MikroTik

mkx

/interface bridge add name=bridge pvid=33 vlan-filtering=yes No PVID! Interface bridge should be tagged for VLAN 33. The next one is completely wrong: /interface bridge vlan add bridge=bridge untagged=vlan33 vlan-ids=33 should be like this: /interface bridge vlan add bridge=bridge tagged=bridge unt...

mkx

Default configuration depends on mikrotik device type, so are necessary steps to be taken. Most SOHO type devices come with default config which uses ether1 as WAN interface, other wired and wireless interfaces are made part of a bridge (all ports are bridged/switched) which is then used for LAN. If...

mkx

The switch chip version: did you verify the section I emphasized? The switch1-cpu port should be all tagged, but (if I'm right) it's set with default-vlan-id=32 meaning it will untag frames belonging to VLAN 32 when handing them over to CPU (bridge) and thus vlan interface vlan32backbone doesn't see...

mkx

If I understand things correctly (and very likely I don't), these terms really apply fully when one has multiple public addresses. In that case there are ways to acomplish target manually or semi-automatically under ROS. If one only has single public address (usual situation for home users), then th...

mkx

I just want to know what is wrong with it and why NTP isn't working. It's hard to tell. Many of us have NTP (and SNTP) clients working just fine. Which means it's sonethjng specific to your case. You can try to raise a support ticket ... possibly at support@mikrotik.com. They'll probably want supou...

mkx

You can deal with VLANs either using bridge vlan-filtering or using switch chip, not both. As long as you have vlan-filtering set to no, bridge setup does not do any harm. However this part does does harm regardless of the way you'll configure VLANs: /interface bridge port add bridge=bridge interfac...

mkx

Not all updates from 6.49beta27 of Testing release tree went to 6.48.2 ?

In ROS features are generally not back-ported. Only important fixes are. For new features and less important fixes you'll have to wait for 6.49 (release).

mkx

Let's stick to your original topic here.

mkx

I'm slightly at loss about how exactly your network topology looks like and how exactly is MT configured. So I suggest you to post a chart (hand drawing would do) of your LAN (showing fibre router, mikrotik, typical LAN device, together with types of connections between various devices). And actual ...

mkx

Dynamic data (DHCP leases, adress lists, ...) doesn't survive reboot, only static data (written to non-volatile storage) does. For DHCP lease list that's not a huge problem. When DHCP lease timer expires (or rather at half time), DHCP clients will try to renew leases and will request the same IP add...

mkx

You need this

Not necessarily ... OP's PD consumes less than 30W which is well inside 802.1at specs. It's OP's power adapter that doesn't allow him to use at standard (while af standard is up to 15W which is too little for AF11FX).

mkx

So which part of my previous post does not give you enough information to get started?

mkx

All CRS switches can switch wirespeed. Some can do wirespeed slightly more complicated stuff. With ROSv7 beta some (but not all) CRS3xx devices can even route wirespeed.

But the big difference is that CRS3xx are contemporary products offering e.g. 10Gbps interfaces. CRS1xx and CRS2xx are not.

mkx

Even though officially they're still available, essentially CRS1xx and CRS2xx are obsolete.

mkx

Realistically RB4011 can't handle 4x1Gbps WANs with load sharing and what not (but could handle 2x1Gbps).

mkx

For the record, RB4011 uses SoC AL21400 (SoC among other things features ARM cores but contains much more). This SoC can route around 2.5Gbps (give or take), IMO plenty for SOHO users now and good enough for vast majority in next few years. If you trip on "features", like CPU names, then y...

mkx

I don't want it 3 years outdated. Which part of RB4011 is 3 years outdated ? The great thing about Mikrotik devices is that they come with insanely long support time. The only thing that outdates Mikrotik devices is lack of performance, other vendors tend to limit support to much shorter time and t...

mkx

Your setup is missing half of DHCP server settings (in /ip dhcp-server network in particular).

VLAN setup is almost non-existent. I suggest you to read through this excellent tutorial.

mkx

If you need your "RB5011" then either look around and see if some available devices may do what you need or just don't buy Mikrotik at all. What are the alternatives? Guess what? Performance doesn't come for free. If you need performance because you have high speed WAN link for which you ...

mkx

It will work with almost all commands. I don't know but I'd expect not to work on e.g. restore of backup. There might be a few other "huge" commands where undo doesn't work.

mkx

You may want to verify that selected NTP servers are actually accessible from your location (you can run ntpdate -d -v <IP address> from a linux host). Just checked and the first one (129.6.15.28 is time-a-g.nist.gov) is fine from my location, however the other one (132.163.96.5 is ntp-b.nist.gov) i...

mkx

I can only agree that bridge in MT world is a mess because it's not explicitly clear which settings are about bridge (the switch-like stuff) and which settings are about bridge (the interface). It's confusing and hence the article by @sindy (it took some time for all of us to find out all of the dar...

mkx

One thing I'd change is this: /interface detect-internet set detect-interface-list=all I'm yet to hear about anything useful about this setting enabled, but there are reports it can break random things. Other than that, your firewall is messy and I certainly hope all of those PCs with exposed RDP se...

mkx

Not really. but it does not tell you that the PVID setting is acting on ingress and egress. IMO you already covered this case under 2.B.ii.b ... because when bridge interface has PVID set (and it always has it set, if not other the hidden default PVID=1), again all frames pass bridge the switch lik...

mkx

Proper NTP client takes a while before it reaches status: synchronized (usually a few minutes). The initial firewall filter in your export (chain=input action=accept connection-state=established,related) should allow NTP client to work (but should have allowed the SNTP client to work as well if it's...

mkx

Smells like ARP problem but it's hard to tell without seeing full router config (text export) and some chart explaining network topology (seems it's not entirely trivial).

