MikroTik

pe1chl

User documentation (a manual) is quite different from programmer's documentation. You cannot generate a user manual from source code, unless you put the manual text as comments in the source code. Maybe you could generate it from design documentation. At least there has been an attempt at creating a...

pe1chl

The allowed interfaces for MAC-level access can depend on the model of the router, and possibly on the software it first came with.
However, usually it is enabled on all ports and when it is not, it is because you changed that yourself before.

pe1chl

When your internal network is flaky, e.g. a large area covered with WiFi access points, or the external network (ISP) is not very reliable, you will have more of those lingering connections that are not accounted for in the firewall tracking. There are some ways around it, e.g. you can decide to pas...

pe1chl

But there are several mistakes in it... that is why you encounter issues. For some unclear reason, the CCR devices do not get the default rules that other devices get. Even with the default rules there are issues with logging dropped traffic, because you will get lots of false positives. E.g. when a...

pe1chl

Your firewall rules are just wrong.
Either study the matter or apply default firewall rules...
(unfortunately the CCR1009 has no default firewall rules, but you can copy them from another model)

pe1chl

There are lots of commands with incomplete documentation. They should get an intern (or group of 2 or 3) tasked with documenting all commands in the same format and checking if every option is documented.

pe1chl

You can just delete that extra package in the /system/packages menu and reboot. It will not come back.

pe1chl

Thank you for the feedback but how is a normal user supposed to do this downgrade ? It's only possible via support, I believe ? I think you are confused with stuff from another manufacturer here. It has never been a problem to downgrade on MikroTik, only you cannot downgrade below the version that ...

pe1chl

"These ping spikes seem to occur when someone else is streaming videos" This could point to overloading of the connection combined with bad queuing policy probably at the ISP side ("buffer bloat"). When there is a lot of data to send, the bulk data gets ahead of your ping. You ca...

pe1chl

What you have there would only accept one specific route: to the network 172.16.0.0/22
Any routes for subnets of that network would not be accepted, and due to the fact that the default is reject, will not pass through.

Probably you meant something like: if (dst in 172.16.0.0/22)

pe1chl

Yes. The big problem when using RouterOS is that there is no easy way to keep the device config synchronized other than being careful with every manual change. I have seen scripting solutions but it is always a bit tricky. The case of the corrupted filesystem would not have been a problem in the old...

pe1chl

Anything that requires fetch now requires FTP permission. Netwatch doesn't have that, I think.
So you need to use special tricks and they are barely documented. Probably someone here knows what to do.

pe1chl

That is the state "corrupted filesystem, can no longer boot, netinstall required"...
So with Netinstall you can recover it.
Did you not send a prepared device to the site after all? That would have fixed it.

pe1chl

It is easy. How do you get the IPv6 space on PPPoE? Is it via DHCPv6 client? Normally you would do something like this: /ipv6 dhcp-client add interface=pppoe1 pool-name=v6prefix request=prefix /ipv6 address add address=::1 from-pool=v6prefix interface=bridge The bridge will get an IP address from th...

pe1chl

Still: no way to satisfy all There is 4011iGS+5HacQ2HnD-IN if you need both freq ... Whatever you do, do not buy that one! When you install the modern WiFi driver it will work ONLY on 5 GHz and 2 GHz will become inoperative. Also, it has no USB port so no way to expand storage. It has lots of RAM b...

pe1chl

The earlier reply from MikroTik has been that the L009 is intended solely as the replacement for their most successful device ever, the RB2011. .... makes no sense. It's silly to not have put 5ghz in I'm pretty sure people aren't buying the 2011 specifically because it DOESNT have 5ghz in it No, th...

pe1chl

7.13.5 one more step against Long Term release :)

I think not. I still see so many "introduced in 7.13x" bugfixes that I think there have been major changes and 7.12.x should be the longterm release.

pe1chl

No, you only can attempt to filter their internet access and they will fall back to using IPv4.

