MikroTik

mkx

I guess you could.

mkx

You have ether1 on hAP ac2 configured as trunk port. If you want to connect additional cAP ac to ether5 of hAP ac2, then you can simply configure ether5 identically to ether1 ... add it to bridge and set the same VLAN properties.

mkx

Netinstall is your next step.

mkx

The "active address" in that row seems to be assigned to MAC address 00:00:00:00:00:00, so maybe the base issue is not the missing client id, but the (empty) MAC. I can't imagine how could this happen. DHCP server does receive "DHCP discover" and "DHCP request" packets...

mkx

It is more an issue with its routing speed, that may be too slow for your requirements, it should be in the 150-200 Mbit range. And how are you going to do that with only 100Mb ports ??? :lol: There are 2 ethernet interfaces and WiFi being (in theory) faster than 100Mbps. And ethernet ports are (ac...

mkx

"Or" is not an "exclusive or" so you can use "one of two" as well as "two of two" inputs. No, it's "use the one with higher voltage". Only if both supply voltages are almost exactly the same, then device will draw power from both (not necessarily ex...

mkx

Client ID is something DHCP clients supply to server (and not the other way around). When DHCP server decides on which lease to offer, it first checks "Client ID" ... and only if that value was not provided by client, it falls back to using client MAC address (as identifier). Indeed most D...

mkx

In CLI you can get radio link details by running command /interface wireless registration-table print stats IMO, signal strength of around -60dBm is pretty decent. Ideally signal-to-noise value will be as high as possible (30dB or more) which then should offer good service. One value which does show...

mkx

I don't have any CSS, but I'd expect it to have mirror functionality. However, since those frames break CSS, they might not come out of CSS via mirror port. Which means you'd have to use another managed switch between CSS and one of connected servers and configure mirror port on that switch.

mkx

Connecting USB hub to Mikrotik should work, so you should be able to connect multiple USB devices (mind the power output capability, MT devices usually don't allow much more than standard 500mA, you may have to use powered USB hub). I'm not sure though how many serial ports are supported in ROS ... ...

mkx

AFAIK nv2 and nstreme are supported on all radios which run (now legacy) wireless driver. These protocols are not supported by new wifi driver (wifi-qcom and wifi-qcom-ac), which is required on AX devices (and supported on many AC devices). So in short: nstreme and nv2 work on older Mikrotik wifi de...

mkx

CRS devices are essentially switches ... as in L2 devices. Yes, running ROS on them does add L3 (routing), but without careful configuration those functions will be done by (slow) CPU. But: there's L3HW offload and it might work for you. Further reading: https://help.mikrotik.com/docs/spaces/ROS/pag...

mkx

It would be great if you could post also configuration of the other end (the one you can't get into). While looking at config of "this end", I see a few things: there's some firewall, but with a few errors (like using interface which is "enslaved" to bridge as in- or out-interfac...

mkx

It's encryption of the password. Password is always encrypted. If not set, default encryption is used: ccmp https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-SecurityProperties in here it is said, that it is - A list of ciphers to support for encrypting unicast traffic. Correct: e...

mkx

When checking with CLI: note that setting property to empty string (i.e. "") is not the same as not setting it at all. Ok, and then what happens if it is set to empty string (i.e. "") and what happens if it is not set at all? When this property is not set at all, default (ccmp) ...

mkx

If nothing is set in encryption property (but check in CLI if that's actually the case), then default will apply ... which is "CCMP" (good old AES in WPA2). When checking with CLI: note that setting property to empty string (i.e. "") is not the same as not setting it at all. You ...

mkx

According to SFP diagnostics, it seems that Rx works ... One can not be sure if Tx is fine as well without checking on the other side of fiber, but on your side seems to be fine as well.

mkx

@jfreak53: if you can pinpoint the problem to certain packet contents, then you'd make MT (and humanity) a favour if you could sniff off those frames and send MT the capture file. IMO this is the only way allowing MT to actually fix it. Unless they see those packets and analyze which combination of ...

mkx

By whoever manages cisco ... Or, if it's really ISP (I'm surprised you can see config of your upstream router), let them explain to you how you're supposed to use the /56 they are assigning to you. I suspect that they expect your router to do proxy ARP thingie on WAN port ... which is, IMO, wrong.

mkx

Screenshots are (mostly) useless, you can remove it as well. Open terminal window and execute /export file=aynnameyouwish ... fetch resulting file to your management computer, open it with your favourite text editor, redact any sensitive information (such as serial number, public IP address, wireles...

mkx

How exactly is your SFP port configured? Post outputs of commands /interface/ethernet/export /interface/ethernet/monitor [ find default-name=sfp-sfpplus1 ] once My guess so far: since MT SFP is without "+" (i.e. 1Gbps) and RB5009 SFP port is SFP+ (i.e. 10Gbps), you'll have to disable auto ...

mkx

... MSTP is the most universally compatible one.

I thought RSTP was the most common one?

mkx

Unfortunately, that is what I was doing, and it wasn't working. As in: I disabled wifi interfaces via UI (of any kind) but wifi signal was still being transmitted? Or is it you expected the button magically dissable/enable wifi interfaces without you configuring anything special? Or something compl...

mkx

What I don't understand is how these IoT devices' packets are being heard, received, and repeated by the AP onto the wired network when there is no established wireless connection between the IoT device and the AP. You said that APs are Unifi ... so the question is for Ubiquiti support ... to verif...

mkx

In this case, the configuration no longer takes place on the physical switch but on the virtual switch which is spanned over the physical switch. (At least in the world of HPE/Aruba) Therefore it is also a kind of virtualisation. The only difference is that the switch itself becomes virtual, not th...

mkx

Since packets are broadcast, you'll always see them on hEX, passing in any possible direction ... whether they are getting received somewhere or not. And it's up to anyone's guess as to what's their purpose (and if they would cease to flow if all IoT gadgets would be happy with their connectivity to...