mkx

looks like that I need to update my OP once again. Not really. What you're missing is that bridge has two or three personalities (depends how you count). When you consider those personalities separately, you don't have to change your explanation. This topic explains bridge and its personalities nic...

mkx

I don't know what you can do. Getting a cat6 (or better) LTE modem would definitely help, this way you could avoid locking wAP to B7 or B3 cells ...

mkx

Your case is pretty simple and there's no need to play with mangling and routing marks. Remove everything shown in your config excerpt except for the default route ( add check-gateway=ping distance=1 gateway=192.168.0.1 ). Simply adding IP address (with correct subnet mask) to ether5 already allows ...

mkx

NTP package is not available for HAP AC. hAP ac is MIPSBE and MIPSBE has ntp package (get extra packages file for your ROS version, mine is 6.47.9 and it contains all packages including ntp-6.47.9-mipsbe.npk ), upload it to your router and reboot. Works great on my RB951G devices (MIPSBE as well). ...

mkx

R11e-LTE (LTE module included in your device) isn't capable of CA. Which nowadays severely limits DL speed (as most of MNO's cells are quite loaded and only way of getting good throughputs is by using CA). That could explain lower DL throughputs. Beware that on B20, where RSRP is likely highest, cha...

mkx

Done - but shouldn't DFS=ALL be set by my regulatory domain? Why is this important? Should it be enabled on both - master and slave? Default is to use all channels feasible. The lsit depends on a) regulatory domain, b) selection of indoor vs. outdoor vs. any . The problem with DFS channels is (as I...

mkx

CCR2004 no switch chip.RB3011 is too big.

CCR2004 is a proper router and thus does not lack switch chip. The rest of devices on your list are SoHo devices (a completely different device group).

You're saying RB3011 doesn't fit standard 19" rack?

mkx

Actually cloud timesync is broken. I've read explanation by Mikrotik that cloud timesync is very approximate and only useful for setting approximate time for logs. For everything else disable cloud timesync and use (S)NTP client. In fact you should only use single time sync method as multiple fight ...

mkx

While you might get upset about watchdog not triggering you really should adjust list of allowed frequencies so that "master device" (sw15) doesn't select a DFS frequency by setting skip-dfs-channels=all ... even if reboot occurred earlier it could still happen that sw15 selects a DFS freq...

mkx

CRS328-24P does have fans and OP contains data about their RPM. However fans are temperature driven and it seems MT thinks these temperatures are fine or else fans would run much faster (I seem to remember they can go as high as 5000 RPM or something like that).

mkx

MT devices in general (both ROS and SwOS) don't implement IGMP snooping quite properly and it's hard to get it working right (with SwOS giving much less possibilities for tinkering with settings even more so) . My own sollution is to have it disabled but this might not be sollution for you if cummul...

mkx

The simple design is guarantee for batteries to get destroyed sooner or later. Even if one uses very simple lead-acid batteries, there are a few problems: when charged, a 12V lead-acid battery has voltage of around 13.7-13.9 Volts. Exact number depends on exact manufacturing process (e.g. normal vs....

mkx

What you want is perfectly doable. However you'll have to reconfigure both devices (RB951G and hAP lite) for use of VLANs. Reconfiguration of both will be done in similar manner: you will use two VLANs: one for IPTV and one for LAN. Use any number between 2 and around 4000. Let's say you'll use VLAN...

mkx

And can't the router ask the chip? Obviously it can't. Not easily at least. I don't think MT devs deliberately threw the functionality out of ROS for ac chipsets (and newer) just for fun. There must be a reason for lack of Tx power information and I guess it has something to do with in-house develo...

mkx

No wasnt aware that the large switch setups with sWOS dont have a config to export.....

Any switch setups with swOS only have one type of human-readable configuration export: the graphical one.

mkx

Documentation about switch trunks, supported by CRS1xx/CRS2xx, is slightly scarce, but judging from configuration example shown in this document it is possible to assume it's similar to bonding with layer2-and-3 transmit policy. And with this kind of bonds pair of hosts (same pair of MAC addresses -...

mkx

Problem is that default value very much depends on exact radio chip model used. Not a problem with pre-ac hardware which can show exact values used. So when you'd set tx-power mode to "card-rates" and check running values, you'd get all the information you need. With newer chipsets that's ...

mkx

Slightly off-topic, but I'll correct myself (before many other users do it):

As this forum is un-official user forum,

Actually this forum is official forum. The user part is true, MT staff don't necessarily react to bugs reported (only) on this forum.

mkx

As this forum is un-official user forum, I suggest you to send your suggestion/request directly to mikrotik, e.g. via e-mail address support@mikrotik.com

mkx

Assuming fibre router is not Mikrotik, you can not set Mikrotik LAN address to same subnet as fibre router's. Instead Mikrotik should perform NAT and all the rest. Default config on SOHO line is using interface list throughout firewall rules (including NAT) and if you stick to that concept, you shou...

mkx

Add configuration something like this; /interface bridge add name=bridge1234 vlan-filtering=yes /interface bridge port add bridge=bridge1234 interface=ether4 pvid=1234 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes /interface bridge vlan add bridge=bridge1234 tagged=bridge...

mkx

In ROS (currently) only one bridge can offload operations to hardware. If configuration is same for all brudges, ROS automagically selectd one for offload. You can affect the selection by manually disable HW offload on all non-preferred ports. Actual limitation is one bridge per switch chip, but mos...

mkx

Just to make it clear: which device (CCR or anonymous router) should take care of VLANs? If it's CCR, then you can use bridge, which is kind of a software bridge and can deal with VLAN tags as well. Have a look at this fine tutorial, applies to CCR as well.

mkx

Absolutely not. Even when ROS v7 will be officially released, you should wait before deploying in production environment. The track record shows that there are always some teething problems after release of new minor version, let alone after major version (such as jump from v6 to v7).

