MikroTik

mkx

I have no experience with Securityonion, so I'm just speculating here ... Are you sure that the mini PC is able to process in real time whatever software requires? Unlike actual HTTP/FTP/etc protocol between client and server, where any of parties can slow down the transfer, your "sniffer"...

mkx

This is feasible way of doing it. As to wifi radio modes ... it's up to you, constraints are: both AP and station have to run same generation of drivers (wifi or wireless), mixed drivers are not compatible in station -bridge mode. Since each device can only run one generation of drivers, in case dep...

mkx

So does that mean there’s basically no difference in this particular scenario between using a wAP ax or the MikroTik Wireless Wire with 60 GHz? If you're thinking about going through concrete floors/ceilings, then lower frequency is likely to fare better ... and IMO 60GHz is guaranteed to go nowher...

mkx

@MKX for the version 7 ECMP it uses L3 hash policy as depicted below. Can you explain these further?? I don't have any experience or knowledge of ECMP. The terms you're asking about sound similar to some terms from (L2) bonding (which I believe I understand well enough), but I've no idea whether th...

mkx

How about using a pair of PLC devices? MT doesn't have any contemporary offering, but there are other vendors offering it.

If there happens to be a (neglected) coaxial cable available, you could use a pair of MoCA devices (usually works way better than PLC ... again no MT offering).

mkx

And if you, despite advice by @sid5632, decide to beam data up ... you might have more success by using reflection from neighbouring building than through two concrete floors/ceilings ... if neighbouring building has large vertical surface facing towards "your" building and is not too far ...

mkx

Wanted to transition to (dual-stack) default IPv6 everywhere to check if there are any bugs in the long run. Perhaps it will give you a bit of incentive in this direction: I've been using IPv6 at home for almost 10 years and I've had no problems with it, all devices I use work with IPv6 just fine. ...

mkx

OK, so it's not possible to block RAs towards individual devices. But it is possible to block all IPv6 frames from individual devices using switch ACL. Drawback is that device in question will see RAs, it will configure self with GUA (based on SLAAC) but won't be able to use it. Which can cause a sl...

mkx

with Fasttrack you can get Full Speed with the 750GR3
and with 7.18beta this is also working with IPv6

In some use cases fasttrack can't be used. E.g. in case by @OP.

mkx

I was just looking at the hap lite tc test specifications. Its speed is very close to hex. It's really stupid. Hex has a 2-core, 2-thread processor, but hap lite has a single core with a low frequency! They are different architectures and hAP lite just might be using CPU which does more per core sn...

mkx

No, not when device is running ROS. You'll simply have to accept that ROS is not the most performing OS on many of supported devices.

mkx

Not sure why would EoIP be required? WiFi interfaces are L2 interfaces already, couldn't they be directly used as bond members? The only gothcha I can think of is link-monitoring setting, in this case it would probably have to be "arp" instead of "mii". Since such bonding will be...

mkx

Your previous switch was 1Gbps (if I understand your opening post right) and your CRS304 is 10Gbps. Which is a huge difference when it comes to UTP cable. Even though you're using a cat7 cable (indicated on your chart), it might be of low quality, it might be improperly terminated, it might be (slig...

mkx

You want to have a dual-band device as AP with wireless backhaul. Having both stations and backhaul on same radio creates major performance bottleneck (each frame gets transmitted over same radio twice, together with all the wireless overhead which increases with multiple devices trying to use airti...

mkx

Which particular model of router are you using? Not all models can do switch rules (even if the config subtree exists).

mkx

There are many possible reasons for device to misbehave. Unfortunately one of them is (invisible) configuration corruption which is also saved in binary backup. If such backup is restored on (newly installed) device, corrupt setup is back in place and waiting to screw things. So if the problem will ...

mkx

CPU in hEX Gr3 is not exactly speed monster. It's got 2 CPU cores (with 4 threads altogether but I don't know how ROS utilizes that). And the gotcha: all packets of same connection are handled by same CPU core/thread (processing may move between cores, but there's no parallel processing). And window...

mkx

It could be the new 'security' feature introduced in 7.17 - /system device-mode has been changed. By default install-any-version is set to no which prevents installation of anything with a lesser version than listed in allowed-versions ... Right, but default setting for allowed-versions is 7.13+ .....

mkx

I didn't try ... but how about /interface/wifi/access-list on CAPsMAN device?

mkx

You can't block advertisments to some clients at the source, being multicast they are sent to all devices within a layer2 network Just to double-check, is it possible to block on L2 level via /interface ethernet switch rule, or multicast cannot be blocked per client (per MAC) even there? It might b...

mkx

For minimum ROS version you have to check this: /system/resource/print Sometimes it can be different than routerboot (I have a wAP ax with factory-firmware: 7.15.2 and factory-software: 7.15.1 ). Anyway, proper way for downgrading is to get list of installed packages (disabled as well) upload all co...

mkx

So what's the Influence of clientid in the defintion of DHCP leases? In principle modern DHCP servers (I can't say anything about tens of years old DHCP servers) assign leases according to client ID value ... which is provided by clients. Vast majority of clients indicate that CLient ID is MAC addr...

mkx

The problem is that on ports with 1003 vlan I cant get any traffic... accept if I add vlan as an interface to the bridge... then some how the traffic starts.. Config should allow switching between ports ether2, ether3 and ether4 without problems. The problem is probably communication to device(s) c...

mkx

It’s a shame they saved a few cents on this motherboard architecture. Quite often, even in cheap devices, the WAN port is connected directly to the SoC, but that’s not the case here. :( It's a feature: this way any of ports can be assigned any role and it's then done equally well. Which adds to ver...

mkx

The only issue I observe is the band steering from 2 to 5 and back that does not work very well and I would have liked to see some parameters I could tune myself. My experience goes that band steering works very well for some (mostly that's newer) stations and doesn't work for some (in particular H...

mkx

My question is where to run CAPsMAN to obtain the best performance. As @holvoetn already explained (using different words): CAPsMAN does very little[*] so it doesn't matter much which device runs it. I agree that some central router (or edge router in installations without central routers) would be...

mkx

You can reset it to default by running same set command with different value. Finding out the default value for certain settings can be tricky though. One of them is e.g. L2MTU which can vary wildly depending on hardware type (and even device model, there are cases where different device models use ...

mkx

There's service "detect internet" which in theory helps to set router correctly for people who don't fiddle with manual settings (too much), but has potential to screw things up ... One of mechanizms is using DHCP client procedures even on interfaces where DHCP client is not configured. So...

mkx

It looks almost right (apart from the fact that ports ether1, ether5, sfp1 and bridge (the CPU-facing bridge port) accept untagged frames with PVID=1).

