MikroTik

mkx

What @tdw wrote is about MT's DHCPv6 server (it doesn't hand out addresses to devices, only prefixes) and not about address types (ULA vs. GUA).

mkx

Yes ... either MSTP or RSTP or STP (in this order of preference), which ever is supported by all L2 devices in your network.

mkx

Generally HTTPS clients absolutely have to be aware that they're connecting to proxy server and not directly to target. And that's done through configuration of clients ...
With HTTP it may be possible to do "transparent proxy" with port forwarding.

mkx

First off: don't mix different STP modes, they simply don't interwork.

mkx

You can't communicate both using tagged and untagged frames (where PVID / default VID for untagged is same as the tagged). Frames can egress either tagged or untagged, not both. And switch has no idea whether the other direction uses tagged or untagged for some particular session. So if you insist o...

mkx

You can exclude something from fasttrack by explicitly accepting that using a rule which is placed above fasttrack rule.

mkx

Address on "LAN" side is wrong:

/ip address
add address=192.168.4.0/24 interface=ether4 network=192.168.4.0

Address should be 192.168.4.1/24 instead.

mkx

Also, the caps are supposed to be able to daisy chained correct? If you're talking about PoE ... then likely no. Visit product page, check powering and PoE out data for all involved devices and do the power budget calculation. Also allow for power losses in cables (meaning that you have to consider...

mkx

Ideally they would not even hear each other if both are mounted at least half decently. Or do they sense high interference?

mkx

I prefer having 2 independent tables for my vlans, so I don't run into issues when the same MAC appears in both vlans. Independent learning is not about same MAC in different VLANs (in majority of implementations that's the way it is anyway). Independent learning might be about MSTP (or something l...

mkx

As @neki already hinted: Tx power is not constant over devices and channels. If you look at device product pages ( cAP ax and hAP ax3 ), section "Wireless specifications", it becomes obvious that hAP ax3 has, in principle, higher Tx power available. When, e.g. talking about 2.4GHz ax, it's...

mkx

When master interface is mode=station (or any station derivative) and virtual interface(s), enslaved to that master, are in mode=ap (or bridge), then master has to be connected to some AP before virtuals can be shown on air. The reason being: only master interface can control properties of radio (fr...

mkx

Another thing to try: set disable-running-check=yes on all wifi interfaces and see if wireless station behaves any different. Alternate tedt would be to connect second station using same PPSK passphrase while first one is successfully connected (if the "running check" is the culprit, then ...

mkx

I really don’t know what transceivers MikroTik want us to use for the L009.

Optical ones ... those may even work with forced speed as per documentation.

mkx

Comments are a linguistic category and since we're coming from different language families (and we're both non-native English speakers), I think we can agree that we don't understand your comments in the same meaning

mkx

I would say that any kind of DDoS protection is mostly futile and the only realistic goal in such case is to keep router/firewall alive ... in a sense that it doesn't start passing forbidden traffic in wrong direction and in a sense that it recovers soon after DDoS attack stops. Pulling WAN cable ou...

mkx

Let me rephrase my last question ... If I understand your comment in one of previous posts, this is what happens: When you try to connect station using "non-standard" password, connection initially fails. When you try to do it second time (a few seconds later), entering very same non-stand...

mkx

So, there is the need of two "monodirectional" rules: comment="Allow from 00:E0:4C:00:03:A7 to ether5" and: comment="Allow to 00:E0:4C:00:03:A7 from ether5" ? :?: Make those "from/to ether5" read "via ether5" to make comment more precise. It seems t...

mkx

A question I have to you, mkx, is what do you mean by default setup. Do you mean the default setup as provided by mikrotik when setting up the device? Yes, I was talking about config which is available if device is "reset to factory default". You can always see it if you open terminal win...

mkx

xdp, bpf & co want to replace the whole kernel packet handling (i.e. everything drawn in nftables diagram) with a different (simplified) implementation of packet handling. And you're right, ROS doesn't do any of it, so just forget about it. Next the DDoS handling in the pre-ingress: that would b...

mkx

The problem is this: DST-NAT rule is evaluated for every packet[*] passing router in any direction. Which means that also packets for connections, originating in LAN and targeting internet, will trigger NAT rule evaluation. It's then the selecting properties of each NAT rule to narrow down selection...

mkx

Now Mikrotik's DHCP assigns an IP, rejects it after 2 seconds, .... [*]dhcp1 client AE:F3:2B:D0:37:79 declines IP address 172.17.44.181 The log says that client rejects offer. Which most likely means that it detects IP being in use. If not all of those IP addresses are actually in use, this likely ...

mkx

When I wrote "If that switch behaves as it should" I was thinking about possible effects one additional switch in packet path might have. E.g. a sligtly increased latency (normally we're talking about fractions of a millisecond). A misbehaving switch could corrupt frames, drop frames, dela...

mkx

After a station with non-default PSK (and hence custom VLAN ID) connects to AP, does wifi interface become member of that non-default VLAN? No, error message is displayed almost immediately so nothing is visible in bridge/vlans. I was asking about the state of CAP after second try (you wrote that c...

mkx

From 7.16. The problem is that the forwarder will not try to ask 10.6.10.221 when 220 is not answering. The basic premise in whole DNS system is that if there are more than one DNS server available (configured), it is assumed that all of them would give the same answer. And answer "no such dom...

mkx

The idea about creating address lists is to avoid sending any feedback to attacking nodes ... which helps to save at least uplink bandwidth. Using the lists in raw firewall also helps to reduce amount of packet processing (even if normal firewall filter rules would eventually drop those packets) ......

mkx

The rule of thumb is: if architecture (e.g. MMIPS or ARM or SMIPS) of device is receiving new ROS versions, then device is still supported. And this is a big feature of MT (as compared to other vendors who drop support quite soon after end of selling). However (and it's a big however): ROS v7 doesn'...