mkx

If trunk port is set to vlan-header=leave-as-is and vlan-mode=secure then on ingress VLAN table (otherwise governing egress filtering) would be consulted. And there's no "untagged" option in that table (could be that it would be possible to add VID 0 to that table, VID 0 is sometimes used ...

mkx

Hmmm ... only now I see the weirdness of your setup. I still think it's bug in code which prints out the ARP table, possibly it expects that one MAC address is only available through one of bridge ports (and in your case, bridge ports are vlan interfaces on top of ether5) which would be usual case. ...

mkx

There's a myriad of issues, revolving around 32-bit timers with offset to UNIX epoch. Linux kernel has support for 64-bit counters since ages ago (also 32-bit kernel), but there are other (mostly 32-bit) applications (and glibc and ...) which not necessarily use it yet. And those include ssl librari...

mkx

/interface ethernet switch port set 4 default-vlan-id=5 vlan-header=add-if-missing vlan-mode=secure Port with index 4 uslually relates to ether5 ... and setting I highlited means it'll untag frames from VLAN 5 on egress [*]. Which obviously is not what you want. So unset the default-vlan-id (or set...

mkx

/interface vlan add interface=bridge name=VLAN-1111 use-service-tag=yes vlan-id=1111 The setting I highlited is toggle between using 802.1q ("usual" VLAN) and 802.1ad ("QinQ" VLAN). Most users want to use 802.1q tags and corresponding setting is use-service-tag=no (which is defa...

mkx

I don't think anything is wrong with your setup, I guess it's a bug in printing host table. Bridge is supposed to do independent VLAN learning. Plus it's customary for VLAN interfaces to use physical interface's MAC address (at least linux does it) so from router's point of view your two gadgets mig...

mkx

Curious: although it's probably moot with the relatively small amounts of data we push, wouldn't separating out guest users with multiple bridges (which occur at the hardware level) be faster than segmenting with VLANs (which occur at the software level, right?) ? As @anav mentioned, bridges in ROS...

mkx

PVID=1 setting is implicit default on all bridge ports when vlan-filtering is enabled. thx but there is no traffic with VLAN-ID=1, so why are they listed? There is active, physical link only on port 01-10 (and 16). Only traffic with VLAN ID=100 runs over port 01-10, so why does VLAN10 say that ther...

mkx

We can only speculate how it works. All those other brands that talk in 100%,90%, 75%,50%,25%,10% TX power setting, how do they implement it? Over all MCS encodings, or is that wishful thinking (again)? Indeed we can only guess. Unless somebody with some professional measurement gear can do some me...

mkx

PVID=1 setting is implicit default on all bridge ports when vlan-filtering is enabled. If you really want to get rid of it, set trunk (tagged only) ports with the following settings: /interface bridge port set [ find interface=ether2 ] frame-types=admit-only-vlan-tagged ingress-filtering=yes (same f...

mkx

best surge protector sofar = 2x 1gbps media converters connected with 1 meter of single mode fiber ...

... powered by? Don't forget that power adapters are "guilty" of quite many surge damages, overvoltage can pass those as well.

mkx

This way you make an AP that is performing way below par, that is interfering more than any other other AP, that looses connection easily, since the chipset with 6-7dBm variation in allowed TX power according MCSrate is in use. Even if your assumption that setting antenna gain higher reduces Tx pow...

mkx

Only one (minor) thing: on trunk ports I always set vlan-header=leave-as-is ...

mkx

As @own3r1138 noticed: default settings are quite good and it's advisable to keep them. It's much better than most of what you can find on internet. If you need some other functionality (e.g. some ports forwarded), then add needed rules, no need to remove anything. Study defaults, understand them be...

mkx

(*) Max TX power in the specs is not what the radio can transmit with a certain MCS, but how well the radio controls the side lobes of the channel, to remain below the legal line of sidelobes in the RF spectrum. Higher MCS rates have a more complex spectrum and do leak more sidelobes than lower MCS...

mkx

ACME working over HTTP needs HTTP server running and delivering (right) response to request from letsencrypt server. This can either be done using already running web server (and asme script simply stores response to correct place in web server's file structure) or acme script can temporarily run it...

mkx

/interface bridge vlan add bridge=bridge-local untagged=wlan1 vlan-ids=10 doesn't go together with /interface wireless access-list add allow-signal-out-of-range=20s interface=wlan1 mac-address=xx:xx:xx:xx:xx:xx vlan-id=10 vlan-mode=use-tag And setting vlan-filtering actually enables the former sett...

mkx

Normis explained in post #32 above: you can set Tx power lower than default (maximum considering country regulations and hard-coded antenna gain) using parameter tx-power . In webfig it's available in advanced section and you can set value if you select "all-rates-fixed" as "Tx Power ...

mkx

Regarding RB2011 in switch mode: The /interface ethernet switch port export is always confusing to me because it's using index numbers instead of port names so it's hard to correlate this section to other sections of config. Command interface ethernet switch port print provides missing information. ...

mkx

Standards ... one thing is to support normal SFPs which (semi-)transparently pass bits between left and right. And it's a pitty these are not more compatible. Which mostly is not result of poor standards but rather bad practice by major players who introduced incompatible extensions. The other probl...

mkx

What beats me is that in Cisco world there are two names for frames without 802.1q headers: untagged VLANs and native VLANs. I'm not fluent in ciscoish so I guess that there can only be single native VLAN per switch/stack/CDP domain while every untagged VLAN port can belong to different VLAN. To me ...

mkx

Mental masturbation: if devices are not locked against illegal settings, they can not be legally sold in certain market. While some nations are used to smuggling goods from third countries, other nations (which might represent considerable markets for MT) are used to buying goods from local business...