So what exactly are those "strange errors"?

mkx

I expect enabled CRS317 coming onlline may become grandmaster if none is present or current grandmaster loses an election. I'd expect that as well ... but I certainly hope that PtP implementation does check if device (which is about to become boundary clock) has a reliable and stable clock source. ...

mkx

CubeSA 60Pro ac brochure says that PoE in can go up to 57V. Both btochure and product page mention 802.3 af/at which mandates input voltage range up to 57V. So the product page is likely incorrect.

mkx

If it bothers you that GPeR acts as PoE pass-through ... then follow advice by @sindy about PoE pass-through jumpers on GPeR device. SWITCH is CATALYST 9200L POE, and if i attach poe device on port out of GPER it ok, but if attach LAN PC gper it off. So I'll ask one last time: did you disable PoE p...

mkx

Boundary clocks will have holdover capabilities to handle temporary loss of GM connection. So they can master time. So the question is: can boundary clock (cold) boot without seeing GM clock? IMO by definition it can't, but some implementations might allow it. Just like NTP server can't start servi...

mkx

You do have PoE switch (on the left of your diagram), which acts as PoE PSE. And you have PoE device (GPeR), which acts as PoE PD. So PoE negotiation (this way or another) will happen on the left segment of your "network". If it bothers you that GPeR acts as PoE pass-through ... then follo...

mkx

I'm doubting that RouterOS 7.x has yet hit kernel version 6.x... but if and when it does, could this be looked at? Experience with move from ROS v6 to v7 shows that ROS v7 series will keep same kernel as it is in use now (5.6.3) until the end of series (just like v6 is still at kernel 3.3.5). So yo...

mkx

GPeR has to be powered over PoE. But it's pretty flexible as what kind of PoE. It takes 802.3 af/at powering, it also takes passive PoE with voltage range between 24V and 57V. The gotcha with powering over long lines is that PoE load detection might not work reliably due to added UTP cable resistanc...

mkx

I guess that L2MTU setting affect number of frame buffers available. E.g.: if switch chip has 1MB of memory, if L2MTU is set to 1516 bytes, then this means space for 691 frames buffered. Setting L2MTU to 2000 bytes reduces number of buffered frames to maximum of 524. Not only that, it will halve th...

mkx

Boundary clocks are by definition only relays (smart because they include/add information about delay induced by device but nothing more) ... If there isn't an external GM device in your network, then you want your device to become GM. Then the only remaining question is what kind of timing source i...

mkx

Please stop setting MTU underlay as "just enough"! I guess that L2MTU setting affect number of frame buffers available. E.g.: if switch chip has 1MB of memory, if L2MTU is set to 1516 bytes, then this means space for 691 frames buffered. Setting L2MTU to 2000 bytes reduces number of buffe...

mkx

When using old CAPsMAN, do/did you use capsman forwarding in datapath? It doesn't exist in new (wifi) CAPsMAN ...

mkx

Not exactly an echo, rather explanation.

mkx

You can't set CPU frequency like this?

/system/routerboard/settings/set cpu-frequency=auto

(or press <TAB> before entering auto to see possible values)

mkx

Generally speaking switches have switching capacity larger than any individual port (including swirch-router or switch-switch interconnect). Which means that connecting server to switch, which also directly connects "main" clients (or large subset of clients) of server, generally offers be...

mkx

The RB2011 is a "special" device that has two switch chips: https://help.mikrotik.com/docs/spaces/ROS/pages/15302988/Switch+Chip+Features Atheros8327 (ether1-ether5+sfp1); Atheros8227 (ether6-ether10) The "modern" way to do what you want to accomplish (good on *any* Mikrotik har...

mkx

> *) net - added initial support for automatic multicast tunneling (AMT) interface; Is this the solution to route mDNS over WireGuard without using an EOIP tunnel? AMT is a tunnel by itself ... not encrypted, only encapsulated into unicast UDP packets. My employer is using it to receive certain mul...

mkx

There's a general standard caveat in documentation saying only one ROS bridge can do hardware offloading, and default best-practice is "only one bridge total unless you know you need more". I actually kinda wonder if that's an accurate description of ROS software limitation, or is it a bi...

mkx

NAT is connection tracking thing and as long as connection is active, NAT will do its job. And will do the inverse for return packets if they get delivered to router. There are two possibilities for SRC NAT: action=src-nat and action=masquerade. There are two important differences between both possi...

mkx

Haven't seen it yet, you should be using CAPsMAN to get this to work seamlessly.

Indeed to get roaming between different APs one needs CAPsMAN up and running. But to get roaming between radios of same AP one doesn't need CAPsMAN, relatively default config should suffice.

mkx

It's not OK to force devices to roam to certain APs. The problem is that whatever is configured (including the whole 802.11 r/k/v), it's still device which decides to move to another AP. The only difference between simply using same SSID and using the whole mobility suite is that in later case devic...

mkx

I remember a couple of reports of people that needed to reset the unit before being able to access it, you can try that, you have nothing to lose. Or it may be the opposite. I've received my brand new wAP ax and initially the password from the sticker worked, I've used it to log in using winbox 3.x...

mkx

Well, I got it working. For some reason, setting the prefix hint to 0 fixed it. Nice to read that you have it now working ... I'm very curiouse as to the prefix size they actually gave you because a prefix hint to 0 in the IPv6 prefix field indicates that the requesting router has no preference for...

mkx

Yup. Product page says

(emphasis is mine)
In addition to emphasis, can you also translate from Mikrotikish?

