmeters, oscilloscope does OTOH. The uneven supply voltage can disrupt devi...

mkx

I'm using 6to4, but I'm assuming there's probably a way to switch it to 6to6 as I can get a single IP6 address and it's probably going to be a little better? Actually not likely. No because IPv6 (the outer layer added by tunnel) has larger headers which means lower payload per same MTU ... which ul...

mkx

Their network team cannot see the ONT (cryptic wall box) and the IP allocation is not coming through it anymore. They cannot see very much because of this. This is wrong …. If the network team cannot see the ONT …. Another possibility (very common where optical network owner is different than ISP) ...

mkx

While waiting to see configuration export, just a comment: "static ARP" is calling for problems ... while it doesn't really provide any security (setting MAC address on interface is only too easy).

mkx

This setting sets DHCP Option 15 (the domain name that client should use as suffix when resolving hostnames via the Domain Name System) ... and it's entirely up to clients on how they use them. Definitely nothing to do with DHCP server or DHCP client. So normally yes, <my.domain.tld> can be "ho...

mkx

I suggest using/setting CNAME records in your main DNS for each DDNSed router item. This only helps with naming (e.g. when router changes, it's DDNS name changes ... and it then has to be changed in many places. If one uses CNAME records, then change has to be done only for that particular CNAME). ...

mkx

... so IGMP Snooping is now disabled again. And it's a feature that I actually need (IPTV usage). It depends. My ISP offers IPTV over tagged VLAN ... so I pass that VLAN only to required ports (connecting TV boxes). Even without IGMP snooping, only those few ports get active streams. Indeed all act...

mkx

wireless interface shows "R" status only if there's at least one wireless client (station) connected to it. Are you saying that SSID is actually not broadcasted? This is best verified by using some kind of wireless debugging application on wireless client (there are plenty of usable apps f...

mkx

New CCMP is same as old AES CCM ... CCMP256 and GCMP* are new ones (not widely supported by wireless stations though, some even barf on seeing these supported by AP).

mkx

UniFi: vlan 1, 400, 401 (tagged) Mikrotik port 4: tagged with vlan 1,400,401. "Native VLANs" (whatever that means) should never be tagged on wires ... also devices on both ends of same cable have to have same config ... and in your case UniFi has "native" (whichever that is) VLA...

mkx

Domain is domain name ... without leading dot. So if your host names are e.g. "host.my.domain.tld", then you should set domain property of DHCP server network entries to domain=my.domain.tld

mkx

Unfortunately I receive the following error message: "failure: incoming interface matching not possible in output and postrouting chains". Any ideas? Then just omit the in-interface property from NAT rule definition. You can instead use src-address property (e.g. src-address=!192.168.30.0...

mkx

I'm waiting the day when @anav will post that he replaced tplink APs with Mikrotiks and want some advice on CAPsMAN

That will follow the act of Canada becoming part of US a.k.a. when the hell freezes

mkx

Just to make sure: your WAN is connected to ether1?

mkx

.. why not just set the dst-nat rule to use in-interface where the in-interface = your WAN interface?

Hairpin-NAT doesn't work with in-interface, it's got to be dst-address.

mkx

You need a second firewall rule that also allows the traffic from IOT / Print as in interface to the out interface home. Basically the "return traffic". It's already there, this is the one: add action=accept chain=forward comment=\ "accept established,related,untracked" connecti...

mkx

How in particular did you export and import config? Did you use backup and restore commands ... or export and import ? If the former ... then it's known (apparently not well though) that binary backups (results of backup ) are not intended to move config from one device to another one. Specially so ...

mkx

- Dude server (I can confirm that after upgrading it to 7.16.2 you can upgrade routerOS devices from Dude (it does not upgrade the routerboard though and in my case I had to install extra packages manually (upgrading from 7.12.1 to 7.16.2) - but I was doing it for the first time, maybe I don't know...

mkx

You could try to change some memory settings in BIOS regarding mapping memory of PCI peripherial devices ... Another thing to try is to increase memory size on PC, the number says it needs a bit less than 4M of contiguous space (not sure if that's possible with your hardware). But the error does see...

mkx

SPF connection is no-go for me, as the infrastructure is already buried in the walls.

