MikroTik

mkx

... and I still wanted several VLANs untagged on the same port (because my WiFi APs are not VLAN aware).

But does this really work for you? Only one VLAN can have bidirectional traffic (single PVID per port).

mkx

In my case, accept (fasttrack counter) is at 2TB and another 2TB for "slow track"... 32MB drop invalid on input and 32MB drop invalid on forward ... and 178MB drop all else (on input ... nothing on forward).

mkx

It does make sense to drop "invalid" packets early, they might match some allow rule down the chain.

mkx

Configure port on router as trunk with all VLANs needed ... here's how to do VLANs in ROS: https://forum.mikrotik.com/viewtopic.php?f=23&t=143620 ... Tutorial may be geared towards switch-like configs, but is usable also for routers (even router-on-a-stick variety). And a suggestion: upgrade you...

mkx

So why bother with a dual IPv4 when you can just have a route that works in either setup? Adding a /32 route doesn't work with peer which uses "normal" /24 addressing ... And, again, doesn't add to security. One has to treat modem as being hostile and adding interface, connecting modem, t...

mkx

I don't think rotating drvices at angle would be a problem by itself. However there are at least two (minor?) issues to think about: wAP60G uses beam forming, so it can direct main lobe in "optimal" direction. But not in any direction, range span is 60° in horizontal direction and only 30°...

mkx

Don't know if this has been discussed already ...

There's such a feature already: port extender. Not many devices are compatible ... and it comes with some serious gotchas. But it's here.

mkx

I didn't manage to get IPv6 addresses not leaking across VLANs when using SLAAC to assign addresses. Did you fix the switch VLAN settings according to @anav's instructions? If port is untagged member of multiple VLANs, then broadcasts of all VLANs will egress through that port (and being untagged o...

mkx

To better understand the process, could you clarify where exactly the packets get tagged in the WireGuard setup? :mrgreen: The smiley you used makes me wonder whether you expect an answer or not. But anyway, here it is: wireguard is IP tunnel so natively it doesn't carry (nor care about) VLAN tags....

mkx

Again (and read my lips:) there's RouterOS version and Routerboot version. Both are distinct.

mkx

RouterOS (as in windows OS) is at 7.16.2. But: RouterBoot (as in BIOS / UEFI) is at 7.16.1. RouterBoot upgrade files are shipped to device along with RouterOS but it's not installed automatically. Hit that "Upgrade" button and reboot device.

mkx

In that case, the Linux kernel is GPL licensed code and as such we should be able to see the sources with modifications from MT ... I don't think that MT linux kernel contains many changes ... apart from some specific device drivers and some patches. I think it's more about missing features. E.g. d...

mkx

The ROS uses Linux kernel underneath anyway and I assume the very same tools underneath as any usual Linux distro ... Here you assume wrong, so nothing you wrote after this point doesn't necessarily reflect reality. ROS indeed runs linux kernel ... but if we can believe MT guys around here (and I d...

mkx

Yes DHCP client sends out broadcast packets when doing DHCP discover and bridge will send these frames out via all member ports. In principle only one DHCP server is necessary per L2 broadcast domain and if there are multiple servers in given L2 broadcast domain (not wrong by itself), it's expected...

mkx

This gbic is working fine with a Ubiquiti Edgerouter X which i'm using right now. ROS is a bit notorious for not supporting properly just any SFP module, thrown at. So the positive experience when using same SFP in different device brand means very little in this case (it only proves that SFP can t...

mkx

Try to check in depth what's going on with SFP+ port and module. ROS is a bit notorious for not supporting just any SFP/SFP+ module properly ...

Also verify as to which physical port corresponds to MAC address, set as bridge MAC address.

mkx

Well, anyway. Logs don't show anything related to hardware issues (link downs or whatever) ... which likely means some L3 problem. In that case you'll have to troubleshoot the issue while problem persists ... like running traceroute (on a LAN PC) towards e.g. 8.8.8.8 and see where things break ... i...

mkx

Errmm ... that's an article from 2014 ?!

That was my point exactly

mkx

With default logging config, ethernet port link-downs are logged. Also PPPoE client outages are logged (and as far as my experience goes, they correlate 100% when there are problems with ethernet port connectivity). With logs you showed (and assuming you didn't filter any events ... either by reconf...

mkx

Even with "plain" file systems (e.g. ext4) it's sometimes necessary to reformat drive (possibly due to lack of support for some type of partition table or some such). But with encrypted drives I'd say it's even more necessary to reformat drive ... it would be logical to me that encryption ...

mkx

Looked at cisco config and I think the problem lies there: interface GigabitEthernet0/1 description ** LAN ** ip address 201.201.201.201 255.255.255.240 no ip redirects no ip unreachables no ip proxy-arp duplex auto speed auto ipv6 address 2001:db8:20a0::1/56 anycast no cdp enable It effectively say...

mkx

IMO the problem is this:

advertising: 1G-baseX
link-partner-advertising:

Note the empty field "link-partner-advertising". Which means that autonegotiation doesn't happen. Try to set port speed to 1Gbps and disable autonegotiation on sfp-sfpplus1 port (under ethernet configuration).

mkx

You actually need to set advertise=yes on addresses on interfaces where there are devices which should use your router as their gateway ... without it, router will not send out RAs and SLAAC then doesn't work. In your opening post, you write "When I try to configure the LAN and define new prefi...

mkx

I just had a quick look at HUB configuration and it seems to me that routing configuration is flawed: /ip address # You probably don't need this: add address=192.168.0.223/24 comment=defconf interface=BR1 network=192.168.0.0 # and you probably don't need this either: add address=192.168.0.223/24 int...

mkx

Is there anything related in logs?

mkx

Can you post configuration from your MT router, at least the /ipv6 part? You can omit firewall part, it probably isn't important in the context of problems you're seeing.