What (the heck) is a cross cable?

I've no idea ... perhaps @OP should ask MT support directly (and post their answer here, it should be interesting).

mkx

And on certain models of AC devices ... those which can run wifi-qcom-ac driver. As to how it works: mobility works between radios, controlled by same entity. Basic setup is single dual-radio device which controls both/all radios and mobility works between those radios. Advanced setup is network of ...

mkx

Question on the Atheros 8237 switch chip that is in my hap2ac (rdb52G). The documentation at this page https://help.mikrotik.com/docs/spaces/ROS/pages/15302988/Switch+Chip+Features#SwitchChipFeatures-Introduction indicates that you can change the advertised speed of an interface to multip different...

mkx

You have vlan-filtering=yes on bridge and CRS1xx can't offload such bridge to underlying switch chip. So all traffic passes CPU. This was the case since forever, nothing changed with 7.17 ... so you can consider yourself lucky that it didn't bite you earlier. You have to configure VLAN stuff on swit...

mkx

In theory a 802.3af/at compliant PD should accept both Mode A and mode B (it is the PSE that decides on which pins to apply power). Your Cisco most probably uses mode A (1,2+/3,6-). It is possible that either the thingy is not fully 802.3af/at compatible or that (for whatever reasons) it is defecti...

mkx

Is hAP AC2 free of the "ether1 as uplink" problem?

I stand by @holvoetn and his answer.

And a spoiler: hAP ac2 doesn't suffer from same problem, all of its wired ports are equal, all are controlled by (same) switch chip.

mkx

You can verify that USB port works and that USB device attached does present to RouterOS kernel by running command /system/resource/usb/print It should shown your attached device along with a few devices with name xHCI Host Controller . Yet another thing is to get USB device working ... and with ROS...

mkx

@jaclaz: even if that was possible, how would you do it for architecture you don't have at home (e.g. ampere)?

mkx

running 2 hAP ac2 (one with the 256MB and one with the 128MB flash storage) this model is supposed to have 16MB of flash, how did you get 128 or 256MB? I guess poster is confusing flash and RAM (early units came with 256MB RAM, the rest came with 128MB RAM as it was always advertised). All units AF...

mkx

New pool won't be created automatically. So if you expect to have more than around 200 devices in your network, then you have to make subnet larger than /24 ... /23 allows for 510 addresses, /22 adds another 512, etc. Increasing subnet requires some dilligence (selecting the right DHCP address range...

mkx

Ah, when looking at /interface/wifi/cap I wasn't looking good enough ... and didn't see the slaves-static setting. Thank you for pointing it out.

mkx

1×RB5009 as main router and CAPsMAN + 3×hAP ac² as APs and bridges,

So how do you handle slave wifi interfaces in this scenario?

mkx

I believe your guess-work is far more educated than mine. I've no idea about how ROS works around such cases.

mkx

After upgrade-induced reboot, log usually has something about upgrade process outcome ... if it fails, log tells the reason (insufficient storage space is one of reasons, various problems with optional packages are showstoppers ad well).

mkx

So I've got this scenario: my LAN is fully VLAN tagged, all MT gear is running 7.16.2 except wAP ax which is running 7.17 I have hAP ac2 configured as main router and lately CAPsMAN. It doesn't have wifi-qcom-ac drivers installed, so it's wired-only I have wAP ax which runs wifi-qcom and can, thus, ...

mkx

@mkx, let me disagree - it is actually not the same ...

I agree it's not the same, I used word "similar" ...

mkx

It's similar problem to having two devices with same IPv4 address (albeit with different MAC addresses) ... it's possible to have it but involves NAT and multiple routing tables. Since NAT in IPv6 is a different beast, I'm not sure if (and how) your problem can be solved.

mkx

Just to be precise:

edit: I figured it out, I'm routing my traffic through nginx proxy manager that handles the domain based routing

nginx doesn't "domain route" traffic, it (reverse) proxies it. Which is L7 operation - contrasted to routing which is L3 operation.

mkx

It can only be an issue when: IMO none of ifs help with OP's considerations ... because they're out of device admin's hands. But there's an up side: netinstall is not triggered without doing a few things and all involve physical access to device at some point: button press while cold booting device...

mkx

The problem with using capsman is that checking config locally doesn't actually have to reflect running values. One thing that CAPsMAN definitely doesn't do is overwrite configuration stored on CAP devices. So running export doesn't show any of CAPsMAN-provisioned settings. Running "monitor&quo...

mkx

But the only reason I have that is because I can't remember which South American country is better :D Was it Panama? Brazil is better than ETSI most of times: 30dBm vs 20dBm on 2.4GHz, 30dBm vs. 14dBm on 5735-5875 MHz ... but not always: ETSI has 30dBm vs. 24dBm on 5490-5730 MHz. According to reg-i...

mkx

Have you been handed over a 7.18 nightly build amongst whose feature the aim was to fix this issue you also faced? No, @timemaster seems to have received it this time. And I know it happened before (although rarely). So you have nothing to worry, there are no 'exceptional' forum members which recei...

mkx

Can we get v7.17 out the door and move to v7.18 beta so we can see what's new..... this version dragging now. I do appreciate stability and rigorous testing but I also want movement and new features as there are stuff I'm waiting for which may or may not be in next version. A counter proposal: can ...

mkx

Where do you got your source then that 7.18 would feature a fix for this issue?

See my second paragraph (add while you were posting your latest post).

mkx

Would you happen to have a link to the changelog to expectat in 7.18? Nightly builds are alpha/developers' versions and nothing is guaranteed to enter to beta of same version. So there's never any changelog for nightly builds. We've seen stuff removed from beta versions (rarely, but it did happen) ...

mkx

UniFi: vlan 1, 400, 401 (tagged) Mikrotik port 4: tagged with vlan 1,400,401. vlan 400 and vlan 401 works fine (seperated dhcp servers on Mikrotik interfaces) But vlan 1 does not work - i I bind the ip address on Mikrotik to vlan 1 interface, the connection to the Unifi will be lost. Unifi expects ...

mkx

Everything works except VLANs.