mkx

What do you mean by "When the destination address (10.10.11.2) is specified in the microtik's NAT rule, some web pages are not displayed" .... which web pages, where are they hosted? Just to clarify: you are setting dst-address=10.10.11.2 on DST-NAT rule? What if you set in-interface=<WAN ...

mkx

The way I read the ACLs, the second rule matches also "return" traffic ... which has dst-mac-address set to MAC address of allowed device. So perhaps you have to introduce another rule and push it between existing two rules: add comment="Allow 00:E0:4C:00:03:A7 on ether5" ports=e...

mkx

The problem is that IGMP snooping in ROS (as well as many other vendors) is shitty. A few years ago, when I tried, IGMP snooping on both ROS and Dlink effectively blocked IPv6. And PTP works using multicasts. So IMO it's a bug in IGMP snooping in ROS. So nothing we, forum members, can help you with....

mkx

My guessing: when you have list of allowed source IP addresses set in service definition, then access from any other IP address will be rejected on service level. Which means that some alien, trying to connect to ssh (TCP port 22), will perform the initial 3-way TCP handshake ... and after that SSH ...

mkx

There are two basic things for this inter-LAN sharing to happen: there has to be device (router), which connects to both networks and is willing to pass packets (i.e. route) between both networks. Additional requirement is that if the before mentioned device is not default gateway for both LAN netwo...

mkx

Well, I should mention that I was quite surprised the first time when I confirmed a device mode change with pressing the reset button that the device actually cold booted... Device mode gets set into routerboot (could be it's even baked into permanent storage just like the rest of routerboot conten...

mkx

I can see the link is up and running (see screenshot).

It seems that autonegotiation failed to do proper thing. The lower part (link partner advertising) stops at 1G baseT full ... and yet RB somehow ended up enabling 2.5G baseT ...

mkx

Would there be any benefit in powering the U6 LR using a separate POE injector and connecting the AP directly to the RB5009UPr?

If that switch behaves as it should, then there's no performance benefit in doing what you wrote (and I quoted).

mkx

CRS317 is an absolute beast for L3 HW offloading, it would do offloaded firewall as well. The CRS326-24S is a very decent device as well, but not a beast. You may want to read about L3 HW offload and its limitations (device dependent): https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloadin...

mkx

It works for me. Although I did not use "-a" command line parameter of ssh-keygen. It could be that ROS implementation doesn't support that high value (ssh-keygen manual says the default is 16).

mkx

Why no SFP+ port (or two)? There are comparable all-SFP+ devices available. I see this one as device for those who don't have SFP+ interconnects in their LAN. This is an "office switch" and not very often there's fiber on the office desk. And not many times office desk is next to closet w...

mkx

One thing I noticed. When I forget network (so I can connect with another password) first time entering password it displays an error on the phone to enter password again. When I enter password second time it connects immediately. I can think of several reasons for that but not necessarily any of t...

mkx

Yes, it is possible. You would set up CRS with as many VLANs as necessary for LAN side, set IP address on corresponding vlan interfaces, set up L3HW offloading ... and configure all devices to use CRS' IP addresses as their default gateway (e.g. make appropriate changes to DHCP server settings). The...

mkx

Sorry. One picture (can be hand drawn and photographed with a phone) of topology and export of current configuration would make the (mental) picture much more clear.

mkx

According to setup shown, ether2 should be part of VLAN 3 as well (probably as dynamic member with comment set to "added by pvid"), but it's not shown in the screenshot. I wonder why's that? Perhaps it gets added when ether2 gets up (something active is plugged in) ... or is ether2 active ...

mkx

You always need one datapath (simply to add CAPsMAN-provisioned wifi radio to CAP's bridge) ... either as datapath profile or static datapath. settings on wifi interface directly (which with CAPsMAN-provisioned CAPs isn't an option obviously). And I guess if CAP is simply configured to be CAPsMAN-dr...

mkx

Unless you configured firewall to block access, your CRS is available for connections on every IP address it's got. For clients in different IP subnet (and/or VLAN) a router is necessary. So answer to your question depends very much on both network topology you have and configuration of CRS. Without...

mkx

Ah, so bridge is ignorant about VLANs on CAP device ... just as I thought. So as long as L2MTU is higher than around 1518, it'll blindly pass ethernet frames left and right without ever looking at VLAN ID in 802.1Q headers ... which means you have to be careful about vlan-id setting on datapath (it ...

mkx

Tested PPSK with CAPsMAN and it's working like a charm. Only modification is to tag port where CAPs are connected, create datapath with PVID1 and interface bridge and add that into configuration.

How does /interface/bridge/vlan/print look like on CAP device?

mkx

This firewall filter rule add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \ connection-state=established,related src-address=192.168.88.0/24 means that traffic gets fasttracked if LAN address is from router's default range. And it thus skips the mangling rules .....

mkx

(I need at least 8 PoE+ ports)

PoE+ is often used as a synonym for 802.3at ... and that one defines max output current of 600mA. But CRS328-24P-4S+RM is specced only with 450mA (which is halfway between PoE 802.3af specced at max 350mA and PoE+).

mkx

Product page for hEX S sys it's got

PCB temperature monitor

. So it's not CPU temperature, it's somewhere on board and only board inspection can tell which of other elements are around to affect the readings.

mkx

Is there any risk I netinstall the wrong device? Or shall I run netinstall on a PC directly linked to the RB5009? You can't netinstall the wrong device, device has to be put in netinstall mode for that. However I'd recommned you to do direct connections ... netinstall is a pretty fragile process an...

mkx

My experience so far is that each new Mikrotik device is better (but backward compatible). No, backwards compatibility is not always guaranteed. One example: curently we're using capsman v2 (nowdays called legacy capsman) and capsman v3 (the new, wifi, capsman). And capsman v1 was not compatible wi...

