MikroTik

xvo

Please stop posting about what can happen when you interpret 802.11d country codes sent by others and focus on the request to send the 802.11d country code in a MikroTik AP so that others (broken, old, whatever) can pick it up and do whatever they were programmed to do with it! I am totally with yo...

xvo

Smartphones and other mobile devices have GPS, they don't need 802.11d at all. That's right, but all the rest of the equipment is needed. The rest of the equipment should use something like "no-country-set" or ask the user, if it can't locate it's position with 100% accuracy. Out of curio...

xvo

We would appreciate further compartmentalizing of Router OS features to increase device efficiency and reduce attack surface. Put SMB, Torrent, and other things that have no place in ISP infrastructure into another package. Put BGP, MPLS, and other things that have no place in consumer devices into...

xvo

If there is no other information. You have to broadcast the region for Mikrotik with another device. 😂 Smartphones and other mobile devices have GPS, they don't need 802.11d at all. Out of curiosity looked what regions do APs around broadcast at the moment, only half of them are set to the correct ...

xvo

I talked about this from the very beginning - re-read it. Only you have a special case in 2010. The new 802.11ac - restriction on visible channels. That is the problem. It's not a special case, It's a long known issue with a known workaround. Although it's not exactly the same problem, it is connec...

xvo

Bottom line: devices CAN use 802.11d to help them set the region, but they CAN NOT use ONLY 802.11d, they need something else - gps, whatever. Thus support of 802.11d is nearly useless - all modern devices will set the region without it. no and no again. I have a mikrotik network. Regoin Apple can ...

xvo

Bottom line: devices CAN use 802.11d to help them set the region, but they CAN NOT use ONLY 802.11d, they need something else - gps, whatever. Thus support of 802.11d is nearly useless - all modern devices will set the region without it. no and no again. I have a mikrotik network. Regoin Apple can ...

xvo

Bottom line: devices CAN use 802.11d to help them set the region, but they CAN NOT use ONLY 802.11d, they need something else - gps, whatever. Thus support of 802.11d is nearly useless - all modern devices will set the region without it. no and no again. I have a mikrotik network. Regoin Apple can ...

xvo

not a true statement, on all models since 2012, everything is fine with 802.11d. The AP must broadcast 802.11d. a piece of shit - tp-link even does it. That is a known problem for pre-2012 devices. Your "everything is fine with 802.11d" most likely means that apple no longer uses 802.11d ...

xvo

not a true statement, on all models since 2012, everything is fine with 802.11d. The AP must broadcast 802.11d. a piece of shit - tp-link even does it. That is a known problem for pre-2012 devices. Your "everything is fine with 802.11d" most likely means that apple no longer uses 802.11d ...

xvo

Apple's implementation of 802.11d is a real pain in the ass, indeed. And setting the correct country code on the AP in use won't solve the problem in some cases. For example (at least for some older macbooks's), if there are changes in country regulations, they are not updated in the drivers. So if ...

xvo

There won't be one. Audience hasn't got USB port (at least I didn't see it mentioned), so you'll have to use generic PowerLine2ethernet devices.

But it has two ethernet ports, so PWR-LINE-PRO can be used.

xvo

The only thought to consider: hEX S have a very weak switch chip implementation - it can't do vlan's in hardware, only in software. It is not a real problem for small loads, but depending of the intra-vlan/inter-vlan ratio it can be a good idea to put a more decent switch between hEX and the rest o...

xvo

Here is my config backup! I have not internet still, and router cant still not ping internet from it self. Could it be the routerbord firmware? Mine says 6.45.3 but on download page it says tilegx_3.41.fwf or is that someting else. Just thinking of what it can be as i think Routerbord follows Route...

xvo

The only thought to consider: hEX S have a very weak switch chip implementation - it can't do vlan's in hardware, only in software. It is not a real problem for small loads, but depending of the intra-vlan/inter-vlan ratio it can be a good idea to put a more decent switch between hEX and the rest of...

xvo

Uh, wait. You said you wanted to use it as an AP only. Then you should have no WAN interface at all, it should be just bridging (wifi is LAN, ethernet is LAN)... right? Or am I missing something? At this point all real WAN/LAN distinctions are already removed from configuration. That's just names o...

xvo

Thanks! I got my device today and had it configured in minutes, thanks to you guys. Quick question though, I'm using the WinBox GUI to connect and configure, which works fine from any device actually connected to the hAP wirelessly. However I have a hard-wired machine on the same LAN as the hAP (it...

xvo

The lamest way to do it is to use the quick-set menu, select the "Home AP Dual" template, and then in the template: - configure a static LAN IP address of your router, that is free in your network. - and remove the check from the DHCP server option. This way eth1 will still be your WAN in...

xvo

Hi, I know that it can be configured as router, but if you look at the links my configuration is only as l2 switch no routing no fw no vlans and still if i copy file from computers in same subnet so routing is not required I got this performance drop. It looks like for some reason it is hitting cpu...

xvo

It's not "just L2 switch", but also a router at the same time.
Not a powerful one, so when it routes instead of switching, you see a huge performance drop.
Keep that in mind configuring your network.

xvo

If it bothers you, just set it 1Gbps for all gigabit ethernet ports and it will disappear from export. It does not bother me, but can easy be misunderstand. On Cisco speed 100 settes the interface 100MB/s fixed. ...and on mikrotik auto-negotiation on/off and speed when auto-negotiation is set to of...

xvo

Running 6.43.4 I do see this as well. /interface ethernet set [ find default-name=ether1 ] name=ether1-Wan speed=100Mbps set [ find default-name=ether2 ] name=ether2 speed=100Mbps set [ find default-name=ether3 ] speed=100Mbps set [ find default-name=ether4 ] name=ether4 speed=100Mbps set [ find de...

xvo

1-5: You need to advertise dns for your deviced: IPv6 --> ND 6: Yes, that is normal. DHCPv6 is ROS is currently incapable of handing addresses - only prefixes. All the addresses on another RB have to be configured manually, got by SLAAC, or picked from prefix pool. So you can: 1) assign the address...

xvo

Would be nice if CRS112 was half rack width with option to join 2 together to make 16 port full width.