mkx

Mikrotik support for ONT SFPs is non existent so some might work and most don't. Even compatibility with "normal" SFPs is incomplete (mildly put). Which means that trying to get ONT SFP to work with any MT device is similar to trying to win a jackpot, even if particular ONT SFP works with ...

mkx

I dare to say the setting Bridge -> Ports -> Bridge Port -> VLAN PVID is clear to me. I assume this is the ingress rule: Untagged traffic incoming: The VLAN tag is added according to the PVID. tagged traffic incoming: the VLAN tag is read but not changed. Yes, your asumptions are correct. However t...

mkx

I think that setting all 4 ports involved (two at each end) to ingress-filtering=yes frame-types=admit-only-vlan-tagged might solve your problem of switches detecting a loop when you're half way through moving VLAN99 from one link to another. The thing is in the first setting which would drop VLAN99...

mkx

According to wikipedia article the PSE (netPower) has quite some constraints about PoE out voltages: when in 802.3 af mode, output voltage should be in range between 44V and 57V. Maximum power is limited to 15.4W. when in 802.3 at mode, output voltage should be in range between 50 V and 57V. Maximum...

mkx

Basically you can configure VLANs either with bridge filtering or on switch, you should not mix both. If you want to configure SFP+ port on CCR as trunk as well, then you have a problem. Your CCR is unfit for switching duties between any pair of ports apart from ports ether1-ether4 (which are run by...

mkx

I'm pretty sure VLAN99 gets into a semi-loop state when you configure two ports as members even on single end. In this moment switch (which has both ports configured as members) starts sending certain frames to both ports and the other switch (which is still configured with single port member of VLA...

mkx

Would there be any reason to use Bridge VLAN filtering on the RB4011 ?

Only if RB4011 was not simply a router-on-a-stick ...

mkx

So if I understand you right: currently you have VLAN 99 over primary link and everything works fine. If you start to configure VLAN 99 also for secondary link, switches detect loop? But there indeed is (a partial) loop in that case. You can have it like that (I guess you have redundancy in your min...

mkx

When you power on both devices and nothing much works ... is the DAC link up&running? You should be able to check that if you configure management computer with static address from 192.168.10.x/24 subnet and connect to ether24 of CRS. You may want to configure a management port on RB4011 in simi...

mkx

Ah, so your unit is one of old ones. The bridge vlan-filtering can only be offloaded on CRS3xx devices. The rest can not offload vlan filtering and one has to configure VLANs on switch chip (under /interface ethernet switch).

mkx

Your CCR1009 quite likely doesn't have switch chip built in (only early models without SFP+ port had one) and hence nothing can be HW offloaded. Your CCR is a great router but mediocre switch/bridge.

mkx

You could try to run TCP traceroute ... targeting same destination IP address, but different standard TCP ports (e.g. 443 along with 53) and compare the path. And choose some normal destination known not to be hosted by some large cloud hosting company as those tend to geographically distribute serv...

mkx

Should i netinstall clean firmware? And how can i do it? Netinstalling your device would certainly be a good action. Prior to doing it do export of configuration ( /export file=yourexport ) so task of configuring the unit afterwards will be easier. The process of netinstalling is quite well documen...

mkx

I tried also nc -w5 -z -v <MyIP> 53 and Connection to <MyIP> 53 port [tcp/domain] succeeded! I dont know what to say.... How my ISP can make a port in my router to respond to requests? You ran the command from where? If you ran it from a device connected directly to WAN interface of your router, th...

mkx

My guess is that your ISP is redirecting/blocking connections to port 53 (DNS server) ... possibly in attempt to block DDoS attacks which abuse mis-configured routers of your ISP's clients.

mkx

/interface detect-internet set detect-interface-list=none

mkx

If I was in your position, I'd disable the feature altogether. I don't know if anybody (I dare to say: MT staff included) has ever found a good use of it, while there are reports of random things breaking and problems stopped after disabling this "feature".

mkx

Quoted sections of RB4011 config which are incorrect: /interface bridge add admin-mac=08:00:00:C0:00:00 auto-mac=no comment=defconf name=bridge Bridge absolutely needs setting vlan-filtering=yes . But first fix the next error ... /interface bridge vlan add bridge=bridge tagged=sfp-sfpplus1,bridge vl...

mkx

Could it be related to detect-internet "feature"?

mkx

Did anybody check the new wave2 drivers for 7.1beta if they support spectral scans?

mkx

I don't think MT actually supports ONU SFPs in any way. If it works somehow it's purely coincidental. So I wouldn't hold my breath waiting for your suggestion to be implemented. Besides, if you really want your suggestion to get to MT devs, you'll have to communicate it directly, this forum is user ...

mkx

Both methods (bridge vlan and switch chip vlan) only matter in switched/bridged environment which is when multiple ports are members of same vlans (or subset of thereof) and pat of traffic simply passes router/switch between these ports (almost) unaltered. When only single port is carrying all vlans...

mkx

Next thing you could try is to netinstall the router.

mkx

Did you click on MAC address to connect?

It's a good sign that it shows in winbox, this means it's up&running, but configuration might be in weird state. Also beware that if ROS running on RB is older than 6.40 you have to use older winbox as well (I think 3.1x should be fine).

mkx

You beleive that there nothing to worry abour? I worry about Koreans knowing my TV watching habbits so my TV is banned from internet (also helps against automatic unattended firmware upgrades, some were not exactly user-friendly in the past), but can access DLNA server in LAN (keeps my daughters ha...

mkx

The only way to power the hAP lite is via the 5 Volt USB power supply, correct?