pe1chl

MikroTik does not support DHCPv6 to distribute individual addresses. So you cannot do that. You can use DHCPv6 to distribute prefixes, e.g. when you have a down line router you want to pick a /64 from your /56 pool, you can setup a DCHP server with the pool you obtained from PPPoE and re-distribute ...

pe1chl

The earlier reply from MikroTik has been that the L009 is intended solely as the replacement for their most successful device ever, the RB2011. Apparently there are still people buying that, and they wanted to introduce a replacement device with similar price and features. When you require 5GHz, don...

pe1chl

That is why I wrote "developing some MikroTik-specific modules for that, like an API interface module and some scripts to perform common tasks". I have done some monitoring using Perl scripts and the Perl API module and it is quite easy to pull data from the router that way. I only use tha...

pe1chl

It would be better to switch to an open-source monitoring application and focus on developing some MikroTik-specific modules for that, like an API interface module and some scripts to perform common tasks. Then you would not have to worry about the runtime environment all the time. (I have experimen...

pe1chl

But dear ChatGPT, there is no development of Dude anymore! So why would "developers" be interested in that?

pe1chl

You can use the /system/default-configuration/print to see what is in defconf and find out how it relates to your expectations or wishes. OP clearly stated the obvious and you seem not to understand nor answer his question? So once again - how is something as queue-types related to the defconf or r...

pe1chl

You can use the /system/default-configuration/print to see what is in defconf and find out how it relates to your expectations or wishes.

pe1chl

For those that do not use VRF but use manually created route tables, it would be very convenient when there would be an option to import Connected routes into a newly created table (so they can be distributed using BGP). E.g.: add an option to /routing/table/add which specifies an interface list. A...

pe1chl

Changes in defconf are not applied on upgrades, AFAIK. That is correct, you need to reset the device to defaults to see such changes. Or you can do /system/default-configuration/print and selectively cut/paste from that. (it is also possible to use file=filename with that, and download the file, fo...

pe1chl

*) bgp - allow to leak routes between local VRFs; For those that do not use VRF but use manually created route tables, it would be very convenient when there would be an option to import Connected routes into a newly created table (so they can be distributed using BGP). E.g.: add an option to /rout...

pe1chl

How can one run ROS 7 on a hAP lite? I've tried this several times and even just as a CPE (no firewall filter rules, a blank config in fact) it was barely unusable.

It is better not to do it. Just remain on v6.

pe1chl

No. There is a filter rule that allows NATted traffic: 28 ;;; defconf: drop all from WAN not DSTNATed chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=WAN log=no log-prefix="" (this combined with the fact that after the last rule there is an implicit...

pe1chl

It isn't even defined what Simple Queue is doing. The documentation just proposes a trivial use case that uses a few of its many parameters.

pe1chl

Remote logging in RouterOS is very primitive. Your only selection is the bsd-syslog flag which unfortunately changes different things at the same time, and no really desirable option is available.

This is a wishlist item for many years, so don't hold your breath.

pe1chl

Unfortunately there is no real documentation for Simple Queue. I asked for it before but it appears low-priority.

Why don't you use Queue Tree? You can use packet marks to mark the interesting traffic.

pe1chl

When you want to route arbitrary traffic over a tunnel, it is easiest when it is a GRE/IPsec (or IPIP/IPsec) tunnel as described above.
When you already have a plain IPsec tunnel it is possible to convert it but you need admin access to both sides.

pe1chl

You should not even have updated to v7. That kind of device is best left on v6.
Probably it is bricked due to lack of space. You can recover it with netinstall.

pe1chl

No. Use the manual or the links above. I am not an unpaid consultant.

pe1chl

Of course, but he is asking for "Something with better CPU, RAM and so on ? Like 1GB memory ? x64 bit 4 cores or more ?" and several models with that already exist in that list. But apparently not to his liking.

pe1chl

The appropriate replies were already given above...

pe1chl

No solution for the memory shortage in 15.3MB ARM devices? The solution is simple! Reset the device without def.conf. , after that make upgrade, or make netinstall with new npk version. The occupied space after the procedure is 14.9MB. Yes, but for me a device with only 350kB free is not viable. To...

pe1chl

Thanks for reply, Its always show 1200Mhz if i use os 7, never change also in Full user load, Only if i downgrade to OS v6 then CPU again show 2600Mhz, Any idea how to solve this issue?