And it doesn't look like having 16G and 1-2SFP+ in CRS112 size is something impossible either.

xvo

Hello. Well i've the same problem here. No ADSL or Fiber...that's why i'm using LTE connection. So...3Unlimited and Vodafone Red+ must have linked to a landline contract? Thanks in advance. Maurizio True for 3Unlimited, but haven't seen such limitation for Red+, only that it is obligatory to stay o...

xvo

I guess no need to further explain the difference between static DNS servers settings and static DNS entries?

xvo

Well, if you have four entries there, how is it blank?!
Remove these four entries, and that would be blank

xvo

I am talking about the IP DNS settings that show up at the top of the frigging page IN WHITE BOXES............ These are set by the ADMIN. What do you call those then???? FIXED DNS settings ;;--))))) In any case, I was stating that using PEER DNS setting overides the manual FIXED entries on the IP ...

xvo

I think my Use Peer DNS, 'trumps" your IP DNS reference. In any case, I imagine you like warm beers, which is like stale cigarettes to a smoker OR moldy cheese to John Cleese in the cheese shop, ie gross but it will do pig. Use-peer-DNS adds dynamic entries, so the static ones will be preferre...

xvo

Thanks for the info, but Unlimited Red+ seems to be smartphone only, and I have no luck to find any info on 3Unlimited. For Italian law, you can use the GB of any mobile plan as you want. You can use sim for smartphone for tethering and modem without problems. https://www.ilsole24ore.com/art/tecnol...

xvo

https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack

"firewall filter and mangle rules will not be applied for FastTracked traffic"

xvo

There's no real difference. You'll just get a public ip instead of some private one on your WAN interface. When you purchase public ip from you provider, I'm sure they will explain the method, how they deliver it - do you need to assign it manually, or you will just get it by DHCP client of from PPP...

xvo

thank you very much for your information God bless you You are welcome. Just keep in mind that having a public IP means you need to pay more attention to security, i.e.: - properly configured firewall - access to services on the router not exposed to the outside - and the ones that you don't use - ...

xvo

It does not matter if I set it to passthrough :/
Also in Wiki there are not passthrough enabled..
https://wiki.mikrotik.com/wiki/Manual:PCC
As I said it works on hAP-lite just not hAP-AC2.
Have you tried it on hAP-AC2.. has anyone?

Passthrough=yes is the default setting.

xvo

The best way is public IP + any kind of VPN server running on your RB. thank you for your speedy replay lets say you get puplic ip for example = 37.230.130.95 what are the next steps , what are the settings in mikrotik system to using this puplic ip address for remotely accessing my routerboard? an...

xvo

But that goes to my point about nothing specific in the redirect rule. How would I exclude the VLAN from that rule in NAT when no source or destination is identified? Just add source to the rule ( in-interface or src-address ) :) Also I am not quite sure if you answered the question, where does the...

xvo

Hello. Well you'll not find any unlimited from our major carriers (vodafone..tim..TRE/ Wind). But there are some company which are selling internet service using our carriers nets. It's not true! Only TIM don't have unlimited data plan. Vodafone have Unlimited Red + WindTre have 3Unlimited Both the...

xvo

You can either remove all current connections to the cam manually (IP --> Firewall --> Connections). Or you can move you rule higher then established/related one, but that can result an additional CPU load (because all traffic will be checked by this rule, even the connections that were already esta...

xvo

The best way is public IP + any kind of VPN server running on your RB.

xvo

Just kidding, inside joke with xvo, he has helped through the same process held my hand, heck practically changed my diapers LOL. You are in good hands, but plug your nose, dont like his aftershave (who am I kidding I'm convinced he doesn't know what a razor looks like must be his perfume errr colo...

xvo

Okay so a user manual setting on a computer will override the DHCP network setting and thus the redirect rule is required (for the office setting) Yes. For office internal network it makes more sense. Especially if you need everybody to use some special dns service - with security and content filte...

xvo

I also find such measures unnecessary in home environment. Someone can always set it manually on the device's network settings. But who cares?! It's a guest network anyway. If someone among your guest have set his laptop/phone to always use google dns, so let it use it - less load and unneeded cache...

xvo

1. Redirect is like dst-nat to the router itself. So if you redirect all DNS requests it means that the will be served by you router, without the client knowing it. Even if it will try to use some external DNS. 2. use-peer-dns only means that you will get the addresses of DNS servers from remote pee...

xvo

Not separate, the "dns" topic in logging section.

I meant that you can use action=redirect in /ip firewall nat for DNS requests - that will force the use of your DNS even if a client attempts to connect to any other DNS server.

xvo

Good to know, now I can add the other vlans I have been planning;

Much thanks!
Forget the Ghost Busters, call XVO!!