mkx

On cAP ax you have /interface wifi datapath add bridge=bridge client-isolation=yes name="GME IoT" vlan-id=3 (and similar for "GME guest" datapath). and that setting allows wifi driver to tag/untag frames by itself (without any intervention by bridge). Just as does switch chip on ...

mkx

Just like PPPoE is an ephemeral interface that exists while tunnel is active, a dynamic sub-if of a stacked vlan is an ephemeral interface that exist while exists traffic that specifies it. Sorry, I simply don't agree that having plethora of dynamic interfaces is a good thing ... just to work aroun...

mkx

It looks like DC-DC regulator working from 48V (or there around, which is likely PoE voltage thrown at hEX S) is much less effective than working from 24V (included power adapter output). And I guess (I don't have the device to check myself) that temperature sensor is placed close to that DC-DC regu...

mkx

I feel like they solved the right problem the wrong way... PPPoE is a special case as it's not IP on the physical interface side ... so they can easily add VLAN ID handling to pppoe process. And tge feature is (currently) only available for PPPoE server , which may serve multiple VLANs and hence ha...

mkx

... but it does not say when "Loosing built-in cards" will be fixed? I wouldn't count on getting that fixed (probably it's a can of worms which MT disposed off already a while ago). If you need to run legacy capsman, then get an older device and run it there (you can do it on one of your ...

mkx

On hAP ax2 you'll have to enable vlan-filtering on bridge, without it PVID setting does nothing. Then you'll have to configure ether1 as trunk port, configuration should more or less mirror of ether10 on RB3011. But you'll gave to use /interface/bridge and subtree hence forth.

mkx

Do you actually have to add multiple VLAN IDs in datapath? My impression is that datapath VLAN ID is a default, but if other mechanisms set it differently (e.g. ppsk settings or radius reply) then wifi-qcom (the non-ac) driver will apply that exception to appropriate frames. Resulting tagged (or unt...

mkx

A few things: do yourself a favour and disable detect internet feature (set detect-internet-list=none) Why MTU on LAN set to odd value of 1420? It's going to hurt all LAN communication ... possibly to make wireguard a bit faster. It may make sense, but really depends on ratio between wireguard and L...

mkx

All my dynamic IP list entries are missing after the upgrade. I had to add them again from backup.

Aren't dynamic entries kept in RAM (to save lots of glash storage space and potentialky many flash writes)? That would mean that entries are lost on every reboot (upgrade or not).

mkx

I have hap-ac² this one has an Atheros AR8327 switch chip included: Yes, but this one is not supported by bridge L2 HW offload (you can configure it under /interface/ethernet/switch, but this kind of config comes with a few complications on their own ... IMO the performance benefit is not worth the...

mkx

Now, the question is security: What would prevent an attacker with physical access to the cable to netinstall the device and do further mischief? Physical security. As soon as attacker gains physical access to your device, you've already lost the game. Guess how "denial of service" looks ...

mkx

From what @Channing wrote I'd say he'd like to see "maximum power consumption" go from 60W (specified for current device) down to ... uhhh, 30W? (Not sure if such reduction is realistic though). And I'd add "increase flash storage to at least 32MB if not 64MB". Personally I don't...

mkx

How do you run the script? Ftom scheduller? If yes, how exactly does the scheduller job definition look like? Since the script uses local variables, I guess that having scheduler run script at midnight (or whatever the start time is) and repeat it every N minutes for 24 hours (and do it every day).....

mkx

If you have fasttrack enabled on mikrotik side, try disabling it.

mkx

I can understand your thinking. However in networking gear, things don't go the same pace as in general processing. Switching is typically done wirespeed on ASIC level ... since it's wirespeed, speed increases don't happen (unless it's supporting newer generation of interface standards). Yes, power ...

mkx

The idea about setting vlan-id in wifi driver is that wifi driver handles the VLAN tags, not bridge (bridge only filters traffic according to existing VLAN tags). Which IMO means you have a few errors in your setup. One is use of multiple datapaths (just noticed you only have them defined but not us...

mkx

Fastpath and fasttrack are two different things. See here: viewtopic.php?t=182658

mkx

mkx

Use netinstall for 7.15.3 (or whichever ROS version you decide to start with). Don't mess with netinstalling v6, upgrading from v6 to v7 leaves (hidden) v6 setup on device which consumes (precious) space. When doing netinstall, select both routeros and wifi-qcom-ac packages in the same step, this av...

mkx

Keep in mind for netinstall: on 7.13+ you need wireless or wifi-qcom-ac package additionally to main package. So, if I install 7.13 or later, do I need to add the wifi-qcom-ac from the extra package to get wifiwave2? If I don’t, will I just get the regular wireless? If you install 7.13 or later, it...

mkx

My suggestions:

1. 7.15.3
2. do a netinstall

Before doing step #2, do a textual export of config, it can prove a valuable aide when configuring anew. Won't help much with wifi though.

mkx

And

4. check that device's storage is not full. 16MB is tight for contemporary ROS versions on ATM architecture ... and you really want to have at least few hundreds of kB free at all times.

mkx

Two things: as @liviu2004 already hinted: make sure that the back of rack allows exit of hot air ... if rack is closed at the back, then no amount of fans can help, hot air is still trapped inside the rack "Operating temperature" in product brochure (specifying range of -20°C..+60°C) refer...

mkx

While ax APs are (in principle) backwards compatible, some legacy station devices are not forward compatible. Some modern features which seem to freak out legacy clients (even to the point they even don't want to try to connect to modern AP): WPA-3 security ax standard FT and any other mobility feat...

mkx

Model name from export says this is LHG R: https://mikrotik.com/product/rblhgr

Which is way different than hAP ac lite.

mkx

The problem resides on the hAP-ac. As I'm forced to use bridge vlan filtering (no HW offload, all on CPU) for wifi-qcom-ac all traffic is handled by the CPU. Maybe this is the issue.

