MikroTik

Pea

Pea

Sure, WPA2-PSK as security profile and optionally disable PMKID. Simplified description: Run your secured WiFi normally on your router, add settings for WDS, add static WDS interface with MAC of second device. On other device start without any setup. Add bridge and DHCP client on bridge. Add securit...

Pea

You can use your wlan1 as WAN port and wireless mode station-pseudobridge on remote Mikrotik. Do not forget to synchronise time of remote device. Or below is what I use reliably with Mikrotik on both ends: On your Mikrotik router /interface wireless set mode=ap-bridge ssid=YOUR-SSID wds-default-brid...

Pea

Use manually non DSF channel (5200, 5220 or 5240). Problem solved.

Pea

You can try latest ROS beta which likely do not need below workaround anymore (I did not test this yet): *) capsman - always accept connections from loopback address; Otherwise this should fix it: /capsman manager interface set [find default=yes] forbid=no add forbid=yes interface=(here put interfac...

Pea

The CAPsMAN takes care about wifi1 and/or wifi2 interfaces only. The rest of functionality and interfaces you can use and configure as you like.

Pea

3) The worst: this is not documented anywhere besides user forums (it should be on CAPsMan manual to prevent people be fighting hours with something that isn´t going to work) https://wiki.mikrotik.com/wiki/Manual:Simple_CAPsMAN_setup#CAP_in_CAPsMAN But I agree that having firewall rule for CAP on C...

Pea

forgot to mention that this is one room condition - both phones, laptop and router are in one room max 3m away.

Ideal situation. Why you even use 2.4GHz? Stay with 5GHz only and problem solved.

Pea

This depends on your firewall rules. By default this is filtered.

Pea

Other option would be to setup different SSID for 5GHz. And never connect phone to your 2.4GHz

Pea

redirect - replaces destination port of an IP packet to one specified by to-ports parameter and destination address to one of the router's local addresses

Pea

The 802.11n prohibits using high throughput with WEP or TKIP as the unicast cipher. If you use these encryption methods (for example, WEP, WPA-TKIP), your data rate will drop to 54 Mbps.
Use only WPA2-AES for full 802.11n speed.

Pea

For standard home use you can remove safely all files and folders from File List
(flash folder cannot be removed but all sub folders yes)

Pea

There should be <1ms for ping even over wifi. What are you getting?

Pea

try to reboot first to clean some memory...

Pea

When processing a chain, rules are taken from the chain in the order they are listed there from top to bottom. If a packet matches the criteria of the rule, then the specified action is performed on it, and no more rules are processed in that chain (the exception is the passthrough action). If a pac...

Pea

Separate configs are for various devices you want to manage from CAPsMAN. Then you push the correct config to the device. E.g. 2,4GHz only config to older 2,4GHz only CAP.
If all your CAP devices support the same standards you can have only one config.

Pea

Hi, this file should answer your questions about CAPsMAN VirtualAP Setup, Dual Band CAP, CAPsMAN and CAP in one board:
https://mum.mikrotik.com/presentations/BR14/Uldis.pdf
(little outdated, November 2014, but still nice explaining)

Pea

Use latest version of RouterOS.
The wireless-fp was long time ago replaced by standard wireless package which is included.

Pea

Use Long term or Stable:
https://wiki.mikrotik.com/wiki/Manual:U ... _numbering

Pea

Yes but this is likely not going to happen for home use

Therefore it is IMHO useless at the end.

Pea

This is not the best example.
Why those rules open udp port 69 (TFTP)?
Also there is defined address list which won't be used later (the rule is after general drop)...

Pea

This simplification should explain the difference: Reject : someone comes to your address and try to open door of your house, but you tell him that it is well locked Drop : someone comes to your address but there is no house or door to open and he gives up after while (timeout) It is up to you what ...

Pea

I am surprised that there was no default firewall. I really thought you removed it

I am sorry.
And I am happy that you fixed it for your needs.

Pea

But you can dual boot to RouterOS on this CRS and this should have default firewall. If not then it would be good idea to add it

Pea

it scared the hell out of me!!!

Yes, you do inappropriate configuration changes. Scary.
Study some basics about firewall and fix it.
If you don't want to study then reset your router to default to get firewall back.