mkx

Can you post the link to tutorial you're referring to? It's quite likely outdated, master port configuration style was abandoned in ROS 6.41 (quite a few years ago) and was replaced by bridge. And before you proceed, I recommend you to upgrade ROS to latest v6 stable (6.49.something), v7 is probably...

mkx

Show us config of switch (text export)..

mkx

At least pist the exact rule which doesn't work for you. And a detail, it might be a hint: firewall rules may be executed before egress interface is known, routing decission is made after most firewall processing is done. Also: screenshot in opening post also hints that ping is originated from route...

mkx

Metarouter is R.I.P. on RouterOS since many moons ago (at least in reality if not officially). It's replaced with container functionality ... but this functionality is not available on all platforms and if one seriously wants to use it (or wants to seriously use it) one better uses a very decent RB ...

mkx

Actualy ax hardware I tested on 7.16.2 on MikroTik have only fixed channels, example 5500 but not 5510 Yup, that's pretty normal on today's mainstream wireless stations (e.g. smart phones) ... they only support standard channel center frequencies. When creating MT-MT point-to-(multi)point link, thi...

mkx

You can't block specific URLs (chosen between different URLs targeting same FQDN host or IP address). Generic reason is that there's no guarantee that whole URL will fit single IP packet. And FW (L7 as well) works with IP packet granularity. So if one uses IP packets with MTU size of 40 bytes, then ...

mkx

In the meantime your devices probably have restarted ...

... or remained in some undefined state if the brief moment without power flowing lasted just the right duration. And in this case one has to reboot device.

mkx

But do think using default 20/40/80Mhz channel width might be cause of at least some of the frequent AX complaints... I don't think that 20/40/80MHz is causing complaints. After all, this kind of channel arrangement is (supposed to be) backwards compatible with devices supporting only narrower chan...

mkx

If considering RB4011 and RB5009 ... then RB4011 is technically inferior in many aspects (slower CPU, uses 2 switch chips and SFP is connected directly to CPU, doesn't have USB port, etc.). Just thought to mention this to contrast higher WAF of RB4011 :wink: Regarding hEX S performance: that rule of...

mkx

about downgrades, there is ZERO logical reason to knowingly downgrade to a version with a known CVE, possibly allowing easy access to the device by a hacker. Zero. Do not try to find it. This is new to me ... that ROS upgrader has built in function to check certain ROS package against database of C...

mkx

You may want to look at output of command /interface/wifi/print and /interface/wifi/security/print (run them in terminal window ... you can start one from WinBox or connect to device using ssh) ... and look for "encryption" property in both outputs. Only then you'll see what is actually co...

mkx

After you uninstall wireless package and install wifi-qcom-ac package - verify that it's actually installed, cAP ac XL has only 16MB storage space which is really tight - (and upgrade routerboard firmware for good measure ... and cold boot device for another good measure), it may be good to reset de...

mkx

I just NEVER see anyone recommend narrowing channel width for AX... which got me questioning physics. My guess: none of the vocal AX supporters considers 2.4GHz band as viable WiFi band any more (everybody is looking at 6GHz now days). I've thought of a reason to go with 20MHz channels (instead of ...

mkx

The problem with communication pausing and/or packets being dropped when there's speed change (most notably from faster to slower, e.g. ingress port is 10Gbps and egress port is 2.5Gbps) is buffering. A switch has only certain amount of buffer and if there's a burst of frames, switch needs to buffer...

mkx

I know AX uses OFDMA to better handle this ... ... so do G and N (and A) ... actually only B uses DSSS with 22MHz-wide channels. So in this respect AX is nothing new. What AX adds is 1024QAM (N stops at 64QAM) so it can reach higher speeds when SINR is great. And reduces subcarrier spacing by facto...

mkx

When doing L2 stuff, it's responsibility of device sending frame (can be originating host, can be router) to find out destination MAC address. And L2 entity (switch) then passes frame to correct port. If sender doesn't know destination MAC address, it can send it to broadcast MAC address. Both when ...

mkx

Problem with using public servers (including iperf3 servers) is that there might be bottlenecks other than "last mile". I tried iperf3 server from the screenshots of @CGGXANNX and I got shitty performance in both directions. In both directions I see fair amount of retransmissions ... and f...

mkx

Anything in logs regarding bridge or its ports?

Are ports, marked as "not running", connected to devices which are powered up?

mkx

And you're entirely sure that <public IP> is the exactly the same that browser uses when trying to connect to your web site?

mkx

Switch Configuration (Port 7 - AP): - Member of VLAN 1,100 - Tagged on VLAN 100 (WiFi) - Untagged on VLAN 1 (default) - PVID 100 The last two bullets contradict each other. Setting PVID on port means that anything untagged on physical media outside the device (e.g. ethernet cable), connected to thi...

mkx

Now here's my main question: do source ports matter? Generally source ports don't matter ... unless they do. As you found out, some ISPs block some well known ports and UDP 123 is often one of them (it used to be abused by some DDoS amplification attacks), UDP 53 is another one. Vast majority servi...

mkx

mANTbox has a pretty narrow-beam antenna. Have a look at diagrams, published in product's quick guide . Since Tx power is generally limited by country regulations, this means that decent signal strength is only available in directions with maximum antenna gain and elsewhere signal strength is pretty...

mkx

a switch and a router - generally speaking, are the same devices ... While we're generally speaking, switch and router are very different devices. (Ethernet) Switch does ethernet frame forwarding between ethernet ports based on SRC and DST MAC addresses and FDB (Forwarding DataBase). And router doe...

mkx

Hmmm ... the way I read OP's screenshot is that WAN Rx is considerably larger than LAN Tx .... which means that router is dropping some of traffic comming to router from internet. Which means that firewall is doing its thing.

mkx

If AP can add/remove VLAN tags as needed, then the switch in between doesn't have to know about VLAN tags at all. The only (minimum) requirement for that switch is that is supports using "baby jumbo frames" ... that is ethernet frames with payload size of 1504 bytes (VLAN header adds 4 byt...