Which device exactly are you using? hAP ac doesn't run wifi-qcom-ac drivers due to wrong architecture (MIPSBE).

mkx

According to official test results and a chunk of common sense, hEX PoE should be able to route at around 300Mbps. Give or take. But seeing your device to choke at around 80Mbps is a bit surprising. So why don't you show complete config? In a command terminal execute /export file=anynameyouwish , fe...

mkx

Interesting possibility. But how/why this started happening last friday on multiple devices? :? @OP says that ARP policer kicked in ... what I'm saying is that the same thing might be going on for ages but last friday cummulative internet usage of those with flawed setups exceeded ARP policer's thr...

mkx

To me it seems like Mikrotik was set with default route to use interface instead of gateway, i.e. add default gateway ether1 (where ether1 is interface used for upstream connection). It seems that there are a few tutorials floating around internet suggesting such approach.

mkx

And how do you know the total space needed for the update?

Due to lack of better info ... by experimenting and observation.

mkx

20cm of cable between two active RJ45 devices indeed seems a bit short. I'd try with a 2m patch cable to see if things change. For this kind of distance a cat5e cable will do (even for multi-gig speeds), no need to go overboard by using cat6+ patch cable.

mkx

And please tell me where and how to find out the required space for the update RouterOS 7? AFAIK there is no official information about it. ROS updater is supposed to check free space before applying update ... but from forum reports one can get a feeling that it's not conservative enough and somet...

mkx

What could be the problem, how to avoid it? Not really an answer, but rather observation: all the mentioned devices have only 16MB flash. Which is tight for recent ROS versions (specially v7). So perhaps your script should check free flash space and bail out if free space is less than, say, 600kB (...

mkx

CRS304 switching results are they correct?
Those results do look very bad

As if they, somehow, only tested the 1Gbps MGMT port?

mkx

If you're talking about restoring backup file, created on a different device model, then no, this is not supported. Even if it somehow works in certain device combinations. If you're talking about importing textual configuration exports ... then again they don't generally work. But since tgey are es...

mkx

Most likely sending CFs or RIFs zo MT wouldn't help much to anybody. Most probably there is/was a hoke in firewall configuration of those devices which allowed atackers to get them under their control. What should be done (by you or some knowledgeable person) is zo analyze configuration with fovus b...

mkx

On end devices themselves.

While you could DST-NAT port 80 (non-encrypted HTTP) to proxy port and it would mostly work (except for older HTTP 1.0 only clients), you can't do the same for port 443 (encrypted HTTPS), client has to uderstand it's talking to proxy when trying to do HTTPS.

mkx

What would happen if the MikroTik is turned off from system shutdown ? MT devices in shut down state stay in that state until they are power cycled. How to work around it? If device has option to be powered via PoE, then you can power cycle it by disable PoE out on port of powering device. Or insta...

mkx

Unfortunately my MNO provides only nano SIM cards with adapters like this so I need to use adapter to insert into router. Isn't it that cuttings for different SIM sizes are not through? So if one needs e.g. micro SIM, only outer piece of plastic has to be removed. The rest is still decently sturdy ...

mkx

cAP ac is "arm" not "arm64" ...

mkx

Sure this has to be disabled? If CAP and CAPsMAN are different devices, then they won't communicate using address of 127.0.0.1 (neither of them) ... hence this rule doesn't apply. Or is it? If CAPsMAN communicates with itself (another process perhaps), then it might use 127.0.0.1 ... @JPbarries, tr...

mkx

So riddle me this, if I need 20 of those switches, how many times will I have to order and RMA the units before I end up with 20 good ones? It's an interesting math problem that fits well in a public school test If you're tackling the issue with "order X, check them and RMA Y ... and loop unti...

mkx

If you're using RB3011 "for educational purposes", then I suggest you to go with single bridge with vlan-filtering enabled. This kind of configuration works on all devices (regardless the underlying hardware) and on many devices (including all the modern switches and many modern routers) i...

mkx

Your firewall is quite strict at dropping anything not allowed. Which is good. But you have to allow capsman protocol. From a note in documentation for capsman v2 (the old wireless capsman): Note: CAPsMAN uses UDP port 5246 for manager traffic and UDP port 5247 for data traffic I didn't find similar...

mkx

And did you perfrom a cold reboot of switch after setting all things up? My experience goes that sometimes actual running switch chip config diverges from what it's supposed to be and a good cold boot (i.e. cut the power) sorts this out.
Not necessarily a solution to your problem though.

mkx

A few random bits, hopefully they'll help you to understand your device and setup: despite the urban legend of necessity to run two bridges on devices with two switch chips that's not true. Indeed setup with using external patch cord connecting ports on different switch chips may help with performan...

mkx

You have to add bridge port as tagged member of VLANs with which IP layer of device has to communicate (and you create corresponding vlan interface, anchored off bridge port ). In case of RB5009 that would be: /interface vlan add interface=rb5009br name=vlan10 vlan-id=10 add interface=rb5009br name=...

mkx

Why do you have "tag-stacking" enabled on sfp-sfpplus1?

mkx

routerboard firmware is separate from ROS version ... similar to BIOS/UEFI being separate from OS (Windows, linux, ...). The difference between ROS and normal PCs is that routerboard firmware ships with ROS itself and it's possible to set it to be upgraded automatically (property "auto-upgrade&...

mkx

When router advertises a prefix, it'll advertise its own IPv6 address with it. And AFAIK it'll advertise it's LL address (but I may be wrong here). What remains to be seen (run a wireshark on a client device and check the RA packets) is whether router actually advertises /64 prefix even though the a...

mkx

Check IGMP related settings on mikrotik's bridge. IGMP snooping can be quite flakey and if it's enabled, it can break IPv6 ...

mkx

a bandwidth-test beetween my CRS328 and a RB5009 Bandwidth-test (as ROS feature) is extremely CPU-bound, so in most cases it's measuring CPU performance rather than link performance. Specially so for devices with fast links and relatively weak CPU (CRS328 in your case). So: just don't use bandwidth...

mkx

What impact if i set the VAP radio mac to C4:AD:34:48:E1:05 (same with the master interface) It most likely won't work ... station, connected to AP (either interface) will send wifi frame with "receiver address" field set to BSSID (MAC) of AP. And then AP will take this frame and do with ...

mkx

I'm really wondering why do you insist on using PAP (which transfers username and password in cleartext) over CHAP (which doesn't exchange password) ... specially as CHAP works in your use case?