It's always option to take down the walls

You never mentioned how the 3 devices are placed physically, so I (wrongly it seems) assumed they are in same place.

mkx

Which SSID is used while you experience problems? What is signal strength, indicated by wireless station at the spot you normally use it? If you check WiFi environment (use some WiFi diagnostic AP on your phone), are there many other APs seen? You have left channel selection to automatic ... does it...

mkx

You don't need any additional routing on switch (as all packets outside it's own subnet - 192.168.88.0/24 - will have to pass over router anyway). Do you have appropriate SRC-NAT rules established on router? Not that when both routes are up and running, the "normal" masquerade rule will li...

mkx

Signal strength, mentioned in CAPsMAN's logs, is signal strength of station as received by CAP. Ideally it should be quite similar to what station receives from AP but can be lower due to lower device Tx power (battery-powered devices are entitled to use lower power in order to prolong battery life ...

mkx

It's hard to trouble shoot behaviour which happens only rarely. When it happens next time, don't forget to thoroughly check the logs, there might be something in it. Another thing to do is to create supout.rif file and send it to Mikrotik support ... they might decode the device state and comment on...

mkx

Solution will work ... but with some delay which depends on DDNS provider settings. Mikrotik's own DDNS solution, which creates <serial_number>.sn.mynetname.net DNS entries, have TTL set to 60 seconds. And option with adding DNS name as member of address lists does observe TTL. Which means that if o...

mkx

/ipv6/settings/set accept-router-advertisements: yes expected end of command (line 1 column 20) Sorry, it should be /ipv6/settings/set accept-router-advertisements=yes If it doesn't allow you to unset prefix-length, then set it to 64. You can omit requesting address ... it's not always needed and s...

mkx

You have quite some settings on L2 entities (bridge ports, etc.), which IMO border on paranoia ... and might affect hotspot operations. You might want to create a very simplified lab setup, starting from defaults and then add settings toward your intended setup ... while checking if hotspot still wo...

mkx

I don't know if that would fix the problem, but: don't create IPv6 pool manually. DHCPv6 client will create it automatically after it receives prefix. don't use prefix-length=48 (either set it to 64 or omit it altogether), it doesn't do what you probabky think it does. It's about prefix length when ...

mkx

Regarding loop between yellow and green parts: if you're careful not to pass same VLAN (tagged or as native) via multiple ports, then there won't be a loop. RSTP or plain STP would detect a loop (their BPDUs disregard VLAN IDs), MSTP would be fine. Another remark (it can be called personal preferenc...

mkx

Attempt4: Why did I volunteer to attend this event for Viktors......
I think the PM's drug-sniff dogs excluded him from the event.

... it reads "volunteer" ... which begs for question: whom did drug-sniffing dogs exclude: Normunds, Viktors, both or themselves?

mkx

I heard they were discussing Latvia buying Cloudflare...

Or is it the other way around?

mkx

this device does not have a switch chip you can use multiple bridges if you do not use STP. True. But then there will be a ton of vlan interfaces (one per VLAN and per port) plus multitude of bridges (one per vlan) ... compared to one bridge and few vlan interfaces (one per VLAN with which device h...

mkx

wAP ax Christmas edition season 2024/2025 :D :D Decorated by me, approved by wife :lol: As Christmass season 2024/25 is almost over, is there any new decoration available? I have my wAP ax ordered and I'm wondering if I have to order some WAF enhancement kit as well? I guess it'll be a close call s...

mkx

EDIT2 : Would a proper term be, that instead of saying native VLAN or VLAN 1, I should rather say, that tv boxes require also untagged traffic? Maybe this way it makes more sense - from ISP the iptv broadcast comes on VLAN 5 as tagged frames, and ISP performed updates and configuration of the tvbox...

mkx

So, it still boils down to "do not use VLAN1" (unless you really know where your towel is), right?

That's about it. So when in doubt, it's 42.

mkx

I saw that netinstall flash does not affect bootloader. Do you happen to know if its the OS containing firmware that controls these leds or its something else other that could be flashed ? Flash is updated from within ROS via system-> routerboard submenu. ROS will always contain routerboot flash im...

mkx

Native VLAN doesn't necessarily mean VLAN1, do you mean that your ISP is using VLAN1 as "native"? Well, I'm not sure how to check that. When I was trying to find out which VLANs they use, I simply ran a torch on input interface to see which VLANs appear there. Most often "Native VLAN...

mkx

The device you're looking at is pretty old now. It's likely that it's starting to fail ... there have been numerous cases where capacitors (both in power adapter and on device's board) have bulged and then device experienced very random ways of misbehaviour. It's likely that configuration isn't at f...

mkx

IMO it doesn't make much sense to use bridge with single port. The only functionality bridge could offer are bridge filters ... for simplicity sake most things done by bridge filters can be done by L3 firewall. But using bridge does insert additional step in frame/packet processing (even if CPU cycl...

mkx

I set request=address,prefix, and I'm getting both a /60 prefix and an unrelated /128 address for my router. Do I need the address? Could I (and should I) just use request=prefix instead? Is there a benefit to my router having both? From what I remember of how layer-3 works, from the ISP's perspect...

mkx

How I understood: If you want to benefit from HW offload where possible (for those devices where it is supported), using bridge for setting up VLANs is the default way already for quite some years. I'm specifically talking about the use-case where I have a Trunk Port on my MikroTik Router which goe...