mkx

Now, if the off-center ball with a flat bottom shape is correct, if you mount a wAP in the center of the ceiling, the apartment below your room should enjoy better coverage than you? :shock: Probably not ... because apart from "back side" (where signal level is supposed to be like 20dB lo...

mkx

For play use a cable, any other consideration is useless ... My guess: @OP doesn't have any wired network infrastructure available ... and/or he fell for "use wireless, it's better than fresh bread" motto of sellers of wireless equipment. Now his multi-player experience suffers but he'd p...

mkx

The ancient ROS version is only supported by (almost) equally ancient versions of WinBox ... I'd go for something older than 3.20 (I don't remember exactly when ROS and winbox changed in this respect). Download link is e.g. https://download.mikrotik.com/routeros/winbox/3.20/winbox.exe (change "...

mkx

Why does the Winbox client share the same JSON file with the web interface? I can't understand this design choice. It is possible to create a "skin" ... like hiding certain interface items. And at least winbox 3 did conform to those skin settings. Which probably means that winbox is suppo...

mkx

- 60db is a pretty good signal already. @OP is not saying he's getting - 60 db , he's saying he's getting 60 % of signal. And only <insert your favourite deity here> knows what kind of signal that means. My experience with 3G and 4G phones says that some vendors set 100% at values where service onl...

mkx

Here's an article, somehow explaining different STP options: https://help.mikrotik.com/docs/spaces/ROS/pages/328068/Bridging+and+Switching#BridgingandSwitching-Per-portSTP According to my understanding, BPDU-guard is almost exactly opposite from setting port as edge: BPDU-guard disables port if it d...

mkx

Depending on setup, MAC addresses of "neighbouring" devices can be in different places: /ip/arp/print As already mentioned, this table contains MAC addresses and IP addresses of devices, which somehow communicated with RB device on IP layer. Values in Status column are explained in this ar...

mkx

It seems fine. It's on a paranoid side, I'd do two more things: for performance reasons I'd enable fasttrack: /ip firewall filter add action=fasttrack-connection chain=forward comment="fasttrack established,related" connection-state=established,related It should be pushed to the top of rul...

mkx

The config you posted seems to be old one ... with capsman settings still under /caps-man ... but to provision your hAP ax2 you need to configure CAPsMAN under /interface/wifi ... e.g. /interface/wifi/capsman/set enabled=yes . Etc. I missed that your CAP device is hAP ax2 in your previous post. So y...

mkx

MTU is L3 setting ... which means at least these two things: switches (as L2 entities) don't have much to do with it, they just have to be able to pass those jumbo frames (L2MTU has to be at least MTU+ethernet overhead+VLAN overhead isf used) whole IP subnet has to use same MTU ... all devices and r...

mkx

In addition: does any of LAN infratructure devices have proxy-ARP enabled? I see many people enable it without understanding what it does and then run into problems caused by it.

mkx

There's been some kind of confusing situation. It doesn't make any sense. I have two 4011s with firmware 7.16.1 that were fine a week ago. Today I noticed that DHCPv6 client on both devices stopped working normally. I have not made any changes to the settings. Did devices reboot in between by any c...

mkx

Assuming that ISP device (modem? GPON ONT?) is working as untagged ... you'll have to create something like this: switch port, connecting to ISP, needs to be configured as untagged/access port with PVID / native VLAN set to 41 switch port, connecting to router, has to be configured as tagged/trunk a...

mkx

Two things: you are running the new "wifi" driver on cAP (optional package wifi-qcom-ac installed I presume), so you'll have to configure the matching CAPsMAN on RB4011 ... and for that, you'll have to focus on /interface/wifi and its subtree (that's the place to configure new CAPsMAN). It...

mkx

L2 devices (switches) don't fragment large frames, they silently discard them. And all devices inside same broadcast domain (most commonly this means same IP subnet) have to be set up with same MTU (traffic from small MTU towards large MTU is fine, traffic in opposite direction will get dropped). Th...

mkx

Apparently, I speak truth.

Don't know about that ... your post was around 244 lines too long for me to even start reading it at full attentiveness.

mkx

If I understand DDM he's trying to set frequency to "auto" ... which is default since around 6.47.

@DDM: read about device mode ... in particular, you'll have to enable routerboard property (i.e. set it to yes).

Edit: meh, have slow fingers

mkx

There are a few places where DNS servers are mentioned: /ip/dns/set servers=<list of IP addresses> This one is used for DNS process in router itself to be able to do any queries. If not for other things, it's important to be working for ROS update checks (and downloads). Or anything else that ROS ne...

mkx

It could be some rogue device somewhere on the edge of your network which initiates STP topology changes. And there are plenty of devices which can do it, e.g. any server running VMs can do it (they tend to run bridges for connecting VMs to network) or servers running any containers, etc. I'd start ...

mkx

First off: CRS354 (the whole CRS family of devices as a matter of fact) is a switch not a router. Yes, if running RouterOS, it can route and if carefully configured, it can route at wirespeed (if not carefully configured, it can route at very low speeds, like 200 M bps cumulative between any combina...

mkx

By setting an IP address on the WAN interface you negatively affect setups where upstream uses DHCP or static assignment as the interface will end up with multiple addresses. I don't exactly understand your argument. I guess that vast majority of devices use static IP subnet for LAN (just like ROS ...

mkx

1) it entirely depends on DNS clients. But mostly they operate like this: start using first DNS server. As long as replies are getting back (even if negative answers), client will use same DNS server. If DNS server fails to reply, then client switches over to using second DNS server. And keeps using...

mkx

This is mission "nearly impossible". One issue is DHCPv6 server on ROS ... it doesn't support giving out IPv6 addresses, it only hands out prefixes (there are some recent activities which may improve DHCPv6 server by adding address assignment functionality). And the big issue is client sup...

mkx

Well, why not just mention that in changelog?