Without posting your config nobody will be able to help you. So either post it or, if you know better, go ask help somewhere else (yes, it sounds rude, but that's how it is).

mkx

At least wireless config can't be applied in any of two mentiobed ways. hAP ax3 runs wifi-qcom driver while your old hAP lite runs wireless driver ... and configuration of both is completely different.

mkx

All employees have a cell phone......

How about using good ole public announcement system incude office building to announce internet outages? Those announcements will automatically reach only people physically present inside offices without them being stalked.

mkx

Simple captive portals (almost) never work for intercepting anything encrypted. They work nicely when "a friendly" device first obrains connectivity and starts to check if it can access (certain servers on) internet. Captive portals appropriately block connectivity and direct client to ope...

mkx

Are you, otherwise, able to access internet sites from router?

And another consideration: right now this forum feels sluggish to me (with 500 errors as well) which likely means that MT servers are under some kind of DDoS attack. And that likely includes DDNS servers as well.

mkx

Your Brocade config indicates that Brocade will do the routing between VLANs. Are you sure about it? If yes, then you'll have to configure DHCP relay on Brocade. If not, then Brocade needs "router interface" only on management VLAN.

mkx

I expected NAT rule with action dst-nat not to catch any connection from my local network unless it is changed to src-nat. So I guess connections outside goes thru both src-nat and then dst-nat? SRC-NAT and DST-NAT are very distinct operations, they happen at very different times (dst-nat is pretty...

mkx

a dstnat port remapping seems like a possible solution, it should be something *like*: Very likely full hair-pin NAT is required as well if the non-standard port is to mapped to standard one for LAN access as well. And hair-pin NAT comes with a bag of annoyances (e.g. "why don't I see real cli...

mkx

Not really (@OP is asking how to instruct browser to connect to non-standard port). Whenever client app needs to access server app, it has to know which port to use. In your case client app is browser and they assume standard port for http (80) and lately they assume https (443). Browsers are perfec...

mkx

It's strange some ISPs hold on to 20 year old concepts. I guess it suits them well for a few purposes ... one of them is user management (less fuss to e.g. assign static IP address and IPv6 prefix). And obviously they don't bother about (under)performance of 3rd party routers, they just care about ...

mkx

If you want to use hAP ax as client to hotel's wireless network, then wifi interface has to be running in mode=station. Also channel settings have to be on default (auto) settings. And then there are higher-level settings which are wrong/missing, e.g. DHCP client tunning on wifi1 interface (now it's...

mkx

You have to set pvid=99 on ether8 ... currently these are not correctly related: /interface bridge port add bridge=Bridge interface=ether8 /interface bridge vlan add bridge=Bridge comment=MGMT tagged=ether23,Bridge,ether1 untagged=ether8 \ vlan-ids=99 Default pvid setting (and thus not shown in expo...

mkx

the adapter is OK (24V). Idle or under load? Marginal power adapter might output close to 24V when idle but drop voltage under load. And failing capacitors also mean very uneven output voltage which isn't shown by normal voltmeters, oscilloscope does OTOH. The uneven supply voltage can disrupt devi...

mkx

I'm using 6to4, but I'm assuming there's probably a way to switch it to 6to6 as I can get a single IP6 address and it's probably going to be a little better? Actually not likely. No because IPv6 (the outer layer added by tunnel) has larger headers which means lower payload per same MTU ... which ul...

mkx

Their network team cannot see the ONT (cryptic wall box) and the IP allocation is not coming through it anymore. They cannot see very much because of this. This is wrong …. If the network team cannot see the ONT …. Another possibility (very common where optical network owner is different than ISP) ...

mkx

While waiting to see configuration export, just a comment: "static ARP" is calling for problems ... while it doesn't really provide any security (setting MAC address on interface is only too easy).

mkx

This setting sets DHCP Option 15 (the domain name that client should use as suffix when resolving hostnames via the Domain Name System) ... and it's entirely up to clients on how they use them. Definitely nothing to do with DHCP server or DHCP client. So normally yes, <my.domain.tld> can be "ho...

mkx

I suggest using/setting CNAME records in your main DNS for each DDNSed router item. This only helps with naming (e.g. when router changes, it's DDNS name changes ... and it then has to be changed in many places. If one uses CNAME records, then change has to be done only for that particular CNAME). ...

mkx

... so IGMP Snooping is now disabled again. And it's a feature that I actually need (IPTV usage). It depends. My ISP offers IPTV over tagged VLAN ... so I pass that VLAN only to required ports (connecting TV boxes). Even without IGMP snooping, only those few ports get active streams. Indeed all act...

mkx

wireless interface shows "R" status only if there's at least one wireless client (station) connected to it. Are you saying that SSID is actually not broadcasted? This is best verified by using some kind of wireless debugging application on wireless client (there are plenty of usable apps f...

mkx

New CCMP is same as old AES CCM ... CCMP256 and GCMP* are new ones (not widely supported by wireless stations though, some even barf on seeing these supported by AP).

mkx

UniFi: vlan 1, 400, 401 (tagged) Mikrotik port 4: tagged with vlan 1,400,401. "Native VLANs" (whatever that means) should never be tagged on wires ... also devices on both ends of same cable have to have same config ... and in your case UniFi has "native" (whichever that is) VLA...

mkx

Domain is domain name ... without leading dot. So if your host names are e.g. "host.my.domain.tld", then you should set domain property of DHCP server network entries to domain=my.domain.tld

mkx

Unfortunately I receive the following error message: "failure: incoming interface matching not possible in output and postrouting chains". Any ideas? Then just omit the in-interface property from NAT rule definition. You can instead use src-address property (e.g. src-address=!192.168.30.0...

mkx

I'm waiting the day when @anav will post that he replaced tplink APs with Mikrotiks and want some advice on CAPsMAN

That will follow the act of Canada becoming part of US a.k.a. when the hell freezes

mkx

Just to make sure: your WAN is connected to ether1?

mkx

.. why not just set the dst-nat rule to use in-interface where the in-interface = your WAN interface?