Do you observe actual decreased performance? Or are you just obsessed by what is shown in that dialog?

pe1chl

No solution for the memory shortage in 15.3MB ARM devices?

pe1chl

Netinstall is a way, but you could also use "reset configuration" and check the "no default configuration" checkmark. The config will then be almost empty and you can connect using MAC and paste it. Or, before the reset you can upload the .rsc to the flash directory and in the re...

pe1chl

That is not surprising because your question is completely unclear! You ask for a new device and think all existing devices that fit the bill are not right for you... If you red carefully my post above you will see that I am applying exactly for a "Ethernet routers" And when I (and others...

pe1chl

May be you don't understand the direction. Applying for a router, not a wireless one!

That is not surprising because your question is completely unclear! You ask for a new device and think all existing devices that fit the bill are not right for you...

pe1chl

Can we expect new "Ethernet routers" ?
Something with better CPU, RAM and so on ? Like 1GB memory ? x64 bit 4 cores or more ?

Like CCR2004-16G-2S+? Maybe CCR2004-16G-2S+PC?

pe1chl

The problem is if I set up the pc with a direct cable (or even through the UDM acting as a switch) it will require changing the ip settings on the pc and that would eliminate my remote access to the pc. Well, you already said you did not see the router in winbox or netinstall so no need trying IP. ...

pe1chl

Buy a new hEX, configure it correctly, and ship it there.

pe1chl

Just drag the line up or down using the mouse...

pe1chl

Actually it would be good to have option to "reset to defaults" any configuration subsection. Yes, but of course it cannot simply be "by window" or "by menu entry" because some configuration has inter-related settings that you cannot apply individually. E.g. as I wrote...

pe1chl

You should have your own firewall. The change affects the default one, which is loaded onto a new device or after reset. It is only the base template and every responsible admin should secure their network manually. It would be helpful when there was a separate commend/button to "reset firewal...

pe1chl

It is a known problem in Linux connection tracking that has been there for years but is never fixed. As recommended, do not log invalid packets. Or make another rule above that which drops invalid packets with TCP protocol and TCP flag FIN or RST, does not log these, and then keep this rule with log...

pe1chl

The Mikrotik would be an excellent place for a print server! I don't know about that. I'd think some mDNS support be more useful, than a print server, in 2024? Indeed! This is just a general "VPN setup in the wrong way" issue. Put your VPN range in a different IP range and it all works fi...

pe1chl

We still don't have information about AS

Of course not. It was not in the release notes, so why should it be there?
This topic is only a suggestion for a new feature.

pe1chl

RouterOS itself should perform actions like that, as mentioned before (to change defaults when they are incorrect)....

pe1chl

Yes. Mitigating factor is that first you have to know the address of the router. In IPv6 that is often not trivial.

pe1chl

Please, stop calling megabits as MB.
MB = megabytes
Mb = megabits

and:
mb = millibits

pe1chl

Now back to the topic. You published a new version to fix something in the default config. How do you think that publishing this new version is going to affect ANYTHING? Should there, at minimum, not be some simple directions in the announcement article that explain what you need to change when you ...

pe1chl

The question is: "does the package overhead is bigger or smaller than the space we save breaking it up?" No, that is not the question. The question is if we can have a useful subset of RouterOS functionality plus one or more extensions, which still fits in the flash memory, so the user ca...

pe1chl

400 millibit/s is quite easy to achieve, even with smoke signals.

pe1chl

This thinking is just wrong. If you are admin in company (which is bigger than small), you typically administrating dozens ( in my case hundreds ) of devices and it cannot be done via web config effectively. No chance at all. Not with winbox either. So that is a little irrelevant in this topic. For...

pe1chl

It was an example. Generally, MikroTik do not tell us in releasenotes what "improved handing" or "improved stability" mean w.r.t. security. That is not right... and in the case of 6.49.13 it solves a security issue only for devices shipped with 6.49.13 installed. Are there any? (...