Pea

If this is a mobile device on your hotspot then this is rather normal, isn't it? Just a battery savings and therefore wifi switch off temporary on the mobile device.
Why do you think this is a problem?

Pea

As mentioned by Normis they sell them as single units.
You can buy one or two or... 8 or... 1000 or even more

Pea

There is better way than drop selectively not used ports:
1) accept only what you need
2) reject/drop everything else
That's it.

Pea

Disable DHCP server, put all ports to bridge, add DHCP client on bridge, modify firewall and nat.
It should work then.

Pea

You re mixing RouteOS update and Firmware upgrade. These are 2 different things.
Press the Download&Install button in Check For Updates window to update RouterOS.
After reboot you can press Upgrade button in Routerboard window to upgrade also the firmware.

Pea

This is what I do. If you use Mikrotik DHCP server just make static DHCP lease for MAC address of iPad from Santa, then dstnat its DNS queries to e.g. OpenDNS FamilyShield: /ip dhcp-server lease add address=10.0.0.123 mac-address=AA:BB:CC:DD:EE:FF /ip firewall nat add action=dst-nat chain=dstnat dst...

Pea

There will be RouterOS so many possibilities for setup are expected. It should be possible to simply disable wifi interface if not needed.

Pea

Not available yet, search for PL7411-2nD: The PWR-LINE AP is a wireless access point with a single Ethernet port , a built-in 802.11b/g/n WiFi radio and capability to connect to other PWR-LINE devices through the electrical lines in your premises. Details and pictures: https://i.mt.lv/cdn/rb_files/P...

Pea

I will also share positive update results:
hAP ac, hAP ac lite, hAP ac², hAP lite, RB951
All fine, no problem.

Pea

Is your SSID unique?
Or do you use something common as "Internet" or "wifi"? Then many devices will try to connect when they know this SSID.

Pea

According to this shop PL7411-2nD will come 12.12.2018: https://www.wifihw.cz/default.asp?cls=stoitem&stiid=4329 Product code: PL7411-2nD CPU: QCA9533 CPU: nominal frequency 650 MHz PLC chipset: AR7420 Size of RAM: 64 MB Memory: 16 MB Flash 10/100 Ethernet ports: 1 Wireless Built-in: 2.4 GHz 802...

Pea

What is the correct and clean procedure to update from main package to separate packages?
Just upload needed separate packages only of higher version and reboot?

Pea

https://wiki.mikrotik.com/wiki/Manual:System/File Warning: If device has a directory named "flash" in its file list, then files which you want to be kept after system reboot/power cycle must be stored within it. As anything outside of it is kept within a RAM disk and will be lost upon rebo...

Pea

Check the channel, some devices do not see 2.4g wifi channel 13 (e.g. Kindle Paperwhite)

Pea

Hi, did you noticed this warning? :) /system note set note="DEVICE HACKED - ACCOUNT admin HAD UNSAFE PASSWORD" and this is not your code, right? /system scheduler add interval=1d name=Auto113 on-event="/system reboot" policy=\ ftp,reboot,read,write,policy,test,password,sniff,sens...

Pea

https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack Packet marking for fast processing. Warning: Queues (except Queue Trees parented to interfaces), firewall filter and mangle rules will not be applied for FastTracked traffic. Make exception in your Fasttrack firewall rule for the IP where you want t...

Pea

I am just curious why you still try to use "Use Peer NTP" from your ISP while you know it is not working?

And did you try to contact your ISP to fix his DHCP NTP address setup?

Pea

still cant change any user names.
introduced in 6.43.0

viewtopic.php?f=2&t=139091

Pea

This link may help you to find suitable emoji:
https://unicode.org/emoji/charts/emoji-list.html
https://unicode.org/emoji/charts/full-emoji-list.html

/interface wireless set [find] ssid="\F0\9F\92\A3\F0\9F\92\A9"

Pea

flynno: https://wiki.mikrotik.com/wiki/Manual:S ... our_Router

Pea

Just start reading!

[time=1535139686 user_id=118648]
how fix this please help me !
1. Please don't put questions not related to a specific release into the release topic, make new topic!
2. You are killing your router by Sector Writes, maybe logging on disc? Check your config, stop it!