Looking at Powering section of product page it certainly looks like that.

mkx

In theory[*], 71.beta5 should be better than 7.0beta6. But since it's still beta (and beta in MT world means less than usually in ICT world) you never know if your particular unit will like it better or not. So before you upgrade your unit, do the following: create (binary) backup ( /system backup s...

mkx

(MKX is faster in typing than me. I will post it anyway .... :-) )

I'd be disappointed if you didn't. It's always pleasure to read your highly skilled and very informative posts, I always learn something new.

mkx

The article should apply to CRS326 ... but if you have some weird scenario (can't figure it out completely from your vague description), then you have to adjust the config from article for your particular case. You can post config (at least from one of units) so we can see if there's room for improv...

mkx

installation=indoor or outdoor is not physical, but rather political setting. In certain countries there are certain frequency channels which are only allowed for indoor use (these usually come with lower Tx power limits as well) and other frequency channels are allowed for outdoor use ... which ac...

mkx

My current network is running off a Ubiquity Access Point with no VLAN and I would like to seperate network traffic using VLAN's as per below: 1) WLAN1 - 192.168.16.0/24 - No VLAN currently (would like to add a VLAN 100) 2) WLAN2 (Guest) - 192.168.168.0/24 - VLAN 999 I have configured the bridge wi...

mkx

In theory it might work with careful configuration. Can you post actual configuration of one of switches (I guess you configured both in similar fashion)? (execute /export hide-sensitive and copy-paste output here).

mkx

License is "baked" to NAND in a way netinstall doesn't touch it. Which also means you can't transfer the license to new NAND just like that. I suggest you to contact support@mikrotik.com and ask them about your options.

mkx

I wouldn't do it, there's real chance that either PoE out port gets damaged or that both PoE-powered devices will not be stable. If you really want daisy-chain both PoE-in devices and run them off single PoE cable, use RBGSP injector which has 2A limit.

mkx

Yes it can. RB260GSP comes with 24V power adapter and both hEX Gr3 and hAP ac lite can take this voltage. However, you'll have to reconfigure hEX from defaults: hEX can take PoE in via ether1 while default config uses ether1 as WAN port. In your case you'll want to use ether1 as LAN port (and dedica...

mkx

Is router successfull in obtaining DHCP lease from FIOS router? Check by running command /ip address print and verify that there's a dynamic address bound to ether1_WAN.

mkx

I guess my question was too generalized to attract helpful responses ... will try to ask better questions next time. The question was indeed very general. On a side note: which particular Mikrotik device type are you using? SOHO devices (most Mikrotik devices except CCR, CRS and some high-end RB de...

mkx

PC01 -> Dumb switch -> to Mikrotik ether2 interface then on my bridge then out to eth2 -> switch again then to -> Server So your router is connected to switch with single ethernet cable, connected to ether2? Unless PC01 and Server are in different subnets (and RB has two IP addresses set on ether2/...

mkx

Mkx is almost correct.

Right. I stand corrected.

mkx

It's a shame that a single CPU thread limits it in such a way though. ARM-based routers (RB4011, CCR2004) are quite good actually, their single-core performance is not too bad. Imagine your disappointment if you used a CCR1072 instead ... on paper it's got tons of umph, but in your case it'd be muc...

mkx

Ethernet 2: ip address 192.168.3.5/24 ip address 192.168.10.5/24 ip address 192.168.0.220/24 Simply setting all 3 addresses to same interface (ether2) does the trick. But the clients cannot see each other. The router can see them all tough. What exactly is the question? That clients should not see ...

mkx

What does /tool profile cpu=all show during ongoing iperf test? I wouldn't be surprised if only single CPU core gets loaded. How does running multiple parallel streams ( iperf -P 8 ... ) affect overall throughput? The thing is that when routing, ROS will use single CPU core for all packets belonging...

mkx

Try to use newest version of winbox. The way password is stored on RB in how password is negotiated with winbox changed somewhere around 6.44. Old versions of winbox don't work with new versions of ROS and vice versa.

mkx

Because device with IP address 192.168.188.165 needs to communicate with gateway at 192.168.188.1 ... the longest netmask covering both addresses is 24-bit long. Because, believe it or not, the link between RB and FIOS router is an entire subnet (because it's running on top of ethernet which is typi...

mkx

You can extend numbering to 192.168.1.1/ 23 ... which gives you another 256 addresses (192.168.1.1-192.168.2.254 ... usable host addresses are then also 192.168.1.255 and 192.168.2.0). You have to change netmask on router's LAN interface, change address pool for DHCP server, change network mask in D...

mkx

add address=192.168.188.165/24 interface=ether1 network=192.168.188.0

Fixed WAN IP for you ...

mkx

Probably as soon as ROSv7 will start working for everybody else. The date? Your guess is as good as everyone's.

mkx

Index numbers (you're using 0 in your example) are dynamic and are created when running print command. They are only valid until next print (the worst thing would be that add or remove or similar doesn't invalidate them). Which means you can't reference entries like this from scripts, you have to us...

mkx

What is "SOP" and "MT" ? S tandard O perating P rocedure M ikro T ik In that case, it seems that a script which is scheduled often could (potentially) degrade the Flash quickly which would subsequently adversely affect the device operation. Yes. So you should think of ways to ma...

mkx

Address list uses resolved IP addresses (repeats resolving after DNS record TTL expires so it keeps IP address semi-uptodate) ... since ultimate destination is some akamai cloud address, it could be same IP address is whitelisted for some other domain. If you want to block according to FQDN, you eit...

mkx

If TV is the only device to be isolated and is connected to dedicated port on router, then use of VLANs is un-necessary complication. The way OP started was fine. There are a few gotchas though. The biggest might be the bug in default configuration where ports ether2-etherX are bridged but LAN IP se...

mkx

The internet is up and running, but not working. How can disable "detect internet" help? I don't think any MT user ever found out what function "detect internet" offers that's not available otherwise. However, there is a number of reports of weird problems which went away after ...