mkx

If you insist that management VLAN resides on VID 1, then it's a). Reason: default config uses VID=1 for all sorts of configuration (e.g. PVID on all ports, including bridge CPU-facing port ). It is possible to get it going as tagged (which is where VLAN interfaces come into play), but it's a tediou...

mkx

something like an entry in the context menu Of which menu? You are surely aware that when device is in sleep mode, it doesn't transmit anything and all caches (e.g. ARP cache, list of DHCP leases, etc.) will forget about it probably long before you'd want to send WoL packet to it, aren't you? Which...

mkx

Since these frames are some kind of broadcasts, you may want to set multicast-enhance=enabled on wifi interface of your AP ... it may or may not help with the problem.

mkx

I can't say about user manager, but usually it should work something like this: set [ find customer=admin username=123456789 password="" ] password="verySecretStuff" Not sure about how to go around 1350 users other than having external script which creates ROS script (with comman...

mkx

Stickers already exist:

They are nice. But let's see what proper W considers as improvement to WAF ... I somehow expect that it's not MT logo stickers no matter what color they are

mkx

Any reason not to upgrade your CRS to ROS version 7.16.2 ?

mkx

Mikrotik supports MLAG. Would that fit at least minimum requirements?

BTW, this doesn't seem to have anything to do with topic of this forum section (virtualization) which is running ROS on virtual machines.

mkx

The MIPSBE devices would be great if they added it ... When they first released wifiwave2 package, it's been said that wave2 requires lots of CPU power and lots of RAM. Old hAP ac lacks both (yeah, hAP ac2 with 128MB RAM can run wifi drivers, but barely so ... minimum RAM for wifiwave2 was set at 2...

mkx

I just said anything but some kind of metallic sticker Now who knows what will arrive from Temu...

Definitely post some photos after WAFization of wAP ax ... Ws tend to have similar views on such matters.

mkx

Since your "project" involves some calculations ... just for comparison: when calculating signal coverage of mobile networks using professional RF propagation tools and then comparing it to reality (measured on the field using professional measurement equipment, such as PN scanners and wha...

mkx

yes, it should.

Not really ... wifi-qcom-ac is only available for routers with ARM architecture ... AC devices of other architectures are "doomed" to run legacy wireless driver ... which doesn't support any new functionality (like PPSK) and I believe it never will.

mkx

This is exactly the same on all servers that support LetsEncrypt. It doesn't have to be. On servers which offer more configuration flexibility one can allow only URLs with path names starting with /.well-known/acme-challenge/ and send 404 for the rest ... or 301 redirecting to https ... or tarpit r...

mkx

Ideally there would be 0 dropped packets (because nobody would be trying to anything bad to you). In reality there's always some bots scanning internet for new victims of their deeds. I guess there will be more dropped packets if bots "smell the blood" (there are many reasons for that, one...

mkx

Show us configuration of both devices ... and mention IP address of management PC (running Winbox or web browser) and where it's connected (physically). Without seeing exact configuration it's impossible to tell the reason why it doesn't work the way you wanted it to.

mkx

It’s about wider compatibility: a DHCP client on the physical interface that connects to the modem and a static route to <MODEM-IP>/32 through the said interface applies to both scenarios (ISP with DHCP and ISP with PPP). A static IP in the LAN of the modem applies “cleanly” only to the ISP with PP...

mkx

... and I still wanted several VLANs untagged on the same port (because my WiFi APs are not VLAN aware).

But does this really work for you? Only one VLAN can have bidirectional traffic (single PVID per port).

mkx

In my case, accept (fasttrack counter) is at 2TB and another 2TB for "slow track"... 32MB drop invalid on input and 32MB drop invalid on forward ... and 178MB drop all else (on input ... nothing on forward).

mkx

It does make sense to drop "invalid" packets early, they might match some allow rule down the chain.

mkx

Configure port on router as trunk with all VLANs needed ... here's how to do VLANs in ROS: https://forum.mikrotik.com/viewtopic.php?f=23&t=143620 ... Tutorial may be geared towards switch-like configs, but is usable also for routers (even router-on-a-stick variety). And a suggestion: upgrade you...

mkx

So why bother with a dual IPv4 when you can just have a route that works in either setup? Adding a /32 route doesn't work with peer which uses "normal" /24 addressing ... And, again, doesn't add to security. One has to treat modem as being hostile and adding interface, connecting modem, t...

mkx

I don't think rotating drvices at angle would be a problem by itself. However there are at least two (minor?) issues to think about: wAP60G uses beam forming, so it can direct main lobe in "optimal" direction. But not in any direction, range span is 60° in horizontal direction and only 30°...

mkx

Don't know if this has been discussed already ...

There's such a feature already: port extender. Not many devices are compatible ... and it comes with some serious gotchas. But it's here.

mkx

I didn't manage to get IPv6 addresses not leaking across VLANs when using SLAAC to assign addresses. Did you fix the switch VLAN settings according to @anav's instructions? If port is untagged member of multiple VLANs, then broadcasts of all VLANs will egress through that port (and being untagged o...

mkx

To better understand the process, could you clarify where exactly the packets get tagged in the WireGuard setup? :mrgreen: The smiley you used makes me wonder whether you expect an answer or not. But anyway, here it is: wireguard is IP tunnel so natively it doesn't carry (nor care about) VLAN tags....

mkx

Again (and read my lips:) there's RouterOS version and Routerboot version. Both are distinct.

mkx

RouterOS (as in windows OS) is at 7.16.2. But: RouterBoot (as in BIOS / UEFI) is at 7.16.1. RouterBoot upgrade files are shipped to device along with RouterOS but it's not installed automatically. Hit that "Upgrade" button and reboot device.

mkx

In that case, the Linux kernel is GPL licensed code and as such we should be able to see the sources with modifications from MT ... I don't think that MT linux kernel contains many changes ... apart from some specific device drivers and some patches. I think it's more about missing features. E.g. d...