Pea

how fix this please help me ! 1. Please don't put questions not related to a specific release into the release topic 2. You are killing your router by Sector Writes, maybe logging on disc? Check your config, stop it! :) 3. You can try netinstall, helped me to recover bad blocks, just give it a try

Pea

And this is how to use the button with scripting:
https://wiki.mikrotik.com/wiki/Manual:R ... ode_button

Pea

When will be available PWR-Line AP announced in April 2018?

Pea

The same here, but no complain

version: 6.42.6 (stable)
factory-software: 6.42.3
free-memory: 205.3MiB
total-memory: 233.2MiB

board-name: hAP ac^2
model: RBD52G-5HacD2HnD

Pea

Yes, this is all fine.
The firmware version increases (synchronize) now with ROS version. Even there is no update in the firmware.
(I do not know the reason why MikroTik made this change)

Pea

port 53

Search for DNS Amplification
And fix your firewall on input chain!

Pea

Currently you are running current-firmware 3.24.
You should upgrade to upgrade-firmware 6.42.6.

Pea

So what about version 6.40.8, is vulnerable or not? Could somebody from Mikrotik finally confirm it? Bugfix release tree Release 6.40.8 2018-04-24 What's new in 6.40.8 (2018-Apr-23 11:34): !) winbox - fixed vulnerability that allowed to gain access to an unsecured router; https://mikrotik.com/downl...

Pea

Yes, last bugfix 6.40.8 is fine (+ change your passwords after upgrading, restore your configuration and inspect it for unknown settings, implement a good firewall)

What's new in 6.40.8 (2018-Apr-23 11:34):
!) winbox - fixed vulnerability that allowed to gain access to an unsecured router

Pea

Did you change all your passwords after update?

Pea

You are running vulnerable version, so no surprise that someone can change your settings when they can get all your usernames and passwords.
It was mentioned in this topic, upgrade, change passwords, add firewall...
viewtopic.php?f=21&t=133533

Pea

This is what I do, working perfectly: Add static DHCP leases Create firewall FamilyShield list for required static IP addresses Add 2 dst-nat rules for the FamilyShield list to the OpenDNS address 8) /ip dhcp-server lease add address=10.0.0.xx comment="FamilyShield" mac-address=xx:xx:xx:xx...

Pea

Well, follow this advice for update and password change, proper firewall, etc.:
viewtopic.php?f=21&t=132499
viewtopic.php?f=21&t=133533

Pea

It will not happen if we could see all open windows within the Winbox as on this simulation:

Pea

This happens when you have several terminals hidden behind other windows. Close some windows and you will find those eight terminals. And close them.

Pea

It's a pity!
But good inspiration to MikroTik for Winbox improvement. Maybe someday

And next would be option to disable/remove Quick Set based on setup on router (e.g. /system routerboard settings quickset=disabled).

Pea

Tell me how to get these window buttons there? I like it! But I do not have it

(I hope this is not a "photoshop" joke)

Pea

Hello, don' use layer 7, use this instead : /ip firewall filter add chain=forward dst-port=443 protocol=tcp tls-host=*.facebook.com action=reject add chain=forward dst-port=80 protocol=tcp tls-host=*.speedtest.net action=reject Hello. One question. Do I have to do something for the filter to take e...

Pea

I see, nothing interesting then...
I am setting it back to default "compression=no"

Pea

Anyone?

Pea

I'm curious about this wireless option: interface wireless set compression=yes Wiki says: Setting this property to yes will allow the use of the hardware compression. Wireless interface must have support for hardware compression. Connections with devices that do not use compression will still work. ...

Pea

Maybe defective power adapter? Do you have any other to test?

Pea

If the hotel keeps login based on device MAC address:
1) Change your laptop MAC address to your router MAC address
2) Pass the login on your laptop
3) Change the laptop MAC address back to default/original
4) Switch on your router, fill the SSID and enjoy "own network"

Pea

No, PoE works in 6.42.1 correctly for me same as with previous versions. Did you try to connect different device?

Pea

I am just curious why you want to block ping? Anyway if you insist on it start with simple input icmp drop rule placed somewhere on top. If this works then do fine tuning in more detail. If this does not work then you are actually pinging different device (you modem - as you wrote that your WAN is e...