mkx

Regarding NIC support (which includes 10Gbps NICs) there are 3 ROS variants: ROS v6 x86 Due to age of ROSv6 and underlying linux kernel it generally lacks support for newer devices. Which (sadly) includes most 10Gbps NICs apart from NIC based on early chipsets. Nothing much will change about support...

mkx

It is fine to configure L2MTU as high as it gets. But for (L3) MTU you have to consider a few things: L3 MTU has to be the same in whole subnet or else some members of same subnet won't be able to communicate (peers with smaller MTU will silently drop packets) when client and server are in different...

mkx

The only reason why IPv6 matters in your case is that server.local somehow resolves to IPv6 address. BTW, bridging two L3 subnets and then using bridge filters (or switch ACLs if you were using some real switch for that) to block traffic is, mildly put, weird. And since your OP was extremely scarce ...

mkx

All what is remembered after a reboot has been written into flash. When exactly does the device performs a write to Flash ? SOP is to write changes imediately. MT stated that simply cutting power to device shouldn't affect it in any way. However there are indications that marginal power supply migh...

mkx

Alb only differs from tlb when the other end is (a dumb) switch connecting multiple clients which don't know anything about this bond. Multiple clients are needed because many bond modes keep traffic between same set of peers (i.e. server and client) on same link to ensure in-order delivery of packe...

mkx

When device is used as a switch, the (L2)MTU setting doesn't matter (much). It has to be large enough not to drop large frames on ingress. If L2MTU is set larger, it still won't make passing frames larger. Where MTU matters is if interface us used for L3 i.e. if interface has IP address set. In this...

mkx

Post full config for review, it's hard to guess which minor detail is missing/wrong. Execute /export hide-sensitive file=anynameyouwish from terminal window and open resulting text file in any text editor, then copy-paste config here inside [code] [/code] environment.

mkx

2. [Tab Bonding] Create a bonding with ether4 and ether5 as slaves and mode "balance rr" (this appears to be the equivalent for Netgear static LAG). I called that one "bond45" I don't know what exactly is Netgear's "static LAG" ... however RR is not the same as XOR. XO...

mkx

Your wording and action don't match when you're talking about adding bond to the bridge. Adding to a bridge is done thusly: /interface bridge add bridge=bridge1 interface=bond0 pvid=10 What you did was to setup VLAN membership of port bond0 (which is done automatically by the command above due to pv...

mkx

If you set up wireless interface according to local legislation, then most probably there will be no difference between Tx power of all three units, clients will measure same signal strength from any of those APs. These days most countries limit wireless devices to 20 dBm or (less frequently) 30 dBm...

mkx

mkx

Post configuration, it's hard to tell what's wrong without seeing it. Is it "native" x86 installation or a CHR?

mkx

I didn't say there was no difference. In case A traffic from other VLANs will bleed through ether5 (broadcasts, multicasts and some unicast packets if switch won't know exact egress port for dst MAC address, ...). It goes against the gist of setting vlan-mode=secure ... Even more so if you don't se...

mkx

The easiest way is to add comment to the entry ... and then toggle disabled flag by searching the comment. E.g. /ip firewall address-list add address=192.168.88.88/32 list=somelist comment="My address #1" # from some script set the address list entry disabled /ip firewall address-list set ...

mkx

Would setting the "bridge uses firewall" setting get this done?

It would if HW offload was disabled for involved ports. And if APs were connected to different ports of a bridge.

mkx

If in practice there is no difference (even though A does not make sense), then I would rather use A. I didn't say there was no difference. In case A traffic from other VLANs will bleed through ether5 (broadcasts, multicasts and some unicast packets if switch won't know exact egress port for dst MA...

mkx

If your hotspot only supports 2.4Ghz, then you can create virtual interface as STA on 2.4Ghz and keep the Wifi AP interface at same time. wireless mode station should only be used on master interface because it has to follow the serving AP (or phone tethering internet connection) ... virtual interf...

mkx

What does

/system ntp client print

show?

mkx

Case A (ether5 member of VLANs 1, 01 and 20) doesn't make much sense since ether5 port is set to untag everything on egress and can only tag untagged frames with single default-vlan-id on ingress.

mkx

@anav, with your mileage in ROS and VLANs I still don't get what exactly is bothering you. I'll try to answer never the less (but I'll probably miss the point). Bridge personality of bridge ... just carries frames between ports ... doesn't care if they're tagged or not. When you're talking of bridge...

mkx

DHCP server only cares about Client ID. Client ID is value supplied by DHCP client when requesting DHCP lease. It usually does contain MAC adderss, but it can be some other identification. Client ID can be of 3 types: text, integer number and MAC address. MAC address, shown by DHCP server, is FYI on...

mkx

I still fail to understand your question. Which bridge personality (according to classification by @sindy) are you talking about?

mkx

That's perpetual "problem" with certificates. Solution is to add DNS entries (resolvable for LAN hosts only) which link public host name with local IP address.

mkx

The problem is now how can i secure my router from external dns requests when "allow remote requests" is enabled? It's firewall rules for chain=input . Default firewall setup (in recent ROS version on SOHO devices) already blocks most connections from WAN, but it really depends on changes...

mkx

The only time when firewall actually cares about anything else but IP addresses (and port numbers) is in L7 firewall. Which doesn't work for HTTPS traffic because it's encrypted.