pe1chl

fine, but that product is not the L009. and will surely cost at least 2x the price and the yelling and whining will go on and on.... it's with the people. there will always be something to dick about. For 2x the price I would be happy. I bought a 4011 for 2x the price of a L009 but I get an orphane...

pe1chl

It would have been easier (and better) to publish a recommended change in the firewall rules. +1 So as discussed many times before: a user that never touched the default firewall rules won't ever get this change automatically. It will stay broken until the user throws the device away or the user re...

pe1chl

Also: why is a new stable release made for such an irrelevant bug? According to many, "nobody uses IPv6". Today's end-user never uses "traceroute". And a change in defconf will not affect people that just upgrade, only those that reset to defaults. That fact is not even mentioned...

pe1chl

Bridge-To-Bridge joiner.

You can do that with two local EoIP interfaces.

pe1chl

Please make dynamic vlan assignment possible for wifi-qcom-ac wireless driver
do you mean via RADIUS?

Via RADIUS or via access list. I also want to have that, I use it in the old wireless driver.

pe1chl

So we can agree that the only essential difference between Winbox and WebFig is the ability of former to connect device even if IP setup is not correct (and matching between ROS device and management workstation). And that difference would like go away if Winbox was rewritten to java. Hence idea ab...

pe1chl

Problem are all ARM wireless devices with 16MB flash.

And even worse: 15.3MB Flash

pe1chl

Recent example: https://forum.mikrotik.com/viewtopic.php?t=202381 In my case I use HP or Aruba switches and I use them to power all kinds of devices (telephones, APs of different make including MikroTik) and I have never seen issues. So it looks like the problems are limited to MikroTik switches po...

pe1chl

The easiest solution for irritating LEDs: apply black tape. I have done that "forever" on MikroTik equipment, e.g. because of the blue powerled (torch).

pe1chl

I never had to fight against 802.3AF/AT implementations! It always "just works".
But of course it requires way more hardware than "passive PoE".

pe1chl

When it really is not possible to gain space by separating the packages, a "RouterOS lite" base package could be created that omits all those bells and whistles and allows the device to be used as a simple NAT router without capabilities like auto routing, mpls, dot1x, proxy, SMB, hotspot,...

pe1chl

It is the same when the peer is RouterOS v6. When you make changes to the route filters and do a "refresh" it issues the error and does not refresh.
When stopping/starting the session it works, but that is unfortunate.

pe1chl

I would recommend remaining on 7.12.2 (so before the wireless changes) at least until 7.14.1 is released Good point. TBH, I don't think there will be some magic in 7.14+ which suddenly gives us lot of extra space. That is unavoidable consequence of adding more and more features. There appears to be...

pe1chl

I tried your tip ( set detect-interface-list=none ) but it did not let all equipment run in the same domain. Are you sure this command changes the behavior? To me it seems to be a filter for reporting purposes, not something that changes the state of an interface. Study the matter a bit better and ...

pe1chl

Still, the sorting in winbox is done by winbox, not by RouterOS.

pe1chl

One of my hAP ac2 running v7.13.2 had an interesting and totally unwanted behavior earlier today: The router was reporting about 3% free space (so not totally full). If this is going to happen to everyone on normal install, we are getting into interesting times. Yes, in particular the hAP ac2 is in...

pe1chl

A good fix is to not reboot routers unless it is required to upgrade software or install an additional package. MikroTik routers do not need to be rebooted after a config change or after some uptime. Next time you face the same situation anyway, instead of reboot the PC try to unplug the network cab...

pe1chl

+1000

pe1chl

Too bad the CRS326-24S+2Q+RM is delivered from factory with RouterOSv7 and 64MB of RAM.

You can run SwOS on that. Anyway, I would never buy that kind of thing from MikroTik.

pe1chl

Did you run into this issue when trying to configure the router from an export, or when just rebooting it after the upgrade? There is this bug in the /export that it exports /ipv6 address before /ipv6 dhcp-client, but it has been like that for longer than 7.13.3 and it usually seems harmless. Could ...

pe1chl

It means your router does a DNS query before everything is up and running. Maybe you configured NTP with a DNS name, or some other service like that. Just ignore it, it will fix itself later. Yes, I ignore it, the intention here was just to show how something as simple as starting a service at the ...

pe1chl

I do feel that 64MB of RAM is on the low side for ROS7.