When did MT make changelogs easily understandable?

mkx

Perhaps some of those v6-only hardware got R2 (with some slight HW changes, requiring minor changes in some device driver?) Since such change doesn't apply to already shipped hardware, ROS change can be factory-only (and it doesn't have to be publicly available since new devices can not be downgrade...

mkx

On both switches: if you're using VLAN Interface, anchored off bridge, then bridge CPU-facing port has to be tagged member of corresponging VLAN:

E.g.:

/interface bridge vlan
add bridge=SW1 tagged=SW1,ether8 vlan-ids=40
/ip dhcp-client
add interface=Management

mkx

Do any ISPs still use squid proxy/cache servers ? Can't speak about ISPs, but in my company (with a few remote offices) we're forced to use proxy server (squid) for remote offices to be able to exit to internet (the connection between remote offices and main office is over some MAN which offers the...

mkx

There is any Mikrotik modem (only modem) that suports this 3 bands? If you're thinking of attaching modem directly to RB5009, then the only option would be USB modem ... and no, MT doesn't offer any USB modems what so ever. So the only option would be to go with models, mentioned by @gigabyte091 .....

mkx

So I added IP address (from modem's "LAN" IP subnet) to my ether port linking with modem. Any particular reason you chose this approach rather than adding <IP>/32 route? The latter should work for both PPPoE and bridged Simplicity. BTW, adding /32 route doesn't make it any more secure (th...

mkx

Depending on requirements (WAN speed being one of more important ones) ... but hAP ax3 is generally one of better choices.

mkx

It is possible to netinstall (older version, 7.17beta4) while keeping configuration. You can try this and see if it works out.

mkx

Thanks for the image. So wAP AX seems to be directional. Correct antenna gains seem to be around ~7dBi in the frontal direction. Around 7 dBi for 2.4GHz band and around 5 dBi for 5GHz band. There's definition about "directionality": antenna beam width is angle where antenna gain drops by 3...

mkx

Your company switch most likely works as "802.3 af/at" and provides around 48V. Which is pretty much incompatible with RB260GSP PoE-in requirements. Provided power adapter is almost certainly 24V and RB260GSP only works as "passive PoE". Which is, again, completely incompatible w...

mkx

Try disabling LCD altogether. It's known that updating LCD contents affects router's performance quite signifficantly. You posted terse (or verbose?) expirt which includes all sorts of default settings making it much less readable ... at least zo me. So if you do another export (a "normal"...

mkx

As the complete bandwidth of 2.4GHz radio is 40MHz wide.... Not exactly true. WiFi 2.4GHz band extends from 2401MHz (lower boundary of channel 1) to 2473MHz (upper boundary of channel 11, relevant in NA) or 2483MHz (upper boundary of channel 13, relevant in EU and almost everywhere else than NA). W...

mkx

Port extender functionality (either CB or PE) has to be run by switch chip to be effective. So there are 3 possibilities: switch chip used in CRS310 doesn't support this feature support is not yet implemented in ROS documentation is outdated Whichever it is, you could get a definitive answer only di...

mkx

"off-topic": Why you should add the eth port that is connected to the isp modem to the WAN list? (I'm using PPPoE) It depends. In my case ISP's modem has management interface (Web-based UI) and for that it has "LAN" IP address. Even though I put it in bridge mode and run PPPoE c...

mkx

My question is: In short: interface is the thing which delivers frame to RouterOS. Most often it has IP address set. This "property" is not passed to parent entities. E.g. if you have a few ether ports members of a bridge and teaffuc is tagged so there's also a VLAN interface anchored off...

mkx

If bridge configuration on SXT doesn't have any VKSN-related config, then its IP layer communicates strictly vua untagged frames. Diagram mentions VID 2 as being used as native on trunk between cisco snd SXT (at least the upper-left pair), which means that 192.168.2.0/24 should be used in VLAN 2 on ...

mkx

Commenting on config from attached rsc file ... You shouldn't set use-service-tag=yes , it switches over to different type of VLAN headers. And no tag stacking. All in all device config is a mess. So I suggest you to start over: install ROS 7.16.1 on your hAP ac2, it'll improve wifi performance quit...

mkx

What does "D" mean in Current Channel?

I'd say it means DFS.

mkx

However not knowing where they come from is troubling us, we only see the LAN ip and mac address of the source.

Find them ... as per advice by @tdw. Yes, it's manual work, but if you want to catch plaintiff, you need to do some detective work before you send out the guns.

mkx

Not sure about the branding bloat ... it might be necessary to install different branding ... https://help.mikrotik.com/docs/spaces/R ... 4/Branding

mkx

Viktors says wAP stands for "wireless access point". 😉 I think that that is only to distinguish it from wired access points :roll: :wink: :lol: I don't know about you, but I have my Audience wired ... both for PoE and for backhaul. And it only works as AP (no routing or anything else). Wh...

mkx

I kindly ask for some official answer will it be possible to receive updates for this device in future? You won't get any official answer. But experience with MT so far is that they are doing anything possible to provide software upgrades way beyond EOL date. The only problem with 16MB flash device...

mkx

There's another path (possibly a tad easier) instead of netinstalling ... available from ROS version 7.13 onwards: mark package wireless / wifi-qcom / wifi-qcom-ac driver (whichever is installed on device, in case of @OP it may be wifi-qcom-ac or wireless) for uninstallation reboot device upgrade de...

mkx

Those values are correct and same for me, but there are 3 issues: 1) In case of 5490-5710 I have only maximal power 26 dBm with 2.5 dBi antenna. 2) I can not set up manually or automatically any of frequencies beyond 5600 with 20 MHz channel or beyond 5580 with 20/40 MHz channel or beyond 5560 with...

mkx

The intention is that local wifi interfaces are not provisiobed by CAPsMAN (running on same device). With new wifi, CAPsMAN and local wifi setup share same configuration profiles, one can apply same profile (e.g. security) both to CAPsMAN and local interfaces. Local radios will still work with other...