Hairpin-NAT doesn't work with in-interface, it's got to be dst-address.

mkx

You need a second firewall rule that also allows the traffic from IOT / Print as in interface to the out interface home. Basically the "return traffic". It's already there, this is the one: add action=accept chain=forward comment=\ "accept established,related,untracked" connecti...

mkx

How in particular did you export and import config? Did you use backup and restore commands ... or export and import ? If the former ... then it's known (apparently not well though) that binary backups (results of backup ) are not intended to move config from one device to another one. Specially so ...

mkx

- Dude server (I can confirm that after upgrading it to 7.16.2 you can upgrade routerOS devices from Dude (it does not upgrade the routerboard though and in my case I had to install extra packages manually (upgrading from 7.12.1 to 7.16.2) - but I was doing it for the first time, maybe I don't know...

mkx

You could try to change some memory settings in BIOS regarding mapping memory of PCI peripherial devices ... Another thing to try is to increase memory size on PC, the number says it needs a bit less than 4M of contiguous space (not sure if that's possible with your hardware). But the error does see...

mkx

SPF connection is no-go for me, as the infrastructure is already buried in the walls.

It's always option to take down the walls

You never mentioned how the 3 devices are placed physically, so I (wrongly it seems) assumed they are in same place.

mkx

Which SSID is used while you experience problems? What is signal strength, indicated by wireless station at the spot you normally use it? If you check WiFi environment (use some WiFi diagnostic AP on your phone), are there many other APs seen? You have left channel selection to automatic ... does it...

mkx

You don't need any additional routing on switch (as all packets outside it's own subnet - 192.168.88.0/24 - will have to pass over router anyway). Do you have appropriate SRC-NAT rules established on router? Not that when both routes are up and running, the "normal" masquerade rule will li...

mkx

Signal strength, mentioned in CAPsMAN's logs, is signal strength of station as received by CAP. Ideally it should be quite similar to what station receives from AP but can be lower due to lower device Tx power (battery-powered devices are entitled to use lower power in order to prolong battery life ...

mkx

It's hard to trouble shoot behaviour which happens only rarely. When it happens next time, don't forget to thoroughly check the logs, there might be something in it. Another thing to do is to create supout.rif file and send it to Mikrotik support ... they might decode the device state and comment on...

mkx

Solution will work ... but with some delay which depends on DDNS provider settings. Mikrotik's own DDNS solution, which creates <serial_number>.sn.mynetname.net DNS entries, have TTL set to 60 seconds. And option with adding DNS name as member of address lists does observe TTL. Which means that if o...

mkx

/ipv6/settings/set accept-router-advertisements: yes expected end of command (line 1 column 20) Sorry, it should be /ipv6/settings/set accept-router-advertisements=yes If it doesn't allow you to unset prefix-length, then set it to 64. You can omit requesting address ... it's not always needed and s...

mkx

You have quite some settings on L2 entities (bridge ports, etc.), which IMO border on paranoia ... and might affect hotspot operations. You might want to create a very simplified lab setup, starting from defaults and then add settings toward your intended setup ... while checking if hotspot still wo...

mkx

I don't know if that would fix the problem, but: don't create IPv6 pool manually. DHCPv6 client will create it automatically after it receives prefix. don't use prefix-length=48 (either set it to 64 or omit it altogether), it doesn't do what you probabky think it does. It's about prefix length when ...

mkx

Regarding loop between yellow and green parts: if you're careful not to pass same VLAN (tagged or as native) via multiple ports, then there won't be a loop. RSTP or plain STP would detect a loop (their BPDUs disregard VLAN IDs), MSTP would be fine. Another remark (it can be called personal preferenc...

mkx

Attempt4: Why did I volunteer to attend this event for Viktors......
I think the PM's drug-sniff dogs excluded him from the event.

... it reads "volunteer" ... which begs for question: whom did drug-sniffing dogs exclude: Normunds, Viktors, both or themselves?

mkx

I heard they were discussing Latvia buying Cloudflare...

Or is it the other way around?

mkx

this device does not have a switch chip you can use multiple bridges if you do not use STP. True. But then there will be a ton of vlan interfaces (one per VLAN and per port) plus multitude of bridges (one per vlan) ... compared to one bridge and few vlan interfaces (one per VLAN with which device h...

mkx

wAP ax Christmas edition season 2024/2025 :D :D Decorated by me, approved by wife :lol: As Christmass season 2024/25 is almost over, is there any new decoration available? I have my wAP ax ordered and I'm wondering if I have to order some WAF enhancement kit as well? I guess it'll be a close call s...

mkx

EDIT2 : Would a proper term be, that instead of saying native VLAN or VLAN 1, I should rather say, that tv boxes require also untagged traffic? Maybe this way it makes more sense - from ISP the iptv broadcast comes on VLAN 5 as tagged frames, and ISP performed updates and configuration of the tvbox...

mkx

So, it still boils down to "do not use VLAN1" (unless you really know where your towel is), right?