Did you check log on MT? Does it say anything about the failed PAP authentications?

mkx

IP generally doesn't care about OS type so generally router doesn't limit speeds for certain OS types. However it is possible that delay (and delay jitter), present on certain network path[*], affects some OSes and not others due to some interference in packet timing. But these are very hard to diag...

mkx

When changing IP address subnet on ROS, there are roughly 4 places where changes have to be made: /ip/address This is the place where router's own IP address is set. Optionally one has to change settings also under /ip/route ... possibly also on other routers if present in LAN. In most SOHO environm...

mkx

4. very often it's a PEBKAC. With an attitude like this, it's almost certain.

mkx

So if i set /ipv6 settings set disable-ipv6=yes my mikrotik router will automatically block everything from wan to lan and from lan to wan via ipv6. Correct? To be precise: router will not block IPv6, rather it will ignore all of IPv6. Not exactly the same thing, but the end effect is very similar.

mkx

You have two rules in srcnat chain. The screenshots don't show all the gory details, but ... masquerade rule is higher than "normal" src-nat rule. If masquerade rule selection rules match the packets which src-nat rule is supposed to act on, then masquerade rule will do it's job and src-na...

mkx

A word of advice: just disable "detect internet" feature ... if you know which port of your router connects towards internet, then this function doesn't add any value ... but can screw things up in random ways if it doesn't work right. I suggest you to reset your router to defaults, then u...

mkx

RB3011 doesn't offload anything to switch chips ... apart from very basic switching (without VLANs).

With vlan-filtering enabled everything is processed by CPU, including bridge filters...

mkx

You have many firewall rules and I'm not going to verify all of them. But there are quite a few "dangerous" ones. For example: add action=accept chain=input comment=Winbox dst-port=8291 protocol=tcp It's allowing winbox access from everywhere (including internet). I'm guessing that there's...

mkx

What about order of NAT rules? They are evaluated from top to bottom, first one matching executes.

mkx

One thing to keep in mind: permitted Tx power is not the same on all 5GHz channels. If you check output of /interface/wifi/radio/reg-info number=0 country=Denmark you'll see that some channels have limit quite a bit lower than others. In order to have signal strength (and coverage) predictable, it's...

mkx

After some more testing, it seems to work fine with encryption=ccmp,gcmp as well. These two are basic encryption algorithms (ccmp is almost another name for AES, used in WPA2) which every device supports pretty bug-free. They use 128-bit keys. The other two (ccmp-256 and gcmp-256) are new ones (usi...

mkx

Apart from the fan noise ... I don't get what on hardware is to be upgraded, what is outdated? Device features 4 optical ports and 8 RJ45 10Gbps ports ... (or less optical and more electrical ports since those are combo ports). And the switch chip, around which the device is built, is a pretty decen...

mkx

Thanks @jaclaz. @prathy, please post current config of your Audience. Open terminal window, execute /export file=anynameyouwish hide-sensitive (the last parameter has to be used if Audience is running ROS 6.x, in ROS 7.x it doesn't exist). Then fetch the resulting file, open it with your favourite t...

mkx

... but that display I don't understand... Why ?

Vastly increased WAF ... if the W is geeky ;-)

mkx

Quite likely. But I wonder why your firewall allows attempts to connect capsman via WAN?

mkx

...one thing i notice is the router actually records the traffic trying to goin in, but nothing besides that How do you notice that, by running sniffer on router itself? This way you should be able to see same packet (e.g. ICMP echo request) multiple times, on each of interfaces it passes (so once ...

mkx

No, none of MT devices have support for battery-backed real-time clock. Quite possibly the RTC support is stripped out of linux kernel, provided in ROS.

mkx

DNS record of type CNAME is not URL, it points to another host name. Your CNAME record contains a few characters which are not legal in hostnames (you can probably guess which ones are those). This would be correct CNAME[*]: /ip dns static add cname="41c389ca-8639-45a6-b901-67791ad4c0cc.unifi-h...

mkx

But from what i understand fast track bypasses packet treatements so it helps reduce latency ? The choke point is WAN interface (e.g. ethernet port) and buffering is done after all of firewall processing is already finished. Fasttrack only reduces amount of processing time of packets, but the speed...

mkx

Bufferbloat is not something fasttrack can solve, it's something that queues can solve (some are designed with this problem in mind). The basic idea is to proritize packets which don't belong to high-volume connections (and this classification is the hard part). In this case: there's a connection (o...

mkx

The information page you linked is not available to me (I'm getting 403 forbidden; could be that HFC limits access to Aussies). So you have to hope somebody with access (or even first-hand experience) drops by to help you.

mkx

Trying to clear the picture of proper interface order. Think of layers: you're trying to send IP packets. PPPoE offers WAN IP interface. So PPPoE wraps IP packet in pppoe "box". your ISP requires you to use VLAN to transport pppoe "boxes", so pppoe has to be pipelined to vlan int...

mkx

You should use /24 netmask on those subnets. Without proper subnet masks, routing won't work. And keep in kind when pinging around: some OSes on end devices include firewalls and some firewalls (e.g. windows) block everything coming in from other than "home" subnet. Home subnet is the one ...

mkx

Show us config of R2 (for starters).