mkx

Just guessing: you have to set address-pool to some existing pool for DHCPv6 server to hand out addresses (seems like it uses prefix-pool only to hand out prefixes). And quite likely you have to provide a pool with same prefix length as is used on interface (and probably router's address on that int...

mkx

I have the same problem. I once used a netinstall a few months ago and after flashing a different version of RouterOS, it left this flash folder (disk) and I can't remove it. It takes up all the space - 16MB and I can't install new certificates due to lack of space. Normally the root of storage, as...

mkx

Hmmm ... what does /interface/wifi/radio/reg-info country=Czech show on your device? On my audience (running 7.15.3) it says ranges: 2402-2482/20 5170-5250/23/indoor 5250-5330/23/indoor/dfs 5490-5710/30/dfs Which more or less corresponds with limits from "your" document). BTW numbers in ab...

mkx

Two things which poke my eyes: disable detect-internet at least on PtMP devices ... I'd disable it on all devices since you're trying to configure things properly yourself. Function detect-internet may help in case when user connects WAN to a wrong ether port. But it also have potential to royally m...

mkx

According to my experience, Tx hash policies on both ends of bond don't have to be the same. Receiver will accept frames no matter via which bond link they arrive. It'll only use Tx hash policy (as configured locally) when selecting between (working) links members of same bond for Tx. So it will be ...

mkx

The problem is that Sonos mesh obviously doesn't care about hetwork loops (neither do unmanaged switches). All managed switches know about xSTP (most have it enabled by default) and those can block one of links creating a loop.

mkx

Any SFP with DDC plugged in (and being queried about their state)? IIRC it's been mentioned that there's a I2C bus which connects all internal monitored parts (power supplies and fans) as well as DDC buses of SFP cages. And if any of those devices block I2C bus for too long, ROS can not poll statuse...

mkx

Indeed MT PoE offering is pretty inconsistent ... but there are a few rare devices which fare a tad better: CRS328-24P-4S+ has internal dual-voltage power supply and offers per-port selectable voltage (24V passive PoE or 48V 802.3 af/at) ... unfortunately it has limit if around 24W per port CRS320-8...

mkx

Check settings in Cloud ... since you have NTP client running (hopefully it shows status synchronized), you should disable time option in cloud settings.

BTW, if you're running NTP only to keep time on router current, you can disable NTP server function.

mkx

Yes. CRS doesn't regulate voltage internally, it only passes whatever supplied. CRS112 is one of few MT devices with dual power input, allowing to select voltage for PoE-out. If one of inputs is missing, corresponding PoE-out voltage is missing as well.

mkx

Contrast this to the RB3011 where the only way to have hardware offloaded VLANs is to perform the configuration directly on the switch chips. But because each of the two switch chips of the RB3011 has no knowledge of the other one, there is no mechanism in the switch chip configuration to refer to ...

mkx

When bond does hash (and based on hash value selects bond link to transmit frame), it takes whatever info configured: L2 - MAC address of source and destination L3 - IP address of source and destination L4 - source and destination port (if L4 protocol, e.g TCP or UDP) uses them. So with L2+L3 any pa...

mkx

Bridge port has to be tagged member of any VLANs which there are corresponding vlan interfaces.

mkx

L3+L4 is less common tho, but it should work good between two mikrotiks L3+L4 can spread traffic between one pair of devices to both bond links ... if devices use multiple connections in parallel. However, a single connection (e.g. single file transfer using SMB - windows file sharing) will still o...

mkx

You haven't mentioned what the log is currently mentioning.
Code: Select all
/system logging action
...

We are actually waiting to see output of /log/print (anything which looks weird and a few lines before weird lines to get some context).

mkx

It boils down to this: interface lists work for interfaces ... and interfaces are the L3 entities (anything with IP address set). In case when one creates a bridge, adds a few L2 entities (ethernet ports, wifi interfaces, etc.), those L2 entities should never be used directly as L3 stuff (this is th...

mkx

It's actually shooting under / between the branches.

Good. So the problem won't happen in Spring of 2025, it'll happen in Spring of 2026

mkx

In case when I connect AP's as a wireless bridge with trunk - no questions about it. I would put specific wlan interface in "admit all" mode. But for users WiFi I would like to avoid it. Well ... what you'd like in this case doesn't correspond with what you can. And since it's up to perso...

mkx

2 - check LAN interface list, both ether1 and ether2 should be there 3 - add all interfaces to bridge (ether1/2 and wifi itf) Actually ... bridge interface should be member of interface list. Individual ports (ether1 and ether2), members of bridge, don't have to be members of any interface list.

mkx

Brief comments: # FIXME: Do I need to explicitly set this? # /interface/ethernet/switch set 0 l3-hw-offloading=yes No. Where did you get this from ? Certainly not from the VLAN guide... I think it's default with recent v7 ... even if device actually doesn't support L3HW which makes this setting irr...

mkx

yes ... just hAP ac2 can't be powered from wAP ax (wAP ax doesn't have PoE-out) yes ... included PoE adapter is "PoE injector" which is plugged between switch and powered device. It is transparent for data passing between both sides. yes ... if hAP ac2 will be running wifi-qcom-ac package...

mkx

could this solve it?
https://github.com/ncravino/mikrotik_en ... our-router

Yes, this would help ... but you'd have to constantly update the list of DoH servers ... so it's a moving target.

mkx

In such a case it _might_ also be worthwhile to export config, netinstall device and then re-apply config again.