Pea

Click on Neighbors card and then simply click on MAC address (or IP address) of the device you want to connect to...

Pea

My experience beyond specifications is to keep the Ethernet cable as short as possible, as isolated as possible

Maximum is really about 100 metres then collision detection mechanisms "break" the link.
Use some repeater in the middle and you should be fine.

Pea

Very nice tutorial on port knocking: http://blog.cactiusers.org/2009/04/17/m ... -knocking/
to: 9939781 - it is with Layer 7 packet sniffing if you insist on it

Pea

pe1chl: yes, this is clear. The report about problem in this version is due to missing feedback in log after pressing the Upgrade button. This " Firmware upgraded successfully, please reboot for changes to take effect! " did not appear in log. And this is unusual. This information line was...

Pea

maybe...
did you try to check how many lines you have setup?
/system logging action print
look for "memory-lines= ..."

Or go to System / Logging / Actions / memory / Lines

Pea

skullzaflare: see viewtopic.php?f=21&t=128915
Please, note that downgrading to previous RouterOS versions (below 6.41) will not restore "master-port" configuration, so use backups to restore configuration on downgrade.

Pea

Hi strods, this happened for the first time that log message about upgrade was missing completely. Unfortunately all my devices are upgraded already, so I cannot check if the warning was in System/Routerboard/Settings. But it was definitely missing in log. Now if I look into terminal I still see 2 l...

Pea

The same with missing line in log "Firmware upgraded successfully, please reboot for changes to take effect!" happened to me today on RB951G-2HnD. Little scary on 50km away device :) Did the upgrade failed? Should I reboot or better not? Anyway I sent the reboot command - and all seems fin...

Pea

You have very likely double NAT.
If you cannot use bridge mode on ISP router then try if setting DMZ is available there.
Or use IPv6 address of your computer for external access.

Pea

There is already linux style option - SSH CLI

If you like click with mouse in windows then it is time for Windows...

Pea

What is in the log when you click on Upgrade button?

Pea

There are two LEDs for the wireless section and two LEDs for the 5th port section in the hAP ac (RB962UiGS-5HacT2HnT) case. The green wireless LED shows 2.4GHz wireless status and the red wireless LED shows 5GHz wireless status. Sometimes their blinking times match and colors blend together. The gr...

Pea

I had seldom this problem with Samsung TV and Samsung BD player, not getting IP from DHCP. Only disconecting the Samsung device from power a connecting after a while fixed the problem. It must be some problem or incompatibility at Samsung side. I finaly fixed it by switching both devices to Sony bra...

Pea

Already answered in this topic:
viewtopic.php?f=21&t=129034&start=150#p640819

Pea

Try this tool to debug the MTU values between you and a host:
https://elifulkerson.com/projects/mturoute.php
(I probably found this on this forum recommended by someone)

Pea

Thank you Steveocee, based on the tutorial I will try to use this now, Option C: /ip firewall nat add action=masquerade chain=srcnat comment="LAN to Server" dst-address=10.0.0.0/25 src-address=10.0.0.0/25 add action=masquerade chain=srcnat out-interface="PPPoE client" src-address...

Pea

Hi, I would like to ask you to review my Hairpin NAT to internal server on 10.0.0.50 The WAN IP is dynamic (VDSL). I access my Server from Internet and also from LAN by using the domain name (WAN IP). Option A: /ip firewall nat add action=masquerade chain=srcnat out-interface="PPPoE client"...

Pea

#2: Just try "Copy" button...

Pea

470k writes after 2 hours? You are likely killing the router by your settings.
Time for a new device... and setup with reduced writes to storage.

Pea

Do you have your domain DNS/DDNS name registered with your WAN IP address? If yes, then you can do it with NAT. These 3 lines will make your web server accessible from internet and also from LAN by your domain name: /ip firewall filter add action=accept chain=forward comment="Accept dstnat pinh...

Pea

The ether5 connector looks perfect, same as others ether1-4. So it seems it is hardware failure.
It is still in warranty, I will contact my dealer to exchange device.

Pea

I use only CAT6 cables.
For test I connected only one computer which negotiates with ether1-4 on 1G but when I move that only cable to ether5 it negotiates on 100M.
From my logic this cannot be caused by cable or connected device. Anyway I tested 3 gigabit devices and few cables with same result.