You are welcome!
I'll try not to forget about the beer you mentioned

xvo

Okay, it worked but I am confused. I added the guest vlan to the interface list for LAN and voila magic it worked. BUT........... I already had. a. homebridge on the lan interface list b. ether2 on the lan interface list c. ether3 on the lan interface list d. ether4 on the lan interface list Since ...

xvo

Thanks - hadn't spotted that. Now got that enabled, and getting some DNS info in the syslog file. It's not very useful info though: <14>1 2018-11-03T17:27:46+00:00 MikroTik forward - - - forward: in:bridge1_LAN out:EE Broadband, src-mac 24:5e:be:1d:09:9f, proto UDP, 192.168.1.98:54957->8.8.8.8:53, ...

xvo

/interface 6to4
add disabled=no !keepalive local-address=1.2.3.4 name=6to4-tunnel1 remote-address=192.88.99.1
Code: Select all
local-address = wan IP
remote-address = address of the tunnel end

That's right and 192.88.99.1 is the right remote-address for 6to4

xvo

xvo

To make firewall logging work you need not only to set log=yes in the rule but also add logging for the firewall topic (or a part of it):

/system logging
add action=remote topics=firewall

(Of course you need to get a syslog server running on your NAS beforehand).

xvo

Well &^%^ me! Awesome pickup. When you come to Canada, I will have a cold beer waiting for you, heck a whole case for all the trouble I have put your through for one little typo. I will fix and try right away! Okay, partial success!!! I now get an IP and connect to the router through the capAC....

xvo

1-5: You need to advertise dns for your deviced: IPv6 --> ND 6: Yes, that is normal. DHCPv6 is ROS is currently incapable of handing addresses - only prefixes. All the addresses on another RB have to be configured manually, got by SLAAC, or picked from prefix pool. So you can: 1) assign the address ...

xvo

Found this: /ip address add address=192.168.0.1/24 interface=HomeBridge network=192.168.0.0 add address=192.168.2.1/24 interface=ether4 network=192.168.2.0 add address=192.168.100.0/24 interface=GuestWifi_T&B_V100 network=\ 192.168.100.0 Unless it's a typo in the post, looks like a reason to me :)

xvo

they should not yes, but i have this issue and also they will be upper of dynamic rules in raw tab

Are you sure they aren't just sorted?

xvo

Hello. Well you'll not find any unlimited from our major carriers (vodafone..tim..TRE/ Wind). But there are some company which are selling internet service using our carriers nets. For unlimited service : OGilink - Works with Vodafone..but is quite expensive. 69 for unlimited - or..39 Euros to have...

xvo

Thanks a lot..!!! Ang greetings from Italy Maurizio Hi again. It turns out, I might need a little advice from you too, if you don't mind: Can you suggest me any mobile carrier in Italy, with unlimited LTE traffic plan, that won't cost me a fortune? :) I might end up having to install a setup very s...

xvo

It shouldn't change on its own.

xvo

I think the answer in your use is to simply get a CRS328 which is a little more expensive but has some "growing room". https://mikrotik.com/product/crs328_24p_4s_rm I hope that dedicated PoE and non-PoE ports will not be a thing in the future and they adopt the standard they are currently...

xvo

Thanks a lot..!!!

Ang greetings from Italy

Maurizio

You are welcome!

xvo

When using L2TP + ipsec you can't be sure, that the packet is not fragmented, even if you specifically restrict fragmentation of the original packet. The original packet first packed into l2tp (that can, by the way, also perform fragmentation and defragmentation, but only if asked to), then it is pr...

xvo

Hello. I don't have any free ports in the router, so i have no choice but to connect them to the switch runnings SwOS. Also i want maximum performance so i don't want to do any filtering/routing/bridging in the CPU, i want to use something that my devices have hardware support for. Thank you for yo...

xvo

I guess it has to do something with that data lanes XOR logic - either SFP or one more lane to the switch chip. You are right - looks like most possible cause. Despite you say the problem is solved, I think this behaviour should be described somewhere (on a wiki? in quick start guide?) in a form of...

xvo

You can either make bridge use IP firewall:
https://wiki.mikrotik.com/wiki/Manual:I ... e_Settings
Or configure filters on the bridge itself:
https://wiki.mikrotik.com/wiki/Manual:I ... e_Firewall

xvo

If you can have the PCs that need to be isolated connected directly to hEX, not the switch, then you can do it without vlans and in several different ways: - you can create separate subnet(s) for such PC(s) - you can run IP firewall on the bridge - you can configure bridge own filtering - you can us...

xvo

Is there a possibility, that you have a default config address assigned to sfp interface instead of the default bridge?

xvo

Hello. Yes..i was looking to it or any RB 951. But what about wireless coverage? Using a CAP AC for example, will help me to have a better wireless coverage inside the house? I know is more complicated but maybe those AP have a better and bigger antenna inside. What do you think.? Does it make sens...

xvo

+1
Need that too

Any of this with internal PSU will be fine:
CRS318-8G-8P-2S+
CRS318-10G-6P-2S+
CRS318-12G-4P-2S+

xvo

hello. I can't use the RBM33 like this just because the routerboard is installed on the pole to make the antennas cables as short as possible. I need to have one router..or switch with dediated AP to be used inside my home. I see... But you can still combine switch + AP in one device, or perhaps ev...

xvo

Hi!

It would be great to be able to configure the refresh rate to lower that bandwidth consumption...

You can give it a try here: viewtopic.php?t=45934

xvo

Hi! Thats strange... I am connecting to the IP of the CRS. I just checked my Firewall-connection-list.... If I just connect to the CRS, it consumes only a few kbps (14,4) If I only open the interface-list, it goes up to 260 kbps --> The problem seems to be the Interface List. Can you confirm this? ...

xvo

any switch working like that to suggest to me for home applications?