mkx

Disabling IPv6 support on router is definitely a safer option ... with firewall rules it's always possible to screw something up. But as @Sob wrote: IPv6 is here to stay and it's only a matter of time when you'll have to bite into this nut ... so you better crack it open before biting it.

mkx

@jaclaz: I'm not saying that default setup should block everything from LAN as well. I'm just saying that attacks from LAN are possible and one should not dismiss such possibility when doing a pist-mortem (with intent to harden router's config). Yes, I agree that attacks from WAN are whole lot more ...

mkx

I still not understand why ROS does not give any possibility to re-gain access ... Possibly because that would enable users to steal CPEs from ISPs if the method of regaining access would be too straight-forward (such as password printed on a sticker attached to device itself). The basic problem in...

mkx

It's normal to have software release with known issues (even before releasing it), accompanying documentation just has to mention those clearly. On the other hand it's sometimes good (if not necessary) to release new version due to required new functionality ... while keeping to work on resolving kn...

mkx

So are you saying that the other two rules, such as 1 chain=prerouting action=drop dst-port=53 log=no log-prefix="" protocol=udp dst-address=172.16.1.100 src-address-list=!dns are not working? According to packet flow , prerouting is executed before DST-NAT ... which means that for packets...

mkx

We are not in a hurry xD, we only saw that in its official documentation and we were surprised to see v7.17 with green markers. I guess that they are planning to introduce some additional functionality (e.g. " Starting from RouterOS v7.17, DHCP snooping is supported with hardware offloading bo...

mkx

The problem is, that there realy isn't any disconnection, just Caps connection becomes suddenly "interrupted" and after few seconds starts working again. When frame loss happens, links don't disconnect ... in worst case they may renegotiate to lower speed (e.g. 100Mbps instead of 1Gbps) b...

mkx

0 chain=prerouting action=add-dst-to-address-list dst-port=53 log=no log-prefix="" protocol=udp src-address-list=!dns dst-address-list=!dns address-list=dns!!! address-list-timeout=none-dynamic Did you thoroughly think about what this rule does? It says: if dst-port is 53 . AND . if proto...

mkx

Some switches try to be smart (too smart as it turns out) ... and try to detect anomalous traffic. I have a Dlink manged switch and it was messing with NTP traffic (UDP to/from port 123) inside LAN. After disabling that "feature" I have zero problems (since more than a year ago). So check ...

mkx

@User345135: since you're running ubunti, run sudo netstat -ntlp | grep 8888 If you don't have netstat installed, install it using command sudo apt install net-tools The output of netstat command should show you name of process listening on port 8888 ... and that should give you a hint as to what's ...

mkx

Not sure if this is ROS specific. With IPv6 there's some spcific configuration necessary on "client" router to make it work. Sometimes ISPs don't do the right thing and in those cases client has to work with ISP support to get things working.

mkx

Does that mean I cannot make it IPv6-only? or at least IPv6 first then if timed out IPv4? You may ... by using firewall filter rules. Tunneled traffic would appear in chain=output when exiting SSH tunnel. But as @sindy already explained, you would not be able to distinguish tunneled traffic from tr...

mkx

Blaming MikroTik for setting proxy properties in your browser. You need to improve your reading comprehension or be more honest. I did not blame Mikrotik. But since you were stating your problem on Mikrotik forum, it certainly did seem so. And @kleshki simply voiced his doubts ... yeah, he might ha...

mkx

Since the CHR has no switch ASICs, perhaps the same applies to it? The problem with RB4011 (and a few other devices) is that they have more than one switch chip and bridge does L2 HW offload to them. With CHR, there is no L2 HW offload AFAIK, so it's not the same case as in the thread you linked. N...

mkx

The error message doesn't come from Qt, it comes from XCB ... which is (one of) implementation of client side of X11 protocol ... and here 'client side' is, contrary to usual situation, the side where application is running (i.e. your Linux workstation). And it seems that it's Xtightvnc who uses XCP...

mkx

Maybe bug or something else? I seem to remember a discussion about this exact problem a while ago (could be many moths ago) and @Normis acknowledged the bug. I'm pretty sure it was supposed to be fixed since then, but I've no idea in which version this was fixed (if at all). So if the problem happe...

mkx

My guess it operates a "matcher"/selector, not like the firewall "filter"/etc Both here and firewall filter rules have most properties "selectors" and only one property which does something (in both cases it's action ... to whatever it's set for a particular rule). In ...

mkx

I’m surprised you can’t do this using dst-nat rules by looking at dst-ip and dst-port and using those to match and send elsewhere. If DNS A records for server1.domain1.tld and server2.domain2.tld point at same IP address (and standard ports are in use), then L3/L4 firewall (which is what ROS runs[*...

mkx

I had some problems to make VLANs work as expected until I also set the bridge as a tagged port too. Bridge has multiple personalities (and the distinction between them in ROS configuration is not made at all). One of personalities is a "CPU-facing switch port" (and by "switch" ...

mkx

Yes, but the dubitative form is anyway appropriate when the standard power supply is used, the 24V/1.2A are IMHO very "tight" to power both the "main" device and another one via (passive) PoE. Well ... one always has to do power budget calculations when doing any kind of PoE ......

mkx

Whether the Cap Ax can actually be powered with passive PoE at 24V is not written anywhere, it may work or it may not. You're right, the passive PoE-in is rarely mentioned for MT devices with 802.3 af/at PoE-in support. But it was explained multiple times (by MT staff) that all MT's PoE-in capable ...

mkx

1. I cannot access the web-interface of RB5009 (or using WinBox) from ether7 after I add "vlan-filtering=yes" to the config. 2. I still cannot understand what is the right way to change the IP address of RB5009 from 192.168.88.1 to the Base VLAN range. More or less full access to your rou...

mkx

The benefit of having one statically compiled binary is that one can choose to package it as-is as an rpm, deb or flatpak without any further work required by Mikrotik devs. The cost is much bigger installable ... and some (functionality) problems when not using system-wide libc (and possibly some ...