That's about it. So when in doubt, it's 42.

mkx

I saw that netinstall flash does not affect bootloader. Do you happen to know if its the OS containing firmware that controls these leds or its something else other that could be flashed ? Flash is updated from within ROS via system-> routerboard submenu. ROS will always contain routerboot flash im...

mkx

Native VLAN doesn't necessarily mean VLAN1, do you mean that your ISP is using VLAN1 as "native"? Well, I'm not sure how to check that. When I was trying to find out which VLANs they use, I simply ran a torch on input interface to see which VLANs appear there. Most often "Native VLAN...

mkx

The device you're looking at is pretty old now. It's likely that it's starting to fail ... there have been numerous cases where capacitors (both in power adapter and on device's board) have bulged and then device experienced very random ways of misbehaviour. It's likely that configuration isn't at f...

mkx

IMO it doesn't make much sense to use bridge with single port. The only functionality bridge could offer are bridge filters ... for simplicity sake most things done by bridge filters can be done by L3 firewall. But using bridge does insert additional step in frame/packet processing (even if CPU cycl...

mkx

I set request=address,prefix, and I'm getting both a /60 prefix and an unrelated /128 address for my router. Do I need the address? Could I (and should I) just use request=prefix instead? Is there a benefit to my router having both? From what I remember of how layer-3 works, from the ISP's perspect...

mkx

How I understood: If you want to benefit from HW offload where possible (for those devices where it is supported), using bridge for setting up VLANs is the default way already for quite some years. I'm specifically talking about the use-case where I have a Trunk Port on my MikroTik Router which goe...

mkx

In shoret: very likely RB260GSP can't be used to power your camera. There are two kinds of PoE: standard 802.3 af/at/bt It operates at 48V, different generations (af vs. at vs. bt) differ in maximum power allowed (and number of UTP pairs used to pass power) and in some minor details. Your camera is ...

mkx

To add subnets, should I just add more /ipv6 addresses but instead of ::1 do ::1:0000:0000:0000:0001, ::2:0000:0000:0000:0001, etc. for each subnet? Unfortunately it's not really possible to set those "S" bits in IPv6 address assignment. So you have to go with example by @ConradPino above...

mkx

Bridge doesn't "flood" its MAC address on trafgic passing via debice ... because MAC address (neither src nor dst) doesn't get rewritten by bridge or switch. So you'll have to be more speciffic as to what you think is a problem. Could be STP/RSTP BPDU frames ... those aren't VLAN tagged by...

mkx

Because of this rule, all incoming tcp traffic to port 443 is answered by the router: add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp The input chain is used for traffic to the router, the forward chain for traffice between networks (like WAN and LAN). Not com...

mkx

Probably price is just a matter of scale for the ONT, but of course they are more complex. Less cabling and less active components however are definitely cheaper. Well ... I don't think they can be cheaper to manufacture than plain FTTH SFPs ... no matter the production scale. The price may come cl...

mkx

It is not (completely) default config. I.e. the IPv6 rules are not there by default. No problem...

Yes they are in ROS v7 (where IPv6 is not optional any more). And yes they are if ipv6 optional package in v6 is installed and enabled when ROS config is reset to factory default.

mkx

SXT LTE kit and SXT LTE6 kit devices come with ROS licence level 3 ... which doesn't allow to configure its wifi interface as AP or AP-bridge. So these units are only usable for PtP links (one is bridge, the other is station-bridge) or as spoke devices in PtMP (where hub is AP-bridge and spokes are ...

mkx

1. Suggestion to increase antenna gain was the best available option before ROS version around 6.44 (or something like that) ... until that certain version, setting Tx power in absolute numbers had been both complicated (it had to be a table with different powers for different rates) and had potenti...

mkx

PON is way cheaper than individual links. Especially in rural areas, deploying PON is also extremly fast&easy. The cost of the last mile is very high, especially if you consider the economy of scale (1user for 1 link). PON saves costs on "the first mile" part of it ... single optical ...

mkx

It could be that your ISP is blocking UDP traffic with dst port 123 towards your router. Have a look at this thread for a work around: viewtopic.php?t=208791

mkx

Now at https://help.mikrotik.com/docs/spaces/ROS/pages/132350014/SSH or https://wiki.mikrotik.com/Manual:IP/SSH . But it doesn't seem to work on RouterOS v6 (tested with v6.49.8 ). Unfortunately Mikrotik's documentation doesn't include history ... e.g. which ROS version brought certain feature or c...

mkx

... especially because you use the complete bandwidth of wifi at 2.4GHz.

Half (give or take) actually. 2.4GHz band (for anything newer than 802.11B) is 70MHz wide (in NA and related parts of universe) or 80MHz wide (elsewhere) ... and 2462/n/eC channel is 40MHz wide.

mkx

A bit annoying and uncommon to do security related filtering on the NAT side of things.. One thing to keep in mind: NAT is not about security ... although it does seem to help some times. So one thing is to introduce NAT rules and a separate thing is to add appropriate firewall rules. It's up to ad...

mkx

are there supposed to be hits on DST NAT rules for traffic that is not permitted by the FW? Yes, there are. According to packet flow , DST-NAT is part of pre-routing ... and firewall filter rules are part of either input or forward packet path ... which both come after pre-routing. Sometimes it's p...

mkx

On networks with any kind of problems (real or perceived, e.g. packet loss or large RTT), TCP and UDP connections behave very much differently. For UDP connections packet drop is fine and stats show high throughput with high packet loss. Usually throughput shown on Tx side reflects throughput of fir...

mkx

Two things: disable add-default-gateway on /ipv6 dhcp-client . The way it's now might work (depends on how your ISP does things), but it's not the correct way. Instead set accept-router-advertisements=yes under /ipv6/settings . more crucially: assign IPv6 address to LAN interface (bridge) to enable ...

mkx

In short: being able to access router's IP address via "non-native" interface is more or less cosmetic thing. A longer explanation: looking at packet flow it becomes obvious that one of early things that stateful firewall does is to classify ingress packets to firewall chains. If packet is...

mkx

Are those HP switches configured with VLANs? No sir, this unmanaged switch, As @holvoetn already wrote, unmanaged / non-VLAN-aware switches are a problem in your intended setup. Managed switches are not absolute requirement in VLANed network, but they have to be able to pass "mini-jumbo" ...

mkx

PON is used to limit the amount of equipment in street cabinets, which reduces costs. If FTTx is regulated, then PON makes more sense to infrastructure owner ... because in this case competitor can't lease dark fiber, it can only rent bit stream and infrastructure owner has more control over whatev...

mkx

Also check settings in /system/device-mode ... I think you have to enable routerboard property to change cpu frequency setting ... just don't know which particular ROS version started to require that (could be it's 7.17).

mkx

which is, to be frank, unnecessary to know about half of millions revoked certificates

They were revoked for a reason and it's only the right thing to be able to verify if certificate of server our device is talking to is one of those. If you don't care, then that's your problem (or wisdom).

mkx

Okay, in this case, I can see that all my ports are open, but is this the right way to open ports?