Pea

Hi, I have RB951G-2HnD (v6.37.1, fw3.33), which has five Gigabit Ethernet ports. The ether1-4 (my WAN, LAN1-LAN3) sync on 1G normally. But ether5 (my LAN4) sync only on 100M (and negotiation takes longer). Attached screenshot shows log when I move one cable from ether2 (LAN1) to ether3 (LAN2)...to e...

Pea

I confirm, Tik-App v0.0.33 does not work with 6.36 ROS, stuck on "Downloading plugins..." with Mikrotik RB951G-2HnD

Pea

It should be enough to do reboot and then update.
How much free-memory you have after reboot?
Anyway 8,6MiB visible in your export should be good for update.

Pea

Use this:

dst-address-type=local

Matches destination address if dst-address is assigned to one of router's interfaces.

Pea

Just question:
Why you do not run PPPoE client on Mikrotik and your adsl router in bridge mode?
This should be imho easier and more obvious for setup.

Pea

Use search, it is easy to find this topic:
http://forum.mikrotik.com/viewtopic.php?p=527754

Pea

You can use Port Knocking to add actual address into allowed address list for WebFig access.
http://wiki.mikrotik.com/wiki/Port_Knocking

Pea

It's not like the AP can recognize a client radio's voice or anything...

nice one

Pea

I will jump here to get answer what is the best practise for the firewall last input rule: 1a - Pretend that there is nothing just black hole: add chain=input action=drop 1b - Shut the front door and lock it: add chain=input action=reject protocol=tcp reject-with=tcp-reset add chain=input action=rej...

Pea

Remove those 4 NAT rules: add action=masquerade chain=srcnat out-interface=all-ethernet add chain=dstnat dst-address-type=local dst-address=!192.168.0.0/16 action=jump jump-target=pinholes add chain=pinholes protocol=tcp dst-port=80,443 action=dst-nat to-address=192.168.1.198 add chain=pinholes pro...

Pea

I think it was never there. Just write a comment and set Inline Comments in Settings and the comment column will show.

Pea

Just tested:
Upload... button does not work, no popup, nothing.
The download option on file works. BUT no warning that file with same name already exists and existing file is overwritten!

Drag and drop works fine as before.
Winbox 3.4 on RB951G-2HnD

Pea

Just small note: Maybe you can add higher resolution app icon...
If you pin it on taskbar, you will have it with a good resolution

Yes, pinned icon on taskbar looks nice.
But when I click it and Winbox is running it gets pixelated

Pea

Just small note: Maybe you can add higher resolution app icon...

Pea

This is answer to your question: What's new in 6.33.5 (2015-Dec-28 09:13): *) wireless - regular “wireless” package is now retired and replaced by "wireless-fp" and "wireless-cm2"; This means that in update you are trying to do is the old wireless package missing - intentionally....

Pea

I was solving the same setup. At the end successfully, works for weeks without problem

See my solution: http://forum.mikrotik.com/viewtopic.php ... 09#p518647

Pea

+1 for Winbox Log filter. Or colour highlight of search phrase at least

Pea

+1 please, Quickset to separate package if possible

Pea

Put your ADSL modem into BRIDGE mode. Then make PPPoE client in your Mikrotik to dial your ADSL.
Then your ADSL modem will be invisible for your customers.

telephone wire RJ11 <=> RJ11 bridge ADSL modem RJ45 <=> RJ45 WAN Mikrotik router

Pea

As I described the " station-bridge " was not working for me. The reason stays unknown to me, there was no connection which always show in log as 4-way handshake timeout (15) . The WDS connection works from beginning excellently, perfectly suits my needs to share LAN ports connected wirele...

Pea

If you want to disable wifi, you must disable wireless interface, not only LED indication.

/interface wireless
set [ find default-name=wlan1 ] disabled=yes

Pea

I had originally wds-mode=dynamic, it was working fine. But I failed many times to get right config, even once I must netinstall hAP :lol: And after each restart or disconnect there was created interface wds2, wds3, ...wds28.... I just do not like this much, so I switched to static :D My plan is to ...

Pea

Thank you for pointing me to direction to find solution. I had time today to play and test. However I didn't get "station bridge" working. I got permanent log for 4-way handshake timeout (15) and no connection at all. :( And I started to search what can be the cause of this problem. As far...