mkx

The ROS uses Linux kernel underneath anyway and I assume the very same tools underneath as any usual Linux distro ... Here you assume wrong, so nothing you wrote after this point doesn't necessarily reflect reality. ROS indeed runs linux kernel ... but if we can believe MT guys around here (and I d...

mkx

Yes DHCP client sends out broadcast packets when doing DHCP discover and bridge will send these frames out via all member ports. In principle only one DHCP server is necessary per L2 broadcast domain and if there are multiple servers in given L2 broadcast domain (not wrong by itself), it's expected...

mkx

This gbic is working fine with a Ubiquiti Edgerouter X which i'm using right now. ROS is a bit notorious for not supporting properly just any SFP module, thrown at. So the positive experience when using same SFP in different device brand means very little in this case (it only proves that SFP can t...

mkx

Try to check in depth what's going on with SFP+ port and module. ROS is a bit notorious for not supporting just any SFP/SFP+ module properly ...

Also verify as to which physical port corresponds to MAC address, set as bridge MAC address.

mkx

Well, anyway. Logs don't show anything related to hardware issues (link downs or whatever) ... which likely means some L3 problem. In that case you'll have to troubleshoot the issue while problem persists ... like running traceroute (on a LAN PC) towards e.g. 8.8.8.8 and see where things break ... i...

mkx

Errmm ... that's an article from 2014 ?!

That was my point exactly

mkx

With default logging config, ethernet port link-downs are logged. Also PPPoE client outages are logged (and as far as my experience goes, they correlate 100% when there are problems with ethernet port connectivity). With logs you showed (and assuming you didn't filter any events ... either by reconf...

mkx

Even with "plain" file systems (e.g. ext4) it's sometimes necessary to reformat drive (possibly due to lack of support for some type of partition table or some such). But with encrypted drives I'd say it's even more necessary to reformat drive ... it would be logical to me that encryption ...

mkx

Looked at cisco config and I think the problem lies there: interface GigabitEthernet0/1 description ** LAN ** ip address 201.201.201.201 255.255.255.240 no ip redirects no ip unreachables no ip proxy-arp duplex auto speed auto ipv6 address 2001:db8:20a0::1/56 anycast no cdp enable It effectively say...

mkx

IMO the problem is this:

advertising: 1G-baseX
link-partner-advertising:

Note the empty field "link-partner-advertising". Which means that autonegotiation doesn't happen. Try to set port speed to 1Gbps and disable autonegotiation on sfp-sfpplus1 port (under ethernet configuration).

mkx

You actually need to set advertise=yes on addresses on interfaces where there are devices which should use your router as their gateway ... without it, router will not send out RAs and SLAAC then doesn't work. In your opening post, you write "When I try to configure the LAN and define new prefi...

mkx

I just had a quick look at HUB configuration and it seems to me that routing configuration is flawed: /ip address # You probably don't need this: add address=192.168.0.223/24 comment=defconf interface=BR1 network=192.168.0.0 # and you probably don't need this either: add address=192.168.0.223/24 int...

mkx

Is there anything related in logs?

mkx

Can you post configuration from your MT router, at least the /ipv6 part? You can omit firewall part, it probably isn't important in the context of problems you're seeing.

mkx

Can you post the link to tutorial you're referring to? It's quite likely outdated, master port configuration style was abandoned in ROS 6.41 (quite a few years ago) and was replaced by bridge. And before you proceed, I recommend you to upgrade ROS to latest v6 stable (6.49.something), v7 is probably...

mkx

Show us config of switch (text export)..

mkx

At least pist the exact rule which doesn't work for you. And a detail, it might be a hint: firewall rules may be executed before egress interface is known, routing decission is made after most firewall processing is done. Also: screenshot in opening post also hints that ping is originated from route...

mkx

Metarouter is R.I.P. on RouterOS since many moons ago (at least in reality if not officially). It's replaced with container functionality ... but this functionality is not available on all platforms and if one seriously wants to use it (or wants to seriously use it) one better uses a very decent RB ...

mkx

Actualy ax hardware I tested on 7.16.2 on MikroTik have only fixed channels, example 5500 but not 5510 Yup, that's pretty normal on today's mainstream wireless stations (e.g. smart phones) ... they only support standard channel center frequencies. When creating MT-MT point-to-(multi)point link, thi...

mkx

You can't block specific URLs (chosen between different URLs targeting same FQDN host or IP address). Generic reason is that there's no guarantee that whole URL will fit single IP packet. And FW (L7 as well) works with IP packet granularity. So if one uses IP packets with MTU size of 40 bytes, then ...

mkx

In the meantime your devices probably have restarted ...

... or remained in some undefined state if the brief moment without power flowing lasted just the right duration. And in this case one has to reboot device.

mkx

But do think using default 20/40/80Mhz channel width might be cause of at least some of the frequent AX complaints... I don't think that 20/40/80MHz is causing complaints. After all, this kind of channel arrangement is (supposed to be) backwards compatible with devices supporting only narrower chan...

mkx

If considering RB4011 and RB5009 ... then RB4011 is technically inferior in many aspects (slower CPU, uses 2 switch chips and SFP is connected directly to CPU, doesn't have USB port, etc.). Just thought to mention this to contrast higher WAF of RB4011 :wink: Regarding hEX S performance: that rule of...

mkx

about downgrades, there is ZERO logical reason to knowingly downgrade to a version with a known CVE, possibly allowing easy access to the device by a hacker. Zero. Do not try to find it. This is new to me ... that ROS upgrader has built in function to check certain ROS package against database of C...

mkx

You may want to look at output of command /interface/wifi/print and /interface/wifi/security/print (run them in terminal window ... you can start one from WinBox or connect to device using ssh) ... and look for "encryption" property in both outputs. Only then you'll see what is actually co...