mkx

In shoret: very likely RB260GSP can't be used to power your camera. There are two kinds of PoE: standard 802.3 af/at/bt It operates at 48V, different generations (af vs. at vs. bt) differ in maximum power allowed (and number of UTP pairs used to pass power) and in some minor details. Your camera is ...

mkx

To add subnets, should I just add more /ipv6 addresses but instead of ::1 do ::1:0000:0000:0000:0001, ::2:0000:0000:0000:0001, etc. for each subnet? Unfortunately it's not really possible to set those "S" bits in IPv6 address assignment. So you have to go with example by @ConradPino above...

mkx

Bridge doesn't "flood" its MAC address on trafgic passing via debice ... because MAC address (neither src nor dst) doesn't get rewritten by bridge or switch. So you'll have to be more speciffic as to what you think is a problem. Could be STP/RSTP BPDU frames ... those aren't VLAN tagged by...

mkx

Because of this rule, all incoming tcp traffic to port 443 is answered by the router: add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp The input chain is used for traffic to the router, the forward chain for traffice between networks (like WAN and LAN). Not com...

mkx

Probably price is just a matter of scale for the ONT, but of course they are more complex. Less cabling and less active components however are definitely cheaper. Well ... I don't think they can be cheaper to manufacture than plain FTTH SFPs ... no matter the production scale. The price may come cl...

mkx

It is not (completely) default config. I.e. the IPv6 rules are not there by default. No problem...

Yes they are in ROS v7 (where IPv6 is not optional any more). And yes they are if ipv6 optional package in v6 is installed and enabled when ROS config is reset to factory default.

mkx

SXT LTE kit and SXT LTE6 kit devices come with ROS licence level 3 ... which doesn't allow to configure its wifi interface as AP or AP-bridge. So these units are only usable for PtP links (one is bridge, the other is station-bridge) or as spoke devices in PtMP (where hub is AP-bridge and spokes are ...

mkx

1. Suggestion to increase antenna gain was the best available option before ROS version around 6.44 (or something like that) ... until that certain version, setting Tx power in absolute numbers had been both complicated (it had to be a table with different powers for different rates) and had potenti...

mkx

PON is way cheaper than individual links. Especially in rural areas, deploying PON is also extremly fast&easy. The cost of the last mile is very high, especially if you consider the economy of scale (1user for 1 link). PON saves costs on "the first mile" part of it ... single optical ...

mkx

It could be that your ISP is blocking UDP traffic with dst port 123 towards your router. Have a look at this thread for a work around: viewtopic.php?t=208791

mkx

Now at https://help.mikrotik.com/docs/spaces/ROS/pages/132350014/SSH or https://wiki.mikrotik.com/Manual:IP/SSH . But it doesn't seem to work on RouterOS v6 (tested with v6.49.8 ). Unfortunately Mikrotik's documentation doesn't include history ... e.g. which ROS version brought certain feature or c...

mkx

... especially because you use the complete bandwidth of wifi at 2.4GHz.

Half (give or take) actually. 2.4GHz band (for anything newer than 802.11B) is 70MHz wide (in NA and related parts of universe) or 80MHz wide (elsewhere) ... and 2462/n/eC channel is 40MHz wide.

mkx

A bit annoying and uncommon to do security related filtering on the NAT side of things.. One thing to keep in mind: NAT is not about security ... although it does seem to help some times. So one thing is to introduce NAT rules and a separate thing is to add appropriate firewall rules. It's up to ad...

mkx

are there supposed to be hits on DST NAT rules for traffic that is not permitted by the FW? Yes, there are. According to packet flow , DST-NAT is part of pre-routing ... and firewall filter rules are part of either input or forward packet path ... which both come after pre-routing. Sometimes it's p...

mkx

On networks with any kind of problems (real or perceived, e.g. packet loss or large RTT), TCP and UDP connections behave very much differently. For UDP connections packet drop is fine and stats show high throughput with high packet loss. Usually throughput shown on Tx side reflects throughput of fir...

mkx

Two things: disable add-default-gateway on /ipv6 dhcp-client . The way it's now might work (depends on how your ISP does things), but it's not the correct way. Instead set accept-router-advertisements=yes under /ipv6/settings . more crucially: assign IPv6 address to LAN interface (bridge) to enable ...

mkx

In short: being able to access router's IP address via "non-native" interface is more or less cosmetic thing. A longer explanation: looking at packet flow it becomes obvious that one of early things that stateful firewall does is to classify ingress packets to firewall chains. If packet is...

mkx

Are those HP switches configured with VLANs? No sir, this unmanaged switch, As @holvoetn already wrote, unmanaged / non-VLAN-aware switches are a problem in your intended setup. Managed switches are not absolute requirement in VLANed network, but they have to be able to pass "mini-jumbo" ...