mkx

The only strategy, which is fast enough, is to handle it using dst-nat ... like you're doing it now. Using external DNS servers is no different in this aspect. Doing it directly on main router cones with a benefit: you are not adding another point of failure (router is already there and for differen...

mkx

With all of your config, even if backup solution doesn't have to be fast, any HW you throw at will struggle if flash and RAM are not large enough. hEX lite with 16MB flash and 64MB RAM is a bit tight. RBM11G with its 256MB RAM should do better but 16MB flash will be equally tight. You may want to ha...

mkx

Creating a flatpak manifest around a statically compiled binary as it is now is no problem at all. In this aspect, cresting deb packets is not much different. Only that executable doesn't have to be statically linked, instead it's possible to declare dependencies and apt/apt-get/... will resolve th...

mkx

I would simply like to know if there is any way to identify each IP on the PiHole server instead of having all queries appear with the IP of the router itself. Curently you're running a thing called "hair-pin NAT" for PiHole DNS service (the src-nat/masquerade is essential part of it). As...

mkx

And all Cyrillic comments are unreadable in WinBox 4 It's a known issue and it'd due zo neglect of properly handling different encoding schemes ... all UIs simply accepted characters as bytecode and didn't interpret them according code page. So it was always a problem if one used different UIs (e.g...

mkx

Broadcast traffic in typical LAN is traffic where devices are looking for others offering certain service. Some examples: DHCP a device sends query about available DHCP server to broadcast address, initial reply is sent unicast (to network interface's MAC address) ARP requests device has to find out...

mkx

Any chance with the next update that will check the model number for example CRS309-1G-8S+, and NOT install any wifi packages and remove wifi from webcfg. Since wifi is not supported. ROS built-in updater never changed list of installed packages ... with notable exception of 7.12.x where updater ma...

mkx

It absolutely makes sense to have those wireless interfaces in bond. Default monitoring mode is mii which relies on undelying interface hardware to announce link failure. Additionally bond will introduce additional delay (default is 100ms) because links status monitoring is done regularly and the de...

mkx

I agree that it's only too confusing to have to configure one functionality in multiple places (VLANs is a good example of this lunacy). Instead here's my proposal: /interface ethernet switch port set ether2 mirroring=egress mirror-targets=ether3 set ether4 mirroring=ingress mirror-targets=ether3 se...

mkx

The proxy service on ROS is not intended to be reverse proxy ... and even though it seems to work for you, it doesn't allow for proper configuration to operate as reverse proxy. You're saying that you have multiple web servers in your LAN. I suggest you to run a proper reverse proxy on one of them (...

mkx

I can't say I understand why there is a need in my case for inventing mac addresses. I understand how ROS needs to invent mac addresses for virtual interfaces. I don't know how Ubiquitis are configuired for additional SSIDs on same radio, but the end result is the same as on Mikrotik. And that is m...

mkx

Here you are:

sorry, but this doesn't scale ... and changes names of properties (to which you opposed).

mkx

It would be inte4resting to see actual configuration from one of LHG-60 devices ... what I'd expect to see is either a bond (possibly active/backup mode) or simple RSTP hierarchy (which would switch over to 5GHz backup a little slower I guess). I thought the LHG-60 has no backup 5GHz?! Sorry, I mea...

mkx

It would be inte4resting to see actual configuration from one of LHG-60 devices ... what I'd expect to see is either a bond (possibly active/backup mode) or simple RSTP hierarchy (which would switch over to 5GHz backup a little slower I guess).

mkx

And in some other post you dare to call others "Nerd" ??
Tjeezz ...

I called others "Mikrotik nerds" specifically

mkx

AA:16:9D is actually A8:16:9D and is a roku tv 1E:1E:E3 is actually 1C:1E:E3 and is also a roku TV 9E:05:D6 is actually 9C:05:D6 and is a U6+ AP The addresses on the left are all "locally administered addresses" (see wiki article on MAC addresses ) where the second most significant value ...

mkx

I know this seems to be related to a license at first, but maybe not. It's interesting to see if the problem persists on another type of hypervisor, especially in Hyper-V since it doesn't use virtio drivers for switches.

Which again points at CHR itself rather than at virtualization platform.

mkx

BSSID is usually MAC address of a particular radio. So if you somehow create an inventory of all (real and virtual) radios in your network, then you should be able to figure out which SSID is transmitted by which AP.

mkx

the new one is (IMHO without reason) stupidly complex The new one is (potentially) flexible, it may allow this scenario: /interface ethernet switch port set ether2 mirror-egress=yes mirror-ingress=no set ether4 mirror-egress=no mirror-ingress=yes set ether5 mirror-egress=yes mirror-ingress=yes /int...

mkx

not sure i really follow that much. just considering a cheapo isp modem (speedport plus) that probably costs a few euro is giving me all 300mbit on wifi on default setup (80mhz channel, it's ac device). What I tried to explain (with perhaps too many words) is that many times less is more ... due to...

mkx

I think that the most important take-away from this thread so far is that throughput drops after applying (high capacity) CHR license ... without changing any of configuration. As documented in post #10 above . Which means that the code, which enforces licensed limits inside CHR somehow misses its t...

mkx

Maybe select another brand for the SFP+ ?? MT devices can be a bit picky when it comes to working with SFP modules ... MT publishes compatibility list , but of course it only contains their own modules (and even there not every box is checked). XS+85LC01D seems to have many checks so it seems to be...

mkx

Which means that somebody configured it to do that. Again, the problem is that it does not do what it is configured to do Sherlock. And I asked you to show us how it's configured, Watson. I don't follow problems of any particular users so I don't know which bug you allegedly "encountered the l...

mkx

The firewall blocks everything except the addresses in the dynamic list.