mkx

After you uninstall wireless package and install wifi-qcom-ac package - verify that it's actually installed, cAP ac XL has only 16MB storage space which is really tight - (and upgrade routerboard firmware for good measure ... and cold boot device for another good measure), it may be good to reset de...

mkx

I just NEVER see anyone recommend narrowing channel width for AX... which got me questioning physics. My guess: none of the vocal AX supporters considers 2.4GHz band as viable WiFi band any more (everybody is looking at 6GHz now days). I've thought of a reason to go with 20MHz channels (instead of ...

mkx

The problem with communication pausing and/or packets being dropped when there's speed change (most notably from faster to slower, e.g. ingress port is 10Gbps and egress port is 2.5Gbps) is buffering. A switch has only certain amount of buffer and if there's a burst of frames, switch needs to buffer...

mkx

I know AX uses OFDMA to better handle this ... ... so do G and N (and A) ... actually only B uses DSSS with 22MHz-wide channels. So in this respect AX is nothing new. What AX adds is 1024QAM (N stops at 64QAM) so it can reach higher speeds when SINR is great. And reduces subcarrier spacing by facto...

mkx

When doing L2 stuff, it's responsibility of device sending frame (can be originating host, can be router) to find out destination MAC address. And L2 entity (switch) then passes frame to correct port. If sender doesn't know destination MAC address, it can send it to broadcast MAC address. Both when ...

mkx

Problem with using public servers (including iperf3 servers) is that there might be bottlenecks other than "last mile". I tried iperf3 server from the screenshots of @CGGXANNX and I got shitty performance in both directions. In both directions I see fair amount of retransmissions ... and f...

mkx

Anything in logs regarding bridge or its ports?

Are ports, marked as "not running", connected to devices which are powered up?

mkx

And you're entirely sure that <public IP> is the exactly the same that browser uses when trying to connect to your web site?

mkx

Switch Configuration (Port 7 - AP): - Member of VLAN 1,100 - Tagged on VLAN 100 (WiFi) - Untagged on VLAN 1 (default) - PVID 100 The last two bullets contradict each other. Setting PVID on port means that anything untagged on physical media outside the device (e.g. ethernet cable), connected to thi...

mkx

Now here's my main question: do source ports matter? Generally source ports don't matter ... unless they do. As you found out, some ISPs block some well known ports and UDP 123 is often one of them (it used to be abused by some DDoS amplification attacks), UDP 53 is another one. Vast majority servi...

mkx

mANTbox has a pretty narrow-beam antenna. Have a look at diagrams, published in product's quick guide . Since Tx power is generally limited by country regulations, this means that decent signal strength is only available in directions with maximum antenna gain and elsewhere signal strength is pretty...

mkx

a switch and a router - generally speaking, are the same devices ... While we're generally speaking, switch and router are very different devices. (Ethernet) Switch does ethernet frame forwarding between ethernet ports based on SRC and DST MAC addresses and FDB (Forwarding DataBase). And router doe...

mkx

Hmmm ... the way I read OP's screenshot is that WAN Rx is considerably larger than LAN Tx .... which means that router is dropping some of traffic comming to router from internet. Which means that firewall is doing its thing.

mkx

If AP can add/remove VLAN tags as needed, then the switch in between doesn't have to know about VLAN tags at all. The only (minimum) requirement for that switch is that is supports using "baby jumbo frames" ... that is ethernet frames with payload size of 1504 bytes (VLAN header adds 4 byt...

mkx

Now, if the off-center ball with a flat bottom shape is correct, if you mount a wAP in the center of the ceiling, the apartment below your room should enjoy better coverage than you? :shock: Probably not ... because apart from "back side" (where signal level is supposed to be like 20dB lo...

mkx

For play use a cable, any other consideration is useless ... My guess: @OP doesn't have any wired network infrastructure available ... and/or he fell for "use wireless, it's better than fresh bread" motto of sellers of wireless equipment. Now his multi-player experience suffers but he'd p...

mkx

The ancient ROS version is only supported by (almost) equally ancient versions of WinBox ... I'd go for something older than 3.20 (I don't remember exactly when ROS and winbox changed in this respect). Download link is e.g. https://download.mikrotik.com/routeros/winbox/3.20/winbox.exe (change "...

mkx

Why does the Winbox client share the same JSON file with the web interface? I can't understand this design choice. It is possible to create a "skin" ... like hiding certain interface items. And at least winbox 3 did conform to those skin settings. Which probably means that winbox is suppo...

mkx

- 60db is a pretty good signal already. @OP is not saying he's getting - 60 db , he's saying he's getting 60 % of signal. And only <insert your favourite deity here> knows what kind of signal that means. My experience with 3G and 4G phones says that some vendors set 100% at values where service onl...

mkx

Here's an article, somehow explaining different STP options: https://help.mikrotik.com/docs/spaces/ROS/pages/328068/Bridging+and+Switching#BridgingandSwitching-Per-portSTP According to my understanding, BPDU-guard is almost exactly opposite from setting port as edge: BPDU-guard disables port if it d...

mkx

Depending on setup, MAC addresses of "neighbouring" devices can be in different places: /ip/arp/print As already mentioned, this table contains MAC addresses and IP addresses of devices, which somehow communicated with RB device on IP layer. Values in Status column are explained in this ar...

mkx

It seems fine. It's on a paranoid side, I'd do two more things: for performance reasons I'd enable fasttrack: /ip firewall filter add action=fasttrack-connection chain=forward comment="fasttrack established,related" connection-state=established,related It should be pushed to the top of rul...

mkx

The config you posted seems to be old one ... with capsman settings still under /caps-man ... but to provision your hAP ax2 you need to configure CAPsMAN under /interface/wifi ... e.g. /interface/wifi/capsman/set enabled=yes . Etc. I missed that your CAP device is hAP ax2 in your previous post. So y...

mkx

MTU is L3 setting ... which means at least these two things: switches (as L2 entities) don't have much to do with it, they just have to be able to pass those jumbo frames (L2MTU has to be at least MTU+ethernet overhead+VLAN overhead isf used) whole IP subnet has to use same MTU ... all devices and r...