If you describe use case, you might get better answer.

mkx

Wireless clients (most notably battery-powered ones, such as phones and tablets) frequently enter sleep mode and during sleep they don't listen to radio. AP knows that and buffers unicast packets until devices wake up. This way packets get delivered, but delay has high jitter. So if you want to test...

mkx

So it seems that "undo" buffer for safe mode is not endless. You should exit and re-enter safe-mode after each block of commands that might break your management connection (whereas your management connection survives).

mkx

wlan interface is historically capable of dealing with VLANs itself. If wlan interface has vlan-id=400 vlan-mode=use-tag (set in /interface wireless section), then from bridge point of view this is tagged port and should be added as tagged member to appropriate VLAN. If, OTOH, one uses wlan interfac...

mkx

Our on-duty configuration parser @anav missed this question: How do I assign an IP address to the bridge that exists in VLAN50? as just adding "192.168.5.254/24" to the bridge only ever replies locally and then prevents further access to the device. For this you'll have to add bridge (the ...

mkx

All three 2.4GHz antennas run on the same frequency and SSID, but all three (Omni +the two APs) handle their own DHCP with a different network IP scheme. This pretty much breaks roaming preformance: when client sees different AP with same SSID, it often assumes L3 network would be contiguous and af...

mkx

What is setting of dns-server property in /ip dhcp-server network? If it's not your router's IP address, then clients will use other DNS server and will miss configuration from /ip dns static.

mkx

The tutorial author is using DNS-01 challenge (instead of a more often used HTTP-01) which requires you to have DNS server for your (sub)domain under your control. In this case the certificate receiver (Proxmox) doesn't have to be publicly accessible. Doesn't have anything to do with particular type...

mkx

Problem is that quite some OSes (e.g. Windows) will use different short-lived IPv6 addresses (even multiple at any given time), constructed in SLAAC manner, and will use those addresses at will. This mostly matters for out-going connections but that means you can't rely on IPv6 address only to contr...

mkx

This won't work because SMTP server doesn't know it needs to use MT as gateway. There are (at least) two ways of dealing with it: set up static route on SMTP server to use MT as gateway. I don't know how feasible that would be if SMTP server should only use MT as gateway for SMTP to most destination...

mkx

Post actual configuration of both devices, it's not really possible to know what exactly you configured from your description. Possibly it's not what you think you configured but what you actually configured.

mkx

If you follow instructions by @bpwl ... I don't see a point in having Mikrotik in the first place. It will act as a dumb switch ... which you already have in place. So you really have to decide the role of Mikrotik router in your LAN. However, if it is to be firewall for your LAN, then ... well, it ...

mkx

I just noticed now, winboard dosn't find it anymore, is that because i turned lldp off? I mean that winboard dosn't find the board? It seems that MNDP (neighbour discovery) runs on top of LLDP. However, you should still be able to connect to your router using winbox if entering its IP address (or M...

mkx

Proper solution would be to add static route towards 192.168.88.0/24 via gateway 192.168.2.1 on ISP router. And add some firewall rules which would allow desired connections and block the rest. And drop SRC-NAT on mikrotik, ISP router should do it for both parts of network. I'll assume you really wa...

mkx

I don't have experience with such behaviour under CAPsMAN. With stand-alone wlan interfaces it's normal that they become inactive (i.e. without R flag) when no client is registered. This is normally not a problem, interface changes state to "running" quickly enough for initial traffic betw...

mkx

Have a look at HW acceleration capabilities per device model. If the combination of encryption algorithm, hashing algorithm and key length is right, HW offload should happen automatically.

mkx

Which part of answer by @SiB is not clear? LTE interface (or mobile broadband interfaces in common) don't need DHCP client running to get IP address from ISP. That's handled automatically when modem is registering to the network (modem can't be registered to the network without having at least one I...

mkx

The forwarding setting only blocks client-to-client forwarding when both clients are served by same AP. If you want to block connectivity between clients of different APs, you have to use either bridge filtering on common device (either switch or router, where APs are connected to different ports of...

mkx

OK, if we get bat on topic: if OP would test if powering device with at least 12V, that would give conclusive answer to the question if marginal power supply caused the problems or not.

mkx

It all depends on the destination MAC and IP addresses of your traffic in each direction. There should not be a problem with layer-2-and-3 , did you change the setting at both ends? transmit-hash-policy does not have to be the same on both ends, as name hints it only affects Tx direction. Using lay...

mkx

The solution by @erkexzcx will work only if the extra addresses are handed out exactly the same way as A1 (come with gateway and subnet mask). If you follow the solutuon, then RB's firewall won't protect server unless you configure bridge to use IP firewall. Another option is to create a DMZ bridge ...

mkx

You've got mechanism to automatically black-list some addresses. It can happen that "trusted" host lands on the list. You also have white-list. You should allow connections from white-list before dropping any of black-list (both static list and auto-list).

mkx

If you want to do it in hardware, then you'll have to tell which hardware. BTW anything passing wireless can't be HW offloaded, only traffic between ethernet ports (managed by same switch chip) can be handled in hardware.

mkx

Device is shiped standard with a 24V power adapter. Go figure.

mkx

No, I'm saying band 41 (n or without it) is a frequency band which can be used for 4G and/or 5G. It then depends on particular equipment whether it supports one or both technologies (which are similar but obviously not the same). With terminals (modems) it's not very often that software upgrade woul...

mkx

Most of frequency bands now used for various mobile technologies, are legally speaking technologically neutral. Which means that operator gets license to use certain sub-band to build public mobile network and it's up to operator to choose technology to operate. A pretty notable example in Eutope is...

mkx

Never powered anything bigger than a wap or cap off the ether 10. If it comes with PoE in, there might be a way to use it... It's not the PoE in, it's PoE out. RB4011 has limit of 600mA output when voltage is less than 30V. If using power adapter shiped with unit (24V 1.5A), that means 14.4W availa...

mkx

There is no secret setting which completely changes personality of a ROS device. What Quickset setting "router" does it preloads device with certain set of rules. If you wanted to, you could manually configure those starting from no settings (which is what @erkexzcx was suggesting). What m...