Thanks a lot.

I think any switch will do ok, but my point was to eliminate the need of additional switch at all, combing it's functionality with AP.

xvo

do you know if any MiniPCie dual and modem exist to be used with routerboard? i've one SXT LTE without modem...eventually i could buy a modem to use it like AP.. Unfortunately I don't have much knowledge about MiniPCie modems/wireless cards. I thought you were going to use RBm11G with the modem? If...

xvo

Yes both checked in safe mode and nothing bad happened so safe mode is off. Operations direct connect commences today. Actually I have a spare (second ethernet cable, diverted from an unused location box, before the basement was recently finished, so I have a direct line to the patch panel going to...

xvo

You can even eliminate the need to buy a 56$ 260GSP and buy a device that will serve as switch, AP and will provide power to RBm11G.

xvo

Hello.. Oops..this is new to me. is it possibile to buy the level 4 licence and upgrade it..? You can purchase it ( https://wiki.mikrotik.com/wiki/Manual:License#License_Levels ). But there's really no point to do so in your case. There are plenty of newer devices, more powerful than RB 411l, that ...

xvo

Done, and still not working. Something is preventing the devices using the virtual AP from a. getting dhcp assigned and b. no internet. I wonder if because I am connected to homelan on my smart phone, when I try to connect to the vlan, the smartphone isnt able to switch IP structures (unlikely). So...

xvo

Okay I will try the VLAN filtering. Not sure what function this does but the last time we tried it at least on the hex, in safe mode, it didnt like it LOL. On the Bridge Vlan checkbox after selecting VLAN filtering, there is only one option to enter a VLAN, Right now it defaults to PVID1 Should I e...

xvo

as i've a Rb411l with a wireless card to be used as AP...this can be connected to the switch as well right? Can the RB 411l upgraded to the last routeros version? You can connect it to the switch and you can upgrade it to the latest version, but you can't use it as AP (unless you have bought a sepa...

xvo

When set to "auto" the switch will perform a check whether device supports PoE or not, and It will apply current only to ports where the devices need that. And if you want, you can always set PoE-mode to off for ports that don't need it. https://wiki.mikrotik.com/wiki/Manual:PoE-Out#SwOS R...

xvo

Hi! Absolutely. I checked it twice It should not be that way. That is winbox connections to 4 different routers: Lower 3 have no open windows, only cpu/time/date/etc in the dashboard. Upper one has an open IP --> Firewall --> Connections from where I took a screenshot. So it never rises over 5kbps/...

xvo

I'm afraid that while each MST instance does build its individual topology (it's the essence of MST functionality), you cannot set different priority/cost to a single port in each instance. So if your idea was to say that port A has lower cost than port B for MSTI 0 and port B has lower cost than p...

xvo

Hi!

I see constantly 200 kbps with NO open windows.

...tested with CRS 326.

Stril

Are you sure that it's winbox traffic?

xvo

Try to remove tkip from /interface wireless security-profiles

xvo

You need to add bridge itself as a tagged port for your vlans, to make a connection to ip configuration of vlan-interfaces: /interface bridge vlan add bridge=bridge1 tagged= bridge1 ,sfp-sfpplus1 untagged=ether6 vlan-ids=100 add bridge=bridge1 tagged= bridge1 ,sfp-sfpplus1 untagged=ether5 vlan-ids=4...

xvo

Yes, but with only one window, I already see 200 kbps... Torch? :) Not necessarily :) For example firewall with around 40 rules - adds around 100kbps in spikes. Interfaces window with 10 interfaces - 80kbps, almost constantly. IPsec Installed SAs with 10 items - 20kbps. So opening a bunch of window...

xvo

Seems that inject-summary-lsa=no works only for stub areas, non for NSSA.

xvo

type=stub ?

xvo

Winbox traffic depends on the number of simultaneously opened windows (number of data, that need to be refreshed in real-time).

xvo

I see no structural flaws: so the last thing left to do is to enable vlan filtering for bridges on both devices. Answers to your questions: 1) I suggested to connect cAP to hEX directly only temporarily - to debug their config and get them running 100% as they should, and only then to deal with any ...

xvo

Thank you for the reply. Since this is only a single trunk port, I just set it up the "old way" with 2 bridges. The EAP245 does properly accept tagged vlans and is giving out proper DHCP on each SSID. I am sorry I posted the question so poorly. I am just having a hard time understanding t...

xvo

There are numerous similar topics on the forum. Briefly: if you need a more complex config then a single trunk port, then in latest ROS versions the best way to configure vlans is one single bridge containing physical ports, with vlan-interfaces created on top of that bridge , and vlan filtering eit...

xvo

Just another suggestion: test with cAP attached directly to hEX (with no switches in between) - there's still a tiny chance, that they can mess with the process.

xvo

Got it working properly now. Thanks for your help!