mkx

In addition: does any of LAN infratructure devices have proxy-ARP enabled? I see many people enable it without understanding what it does and then run into problems caused by it.

mkx

There's been some kind of confusing situation. It doesn't make any sense. I have two 4011s with firmware 7.16.1 that were fine a week ago. Today I noticed that DHCPv6 client on both devices stopped working normally. I have not made any changes to the settings. Did devices reboot in between by any c...

mkx

Assuming that ISP device (modem? GPON ONT?) is working as untagged ... you'll have to create something like this: switch port, connecting to ISP, needs to be configured as untagged/access port with PVID / native VLAN set to 41 switch port, connecting to router, has to be configured as tagged/trunk a...

mkx

Two things: you are running the new "wifi" driver on cAP (optional package wifi-qcom-ac installed I presume), so you'll have to configure the matching CAPsMAN on RB4011 ... and for that, you'll have to focus on /interface/wifi and its subtree (that's the place to configure new CAPsMAN). It...

mkx

L2 devices (switches) don't fragment large frames, they silently discard them. And all devices inside same broadcast domain (most commonly this means same IP subnet) have to be set up with same MTU (traffic from small MTU towards large MTU is fine, traffic in opposite direction will get dropped). Th...

mkx

Apparently, I speak truth.

Don't know about that ... your post was around 244 lines too long for me to even start reading it at full attentiveness.

mkx

If I understand DDM he's trying to set frequency to "auto" ... which is default since around 6.47.

@DDM: read about device mode ... in particular, you'll have to enable routerboard property (i.e. set it to yes).

Edit: meh, have slow fingers

mkx

There are a few places where DNS servers are mentioned: /ip/dns/set servers=<list of IP addresses> This one is used for DNS process in router itself to be able to do any queries. If not for other things, it's important to be working for ROS update checks (and downloads). Or anything else that ROS ne...

mkx

It could be some rogue device somewhere on the edge of your network which initiates STP topology changes. And there are plenty of devices which can do it, e.g. any server running VMs can do it (they tend to run bridges for connecting VMs to network) or servers running any containers, etc. I'd start ...

mkx

First off: CRS354 (the whole CRS family of devices as a matter of fact) is a switch not a router. Yes, if running RouterOS, it can route and if carefully configured, it can route at wirespeed (if not carefully configured, it can route at very low speeds, like 200 M bps cumulative between any combina...

mkx

By setting an IP address on the WAN interface you negatively affect setups where upstream uses DHCP or static assignment as the interface will end up with multiple addresses. I don't exactly understand your argument. I guess that vast majority of devices use static IP subnet for LAN (just like ROS ...

mkx

1) it entirely depends on DNS clients. But mostly they operate like this: start using first DNS server. As long as replies are getting back (even if negative answers), client will use same DNS server. If DNS server fails to reply, then client switches over to using second DNS server. And keeps using...

mkx

This is mission "nearly impossible". One issue is DHCPv6 server on ROS ... it doesn't support giving out IPv6 addresses, it only hands out prefixes (there are some recent activities which may improve DHCPv6 server by adding address assignment functionality). And the big issue is client sup...

mkx

Well, why not just mention that in changelog?

When did MT make changelogs easily understandable?

mkx

Perhaps some of those v6-only hardware got R2 (with some slight HW changes, requiring minor changes in some device driver?) Since such change doesn't apply to already shipped hardware, ROS change can be factory-only (and it doesn't have to be publicly available since new devices can not be downgrade...

mkx

On both switches: if you're using VLAN Interface, anchored off bridge, then bridge CPU-facing port has to be tagged member of corresponging VLAN:

E.g.:

/interface bridge vlan
add bridge=SW1 tagged=SW1,ether8 vlan-ids=40
/ip dhcp-client
add interface=Management

mkx

Do any ISPs still use squid proxy/cache servers ? Can't speak about ISPs, but in my company (with a few remote offices) we're forced to use proxy server (squid) for remote offices to be able to exit to internet (the connection between remote offices and main office is over some MAN which offers the...

mkx

There is any Mikrotik modem (only modem) that suports this 3 bands? If you're thinking of attaching modem directly to RB5009, then the only option would be USB modem ... and no, MT doesn't offer any USB modems what so ever. So the only option would be to go with models, mentioned by @gigabyte091 .....

mkx

So I added IP address (from modem's "LAN" IP subnet) to my ether port linking with modem. Any particular reason you chose this approach rather than adding <IP>/32 route? The latter should work for both PPPoE and bridged Simplicity. BTW, adding /32 route doesn't make it any more secure (th...

mkx

Depending on requirements (WAN speed being one of more important ones) ... but hAP ax3 is generally one of better choices.

mkx

It is possible to netinstall (older version, 7.17beta4) while keeping configuration. You can try this and see if it works out.

mkx

Thanks for the image. So wAP AX seems to be directional. Correct antenna gains seem to be around ~7dBi in the frontal direction. Around 7 dBi for 2.4GHz band and around 5 dBi for 5GHz band. There's definition about "directionality": antenna beam width is angle where antenna gain drops by 3...

mkx

Your company switch most likely works as "802.3 af/at" and provides around 48V. Which is pretty much incompatible with RB260GSP PoE-in requirements. Provided power adapter is almost certainly 24V and RB260GSP only works as "passive PoE". Which is, again, completely incompatible w...

mkx

Try disabling LCD altogether. It's known that updating LCD contents affects router's performance quite signifficantly. You posted terse (or verbose?) expirt which includes all sorts of default settings making it much less readable ... at least zo me. So if you do another export (a "normal"...

mkx

As the complete bandwidth of 2.4GHz radio is 40MHz wide.... Not exactly true. WiFi 2.4GHz band extends from 2401MHz (lower boundary of channel 1) to 2473MHz (upper boundary of channel 11, relevant in NA) or 2483MHz (upper boundary of channel 13, relevant in EU and almost everywhere else than NA). W...