mkx

In the left part of winbox you have "New Terminal" icon ... click it and you'll get CLI access. A question: after you set device into router mode, did you do any changes in any other configuration parts? The thing is that quickset can't understand anything done outside it's very limited sc...

mkx

When the 'hAP ac2' is connected to its power supply adapter through the round power connector, is then the 24V available on its Internet/PoE 'in' connector so that it can supply the device that receives the internet, so actually working as Internet 'in' / PoE 'out' ? No, hAP ac2 does not have PoE o...

mkx

It looks like you connected WAN cable to one of LAN ports. WAN port in default configuration on Mikrotik is ether1 port (the left-most port), the rest are LAN ports. If this doesn't seem to be the problem, please provide the textual export of configuration. You can get it following these steps: open...

mkx

I'm glad you made your RB4011 work as you want ... regardless the way you managed it. Actually, even if my router is old, it's still was running the current stable RouterOS version. (6.48.1) The problem with old devices is the following: even if they are regularly upgraded to recent ROS version, the...

mkx

Based on your remark about ssh service I strongly advise you to start configuring RB4011 from defaults ... and not by blindly copying settings from old 3011. Reason: recent ROS versions come with pretty sensible defaults (which blocks pretty much everything from WAN). Only add things you really miss.

mkx

You started to mix in bridge vlan-filtering ... which should not be used together with switch-chip vlan setup. First decide which way you want to do and then we'll help you. BTW, my post #2 above was based on switch-chip vlans (since you had that in your original post). It does not apply (directly) ...

mkx

You can read more about the problem in this article. In short: get yourself another AP by same vendor and you'll likely get it working in short time. Use any other vendor and you'll have problems this way or another.

mkx

The post @erlinden linked is generally fine. However the setup has one drawback (which might be show stopper): it is not possible to directly access devices "behind" wireless device. As you're mentioning server (for which powerline adapters are not reliable enough), I guess you are actuall...

mkx

I did run the "no-smoke.bat" file, so all should be ok :-)

8.3 rocks ;-)

mkx

Mangle means that fast-track is out of question and that severely increases processing load (and thus reduces practical throughput). You did not tell what throughput you require, but none of devices you listed (if those are full model names) is exactly powerful. Mangle is not really memory-demanding...

mkx

Pwr-line pro (PL7510Gi) product page states

This product works best with other PL75xx series products, but is backwards compatible with PL64xx and PL74xx as well.

So the combo you're after should work.

mkx

From the explanation I fail to see what exactly is the problem wiith wlan1 and wlan2. It seems you'd like to have wlan1 and wlan2 set as access ports to VLAN 20? You can achieve that by setting vlan-mode=use-tag vlan-id=20 on wlan1 and wlan2 interfaces while adding those as ports of bridge VLAN-BR.

mkx

Configuration on bridge1 seems overly complicated to me. From a quick glance nothing is sticking out as wrong to me, but frankly I don't want to delve into config. There are quite a few mis-configs (which don't necessarily break the whole config, such as assignment of IP addresses to each of bridge ...

mkx

I can't say anything about devices on bridge2 ... but since you can ping bridge1 from your phone, then I guess bridge2 is pretty much transparent for communication between phones and bridge1. Since bridge2 is getting its IP config via DHCP, you have to verify that DHCP server also sets default gatew...

mkx

In principle MTU is end-to-end property of a connection. So you should set it to lowest number known to exist on a connection, in your case it would be 1492 gross (and substract tunnel overhead from that). It may happen that even this setting is too big if there's an intermediate segment of the conn...

mkx

It's hard to fix realtek problems on mikrotik ... other than configuring mikrotik such that realtek works (e.g. changing channel width to 20/40 if that's what makes realtek happy).

mkx

If you create address list where entries have timeout set, then this configuration doesn't get stored to permanent storage. It is lost on reboot and you have to refresh it every now and then, so this might or might not be a solution for you. There's no way for ROS to use anything else than built-in ...

mkx

1. Yes, for devices with small disk (i.e. less tgan 128MB disk) this is tgen RAM disk.
2. Yes, configuration related to "surviving" packages will be kept intact.
3. As written: after you "unbundle" ROS once, it'll stay unbundled after normal upgrades (using winbox).

mkx

In mikrotik settings for ingress and for egress are pretty independent of each other (but not entirely). In example by @Guscht: ingress settings say that both tagged and untagged frames are allowed on ingress and that untagged frames get tagged with PVID (in example it's 1). Additional setting "...

mkx

Any IP service (e.g. DHCP server) can be run by any network-connected device, it just needs to have adequate capacity. However it doesn't have to be a dedicated device. But when concetrating multiple services to a single device, take care to reduce number of failure points in your LAN. A typical MT ...

mkx

Thanks for the reply, it is specified as 802.3af compliant. So per your details, it will not be compatible. Where is this particular model listed as 802.3 af/at compliant? Are there any passive PoE devices that are recommended to power a RouterBoard? Mikrotik is selling its own passive PoE injector...

mkx

@Jerre: you should set up hAP lite as access point / switch. Unfortunately there isn't a predefined template for that (a QuickSet setting), so you'll have to do it manually. It's not a trivial task, but if you feel you're up to it, we can list you the necessary steps. Or find a post with steps alrea...

mkx

In short: PoE injector and RB951Ui are not compatible. Since you're mentioning 48V PoE ... I'll assume it's a PoE injector adhering to 802.3af/at standard. Your RB951Ui on the other hand only supports passive PoE (passive means it doesn't do any active handshake with PSE) and accepts voltages betwee...

mkx

It is possible that in upcoming ROS versions all ARM-based devices will see lower idle power consumption, MT implemented dynamic CPU frequency scaling on those platforms ... which should help save a watt or two and decrease CPU temperature a bit.

Search found 5724 matches