Great! You are welcome

xvo

Hi xvo, In my current forward rules I probably go overboard as I have source address (192.168.0.0/24) In-Inteface: HomeBridge Out-Interface List: WAN But I do that to distinguish which address source on the home bridge I am delineating. Thus my intention for the VLAN to WAN allow forward chain is t...

xvo

Please post an export from both routers.

xvo

After a couple of days with just another similar topic I started to mix things up :))) The correct setting for cAP will be: /interface bridge vlan add bridge=bridge tagged=ether1,Basement_Guests vlan-ids=100 You are right about firewall rules - need one rule to allow from Guest to WAN. From Guest to...

xvo

I've figured out how to set the limits for the VPN user. Now if I log in as that user and exceed the limit the VPN connection drops. Is there anyway that I can keep the VPN connection established, but drop packets instead? Use the second option I mentioned - dynamically created queues, configured o...

xvo

What in-interface for traffic which go from bridgeLAN interface to bridgeLAN interface ? Why if i do exactly same operation on CCR then ping works ? I doubt interfaces are used at all when you are pinging local addresses. At least in-interface. And you log entries clearly show that. If you want to ...

xvo

Some things are still not clear: do you have your tunnel bridged with LAN only on one side or on both sides?

xvo

...and finally I got what are you trying to prove

No difference in behaviour between CCR and all others I mentioned above.
The answer is in your log: obviously, in such case there is no in-interface, so it doesn't match your first rule.

xvo

On hEX you forgot to allow traffic from Guest.... to WAN

On cAP, that:
/interface bridge vlan
add bridge=bridge tagged=Guests_T&B_VLAN,bridge vlan-ids=100
has to be this:
/interface bridge vlan
add bridge=bridge tagged=Guests_T&B_VLAN,Basement_Guests vlan-ids=100

xvo

Tried on hEX, hAP ac2, hAP mini - nothing like this.

xvo

Well, the next day. I'm still trying to build up a simple AP and it still doesn't work... :( It's even impossible to set the CAP with the Quick Set again :-/ If I choose that option and activate it it's impossible to connect to the AP again :( :( :( Isn't there a step by step tutorial to build a AP...

xvo

It totally makes sense.
When increasing the timeout you are still sure that the action for all previously met rules are still fulfilled.
If you allow to decrease the timeout, that will mean than one rule can cancel the one that was met previously.

xvo

What exactly do you have configured on that bridge?
What is connected to it?
Do you have (R/M)STP running on it?

xvo

All changes implemented and ready to test it shortly. In terms of the cap AC setup. Let me recap. a. its in ap bridge mode and not router mode so not sure why the default config has ether1 in WAN mode. b. ether1 is active and is physically attached to the network, strangely the cap AC seems to be h...

xvo

After implementing vlan-aware bridges with hw-offload you no longer need 1 bridge per vlan. But with VLAN-aware bridges you have no hw-offload at all! The config mentioned above - with multiple bridges - was always purely software, and it was the only way for devices without switch chip. No point t...

xvo

I want to see HW Off-load enabled in all bridge interfaces, not just one. Specially knowing that you need 1 Bridge per VLAN having this limitation is a killer as I will limit the traffic throughput without unable to get wired speed only in just 1 VLAN. Really?? Seriously?? After implementing vlan-a...

xvo

I don't see anything wrong. And I could not reproduce the issue: I have an AP running with vlan-mode=use-tag and vlan-inerface attached to the bridge with the only difference being vlan-filtering enabled on the bridge. I disabled vlan-filtering and it made no difference, I was still able to connect ...

xvo

What is the purpose of you nat rules?
I'm almost sure that one default masquerade rule is sufficient:

/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN

or

/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-out1

xvo

I've figured out how to set the limits for the VPN user. Now if I log in as that user and exceed the limit the VPN connection drops. Is there anyway that I can keep the VPN connection established, but drop packets instead? Use the second option I mentioned - dynamically created queues, configured o...

xvo

Please, attach the whole config with hide-sensitive option.

xvo

The WISP AP in a bridge mode doens't work at all. No Internet via LAN nor WLAN and I can't connect to the accesspoint again, so I have to do a OS reset. In wisp ap bridge mode you need to connect cap to existing network with running dhcp server for it to work, it won't work standalone. I just have ...

xvo

There is rate-limit setting in ppp profile.
Or the ability to create a queue autimatically.

xvo

Here's the link to the similar thread:
viewtopic.php?f=13&t=138366&p=682048#p681679

xvo

The closest quickset preset for you is WISP AP in a bridge mode . But it is preconfigured with only one radio, and the second one disabled. So you will need to configure the second radio manually. Or you can go the "pro way" and configure everything from blank config without using quickset...

xvo

That should work just the same as with ethernet port.

Check what do you have in /tool mac-server mac-winbox export
You probably have not the whole vlan but only some interfaces added to that list.

xvo

Ok, that worked so far. I set the intern IP adress of my Accesspoint to the IP I got from the FritzBox and deactivated DHCP on my accesspoint. I changed my PC IP manually and I can connect to the accesspoint now. The problem is now, that I don't have a internet connection with my pc. What can I do ...

xvo

1) On HEX this line: /interface bridge vlan add bridge=HomeBridge tagged=ether2 vlan-ids=100 must include the bridge itself: /interface bridge vlan add bridge=HomeBridge tagged=HomeBridge,ether2 vlan-ids=100 On cAP AC it is really a little messy :) 2) This: /interface vlan add interface=Basement_Gue...

xvo

The default firewall is configured to allow access from interfaces in a default interface-list "LAN", so just add your new bridge as a member of this list.

xvo

Just to give some information about this setup. It is the old way by using many VLAN. From 6.41 you can use Bridge aware VLAN. Se some example here: https://forum.mikrotik.com/viewtopic.php?t=138232 ...and the config above is exactly a vlan-aware bridge. Aka "the new way". "The old w...

xvo

Try googling “hairpin nat”

xvo

Wont have time to work on this until later but the Bridge VLAN tab has the following selection (talking HEX). Bridge - assume my home bridge goes here VLAN ID - assume pvid 100 goes here Tagged - ? Untagged - ? There are two more entries but they do not look modifiable current tagged and current un...