mkx

Port extender functionality (either CB or PE) has to be run by switch chip to be effective. So there are 3 possibilities: switch chip used in CRS310 doesn't support this feature support is not yet implemented in ROS documentation is outdated Whichever it is, you could get a definitive answer only di...

mkx

"off-topic": Why you should add the eth port that is connected to the isp modem to the WAN list? (I'm using PPPoE) It depends. In my case ISP's modem has management interface (Web-based UI) and for that it has "LAN" IP address. Even though I put it in bridge mode and run PPPoE c...

mkx

My question is: In short: interface is the thing which delivers frame to RouterOS. Most often it has IP address set. This "property" is not passed to parent entities. E.g. if you have a few ether ports members of a bridge and teaffuc is tagged so there's also a VLAN interface anchored off...

mkx

If bridge configuration on SXT doesn't have any VKSN-related config, then its IP layer communicates strictly vua untagged frames. Diagram mentions VID 2 as being used as native on trunk between cisco snd SXT (at least the upper-left pair), which means that 192.168.2.0/24 should be used in VLAN 2 on ...

mkx

Commenting on config from attached rsc file ... You shouldn't set use-service-tag=yes , it switches over to different type of VLAN headers. And no tag stacking. All in all device config is a mess. So I suggest you to start over: install ROS 7.16.1 on your hAP ac2, it'll improve wifi performance quit...

mkx

What does "D" mean in Current Channel?

I'd say it means DFS.

mkx

However not knowing where they come from is troubling us, we only see the LAN ip and mac address of the source.

Find them ... as per advice by @tdw. Yes, it's manual work, but if you want to catch plaintiff, you need to do some detective work before you send out the guns.

mkx

Not sure about the branding bloat ... it might be necessary to install different branding ... https://help.mikrotik.com/docs/spaces/R ... 4/Branding

mkx

Viktors says wAP stands for "wireless access point". 😉 I think that that is only to distinguish it from wired access points :roll: :wink: :lol: I don't know about you, but I have my Audience wired ... both for PoE and for backhaul. And it only works as AP (no routing or anything else). Wh...

mkx

I kindly ask for some official answer will it be possible to receive updates for this device in future? You won't get any official answer. But experience with MT so far is that they are doing anything possible to provide software upgrades way beyond EOL date. The only problem with 16MB flash device...

mkx

There's another path (possibly a tad easier) instead of netinstalling ... available from ROS version 7.13 onwards: mark package wireless / wifi-qcom / wifi-qcom-ac driver (whichever is installed on device, in case of @OP it may be wifi-qcom-ac or wireless) for uninstallation reboot device upgrade de...

mkx

Those values are correct and same for me, but there are 3 issues: 1) In case of 5490-5710 I have only maximal power 26 dBm with 2.5 dBi antenna. 2) I can not set up manually or automatically any of frequencies beyond 5600 with 20 MHz channel or beyond 5580 with 20/40 MHz channel or beyond 5560 with...

mkx

The intention is that local wifi interfaces are not provisiobed by CAPsMAN (running on same device). With new wifi, CAPsMAN and local wifi setup share same configuration profiles, one can apply same profile (e.g. security) both to CAPsMAN and local interfaces. Local radios will still work with other...

mkx

Just guessing: you have to set address-pool to some existing pool for DHCPv6 server to hand out addresses (seems like it uses prefix-pool only to hand out prefixes). And quite likely you have to provide a pool with same prefix length as is used on interface (and probably router's address on that int...

mkx

I have the same problem. I once used a netinstall a few months ago and after flashing a different version of RouterOS, it left this flash folder (disk) and I can't remove it. It takes up all the space - 16MB and I can't install new certificates due to lack of space. Normally the root of storage, as...

mkx

Hmmm ... what does /interface/wifi/radio/reg-info country=Czech show on your device? On my audience (running 7.15.3) it says ranges: 2402-2482/20 5170-5250/23/indoor 5250-5330/23/indoor/dfs 5490-5710/30/dfs Which more or less corresponds with limits from "your" document). BTW numbers in ab...

mkx

Two things which poke my eyes: disable detect-internet at least on PtMP devices ... I'd disable it on all devices since you're trying to configure things properly yourself. Function detect-internet may help in case when user connects WAN to a wrong ether port. But it also have potential to royally m...

mkx

According to my experience, Tx hash policies on both ends of bond don't have to be the same. Receiver will accept frames no matter via which bond link they arrive. It'll only use Tx hash policy (as configured locally) when selecting between (working) links members of same bond for Tx. So it will be ...

mkx

The problem is that Sonos mesh obviously doesn't care about hetwork loops (neither do unmanaged switches). All managed switches know about xSTP (most have it enabled by default) and those can block one of links creating a loop.

mkx

Any SFP with DDC plugged in (and being queried about their state)? IIRC it's been mentioned that there's a I2C bus which connects all internal monitored parts (power supplies and fans) as well as DDC buses of SFP cages. And if any of those devices block I2C bus for too long, ROS can not poll statuse...

mkx

Indeed MT PoE offering is pretty inconsistent ... but there are a few rare devices which fare a tad better: CRS328-24P-4S+ has internal dual-voltage power supply and offers per-port selectable voltage (24V passive PoE or 48V 802.3 af/at) ... unfortunately it has limit if around 24W per port CRS320-8...

mkx

Check settings in Cloud ... since you have NTP client running (hopefully it shows status synchronized), you should disable time option in cloud settings.