mkx

PON is used to limit the amount of equipment in street cabinets, which reduces costs. If FTTx is regulated, then PON makes more sense to infrastructure owner ... because in this case competitor can't lease dark fiber, it can only rent bit stream and infrastructure owner has more control over whatev...

mkx

Also check settings in /system/device-mode ... I think you have to enable routerboard property to change cpu frequency setting ... just don't know which particular ROS version started to require that (could be it's 7.17).

mkx

which is, to be frank, unnecessary to know about half of millions revoked certificates

They were revoked for a reason and it's only the right thing to be able to verify if certificate of server our device is talking to is one of those. If you don't care, then that's your problem (or wisdom).

mkx

Okay, in this case, I can see that all my ports are open, but is this the right way to open ports?

If you want ports open, then this is the right way. If you're concerned about security, then don't open them. Or restrict access to those ports.

mkx

Nominal CPU frequency is 1700MHz. But it's possible to overclock it by setting /system/routerboard/settings set cpu-frequency=<value> . Nowdays default setting is auto which allows ROS to scale frequency up or down depending on CPU core load. Sometimes this doesn't work too well (it takes sone time ...

mkx

How do I remove the packages from RouterOS now?

If they are not listed under Packages, then they are not installed. New CAPsMAN is included in core (routeros) package since version 7.13 (so running new CAPsMAN doesn't require any optional package).

mkx

Are those HP switches configured with VLANs? BTW, as soon as cAP is provisioned by CAPsMAN, local settings under /interface/wifi largrly don't sppky. Which includes datapath. Settings from CAPsMAN apply, including bridge name (and yours don't match). So I wonder how on earth could anything work actu...

mkx

Which ROS version? Only newer v7 versions correctly display dynamic IPv6 addresses and routes, older versions (including all v6 versions) omit them from print command. Addresses and routes are there or else IPv6 wouldn't work in certain aspects.

mkx

What I don't understand: why reply-only work for IPv4, but not for IPv6 ? Because address acquisition for IPv6 works very differently than for IPv4. For starters there's SLAAC (which is based on RAs and those are elementary for getting routing working) and networked devices assign addresses them se...

mkx

Check setting of property configuration.distance . Here's description: The distance is setted for 22km, check the first photo in the first message. This was replying to @MulderSK. Looking at ping responses is mostly useless. I don't agree. You have every right to disagree. But so do I :wink: Did yo...

mkx

Your network is obviously not as flat as you're trying to imply. There are 3 VLANs mentioned next to CAPsMAN device (and possibly the "untagged" subnet). You're also writing about "hubs" ... these days nobody uses ethernet hubs, everybody is using ethernet switches, quite possibl...

mkx

As far as I can tell, you're heading in the right direction with the latest config snippet.

mkx

not only does the ping drop, but the connection is also interrupted

Which connection? The wireless link? Winbox management connection?

mkx

Looking at ping responses is mostly useless. If link is fully utilized, then those pings will get queued and seemingly dropped ... in reality they will likely get around but with round trip delay larger than 1s (which is usual timeout value), responses will be ignored by ping application. Try to run...

mkx

New beta 7.18 for christmas? I wish Not likely. So far, beta only came out after previous version was released as stable. 7.17 is still Release Candidate and folks @MT are running out of time ... it's almost Christmas eve, Latvia is at UTC+2 which means it's 3:30 PM and almost end of office time.

mkx

@HeptaZ, did you read through excellent Using RouterOS to VLAN your network tutorial?

Because most of discussion in this thread is about VLANs and they are explained pretty well in the tutorial I linked above.

mkx

There are things to be set-up on gmail side, check their article: https://support.google.com/a/answer/2520500?hl=en

Then it could be TLS support mismatch. AFAIK ROS supports up to TLS 1.2 and some sites already require minimum of TLS 1.3 (not sure if gmail does).

mkx

Check setting of property configuration.distance . Here's description: distance () Maximum link distance in kilometers, needs to be set for long-range outdoor links. The value should reflect the distance to the AP or station that is furthest from the device. Unconfigured value allows usage of 2 km l...

mkx

If there's a chain of accessibility (i.e. you can access R1 but cant access R2 directly, while R1 can access R2), then you can use CLI (ssh, MAC telnet, normal telnet) if any of these is allowed on R2. ROS includes clients for all mentioned protocols. The only issue is with MAC telnet, ancient versi...

mkx

Mikrotik app for Android shows the following value of dtim-period setting:

It might be artifact (by Tik app) for not having property set at all ... in which case default value (1) would be used.