True, you should not upgrade that kind of vintage device to RouterOS v7 unless you are prepared to live with performance issues.

pe1chl

On a router like that, it would be a good idea to use partitions=2. You have 2 partitions of 64MB, usually enough for operation. Then before you upgrade, do a "copy to" in the partition menu, copying the active partition (0) to the other (1). When after the upgrade you are not satisfied wi...

pe1chl

Thank yoU!! having this file ios awesome I can copy this into a new router piecewise as I wish!!!!! even the firewall chains!!!! Yes, but only when you remove existing chains before you copy/paste the new ones! Always check what configuration exists when you paste an export. E.g. for your example, ...

pe1chl

It even feels counter intuitive that the most expensive and high-end CRS5xx series feels crippled compared to the lower-end series due to lesser cpu/memory/storage (1core/64/16 & 1core/128/32) vs (2core/1Gb/16 & 1core/512Mb/16) That is because in a high-end switch the CPU and its associated...

pe1chl

What I mean is that I would like to have a router with 8 RJ45 ports that support 2.5Gbps. Because that allows to easily connect faster equipment and internet lines without having to use S+RJ10 or similar SFP->UTP modules which generally run very hot. Fine if the router also includes one or two SFP+ ...

pe1chl

It's a great idea to rename to "nas"! I love roses, like well Guns'n'Roses, rose flowers, rose perfume and so on… but how it is related to SMB I really don't understand! the rose-storage package does not only offer the "nas" function, but also the "client" function. In...

pe1chl

The auto-before-reset.backup is created when you reset the settings to defaults. You can remove that file when you no longer need it (and you can skip the creation of the file when doing the reset). To backup the config there are two ways: - backup. that creates a .backup file which is a binary file...

pe1chl

Routers with only SFP+ ports are not very practical to use. Optical modules are nice, everything else runs so hot that I would not want to have it (e.g. the SFP to RJ45 modules, or the SFP VDSL modem I tested in the past).

pe1chl

It means your router does a DNS query before everything is up and running. Maybe you configured NTP with a DNS name, or some other service like that.
Just ignore it, it will fix itself later.

pe1chl

Probably one was "partitioned", i.e. there are different versions of RouterOS on it for fallback in case of failed upgrade etc.
Look under the Partition menu.

pe1chl

You can fix that using this command:

/interface detect-internet set detect-interface-list=none

pe1chl

When you have an existing configuration in a router running v6, and then you upload v7 and upgrade, the configuration will be automatically converted. So you should not have such problems unless you have netinstalled v7 and then try to import (or paste) the old v6 configuration into v7. In case of t...

pe1chl

It is not difficult, but it takes some time, and some attention, the biggest issue is AFAIK, even with relatively simple configurations that the lines need to be pasted/inserted in the new configuration with a logic order (which is not necessarily the order of the lines in the export) otherwise the...

pe1chl

Last beta broke my RB4011 wireless. Now is not working anymore. Very good job!! Maybe you installed the qcom-ac package without careful reading? It will break the 2GHz WiFi. To have 2GHz WiFi on the 4011 you need to keep the "wireless" package, and you cannot have both "wireless"...

pe1chl

More RAM helps at buffering the traffic, at my understanding.

Yes, but a lot of buffering of the traffic is actually a bad idea. Especially when there are not multiple queues and DSCP based priority.

pe1chl

L009 replaces RB2011, it is for people who need 2GHz. We have plenty of other devices for those who need 5GHz. Actually, not that many. There is no real product "for the higher-end home user" with 8+ switch ports and modern WiFi. The 4011 is not well supported, the 5009 has no WiFi, the h...

pe1chl

Why does MikroTik not make more routers with at least two 2.5 ports? My guess is they will come out with 10g ports and not waste time with anything less. Indeed that is a bit of a pity. A router like the 5009 but with all 2.5Gbit ports would be welcome. Even the 2004 (the logical successor to the 1...

pe1chl

What they do have in common CCR1009 and EOL.