BTW, if you're running NTP only to keep time on router current, you can disable NTP server function.

mkx

Yes. CRS doesn't regulate voltage internally, it only passes whatever supplied. CRS112 is one of few MT devices with dual power input, allowing to select voltage for PoE-out. If one of inputs is missing, corresponding PoE-out voltage is missing as well.

mkx

Contrast this to the RB3011 where the only way to have hardware offloaded VLANs is to perform the configuration directly on the switch chips. But because each of the two switch chips of the RB3011 has no knowledge of the other one, there is no mechanism in the switch chip configuration to refer to ...

mkx

When bond does hash (and based on hash value selects bond link to transmit frame), it takes whatever info configured: L2 - MAC address of source and destination L3 - IP address of source and destination L4 - source and destination port (if L4 protocol, e.g TCP or UDP) uses them. So with L2+L3 any pa...

mkx

Bridge port has to be tagged member of any VLANs which there are corresponding vlan interfaces.

mkx

L3+L4 is less common tho, but it should work good between two mikrotiks L3+L4 can spread traffic between one pair of devices to both bond links ... if devices use multiple connections in parallel. However, a single connection (e.g. single file transfer using SMB - windows file sharing) will still o...

mkx

You haven't mentioned what the log is currently mentioning.
Code: Select all
/system logging action
...

We are actually waiting to see output of /log/print (anything which looks weird and a few lines before weird lines to get some context).

mkx

It boils down to this: interface lists work for interfaces ... and interfaces are the L3 entities (anything with IP address set). In case when one creates a bridge, adds a few L2 entities (ethernet ports, wifi interfaces, etc.), those L2 entities should never be used directly as L3 stuff (this is th...

mkx

It's actually shooting under / between the branches.

Good. So the problem won't happen in Spring of 2025, it'll happen in Spring of 2026

mkx

In case when I connect AP's as a wireless bridge with trunk - no questions about it. I would put specific wlan interface in "admit all" mode. But for users WiFi I would like to avoid it. Well ... what you'd like in this case doesn't correspond with what you can. And since it's up to perso...

mkx

2 - check LAN interface list, both ether1 and ether2 should be there 3 - add all interfaces to bridge (ether1/2 and wifi itf) Actually ... bridge interface should be member of interface list. Individual ports (ether1 and ether2), members of bridge, don't have to be members of any interface list.

mkx

Brief comments: # FIXME: Do I need to explicitly set this? # /interface/ethernet/switch set 0 l3-hw-offloading=yes No. Where did you get this from ? Certainly not from the VLAN guide... I think it's default with recent v7 ... even if device actually doesn't support L3HW which makes this setting irr...

mkx

yes ... just hAP ac2 can't be powered from wAP ax (wAP ax doesn't have PoE-out) yes ... included PoE adapter is "PoE injector" which is plugged between switch and powered device. It is transparent for data passing between both sides. yes ... if hAP ac2 will be running wifi-qcom-ac package...

mkx

could this solve it?
https://github.com/ncravino/mikrotik_en ... our-router

Yes, this would help ... but you'd have to constantly update the list of DoH servers ... so it's a moving target.

mkx

In such a case it _might_ also be worthwhile to export config, netinstall device and then re-apply config again.

With emphasis being "export ... re-apply config" ... which is very different from "backup ... restore".

mkx

I have started from ground up, so I'm not using the defconf of the MT. IMO this is a pretty bad decision. Default MT firewall is quite good and allows for easy adaptation (e.g. for using PPPoE instead of DHCP client as WAN "technology"). It also allows to make adjustments (e.g for port fo...

mkx

Will I loose the capsman configuration ? It is a possibility. As far as I remember wifiwave2 config structure is pretty close (if not the same) as the (new) wifi config structure. So even if you'll have to manually upgrade configuration after you upgrade ROS, it shouldn't be a big problem. Export (...

mkx

Distance is measured as round-trip time and difference of 9 m roughly translates to 30 nano seconds. I slightly doubt that timing resolution in WiFi chip is any better than this. RTT is measured by each radio independently ... so there can be slight differences. Other link properties are dynamic and...

mkx

Also check how much free space is on flash storage ... You didn't mention device model but some devices have tiny flash storage (16MB or even a bit less) and depending on amount of packages installed and complexity of configuration it may run out of space, which may cause ROS to loose configuration ...

mkx

MT doesn't provide separate documentation for particular device models. Several documents do include sections, which only apply to particular hardware, but often this is indicated in a way not really obvious to users not intimately familiar with devices (e.g. often they indicate that some section ap...

mkx

As already explained: you can't have multiple VLANs untagged on single port and having bidirectional communication (with exception of somehow implementing MAC VLAN which tags ingress packets based on source MAC addresses). I recommend you to rethink the network topology ... best would be to install ...

mkx

1. I don't know which exactly manual you're reading. But: RB4011 doesn't really belong in the group of devices mentioned. It's using RTL8367 switch chips and it didn't support VLAN switching configured by switch configuration (under /interface/ethernet/switch), the menu didn't exist. One could only ...

mkx

I think the problem is DOH, if I do a torch I see requests towards 8.8.8.8:443. so AdGuard is skipped. How do I manage these requests to process everything from AdGuard?

You don't manage DoH requests, you live with it.

mkx

Only one vlan go pass untagged leaving ether 2 and that is predicated upon the pvid setting at /interface bridge port Wrong. Correct would be: All configured VLANs pass untagged leaving ether2 but only one VLAN offers bidirectional communication. Just because you don't see use case for something do...

mkx

6.40 is ancient and can miss some functionality. I highly recommend you to upgrade to 6.49.17 (latest v6). I understand you may struggle but IMO this is essential. And yes, netinstall is a almost certainly a must (lack of space likely indicates remnants of unwanted config and/or unnecessary files on...

mkx

but also want to untagg VLAN-20 & (native VLAN-1) traffic on the ether port. Your main problem so far is that VLAN 20 is only mentioned in VLAN interface creation. Bridge doesn't kniw about VLAN 20, so it won't pass it between CPU and other bridge ports ... and other bridge ports are not config...

mkx

Did you manage to set up your PtMP into transparent operation? After this is done, you can add configuration to transparently pass 802.1Q headers (VLANs). Or you can decide not to go with VLANs and keep the whole network (all 3 sites) as one flat LAN. In any case, CAPsMAN / CAP configuration is exac...