With emphasis being "export ... re-apply config" ... which is very different from "backup ... restore".

mkx

I have started from ground up, so I'm not using the defconf of the MT. IMO this is a pretty bad decision. Default MT firewall is quite good and allows for easy adaptation (e.g. for using PPPoE instead of DHCP client as WAN "technology"). It also allows to make adjustments (e.g for port fo...

mkx

Will I loose the capsman configuration ? It is a possibility. As far as I remember wifiwave2 config structure is pretty close (if not the same) as the (new) wifi config structure. So even if you'll have to manually upgrade configuration after you upgrade ROS, it shouldn't be a big problem. Export (...

mkx

Distance is measured as round-trip time and difference of 9 m roughly translates to 30 nano seconds. I slightly doubt that timing resolution in WiFi chip is any better than this. RTT is measured by each radio independently ... so there can be slight differences. Other link properties are dynamic and...

mkx

Also check how much free space is on flash storage ... You didn't mention device model but some devices have tiny flash storage (16MB or even a bit less) and depending on amount of packages installed and complexity of configuration it may run out of space, which may cause ROS to loose configuration ...

mkx

MT doesn't provide separate documentation for particular device models. Several documents do include sections, which only apply to particular hardware, but often this is indicated in a way not really obvious to users not intimately familiar with devices (e.g. often they indicate that some section ap...

mkx

As already explained: you can't have multiple VLANs untagged on single port and having bidirectional communication (with exception of somehow implementing MAC VLAN which tags ingress packets based on source MAC addresses). I recommend you to rethink the network topology ... best would be to install ...

mkx

1. I don't know which exactly manual you're reading. But: RB4011 doesn't really belong in the group of devices mentioned. It's using RTL8367 switch chips and it didn't support VLAN switching configured by switch configuration (under /interface/ethernet/switch), the menu didn't exist. One could only ...

mkx

I think the problem is DOH, if I do a torch I see requests towards 8.8.8.8:443. so AdGuard is skipped. How do I manage these requests to process everything from AdGuard?

You don't manage DoH requests, you live with it.

mkx

Only one vlan go pass untagged leaving ether 2 and that is predicated upon the pvid setting at /interface bridge port Wrong. Correct would be: All configured VLANs pass untagged leaving ether2 but only one VLAN offers bidirectional communication. Just because you don't see use case for something do...

mkx

6.40 is ancient and can miss some functionality. I highly recommend you to upgrade to 6.49.17 (latest v6). I understand you may struggle but IMO this is essential. And yes, netinstall is a almost certainly a must (lack of space likely indicates remnants of unwanted config and/or unnecessary files on...

mkx

but also want to untagg VLAN-20 & (native VLAN-1) traffic on the ether port. Your main problem so far is that VLAN 20 is only mentioned in VLAN interface creation. Bridge doesn't kniw about VLAN 20, so it won't pass it between CPU and other bridge ports ... and other bridge ports are not config...

mkx

Did you manage to set up your PtMP into transparent operation? After this is done, you can add configuration to transparently pass 802.1Q headers (VLANs). Or you can decide not to go with VLANs and keep the whole network (all 3 sites) as one flat LAN. In any case, CAPsMAN / CAP configuration is exac...

mkx

I wonder why this bothers you? Let’s say I have obsessive-compulsive disorder ) My vision of an ideal world (mainly came from years of configuring various Cisco networks) is that user access edge should be always in “access mode”, that is tagged traffic should be avoided at all cost on access ports...

mkx

switchX-cpu is a switch port and doesn't exist outside of /interface/ethernet/switch scope. Ether ports are (in ROS) different as ROS does have capability to work with individual switched ports (as if they were stand-alone interfaces). If you have a bridge and has any of there ports (run by that par...

mkx

We only see the mac address and LAN ip of the device, is there a way to trace the source WAN IP or route over the radio link, at least this way we could work out who it might be. You can't see IP address of your device because (apart from acting as a switch) it doesn't collaborate in malicious acti...

mkx

It's not bug, it's how get works. Like this:

:put [ /interface/ethernet/get sfp-sfpplus1 sfp-ignore-rx-los ]

mkx

3. if LAN clients are on same subnet as pi-hole, then you need to implement the SRC NAT part of hairpin NAT

mkx

When traffic is bridged between both switch chip port groups, there are two bottlenecks: 2.5Gbps interconnect between switch chip and CPU ... if cumulative traffic between ether ports of single switch chip and the rest of RB4011 would exceed 2.5Gbps, then this will slow things down CPU processing p...

mkx

Settings from CAPsMAN (datapath as well) are applied on CAP device. In your setup, you're setting /interface wifi configuration add country=Serbia datapath.bridge=bridge2 disabled=no mode=ap name=cfg1 security.ft=yes .ft-mobility-domain=0x1 .ft-over-ds=yes ssid="EF WiFi" but CAP device onl...

mkx

... best practice is to use MAC of the first ethernet interface that is part of the bridge ... While this might be one of best approaches, it's not flawless ... if one removes "first ethernet interface" from bridge and forgets to change bridge MAC address, it's possible that some problems...

mkx

MikroTik should probably revise the policy on having default configuration? While it can be understood that a CCR does not have a "forward" firewall (and "NAT"), for sure it should always have an "input" firewall. So it does not hurt to have an example of that in the d...

mkx

What to do to resolve the issue?

Throw RB951 in trash can?

mkx

But I didn't like the fact that with usage of datapath I got a tagged wireless traffic

I wonder why this bothers you?

mkx

You cannot have the rb5009 providing separate subnets without double NAT ...

You can. But TPlink has to perform NAT also for "alien" subnets on LAN side ... and I've no idea if that's possible or not.

mkx

Also, I don't really understand the logic of the "update ROS first, then upgrade firmware at next reboot": https://forum.mikrotik.com/viewtopic.php?t=199442 As I wrote in the last post of linked topic, FWF files (containing routerboot images) are inside ROS disk image. Generally installer...

mkx

By setting both spoke devices to station instead of station-bridge mode things get less transparent. So I wonder why you can't set these devices into station-bridge ... what is error message? Seeing CCQ considerably less than say 90 (100 would be ideal) while link is in use means trouble for the lin...

mkx

CRS line of devices are switches ... by running ROS they can route but at fairly low speed. If running recent versions of ROS v7, certain configurations can offload routing and some firewalling to switch chip, increasing routed throughput a lot. Have a look at documentation: https://help.mikrotik.co...

mkx

... if L3 hashing policy is used by them

L3 hashing depends on IP addresses (src and dst) so multiple connections (different ports) will always pass same LACP member. Only if L3+L4 hashing is used, then different connections (different src/dst port numbers) might take different LACP members.

mkx

Some "essential" new ROS features require routerboot upgrade. Such as device-mode. (IIRC there were no such changes in ROS v6, routerboot changes were only necessary when hardware initialization had some problems). Also to boot ROS v7, one had to run some minimum version of routerboot (som...

mkx

Is there a guide I could follow that helps me to setup WiFi?