xvo

1) When you said create vlan interface for guest users on your bridge , I assumed this meant my current bridge, which my LAN resides. (in other words no need to create a new bridge). Yes, you can use your default bridge. 2) Next you want me to go to BRIDGE winbox menu selection (not interface menu ...

xvo

Wonderful xvo, that is great news to hear. What I assume is that I will need to identify/create a VLAN for the guest wifi, call it VLAN100 on the HEX I will have to create an address group and DHCP server for the VLAN (as I do want these device to get a different LAN nomenclature, lets call it 192....

xvo

Hi xvo, I have been reading many of your replies on the forums, and just wanted to state I find them very helpful (big thanks!). Always a pleasure to hear, thanks! Okay I got it working without any IP configuration. All I was missing was adding the virtual interface to the bridge BY WAY OF ASSIGNIN...

xvo

Why don't you want to make a bonding with this two interfaces?

xvo

If you want clients of that guest AP to be treated somehow special (limited access, limited speed, etc) you need to create a different ip configuration attached to it: address, dhcp-server and a set of firewall rules to define that special behaviour. And since everything seems to be configured on yo...

xvo

Bridge always worked that way and if suddenly bridge with inactive (no ports) will not have running flag, it will break all configurations with loopbacks and other configurations where bridge is used as dummy interface. Well, there can be an option to choose the desired behaviour: to leave a runnin...

xvo

What type of VPN?

xvo

Sorry for taking a long time to answer. ROS versión: 6.43.4 The problem is not the peer, it is established correctly. The problem is the duplicate policy with different SA src address, one of them become invalid. [admin@C1] /ip ipsec> remote-peers print detail Flags: R - responder, N - natt-peer 0 ...

xvo

XVO, much appreciate you reply. I will go with the "worse" option. Please excuse my ignorance, could you advise how I could do that? I cannot see the option to forward the port on the hEX router. Port 5 on the hEX is connected to Port 1 of the switch. You need: 1) A dst-nat rule in your I...

xvo

CRS354-48G-4S+2Q+
CRS354-48P-4S+2Q+
CRS332-32S+RM

Will be these ever released ?

By the way, if anyone noticed, CRS332-32S+RM has now became CRS326-24S+2Q+RM
https://mum.mikrotik.com/presentations/ ... 023534.pdf

xvo

hello I search the method for migrate my CCR1009 to my new CCR1036. The combo port is not present in the CCR1036. Should i modify manually the backup file before "import" ? Thank for your advice. JM. You shouldn't use a backup file on the hardware of different type from the one it was cre...

xvo

"discover" list is by default used to specify interfaces on which neighbour discovery works. "mactel" list of interfaces from which mac-telnet server is availible. "mac-winbox" the same for accessing the router by mac address in winbox. If I remember correctly, on blank...

xvo

You can:
1) (worse) Open a port on hEX and forward it to web interface of the switch.
2) (better) Run a VPN server on hEX, so that you can connect to the whole your internal network from outside in a secure way.

xvo

What is your ROS version?

What's new in 6.43.4 (2018-Oct-17 06:37):

Changes in this release:

*) ipsec - allow multiple peers to the same address with different local-address (introduced in v6.43);

xvo

Ideally to have 4 x SFP+ and 10 1 GbE ports!. so if down stream switches can get 10 Gbps speeds.

I'm almost sure something like this is to be released in a foreseeable future.
And you can even guess a price for it looking at the price of current CCR1036.
I think you got my point

xvo

Yes, you can. maybe anyone has an example? I know that ROS has /interface 6to4 but since 6in4 (STI) and 6to4 (STF) are NOT the same, the wiki article is misleading: https://wiki.mikrotik.com/wiki/Manual:IPv6_Overview#6to4_.286in4.29_tunnels https://en.wikipedia.org/wiki/6to4 https://en.wikipedia.or...

xvo

Yes, you can.

xvo

I suggest you to try to find the step on which the packet from A network to your mysterious host on B is lost:
use torch, packet sniffer or just create a couple of rules on top of the firewall forward chain both on A and B routers - one rule for way from A network to x.x.x.10, and one for way back.

xvo

And nothing special about x.x.x.10 in mikrotikB config?
No firewall/NAT?

xvo

In default config there is only one member of interface list "LAN"- the default "bridge". And all firewall is build around interface lists "LAN" and "WAN". So you need to add "wlan1" interface to interface list "LAN" and 99% that it will re...

xvo

Windows machines can listen to RIP.

xvo

Seems that in the provision for cap AC “Client to client forwarding” is set to “no”.

xvo

You don't need VLANs for what you are trying to achieve: just remove wlan1 from the bridge and attach ip configuration to it directly.

xvo

There can be such setting on the switch - port isolation or something like that, depending on a switch manufacturer.
But this has nothing to do with the mikrotik.

xvo

There is an option to run a specified script (that is stored on flash) after reset. I guess you can make your application create a script with a simple IP config before reset, and run it afterward. Thank you, but I really want to handle all cases, example like hardware reset. If you perform a hardw...

xvo

So what MTU do you have on the 6to4 after all?
And in the HE cabinet?

xvo

But I have tried auto, 1500 (upping my L2 MTU), 1492, 1488, 1480 (which is the one that gets selected when I say "auto"). PPPoE default is 1492, 6to4 substracts 20 (that is why “auto” is 1480=1500-20), so you should at least try 1472. And specify it on both ends - yours and in HE settings...