When in doubt, always use CLI to verify ... and report a bug in UI to MT to get it fixed.

mkx

Setting of band property on new wifi actually only limits the newest generation of wifi technology but allows all the older. So by setting band=2ghz-n one is allowing B, G and N, but not AX. When constructing AP for really old devices, one has to be extra careful with security settings: B-only devic...

mkx

I'm trying to configure my rb951 to access Internet from ISP router but after setting the static IP ( 192.168.100.100/24) and checking routes and when I try to ping google.com Does your ISP support DHCP as means of obtaining IP config for clients? If it does, then use it, it's usually less error-pr...

mkx

I’m sure I listened to a MuM talk once that forwarding a packet to black hole takes less CPU than dropping? If there's a very effective way of doing it. Otherwise I doubt it. But whatever one does, packets definitely have to be silently dropped (as opposed to rejecting them with ICMP port unavailab...

mkx

Had same issues, changed DTIM values to 3 for 5GHz (it was 10 by default), the same was proposed upper in the thread, 2 days - no disconnects so far. A random thread from quite some time ago ... which concluded that DTIM interval longer than around 3 can (and will) cause problems with certain stati...

mkx

But it seems the CRS304 can FastTrack at 1700 which would be acceptable for a 2.5G WAN. Not in my book. I'm paying monthly fee to ISP and I certainly want to have hardware which can use all of what I'm paying for. Otherwise I can save a few euros (every month) and live with slightly slower WAN link...

mkx

Don't know how far 2.4ghz interference can go for USB3. The test computer is around 2/3 meters away from the next AP. The big problem is interference between locally connected interfaces (i.e. hAP ax3 with flakey USB3 stick plugged in and 2.4GHz radio ... USB3 activity will interfere with Rx path o...

mkx

I'm here with @chechito wondering why TF? CRS520 comes with list price of almost 2200$ and power consumption exceeding 120W. So one doesn't really save much by not adding a small server to the network, a high-end raspberry pi would dance around CRS520 when it comes to server functions (stock samba v...

mkx

... so I don't see how the hEX could have any influence on the problem Some interference in form of timing jitter affecting TCP window scaling? Experience with official test results says that figure listed under "Ethernet test results -> Routing -> 25 ip filter rules -> 512 bytes [packet size]...

mkx

CPU in hAP ax3 can shuffle around 2.5Gbps (look at test results for bridging) and that's pretty lean on CPU (no packet processing, only passing between two ethernet interfaces). With SMB there's plenty of processing involved. And USB in SoC IPQ-6010 is 3.0, so max 5Gbps (including overhead) possible...

mkx

What you showed looks like a really old product for legacy customers. 40G and very slow at routing. CRS devices are switches (remember this fact by heart!) ... and many can route at wirespeed if properly configured for L3HW offload (with certain limitations which are device class dependent). If any...

mkx

When port is used as stand-alone, then switch-chip passes frames to CPU (via cpu-facing bridge port) as they are ... then CPU does VLAN header manipulations (via VLAN interfaces attached to such stand alone port). So in this case no L2HW offload. It's rather similar when bridge is used ... and L2HW ...

mkx

One can get a 2x 25G card for 135 euro. Add processing power, necessary to route at 25+ Gbps and price tag is easily around 1000€ ... and you've got a mere 2-port router. And I'm pretty sure that such price tag is outside of MT users' comfort zone. So my guess is that we won't be seeing full 10Gbps...

mkx

What do I need to consider for the additional units? The problem is that one wireless station can only be connected to one bridge at a time. This problem kicks in when e.g. you need a chain of APs like this: ethernet -> AP1 <- wireless1 -> AP2 <- wireless2 -> AP3 <- wireless3 -> AP4 (etc) Let's say...

mkx

@sindy if I understood correctly, there should be two "entities" capable of switching, the switch chip and the switching functional block in the cpu? In the context of bridge nyszeries explanation forget about switch chip (the real, piece of hardware). In this context, there's only switch...

mkx

Because we use existing device from several brand on our client, we need follow their default VID for their management. If it's only management, then you can bridge all 3 VLANs. I'll assume you have ether5 off-bridge and have something like this: /interface/vlan add interface=ether5 vlan-id=98 name...

mkx

Also 50 cm can be too close. This. Depending on channel selected, but ... As I mentioned, I've got single Audience, so the 4x4 radio is used in AP mode as well ... and my tablet, which currently resides around 3m away (and 1.5m below) with LOS, shows signal strength of -35dBm. Which is on the highe...

mkx

IMO it would be smart to ask MNO if they can give a public IP address and how much would that cost. I know a few MNOs who provide public IP addresses to those asking for one at small cost (or no cost at all).

mkx

BTH function is done exactly for such cases.

mkx

Some MNOs run firewall blocking certain types of traffic (typically with low destination port numbers because these are often used by servers). And some do CGNAT in a senseless manner. When those two worlds collide, anything can happen. Basically wireless broadband is mostly not fit for anything els...