Pea

I need your help and advice for probably very simple setup: 1) I have configured router RB951G-2HnD doing the entire job (PPPoE to VDSL, NAT, DHCP, DNS, firewall, ipv6, wireless AP 802.11n, etc.). 2) Now I want to connect new RB941-2nD-TC (hAP lite) to my wireless AP and share this connection to its...

Pea

+1

I want to get rid of ISP bridged VDSL modem

Or just a small black box with RJ11 on one side and RJ45 on other side (PoE powered)

Pea

Also check what is your setup under /interface wireless max-station-count

Pea

Someone from US and UK is failing to login to your device via SSH and Telnet :D If you do not need ssh and telnet then go to services and disable ssh and telnet: /ip service set telnet disabled=yes set ssh disabled=yes If you need it then setup firewall rules to accept login from known adress list o...

Pea

The mipsbe v6.33 and ntp package works fine.
Did you try to upload separate ntp-6.33-mipsbe.npk and reboot?
If yes, what was the log report?

Pea

Once happened to me in Winbox to move input "drop all" rule to first place

Pea

Your ISP modem is xDSL? If yes, then put modem into bridge and configure everything in MikroTik router. 1) Start with DHCPv6 Client: /ipv6 dhcp-client add add-default-route=yes interface="PPPoE" pool-name=IPv6-pool use-peer-dns=no 2) Add DHCPv6 and address from pool to bridge-local: /ipv6 ...

Pea

Winbox can show you explanation as well - just keep mouse on this column and see popup.

Pea

Just reboot your router or wait till all fasttracked connections disappear.

Pea

Hi Sob, now I got it, thank you for explanation.
I was confused by the same /64 prefix and unreachable route seemed to me unnecessary.
So I will ignore it and let it there

Pea

Thank you. But the #3 route is similar to #2 route which gets connected. So why there is another dynamic route created? 2 ADC 2a00:xxxx:yyyy:aaa::/64 bridge-local 0 3 DSU 2a00:xxxx:yyyy:aaa::/64 1 I have still no idea why they gave me second (WAN) IPv6/64 prefix, everything is working well only with...

Pea

I would like to ask you to revise my setting for IPv6 because this is new for me. I have very simple setup: ISP <=PPPoE=> VDSL modem (bridge) <=PPPoE client=> Mikrotik RB951G-2HnD <==> LAN+WiFi I got from my ISP this information for native IPv6: LAN: 2a00:xxxx:yyyy:aaa::/64 WAN: 2a00:xxxx:yyyy:aa8::...

Pea

Even if allow-remote-requests: no solved your problem you should secure your router by simple firewall rules: 1) Allow what you need (established, related, your LAN, pings) 2) Block everything else (this will also drop external DNS requests on port 53) Example rules: add chain=input comment="Ac...

Pea

Do you have unique SSID?
Because if you have common (e.g. Internet) many devices will try to login when walking around because of previously stored login from other location.
Maybe SSID change will solve your problem.

Pea

This is what I got when reading this forum: wireless - oldest package, discontinued? wireless-fp - new legacy package compared to previous has improved wireless driver, "wireless fast path" mode wireless-cm2 - CAPsMAN v2 support plus also has some improvements for newer 802.11ac and other ...

Pea

What is the problem with default config? /ip firewall { filter add chain=input action=accept protocol=icmp comment="default configuration" filter add chain=input action=accept connection-state=established in-interface=ether1-gateway comment="default configuration" filter add chai...

Pea

IP > DHCP Server > Networks > change DNS Servers address to 192.168.1.1

Pea

1) open tp-link administration page
2) click DHCP from menu
3) click Disable option
4) click Save button

clear enough?

Pea

If you do not use simple queues etc. you can enable Fasttrack to increase your speed (ROS 6.29 and newer). Just put this rule above other firewall rules: /ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related That Fasttrack is enabled you can check und...

Pea

Just click both established and related in WinBox...

Pea

I had exactly same issue when accessing home server by DNS name. First I was using static DNS but I must use port in browsers and there were issues with some mobile browsers. So I started to use masquerade for LAN access instead and everything is working perfect. (Only one small side effect - all ac...

Search found 238 matches