xvo

Second. But on 6.43 there is an easier way: /interface vlan add interface=bridge-vlan name=vlan4 vlan-id=4 add interface=bridge-vlan name=vlan17 vlan-id=17 add interface=bridge-vlan name=vlan424 vlan-id=424 /interface bridge add name=bridge-vlan vlan-filtering=yes /interface bridge port add bridge=b...

xvo

And also you need to specify out-interface=ether1 for your masquerade rule.
Otherwise it changes src-address to the router's addresses for everything that passes through it.

xvo

For sure it does!
When you specify a port it tries to ping TO this port, not FROM this port.
And since you don't have 8.8.8.8 available through any of your vlans - it timeouts.

xvo

There is an option to run a specified script (that is stored on flash) after reset.
I guess, you can make your application create a script with simple ip config before reset, and run it afterwards.

xvo

MAC Winbox and ROMON are working on the build from joshaven.
Ctrl-C and ctrl-V as well (ctrl-, not cmd-).
Drag’n’drop does’t work, but that’s no big deal.
The rest: there is some oddity, when pasting to terminal, but again - no big deal.

xvo

https://mikrotik.com/product/crs305_1g_ ... ifications

xvo

The sweet spot would be 2x SFP+, 2x 10GBase-T, 10x 2.5GBase-T.
Such ports config would place it between CCR1036 and CCR1072 (or actually above CCR1072 because it'd give 85G theoretical throughput)

Not that it really matters, but 2x10G + 2x10G + 10x2,5G = 65G

xvo

The module would seem to be compatible at the hardware level. Jokes aside, the SFP+ port in 4011 is already confirmed to have some bizarre limitations - no passive DACs support, for example. Whether this is a hardware or software issue is an open question for now, but it clearly indicates, that som...

xvo

Isn't this compatible with the S-RJ01 ? Someone might want to use it for some reason. It is not shown as a related product. i think you must use S+RJ10 instead. What if someone already has an S-RJ01 but no gigabit+ service yet? Then the router will definitely change it's own internal architecture (...

xvo

The reason is the response for DHCP offer never got back to the router, because it was not tagged with the proper vlan tag by the switch.

xvo

Have you added cpu to /interface ethernet switch ingress-vlan-translation as well?

xvo

First of all you need to add switch cpu as a member of vlan on which you want to get an address (vlan-id=11, i guess).
And also you may also need to move vlan11 interface from ether1 to bridge1.

xvo

Just do exactly as you wrote yourself: 1) Create vlan-interface on top of port 2 with vlan-id=10 2) Create vlan-interface on top of port 3 with vlan-id=20 3) Assign addresses to this vlan-interfaces 4) Create DHCP servers on top of this vlan-interfaces As a result the traffic on port2 and port3 will...

xvo

Winbox has a possibility to work on Level 3 - when you connect to IP address, and on level 2 - when you connect to MAC address. Firewall works on level 3. To restrict the ability to connect to winbox by MAC from some ports, look here: /tool mac-server mac-winbox export And then remove unwanted inter...

xvo

Thank you for the answer. It's a good diagram, but I want to know why in the system resources show separately from system resource cpu? I don't really get, what you mean. On your screenshot: In CPU you have the load: 52% + 6% + 8% + 13% = 79% out of 400% That's 19,75% of the whole CPU In system res...

xvo

No surprise.
It's a router, not a switch.
And you can easily predict this behaviour just looking at the block diagram.

xvo

You can use Time under access list rule, never tried it, but should work.

That won't work.
And the kid control feature as well.
They both can only restrict the hour ranges when the client can stay connect, not the total connected time per day.

xvo

XVO was right, I just changed the masks from 32 to 27 in queue types and it worked as desired, sweet. As much as i'd like to say solved, not quite yet. I have one subnet (hotspot) that is a /23 and the rest are all /27. Yes I could make them all /23 but that's yuk and not proper. Anyone have any id...

xvo

I believe in WinBox IP>Routes>Add 10.0.0.0/8 bridge - reachable Pref source 192.168.1.4 can't really be that easy right? If I understood you correctly the 10.0.0.0/8 is behind the 192.168.1.4? Then it would be just: IP>Routes>Add Dst. Address: 10.0.0.0/8 Gateway: 192.168.1.4 And that would be all.

xvo

you cannot say that traffic of a whole subnet of a given size should be treated as a single stream I'm not sure but it seems that it is possible to use subnets as a sub-stream. There are pcq-dst-address-mask and pcq-src-address-mask parameters and by default they are set to /32 to refer to a single...

xvo

Have you tried 6.42.7?
It seems that something is broken in DHCPv6 in 6.43
However previous messages were about DHCPv6-server, not the client.
So it's just a wild guess.

xvo

Just add the rule that will NOT authenticate everything as the last one in access list.

xvo

I'm starting to think that the only reason for RB4011 to have that SFP+ is that MT can claim it offers "1733 Mbps data rate" (see top most banner on all forum pages).
One could hardly claim that if all wired ports were 1Gbps.

2x1Gbps would be enough for that.

xvo

Totally agree with WirelessRudy.

xvo

It should. CPU is similar (the same arch) in hAP ac, CRS-326 and RB4011.

hAP AC is MIPSPBE, CRS-326 and RB4011 are ARM.

xvo

You still can do it "the old way".