mkx

Using CAPsMAN to provision audiences' "public radios" (i.e. the ones serving normal client devices) gives opportunity of better client mobility ... APs, participating in client mobility, have to be controlled by single entity (e.g. CAPsMAN) for all the mobility features (802.11 r/k/v) to w...

mkx

hAP ac2 can run v7 pretty fine. But : its 16MB flash is tiny and it's very likely it'll get full (and then all sorts of funny things start to happen). Base routeros v7 uses around 13MB of it, any wireless (legacy or new wifi) another 2MB or slightly more ... so not much free for config and/or additi...

mkx

Generally it doesn't matter which way you do it if you configure wifi manually. In this case the only difference is if one uses multiple VLANs with single SSID, such scenario can't be implemented with bridge handling all VLAN tagging. If you use CAPsMAN and VLANs, then it takes lots of fussing (and ...

mkx

How does profile output look like while pings are timing out?

mkx

CAPsMAN doesn't configure backhaul ... which in usual AP installation is ethernet while in mesh it's the 4x4 radio (I guess it's called wlan2 when running wireless drivers, it's wifi2 when running wifi-qcom-ac drivers). Further more, radios loose their setup if they loose connectivity towards CAPsMA...

mkx

The second rule hints at use of hairpin NAT because in-interface=bridge to-addresses=192.168.88.244 ... default config has 192.168.88.0/24 on LAN and bridge is the interface used by roouter to talk to LAN. And if that's how you need it, then you need the masquerade rule which obfuscates actual src-a...

mkx

It's the last rule (masquerade) which messes src-address. In principle it's not needed unless you require "hairpin NAT" ... in which case thrte's no way around it.

Unless you create separate IP subnet fot the server.

mkx

Don't think so.
Not on RB5009 with 8 ether ports
Then they should have called it the RB5008 LOL
Then use port 8, use your imagination, drink some moose milk!!!

5009 is indeed an odd number for a router ... specially because it's even

mkx

Verify on Mikrotik that NTP client is properly synchronized. Without that, NTP server won't allow further clients to synchronize to it. ROS NTP server doesn't use own RTC as time source (among other reasons because MT hardware doesn't have RTC).

mkx

Move DHCP client from ether1 to "JJMarketing Wireless Bridge". Also remove comment on DHCP client as your device doesn't have WAN interface. Two other minor things: remove bridge with name bridge1 ... it's not used at all setting names of items to settings with spaces in them makes config ...

mkx

As I wrote: provide us with actual configuration and we'll proceed from there.

mkx

You've set 192.168.10.1/24 to one interface and 192.168.10.2/24 to the other interface. Every normal device will assume these two addresses are in same subnet and hence directly accessible without explicitly using router. And bridge is here to pass traffic from ether1 to ether2 (with appropriate VLA...

mkx

I have some problems with my MikroTik Routers. I plan to upgrade all MKT devices from version 6.46.6 to 7.16.1. I think that MT would recommend you to use ROS built-in updater (under /system/packages/update). As already mentioned, there will be a few steps: while running 6.46.6, upgrade it to lates...

mkx

Basically your list of tasks performed seems about right for an AP/switch combo ... which then needs another device acting as router / DHCP server / etc in same ethernet network. Can you post current configuration? Open terminal window (from GUI) or connect to device using SSH. Then execute command ...

mkx

I have no closet solution. There are devices with better form factor (and WAF) than RB5009 when it comes to placing/mounting anywhere else than inside rack. To be absolutely clear: I'm not saying that there's no place for wireless routers any more ... my main point being that RB5009 / L009 form fac...

mkx

I have tried doing a netinstall as follows: 1. Press and hold reset button 2. Insert power cable. 3. Wait for flashing act light, continue to wait for On act light, continue to wait act light off. then release reset button. [snip] Running wireshark on the used ethernet I can see the routerboard sen...

mkx

IMO the big problem with powerfull wireless routers is the fact that with increasing "mainstream" wifi frequencies (5GHz now, 6GHz coming) it's necessary to deploy multiple APs on the same area where with 2.4GHz APs it was enough to have single AP. And those multiple APs have to be positio...

mkx

About 160MHz channel width, that's for APs capable of using it. First one which can is wAP AX (and it works just fine 8) ). Actually ... audience was first 8) : 2 L radio-mac=2C:C8:1B:77:DE:EA tx-chains=0,1,2,3 rx-chains=0,1,2,3 bands=5ghz-a:20mhz,5ghz-n:20mhz,20/40mhz,5ghz-ac:20mhz,20/40mhz, 20/40...

mkx

To the topic: so basically your core switch doesn't respond to every ping sent at, regardless of where it was sent from. So it might be something about core switch IP configuration (or it might actually be overloaded ... run CPU profiler and see if that might be the case). CPU total is about 16-24 ...

mkx

Is it normal that the first interface has the same mac as the bridge? This is default behaviour if you don't set bridge MAC manually (bridge assumes MAC address of first member port). To the topic: so basically your core switch doesn't respond to every ping sent at, regardless of where it was sent ...

mkx

Can you provide some basic real world examples on when I need L3 access to the bridge from the CPU?