mkx

I wonder why this bothers you? Let’s say I have obsessive-compulsive disorder ) My vision of an ideal world (mainly came from years of configuring various Cisco networks) is that user access edge should be always in “access mode”, that is tagged traffic should be avoided at all cost on access ports...

mkx

switchX-cpu is a switch port and doesn't exist outside of /interface/ethernet/switch scope. Ether ports are (in ROS) different as ROS does have capability to work with individual switched ports (as if they were stand-alone interfaces). If you have a bridge and has any of there ports (run by that par...

mkx

We only see the mac address and LAN ip of the device, is there a way to trace the source WAN IP or route over the radio link, at least this way we could work out who it might be. You can't see IP address of your device because (apart from acting as a switch) it doesn't collaborate in malicious acti...

mkx

It's not bug, it's how get works. Like this:

:put [ /interface/ethernet/get sfp-sfpplus1 sfp-ignore-rx-los ]

mkx

3. if LAN clients are on same subnet as pi-hole, then you need to implement the SRC NAT part of hairpin NAT

mkx

When traffic is bridged between both switch chip port groups, there are two bottlenecks: 2.5Gbps interconnect between switch chip and CPU ... if cumulative traffic between ether ports of single switch chip and the rest of RB4011 would exceed 2.5Gbps, then this will slow things down CPU processing p...

mkx

Settings from CAPsMAN (datapath as well) are applied on CAP device. In your setup, you're setting /interface wifi configuration add country=Serbia datapath.bridge=bridge2 disabled=no mode=ap name=cfg1 security.ft=yes .ft-mobility-domain=0x1 .ft-over-ds=yes ssid="EF WiFi" but CAP device onl...

mkx

... best practice is to use MAC of the first ethernet interface that is part of the bridge ... While this might be one of best approaches, it's not flawless ... if one removes "first ethernet interface" from bridge and forgets to change bridge MAC address, it's possible that some problems...

mkx

MikroTik should probably revise the policy on having default configuration? While it can be understood that a CCR does not have a "forward" firewall (and "NAT"), for sure it should always have an "input" firewall. So it does not hurt to have an example of that in the d...

mkx

What to do to resolve the issue?

Throw RB951 in trash can?

mkx

But I didn't like the fact that with usage of datapath I got a tagged wireless traffic

I wonder why this bothers you?

mkx

You cannot have the rb5009 providing separate subnets without double NAT ...

You can. But TPlink has to perform NAT also for "alien" subnets on LAN side ... and I've no idea if that's possible or not.

mkx

Also, I don't really understand the logic of the "update ROS first, then upgrade firmware at next reboot": https://forum.mikrotik.com/viewtopic.php?t=199442 As I wrote in the last post of linked topic, FWF files (containing routerboot images) are inside ROS disk image. Generally installer...

mkx

By setting both spoke devices to station instead of station-bridge mode things get less transparent. So I wonder why you can't set these devices into station-bridge ... what is error message? Seeing CCQ considerably less than say 90 (100 would be ideal) while link is in use means trouble for the lin...

mkx

CRS line of devices are switches ... by running ROS they can route but at fairly low speed. If running recent versions of ROS v7, certain configurations can offload routing and some firewalling to switch chip, increasing routed throughput a lot. Have a look at documentation: https://help.mikrotik.co...

mkx

... if L3 hashing policy is used by them

L3 hashing depends on IP addresses (src and dst) so multiple connections (different ports) will always pass same LACP member. Only if L3+L4 hashing is used, then different connections (different src/dst port numbers) might take different LACP members.

mkx

Some "essential" new ROS features require routerboot upgrade. Such as device-mode. (IIRC there were no such changes in ROS v6, routerboot changes were only necessary when hardware initialization had some problems). Also to boot ROS v7, one had to run some minimum version of routerboot (som...

mkx

Is there a guide I could follow that helps me to setup WiFi?

Not a guide, but refrence manual for WiFi config: https://help.mikrotik.com/docs/spaces/R ... 59120/WiFi

mkx

... although personally I use the later ... Couldn't that be called "preaching virtue but practicing vice"? :shock: Nope, not in case of routerboot upgrades ... I've never imposed (ever so mildly) suggestion in any direction in any of my posts (I'll buy you a beer or any other beverage of...

mkx

do any of ARM devices have IPsec acceleration working yet? It's not just a matter of the CPU architecture. I know. IPsec can as well depend on some particular CPU instructions ... which may or may not be present in some particular CPU implementation ... this seems to be the case. OTOH necesary inst...

mkx

If you don't mind "antenna connector surgery" and ugly-looking antennas on the outer building facade (or on roof top), then Iskra P-60 5G antenna set might fit the needs. They come with 5m or 10m of antenna cable, SMA connectors attached. And their gain is very decent for most of supported...

mkx

... if I'm reading the calculations correctly? Yup. And that's "required clearance" at the middle of link, it's less closer to either antenna. But it's a good rule of thumb to have such clearance along the whole length of link. Beware of trees, they (or at least some of them :wink:) tend ...

mkx

Are you sure your original device was hAP ax2 snd not hAP a c 2? With event of ax devices ROS now includes new wifi driver and config is under /interface/wifi . Older devices ran wireless driver (with config under /interface/wireless ) and some ac devices could run either of drivers (with default be...

mkx

Now #6 might be added as either: 6) You set automatic updates for routerboard firmware but not for ROS. or 6) You do not set automatic updates. Since your rules are intended "for dummies" (seasoned MT admins already live by these rules, right?), I'd go for the former ... although personal...

mkx

No simple way. Exported config depends on packages installed and builds on defaults. But also includes some of default config. So best chance to apply config from export is to start from no config on "recipient" ... and likely there will still be lines which will fail. And if they fail, yo...

Search found 13369 matches