Or you can create vlan interfaces for ALL vlans (including the "native" vlan) on top of one bridge, and then bridge the ones you want together.

xvo

/interface vlan add interface=ether3 name=vlan200 vlan-id=200 add interface=ether3 name=vlan300 vlan-id=300 add interface=ether3 name=vlan400 vlan-id=400 This part on CHR-1 is wrong: the interfaces should be created on top of the bridge, not ether3. Then you add ether2 to the same bridge1, set PVID...

xvo

A nother question regarding the hAP ac2: can it be used with capsman and be used as a switch at the same time if i would plug in any laptops or other wired junk if i neded an umph in speed?

Sure.

xvo

wAP ac is a good device but it is indeed bottlenecked by cpu. With VLAN's configured it can deliver about 200mbit when two chains are used. Haven't tested it with three chains thou. I think you'd better go with newer devices: cAP ac or hAP ac2 (depending on where you would like to mount AP's) - most...

xvo

/interface vlan add interface=ether3 name=vlan200 vlan-id=200 add interface=ether3 name=vlan300 vlan-id=300 add interface=ether3 name=vlan400 vlan-id=400 This part on CHR-1 is wrong: the interfaces should be created on top of the bridge, not ether3. Then you add ether2 to the same bridge1, set PVID...

xvo

Yes, all CCR routers do.

https://wiki.mikrotik.com/wiki/Manual:I ... celeration

xvo

The only way to do this on mikrotik side only (and the easiest way overall) is to enable wlan on mikrotik solely for this device, exclude wlan interface from the bridge and add a firewall rule that will drop everything from this wlan interface to the rest of the lan. Otherwise you need to look for i...

xvo

thank you for the reply ! So I over-reacted. I don't need to worry about it ?

My CCR1009 behaves the same way.
But if you haven't done that already, I suggest you to temporarily switch the power cord from PSU1 to PSU2 to know for sure that they are both working properly

xvo

It failed to provide power to the unit.
Obviously the reason of this failure is that you didn't connect it to the power outlet

xvo

You really need (R/M)STP to run on top of LACP bonding if you add the "Switch C" for the whole system to work (your lower picture). The LACP bonding itself will be treated like one physical port by RSTP - it can't disable only part of it. But if there is no other potential loops, and the L...

xvo

@xvo: Thanks a lot. Do you have any resources like documentation or tutorials on this? I would like to learn more about this. I thought tagging here is not needed, since it is already done at capsman datapath. You are welcome. The thing is, that the whole approach on vlan filtering on the bridge is...

xvo

The Capsman Interface for the appropriate Wireless under "/interface bridge port" is actually shown as dynamic and can not been changed. I have changed the Interface "CAP" to PVID200 but I dont see a change - the client still dont get an IP from the DHCP-Server. Flags: X - disab...

xvo

Check that capsman interface is set to be a tagged port for vlan200 on the bridge.

xvo

Finally:

RB4011iGSplusRM-180905135303.png

xvo

Routing between vlans is done by CPU and it won't be able to handle 2Gbit, only around 1Gbit:
https://mikrotik.com/product/crs328_24p ... estresults

RB450Gx4, hAP ac2, hEX, hEX S should be able to route around 2Gbit according to official test results.

xvo

xvo It is a cry in emptiness, we can only give an idea, its development and financial return depends on their decision If you have somewhere to hide the appearance of the device, then you are lucky, and when there is no such opportunity, I have the right to offer my idea, and spit on your opinion D...

xvo

pe1chl When you come across a problem - one outlet ethernet for the whole department, then we'll talk (socket for 220v - one) xvo Most network devices consist of 8 ports, I just point out that the Mikrotik does not have such devices, even simple switches for 8 ports Why should we buy a device that ...

xvo

Ok. So now just everybody can ask for a custom device for his specific needs and set a price for it himself?!
No to googling for what is actually an the market?
No to designing the network according to it?
No to trying to fit everything in the budget?
Just like that?!

xvo

The spec sheet lists the max operating temp as +45 C, which is much lower than most other models. I've seen ambient (internal) temps of 60c on my routers that are inside telecom closets etc so unless this has some active cooling, I'm worried it won't be able to operate in the same environments as c...

xvo

Sure. You can use one radio as a client to existing wifi and the second for your own wifi network. And more to it - this can be done even on the devices with only one radio, using virtual wlan interface. The downsides of this approach are that both networks use the same channel and that the overall ...

xvo

why not
is rb 3011 best than cloud core crs 125 ? i use it as a switch....

RB3011 is a better router, but CRS125 is a better switch.
So replacing CRS125 by RB3011 as a switch is not a good idea, but adding RB3011 to act like a dedicated router sounds much better.

xvo

One question: why you need to push all that through the router? Why not to switch the most part? Long story short - MikroTik switches don't support VEPA and I use VEPA. And datacenter switches that support VEPA cost more than MikroTik router that can handle 10G lol. And I want to have stateful fire...

xvo

Correction: 10 Gbps. Or more precisely: 12 Gbps because I use SFP+ link only for VMs networks on home hypervisor plus NAS. Other networks eg. for my laptop and phone go through dedicated LACP bonding 2G to CCR so I have total 12G pipe between CRS317+CRS326 and CCR1009. Also all other ports in CCR a...

xvo

The move toward ARM had really boosted up performance per $: hAP ac2, now RB4011.
The next logical move is to extend this further to CCR line: the new ones in 400-500$ range can turn out real beasts if this trend will persist

xvo

Being a CCR1009 owner I can confirm - it is way overkill for home use. I ended with it only because I found one used for nearly the price of 3011. Otherwise it makes no sense, especially now, when you can get 4011 + CRS326 for the price of 1009. Though even home user can kill CCR1009 if you use too...

Search found 1239 matches