Management of said device (used as switch) from network connected to one of bridged ports.

Routing between single off-bridge port (WAN) and bridged ports (LAN).

Etc.

mkx

Bridge has a few personalities, neatly explained in this tutorial: https://forum.mikrotik.com/viewtopic.php?t=173692 One of personalities is interface allowing CPU to communicate with L2 network joined together by bridge (the switch-like personality). If CPU is to communicate on L3 with devices memb...

mkx

The DE FACTO guide on setting up VLAN for ROS https://forum.mikrotik.com/viewtopic.php?t=143620 Configuration, based on linked tutorial, will work fine ... but sloooowly because CRS1xx can't offload bridge config to switch chip. Instead one has to configure things directly on switch chip: https://h...

mkx

It's possible to set pref-src property on static routes, e.g. /ip/route add dst-address=0.0.0.0/0 gateway=172.16.1.1 pref-src=172.16.1.30 Then router uses this address when making new connection using that particular route. But I don't know if the same selection applies if destination is in same IP ...

mkx

... restore config from export (not backup!).

Or, better yet, start from default config and apply minimum changes required. It's possible that flakey config allowed exploit to succeed.

mkx

Whatever datapath settings from capsman config are enforced on CAP side. E.g. bridge name ...

How to split traffic? Most straight forward using VLANs (if not using wifi-qcom-ac driver on CAP) or some L2 tunneling (e.g. EoIP) if VLANs absolutely aren't possible.

mkx

Some devices try to identify the network to set appropriate firewall setup (e.g. home/work/public) ... e.g. winfows does that. And among other information gateway's MAC address is taken into account. And I guess some (paranoid) devices might require re-entering pass phrase simply to make owner aware...

mkx

... when using the previous generation access point, I only need to configure a profile in CAPsMAN that goes to each datapath. As I wrote: with new CAPsMAN there is no capsman-forwarding any more. Wireless interfaces, even though provisioned by CAPsMAN, are attached locally to CAP's bridge and loca...

mkx

Can you please point me where are the defaults firewall rules?

Open terminal and execute

/system/default-configuration/print

(as user with admin privileges)

mkx

wifi-qcom is an extra package. Dont install it. No drivers - no radio. I think the point is that WiFi module costs money that could have been spent elsewhere (better CPU, 2 Gbps eth1-CPU link etc) or just excluded to make the price less. Commodity hardware, used as heart of MT devices, often alread...

mkx

New wifi CAPsMAN doesn't offer capsman forwarding. Which means that without VLANs CAP is joining normal LAN. And traffic then normally doesn't hit CAPsMAN. When it comes to DHCP ... when DHCP client (WiFi station in your case) sends out DHCP Discovery , every DHCP server in same L2 broadcast domain ...

mkx

Seems that connect-priority 0/1 improved the situation. Devices now do switch to 5ghz, but it does not seem due to actual steering, but because they eventually take that decision themselves. WiFi standards (802.11 anything ) don't standardize handovers (at decision of network entity), they standard...

mkx

Does this problem still exist in Ros 7? This problem never existed for me, neither in v6 nor in v7. I cannot delete PVID on the bridge interface. You can't delete PVID ... but if you set bridge CPU-facing port with frame-types=admit-only-vlan-tagged , then PVID setting will become irrelevant. After...

mkx

It shows who has everything to say in your household.

As if it's not the same in your household

We are speaking about WAF here, not about HAlF

mkx

Set aside the whining, I don't see a difference between hexs and L009: I don't have either hEX S nor L009 ... so only guessing: it could be that L009 doesn't allow PoE out if it's powered via PoE in ... while hEX S did? The fact is that PoE 802.3 comes with some stringent spcifications (which MT mo...

mkx

What are my options to achieve 20gbps speeds ? I thought 802.3ad would give this with layer3+4 hashing, but even with multiple-streams (iperf3 -P) I get capped at 10gbps. I noticed that iperf3 is using same port for all streams, so I guess that can explain it. IMO you should stick to 802.3ad ... wi...

mkx

Generally I'd say that your current firewall is .... inadequate. IMO default rules are much better than yours. So I guess you have very good reasons for ditching default and implementing .... what you have now. However, it does seem weird if DDoS attack would cause your router to drop ethernet link....

mkx

My other Linux server that is 2x2.5G bonded on Linux side and is connected to Layer3 TP-link switch. I didn't have to do any config changes on switch to make this bond work. There are some bond modes, available in linux, which don't require switch to know there's bond involved ... but it works well...

mkx

I can't see anything weird...