Which means that somebody configured it to do that.

So do you want us to start the guessing game? Otherwise post full config for review.

mkx

Base article to truly understand my answer that follows: viewtopic.php?t=173692

Setting of properties pvid and frame-types are settings for the router-facing port of the switch.

mkx

One (relatively radical) possibility is to disable/re-enable capsman on hAP ac2. It should trigger all CAP devices to re-provision (CAPs get un-provisioned if they loose connection with CAPsMAN). You can also go around CAP devices and individually disable/re-enable cap client. And probably there are...

mkx

Well, wifi in 5GHz sucks (almost as much as 2.4GHz). According to wifi channel allocations, there are only 3 160MHz channels available: channel 50 ranging from 5170 MHz to 5330 MHz (in ROS parlance that's center frequency 5180 with Ceeeeeee channels) channel 114 ranging from 5490 MHz to 5650 MHz (th...

mkx

I'm looking for a small version of the Model CRS328-24P-48+RM for testing configs for a customer. I don't care about speed/sfp or dual boot. I only need switch OS. Would the CRS106-1C-5S work? I couldnt find a comparison guide. Depends on how similar the testing switch should be to the "real&q...

mkx

But if there is only 1 wace2 device, why bother ? As far as info in this thread goes, @OP runs a few RBD22UGS-5HPacD2HnD (which are ac devices) and now he threw an L22UGS-5HaxD2HaxD into the mix ... which is ax device. All of these are capable of running wifi drivers (L22 only this one), so @OP wou...

mkx

If device is fully bridged it doesn't matter if ether1 and 2 are connected

Agree to that. I was just explaining to @OP why he can't manage device via ether1 if they're running factory default config (which doesn't bridge ether1 with the rest of ports AFAIK).

mkx

Thank you for the suggestion, Amm0. Added to wishlist. Behaviour should adhere to system settings. I don't use Mac, but on Windows and Linux I prefer not to have apps groupped ... and there's system-wide setting for that both in Windows and KDE (which is what I use on Linux if I can choose). In nor...

mkx

It's been a while since my devices were pushed in storage starvation ... but I don't remember seeing anything in the log. Specially so not after reboot (since by default all logging goes into RAM and even if one set up logging to built-in flash, that would be unsuccessfull as well due to same reason).

mkx

Why can't I connect to the CAPs using Winbox from the router? Why do I have to physically go to each CAP just to apply my configuration? Because out of factory, default config for most MT models is "home router" mode ... in which first ether port (ether1) is used as WAN port and to protec...

mkx

While it's preferable to make MTU of all interfaces the same (i.e. 1500) and while it seems that @OPs ISP allows to play with these values, it could be that there's some segment in ISP's network which doesn't support full 1500 byte packets over PPPoE ... and fragmentation happens there (and also spe...

mkx

Not much to take care of. One major thing is to set priority on bridge of switch you want to use as "master" in STP hiearchy to value, lower than default (which is 0x8000) ... 0x2000 would be a safe value. This way you won't see topology changes if some switch changes its MAC address (if p...

mkx

If would be nice, if Winbox had told me about the full disk when saving a configuration.

I agree to that. AFAIK none of GUIs actually warn user about storage being depleted ...

mkx

1. I uninstalled wireless package from CCR1036, but now I don't have an option for Capsman anymore. You do. It's under /interface/wifi (you have to use a few subtrees there from, capsman uses profiles). On devices with ac/ax radio and with wifi-qcom (or wifi-qcom-ac) drivers installed, one configur...

mkx

Be carefull with the fast (sponsored) answer of the Google (AI based?) search.

Gosh ... doesn't everybody (and their favourite pet) skip top results from search engines?

mkx

Which GUI do you use? There are WebFig (web based UI), Winbox3 (very stable) and new Winbox4 (early beta, so likely buggy) If you change detect-internet (to "none") in CLI, does it stick? And when you open that setting in GUI (which flips its setting) ... and close it without applying ... ...

mkx

AND the hex is losing it's configuration, comments and also files I created. What is going on?! Doesn't it store those things on an internal device? Check hEX for flash utilization. If it's (almost) full, then configuration changes can get lost. But that happens after reboot, running copy of config...

mkx

When I close the dialog the value I get in the CLI is wrong again.
I just leave it at "LAN", that seems to work for me.

Why don't you change it via CLI if you've gotten that far? (big thumbs up for that!)

mkx

RBD53iG-5HacD2HnD = hAP AC3

How to tell a Mikrotik nerd from normal people: the former can recite product codes together with their marketing model names

(while the later have to use their favourite internet search engine)

mkx

I think we can go back to "do NOT use quickset" ... if user comes to @holvoetn asking him about rules, then that user is already way past the IFs and BUTs which would potentially allow to use quickset.

mkx

As for those two NAT rules - It's been a while since I set this up but if I remember correctly (and I can certainly test this..) without those DNS breaks and nothing resolves. From context of device config posted these rules are useless ... the TCP rule has potential to rewrite dst-port but actuall...

mkx

Avoiding it in total may be for most the wiser option. Exactly. If there were enough quickset profiles/schemes to cover like 98% of use cases, then I'd be all for quickset ... it is a corner stone for offering MT devices to people without ROS knowledge. However since many profiles are missing (and ...

mkx

As I already hinted: does device, connected to ether7, expect tagged VLAN 200 or not? Required configuration on switch entirely depends on this "design decision". From your observation in last line of previous post it seems that device doesn't talk VLANs ... in which case you do need the i...

mkx

Why would I need TWO (2) SFP? Future expansions? Or some other similar excuse. See answer to your last question. anything in particular that I should watch out for when ordering the fiber? I have seen a bunch of different ones on Amazon just not sure which one to get. Just keep in mind that general...

mkx

4. Do NOT use quickset

This one should be made rule number -1 ... or whatever takes to make it to very top of rules.

Search found 12914 matches