Not a guide, but refrence manual for WiFi config: https://help.mikrotik.com/docs/spaces/R ... 59120/WiFi

mkx

... although personally I use the later ... Couldn't that be called "preaching virtue but practicing vice"? :shock: Nope, not in case of routerboot upgrades ... I've never imposed (ever so mildly) suggestion in any direction in any of my posts (I'll buy you a beer or any other beverage of...

mkx

do any of ARM devices have IPsec acceleration working yet? It's not just a matter of the CPU architecture. I know. IPsec can as well depend on some particular CPU instructions ... which may or may not be present in some particular CPU implementation ... this seems to be the case. OTOH necesary inst...

mkx

If you don't mind "antenna connector surgery" and ugly-looking antennas on the outer building facade (or on roof top), then Iskra P-60 5G antenna set might fit the needs. They come with 5m or 10m of antenna cable, SMA connectors attached. And their gain is very decent for most of supported...

mkx

... if I'm reading the calculations correctly? Yup. And that's "required clearance" at the middle of link, it's less closer to either antenna. But it's a good rule of thumb to have such clearance along the whole length of link. Beware of trees, they (or at least some of them :wink:) tend ...

mkx

Are you sure your original device was hAP ax2 snd not hAP a c 2? With event of ax devices ROS now includes new wifi driver and config is under /interface/wifi . Older devices ran wireless driver (with config under /interface/wireless ) and some ac devices could run either of drivers (with default be...

mkx

Now #6 might be added as either: 6) You set automatic updates for routerboard firmware but not for ROS. or 6) You do not set automatic updates. Since your rules are intended "for dummies" (seasoned MT admins already live by these rules, right?), I'd go for the former ... although personal...

mkx

No simple way. Exported config depends on packages installed and builds on defaults. But also includes some of default config. So best chance to apply config from export is to start from no config on "recipient" ... and likely there will still be lines which will fail. And if they fail, yo...

mkx

Then why are ipsec features listed as being tied to mt7621 on MT Help pages related to IPSEC ? MT7621 is a SoC ... which includes CPU (MMIPS architecture), switch chip and some other things. EN7562CT is a SoC as well ... which includes CPU (ARM architecture), switch chip (which is specced as EN7562...

mkx

CSS is strictly a switch, it can't do any routing. You'll have connect both routers together. You can use CSS and create an "interconnection" VLAN if you will, but both routers would then have to "speak" VLAN at least for interconnection VLAN. Or connect both touters with direct ...

mkx

I expect IPSEC performance will be at least on par, if not better (since same MT7621 is included). Your expectation may be correct, but it's based on wrong premise. IPsec acceleration depends on CPU features or included accelerators ... but not on switch chip emulation. The new SoC EN7562CT include...

mkx

Look into 802.3ad bonding (a.k.a LACP). This has to be configured (and, above all, supported) on both sides. Bonds work best if all bond members use same speed. And beware that 802.3ad doesn't provide any mode which evenly distributes traffic between bond members "no matter what", it's alw...

mkx

Perhaps: configure CHR with firewall rules (and SRC NAT rule) according to defaults for SoHo MT devices (they were posted a few times in last year or two in some posts on this forum, use your favourite search engine to find them). Those defaults generally offer decent base for customization ... Then...

mkx

One addition: list by @amm0 in bullet #7 mentions QuickSet ... IMO it's worth mentioning that if user did anything according to bullets 3-11 outside of QuickSet (which is very likely), then use of QuickSet is a very avanturistic act since it can revert some of changes (but not all) and hence end res...

mkx

If I'm wrong, please correct me then. If the PPPoE authentication is removed, logically, the product would only function like a switch and wouldn't be unnecessarily burdened.

If L3HW is configured, then your CRS could even route at wirespeed ... but yes, PPPoE is a deal-breaker here.

mkx

The unclear thing is that they are using the same device with a 10 Gbps network. Probably as 10Gbps switch ... Thre's another thing: L3HW offload, which allows CRS3xx to route at wire speed. But it has many constraints. Read more at: https://help.mikrotik.com/docs/spaces/ROS/pages/62390319/L3+Hardw...

mkx

SwitchOS offers only switching, no routing. But you probably need a router between internet and LAN. Regarding optimization: which part of my previous post is not clear to you? And a coment on "high-end device": a switch with MSRP of around $200 is hardly a high-end device. If retailers in...

mkx

In theory link performance depends on how obstructed is Fresnel zone. Which is widest at the link midpoint and gets narrow at both antennas. Which means that for best performance clear direct line of sight is not enough, even some vicinity has to be obstruction-free. OTOH for link that has "som...

mkx

The difference between license level 3 and 4 (when it comes to radio) is that level 3 device can only be connected to one peer ... so any of station modes or bridge (but not ap-bridge). In PtMP scenario this means it can only be "spoke", not "hub". As to the rest of performance t...

mkx

Device running ROSv7 version 7.13+ with wireless package installed (ot contains legacy capsman) can act as capsman for both legacy and modern APs. But with a few gotchas: if capsman also has wireless interfaces, then it better requires legacy drivers (generally this means pre v7 device) because driv...

mkx

Your basic error is in believing that CRS326-24G-2S+RM is a decent router. In reality it's a switch which has (a fairly slow) CPU and when device runs ROS (it can run SwitchOS as well) it can route. And based on official test results you're getting very decent routing speeds for this device.

mkx

No, ethernet ports are 1Gbps. "Aggregate speed" is a marketing BS buzzword ... effectively saying that port is full-duplex and can transfer at 1Gbps in both directions simultaneously. Wireless, OTOH, is half-duplex with large "direction switching" overhead ... so in reality (real...

mkx

How are LAN devices configured ... to use adguard directly or to use router? This config is likely buried in DHCP server config.

mkx

@holvoetn now you started to nitpick. Who cares about performance if it looks this great?