One line above the message about loosing DHCP lease it mentions link down on ether8-WAN ... so you'll have to investigate why link between your router and ISP device drops. There are plenty of possible reasons for that ...

mkx

... but randomly appears
Code: Select all
dhcp-client on ether8-WAN lost IP address 89.XXX.XX.18 - lease stopped locally

Can you show us log lines immediately preceding the quoted message (a few tens of seconds of history should do it) ... in general anything related to ether8-WAN port or DHCP.

mkx

I bought this thing. It has 25G interfaces to be a typical bridge, but there is no way to transfer even 10G in bridge mode. Is this some kind of joke? You bought router which happens to have 2x 25Gbps ports (and some others). Official test results tell that thing can route at speeds between 5Gbps a...

mkx

So nothing to be done on Linux itself ? Of course there is, bonds have to be configured on both sides of logical link. And bond mode (e.g. 802.3ad) has to match (Tx hash strategy can be different on both ends). I guess you didn't get feedback on linux-side config because that is largely of scope of...

mkx

Let's assume they are working on it.

You know what they say: assumption is mother of all f**ups. So let's not assume anything ... not with Mikrotik

mkx

As long as TLS 1.2 is still considered secure and ROS supports secure ciphers, I couldn't care less. Everything else is compliance BS. It's is not just about security, TLS 1.3 have more optimal handshake, less round trips. True. But when it comes to managing your router/switch/AP, how many hundreds...

mkx

... if for whatever reasons you applied an excessive voltage to ether1 I would expect It to fry, not the other ports.

If this happened, then this is quite a problem ... because netinstall works only ether1.

mkx

I don't understand why mikrotik doesn't have some kind of roadmap...

Wait ... Mikrotik has a roadmap?

I'd love to buy an Audience ax or two as long as it's as good as current Audience (I simply love it).

mkx

There have been previous reports on this forum about CCRs with similar symptoms. All have been resolved by replacing capacitors in PSU and/or main board, which showed signs of failing (bulged ends). When doing it, make sure that replacement capacitors match capacity of original ones (too big differe...

mkx

Are ether1 and wlan2 members of same bridge? Broadcast packets are in principle not routed, only switched/bridged.

And possible misconception: if only traffic flowing is broadcast, then it'll only affect Tx counters not Rx (only port connecting to broadcast source(s) will show Rx activity).

mkx

Bridge is only necessary if one wants to switch between bridge member ports. If device is used as pure router (strictly routing between ports), then bridge is not needed (and if it's used then one has to take extra steps to block L2 communication between different ports).

mkx

Post textual export of configuration of your RB960PGS. I suspect that the problem is in routing indeed. Either you have to add routes to different remote locations on main router or you have to configure SRC-NAT on each of remote location routers. Personally I'd go for first option as it allows you ...

mkx

just use your own dns, set up a cname to the ugly domain name and problem solved. Is not. Even if your own DNS server can reply with CNAME record, clients still won't be able to resolve the serial.sn.mynetname.net ... the only way around it is to actually update A record on your DNS server whenever...

mkx

It should match http://youtube.com but not a lot more.

AFAIK not even protocol (http), only host name, e.g. youtube.com ...

mkx

As I already wrote: if those domain names are not sent from client towards server in plain text, then L7 matcher won't be able to match them. You can verify if this is indeed a problem by doing a wireshark recording (on client machine would be fine) and check initial few packets, sent from client to...

mkx

I have mentioned about this problem in 2019, fife years passed and still the same. CRS326 is unusable at all. Do you actually have problems with CRS326 or is only the stats which are worrying you? And an idea: screenshot shows really low port speeds (10Mbps, 100Mbps) for ports with most link downs....

mkx

Only on the bridge, as that's what the IP stack is linked to. The Ethernet interfaces are just member ports of the bridge in this setup. ... which also means that access to other networks (including internet) can be controlled in this way. But: communication between devices on same IP subnet (even ...

mkx

Almost definitely the two rules you showed are not full firewall config. Or is it? Regarding L7: almost everything now days works over encrypted communications (httpS) and almost every server/client combination supports TLS v1.3. In TLS v1.3 also SNI is encrypted, hence L7 regex rule in ROS can not ...

mkx

Unfortunately, one drawback of my setup is that my location data is random. At one point websites think I'm in southern California, and then a day or two later I'm supposedly outside Chicago. AFAIK this has nothing to do with your actual physical location, it's got to do with some GeoIP databases ....

mkx

My experience with Gmail and IMAP is that when there are many messages in inbox (several thousand which in my case translates into a couple of gigabytes of space consumed), then sync rate plummets. IMO nothing to do with router.

Search found 13601 matches