If you want ports open, then this is the right way. If you're concerned about security, then don't open them. Or restrict access to those ports.

mkx

Nominal CPU frequency is 1700MHz. But it's possible to overclock it by setting /system/routerboard/settings set cpu-frequency=<value> . Nowdays default setting is auto which allows ROS to scale frequency up or down depending on CPU core load. Sometimes this doesn't work too well (it takes sone time ...

mkx

How do I remove the packages from RouterOS now?

If they are not listed under Packages, then they are not installed. New CAPsMAN is included in core (routeros) package since version 7.13 (so running new CAPsMAN doesn't require any optional package).

mkx

Are those HP switches configured with VLANs? BTW, as soon as cAP is provisioned by CAPsMAN, local settings under /interface/wifi largrly don't sppky. Which includes datapath. Settings from CAPsMAN apply, including bridge name (and yours don't match). So I wonder how on earth could anything work actu...

mkx

Which ROS version? Only newer v7 versions correctly display dynamic IPv6 addresses and routes, older versions (including all v6 versions) omit them from print command. Addresses and routes are there or else IPv6 wouldn't work in certain aspects.

mkx

What I don't understand: why reply-only work for IPv4, but not for IPv6 ? Because address acquisition for IPv6 works very differently than for IPv4. For starters there's SLAAC (which is based on RAs and those are elementary for getting routing working) and networked devices assign addresses them se...

mkx

Check setting of property configuration.distance . Here's description: The distance is setted for 22km, check the first photo in the first message. This was replying to @MulderSK. Looking at ping responses is mostly useless. I don't agree. You have every right to disagree. But so do I :wink: Did yo...

mkx

Your network is obviously not as flat as you're trying to imply. There are 3 VLANs mentioned next to CAPsMAN device (and possibly the "untagged" subnet). You're also writing about "hubs" ... these days nobody uses ethernet hubs, everybody is using ethernet switches, quite possibl...

mkx

As far as I can tell, you're heading in the right direction with the latest config snippet.

mkx

not only does the ping drop, but the connection is also interrupted

Which connection? The wireless link? Winbox management connection?

mkx

Looking at ping responses is mostly useless. If link is fully utilized, then those pings will get queued and seemingly dropped ... in reality they will likely get around but with round trip delay larger than 1s (which is usual timeout value), responses will be ignored by ping application. Try to run...

mkx

New beta 7.18 for christmas? I wish Not likely. So far, beta only came out after previous version was released as stable. 7.17 is still Release Candidate and folks @MT are running out of time ... it's almost Christmas eve, Latvia is at UTC+2 which means it's 3:30 PM and almost end of office time.

mkx

@HeptaZ, did you read through excellent Using RouterOS to VLAN your network tutorial?

Because most of discussion in this thread is about VLANs and they are explained pretty well in the tutorial I linked above.

mkx

There are things to be set-up on gmail side, check their article: https://support.google.com/a/answer/2520500?hl=en

Then it could be TLS support mismatch. AFAIK ROS supports up to TLS 1.2 and some sites already require minimum of TLS 1.3 (not sure if gmail does).

mkx

Check setting of property configuration.distance . Here's description: distance () Maximum link distance in kilometers, needs to be set for long-range outdoor links. The value should reflect the distance to the AP or station that is furthest from the device. Unconfigured value allows usage of 2 km l...

mkx

If there's a chain of accessibility (i.e. you can access R1 but cant access R2 directly, while R1 can access R2), then you can use CLI (ssh, MAC telnet, normal telnet) if any of these is allowed on R2. ROS includes clients for all mentioned protocols. The only issue is with MAC telnet, ancient versi...

mkx

Mikrotik app for Android shows the following value of dtim-period setting:

It might be artifact (by Tik app) for not having property set at all ... in which case default value (1) would be used.

When in doubt, always use CLI to verify ... and report a bug in UI to MT to get it fixed.

mkx

Setting of band property on new wifi actually only limits the newest generation of wifi technology but allows all the older. So by setting band=2ghz-n one is allowing B, G and N, but not AX. When constructing AP for really old devices, one has to be extra careful with security settings: B-only devic...

mkx

I'm trying to configure my rb951 to access Internet from ISP router but after setting the static IP ( 192.168.100.100/24) and checking routes and when I try to ping google.com Does your ISP support DHCP as means of obtaining IP config for clients? If it does, then use it, it's usually less error-pr...

mkx

I’m sure I listened to a MuM talk once that forwarding a packet to black hole takes less CPU than dropping? If there's a very effective way of doing it. Otherwise I doubt it. But whatever one does, packets definitely have to be silently dropped (as opposed to rejecting them with ICMP port unavailab...

mkx

Had same issues, changed DTIM values to 3 for 5GHz (it was 10 by default), the same was proposed upper in the thread, 2 days - no disconnects so far. A random thread from quite some time ago ... which concluded that DTIM interval longer than around 3 can (and will) cause problems with certain stati...

mkx

But it seems the CRS304 can FastTrack at 1700 which would be acceptable for a 2.5G WAN. Not in my book. I'm paying monthly fee to ISP and I certainly want to have hardware which can use all of what I'm paying for. Otherwise I can save a few euros (every month) and live with slightly slower WAN link...

mkx

Don't know how far 2.4ghz interference can go for USB3. The test computer is around 2/3 meters away from the next AP. The big problem is interference between locally connected interfaces (i.e. hAP ax3 with flakey USB3 stick plugged in and 2.4GHz radio ... USB3 activity will interfere with Rx path o...

mkx

I'm here with @chechito wondering why TF? CRS520 comes with list price of almost 2200$ and power consumption exceeding 120W. So one doesn't really save much by not adding a small server to the network, a high-end raspberry pi would dance around CRS520 when it comes to server functions (stock samba v...