If @jvanhambelgium cared about performance, then he wouldn't even think about fixing RB3011 (6x routing speed at 80% power consumption).

mkx

This is entirely L7 operation. And ROS can not rewrite L7 information. With encrypted traffic (httpS) ROS even doesn't see this information, let alone can it manipulate encrypted information. A decent proxy server (browsers would have to be configured to use one) could rewrite this information ... b...

mkx

So it seems that hEX, with refresh, got degraded from a decent 5-port ethernet switch to a decent 4-port ethernet switch with management port

mkx

... brand new shiny RB5009

They may be shiny, but fun level is anywhere near what RB3011 provides: full 1U dimension, LCD display, two switch chips, etc. Only colour comes near RB3011's black

mkx

Is there any way I can log those events?

I'm not sure. I some related tings (such as "received packet with own MAC address" or something like that) are logged even by default, not sure if there are some more extensive loggings available for STP.

mkx

Logs are saying that there are some STP events which cause bridge to block wifi2 interface ... and 7 seconds later traffic resumes. As I wrote, those events don't necessarily originate from either of wifi bridge members, they could start somewhere else and got propagated across other switches and br...

mkx

So ... what else is there to try execept for the trashcan ?

Replace RAM?

mkx

Is there any chance that you actually have some loop in your network? Not necessarily directly on either of these two wireless devices?

Another possibility is that there's an actual bug (in combination between L23UGSR and recent ROS), but only MT can tell that.

mkx

Do you have "detect-internet" active on any device other than "none"?

mkx

That doesn't seem right if it's the 2024 model. Not really, basic switch chip functionality didn't change since ages ago. And Qualcomm does the same: my Audience uses IPQ4018 SoC ... and switch chip reported is Atheros-8327. My venerable RB951G uses discrete ethernet switch chip type ... Atheros-83...

mkx

bandwidth test is very CPU intensive, in your case slow CPU is bottle neck. You realky should test throughput through switches. Using two computers and running iperf3 between them is pretty common way of testing. I guess the only issue here is to get hold on two computers which are actually capable ...

mkx

How do you test bandwidth? By running bandwidth test function on switches them selves?

mkx

... setting the order of those interfaces is something which is done by startup script. I don't think so ... script says :local ifcId [/interface wifi find where default-name=wifi1] set $ifcId configuration.mode=ap channel.band=2ghz-ax disabled=no ... So the script knows that wifi1 is 2GHz radio (....

mkx

Anything in logs of both devices?

mkx

anyone noticed the order of wifi1/2 has been changed ... AGAIN ?? Wifi1 = 2Ghz Wifi2 = 5Ghz It may have something to do with the fact, that IPQ-5010 has only 2.4GHz WiFi built in SoC and that 5GHz radio is added by attaching separate radio chip to PCIe interface. Previous AX hardware (at least some...

mkx

That's explain why I can't connect to the hap from the main network? I can't ping it either. I've no idea. It might be due to the fact that static IP address is set on wlan2 instead of bridge1? From winbox only the frequency can erase. You can set frequency=auto , band=5ghz-a/n/ac and channel-width...

mkx

Which is more likely: you're working on the right solution and merely need to find the right way to express it, or every one of us opposing this plan of yours is wrong? The former ... because everybody is jealous seeing the great plan of @OP and nobody else ever thought of going that way. BTW, grea...

mkx

Added to discussion in my previous post I have another suggestion: when configuring wireless interface into any of station modes, don't "pin point" radio settings to anything. If AP decides to change its own running values, station may not be able to follow those changes. In particular: se...

mkx

I'll just jump on a fragment: Analyzer: #1101 add action=accept chain=forward in-interface=WAN protocol=udp dst-port=443 dst-address=<QUIC Server> #1102 add action=accept chain=forward in-interface=WAN protocol=udp dst-port=443 dst-address=!<QUIC Server> The second rule is using a "not" ma...

mkx

Any station mode, other than "station-bridge", has problems when transparent bridge between two wired islands is required. In particular: MAC address of wired computer is lost when frame is passing such wireless link and any service, which expects to see unique MAC address (DHCP server is ...

mkx

Default cap config it's called bridgeLocal.

Interesting, I didn't know that.

mkx

Authoritativity of servers depends on whether they are declared (by SOA and NS records) as such for certain domain(s). All other servers are caching servers. Like DNS server at 8.8.8.8 is caching server for mikrotik.com ... and servers of @TomjNorthIdaho are exactly the same in tthis respect. So a ...

mkx

Basically you have 5 switches. Currently help.mikrotik.com doesn't work for me and I can't verify, but from the top of my head none are really good at L3 tasks (they do support L3 HW offload). Which device does have address 192.168.1.1, netgear?

mkx

I'd say that if wireless router is rebooting (and it's not powered via PoE from your MT router), then it's likely an issue of wireless router. But my logic might be flawed, what do I know?

mkx

I maintain my own dedicated Linux BIND DNS servers. North Idaho Tom Jones Are these servers authoritative? Authoritativity of servers depends on whether they are declared (by SOA and NS records) as such for certain domain(s). All other servers are caching servers. Like DNS server at 8.8.8.8 is cach...

mkx

Not going into details, but ... wifi CAPsMAN doesn't offer "capsman forwarding" ... which means that anything, defined in datapath, is applied on each CAP device. In particular: your setting /interface wifi datapath add bridge=Bridge-CAPsMAN-202 disabled=no name=DP-VoIP-WLAN means that CAP...

Search found 13328 matches