mkx

... so I don't see how the hEX could have any influence on the problem Some interference in form of timing jitter affecting TCP window scaling? Experience with official test results says that figure listed under "Ethernet test results -> Routing -> 25 ip filter rules -> 512 bytes [packet size]...

mkx

CPU in hAP ax3 can shuffle around 2.5Gbps (look at test results for bridging) and that's pretty lean on CPU (no packet processing, only passing between two ethernet interfaces). With SMB there's plenty of processing involved. And USB in SoC IPQ-6010 is 3.0, so max 5Gbps (including overhead) possible...

mkx

What you showed looks like a really old product for legacy customers. 40G and very slow at routing. CRS devices are switches (remember this fact by heart!) ... and many can route at wirespeed if properly configured for L3HW offload (with certain limitations which are device class dependent). If any...

mkx

When port is used as stand-alone, then switch-chip passes frames to CPU (via cpu-facing bridge port) as they are ... then CPU does VLAN header manipulations (via VLAN interfaces attached to such stand alone port). So in this case no L2HW offload. It's rather similar when bridge is used ... and L2HW ...

mkx

One can get a 2x 25G card for 135 euro. Add processing power, necessary to route at 25+ Gbps and price tag is easily around 1000€ ... and you've got a mere 2-port router. And I'm pretty sure that such price tag is outside of MT users' comfort zone. So my guess is that we won't be seeing full 10Gbps...

mkx

What do I need to consider for the additional units? The problem is that one wireless station can only be connected to one bridge at a time. This problem kicks in when e.g. you need a chain of APs like this: ethernet -> AP1 <- wireless1 -> AP2 <- wireless2 -> AP3 <- wireless3 -> AP4 (etc) Let's say...

mkx

@sindy if I understood correctly, there should be two "entities" capable of switching, the switch chip and the switching functional block in the cpu? In the context of bridge nyszeries explanation forget about switch chip (the real, piece of hardware). In this context, there's only switch...

mkx

Because we use existing device from several brand on our client, we need follow their default VID for their management. If it's only management, then you can bridge all 3 VLANs. I'll assume you have ether5 off-bridge and have something like this: /interface/vlan add interface=ether5 vlan-id=98 name...

mkx

Also 50 cm can be too close. This. Depending on channel selected, but ... As I mentioned, I've got single Audience, so the 4x4 radio is used in AP mode as well ... and my tablet, which currently resides around 3m away (and 1.5m below) with LOS, shows signal strength of -35dBm. Which is on the highe...

mkx

IMO it would be smart to ask MNO if they can give a public IP address and how much would that cost. I know a few MNOs who provide public IP addresses to those asking for one at small cost (or no cost at all).

mkx

BTH function is done exactly for such cases.

mkx

Some MNOs run firewall blocking certain types of traffic (typically with low destination port numbers because these are often used by servers). And some do CGNAT in a senseless manner. When those two worlds collide, anything can happen. Basically wireless broadband is mostly not fit for anything els...

mkx

Using CAPsMAN to provision audiences' "public radios" (i.e. the ones serving normal client devices) gives opportunity of better client mobility ... APs, participating in client mobility, have to be controlled by single entity (e.g. CAPsMAN) for all the mobility features (802.11 r/k/v) to w...

mkx

hAP ac2 can run v7 pretty fine. But : its 16MB flash is tiny and it's very likely it'll get full (and then all sorts of funny things start to happen). Base routeros v7 uses around 13MB of it, any wireless (legacy or new wifi) another 2MB or slightly more ... so not much free for config and/or additi...

mkx

Generally it doesn't matter which way you do it if you configure wifi manually. In this case the only difference is if one uses multiple VLANs with single SSID, such scenario can't be implemented with bridge handling all VLAN tagging. If you use CAPsMAN and VLANs, then it takes lots of fussing (and ...

mkx

How does profile output look like while pings are timing out?

mkx

CAPsMAN doesn't configure backhaul ... which in usual AP installation is ethernet while in mesh it's the 4x4 radio (I guess it's called wlan2 when running wireless drivers, it's wifi2 when running wifi-qcom-ac drivers). Further more, radios loose their setup if they loose connectivity towards CAPsMA...

mkx

The second rule hints at use of hairpin NAT because in-interface=bridge to-addresses=192.168.88.244 ... default config has 192.168.88.0/24 on LAN and bridge is the interface used by roouter to talk to LAN. And if that's how you need it, then you need the masquerade rule which obfuscates actual src-a...

mkx

It's the last rule (masquerade) which messes src-address. In principle it's not needed unless you require "hairpin NAT" ... in which case thrte's no way around it.

Unless you create separate IP subnet fot the server.

mkx

Don't think so.
Not on RB5009 with 8 ether ports
Then they should have called it the RB5008 LOL
Then use port 8, use your imagination, drink some moose milk!!!

5009 is indeed an odd number for a router ... specially because it's even

mkx

Verify on Mikrotik that NTP client is properly synchronized. Without that, NTP server won't allow further clients to synchronize to it. ROS NTP server doesn't use own RTC as time source (among other reasons because MT hardware doesn't have RTC).

mkx

Move DHCP client from ether1 to "JJMarketing Wireless Bridge". Also remove comment on DHCP client as your device doesn't have WAN interface. Two other minor things: remove bridge with name bridge1 ... it's not used at all setting names of items to settings with spaces in them makes config ...

mkx

As I wrote: provide us with actual configuration and we'll proceed from there.

mkx

You've set 192.168.10.1/24 to one interface and 192.168.10.2/24 to the other interface. Every normal device will assume these two addresses are in same subnet and hence directly accessible without explicitly using router. And bridge is here to pass traffic from ether1 to ether2 (with appropriate VLA...

mkx

I have some problems with my MikroTik Routers. I plan to upgrade all MKT devices from version 6.46.6 to 7.16.1. I think that MT would recommend you to use ROS built-in updater (under /system/packages/update). As already mentioned, there will be a few steps: while running 6.46.6, upgrade it to lates...

Search found 13646 matches