They are no longer sold but they are still supported. Updates for RouterOS are released for this model.
There is no need to replace it just yet.

pe1chl

PPPoE is a protocol that encapsulates your internet traffic (it puts a header in front of it) and then sends it down to the layer below it. That will usually be a VLAN. That again puts a header in front of it. Finally the traffic is sent out on a physical interface (in your case SFP+). In all those ...

pe1chl

He has a different model. CCR1009-7G-1C-1S+.
It is the later model. It does not have the ether1..ether4 switch. So the issue you are seeing is not present on that model.

pe1chl

No fasttrack!

That is a different model! And different config as well.

pe1chl

Or get one of those "software router" x86 boxes at Aliexpress that have a couple of ethernet ports.
You can get the minimal options for memory and storage, and that makes them quite cheap.

pe1chl

On that particular model, you would not use ether1 as the WAN interface as usual with MikroTik routers. Use one of ether5..ether8 (or one of the SFP) as the WAN interface and you can use ether1..4 as LAN. Assuming you have another independent switch to connect the LAN systems, do not use any of the ...

pe1chl

I use the SFP+ module as WAN port, and under interfaces I can see the traffic for both send and receive no problem for that port. However, as soon as I select that as the port for the queue, I see no traffic flow in the queue, not even a single packet. This is also the case when I turn off Fasttrac...

pe1chl

You need to explain what you mean or start a new topic. There was a problem but the methods explained above do work.

pe1chl

No. NAND is just a (confusing) shorthand for "NAND Flash", one of the types of Flash memory.
Another is "NOR Flash" and todays flash storage also has other different types of construction.
My computer has 2 Flash devices of 2TB each. I would have liked ~1GB of flash in my router.

pe1chl

Probably because they bought a truly excessive quantity during COVID, due to the shortage of supplies of materials, which now have to put them everywhere to dispose of them and cover the costs incurred to buy them. The whole 16MB debacle started WAY before COVID!!! When I initially "discovered...

pe1chl

With all those outdoor solutions it becomes more and more sad that the new wireless driver does not support dynamic VLAN assignment via RADIUS...

pe1chl

Yes, I saw it that finally the counters are 64-bit, hooray! That means I do no longer have to set a 1-minute timeout on flows... However it will be some time before this version gets installed on our work router, currently running 7.12.1 (too many "introduced in 7.13" in the changelog late...

pe1chl

VLAN configuration is tricky in many different products. Often there is no good overview of what you are doing. It can be done VLAN-centric (you define VLANs and specify which ports are tagged members and which are untagged members) or it can be done port-centric (for each port you can set which VLA...

pe1chl

Yeah, the implementation was sort of sub-optimal, and it would no longer work today. But the idea in itself is apparently what a lot of people want: manage the router at "application" or "task" level, not at "VLAN config" or "firewall rule" level. When there i...

pe1chl

Well, for WiFi I use the usermanager to allow a limited set of MAC addresses and assign them the VLAN I want.
(unfortunately the new WiFi driver cannot do that anymore...)
But with this config, the connection time and amount of data is also maintained by usermanager. So I have an overview of that.

pe1chl

I never really saw Cisco GUI, last time i had interaction with Cisco was in high school 11 years ago and that was through CLI. I don't know how it works today, but in the past we had Cisco routers and at some point a new router came with a package that could be used to configure it. Written in Java...

pe1chl

I would like to say THANK YOU VERY MUCH for this improvement in 7.14 beta8:
Code: Select all
*) traffic-flow - use 64bit counters for v9 and IPFIX flows

Yes, that is great! I have been asking for that for many years...

pe1chl

It would not require a different RouterOS do do that, just an application that has many wizards and knowledge of the hardware (how many ports, what are they called, what kind of WiFi, etc). The application asks the users what he wants to have, and sends the correct configuration commands to the rout...

pe1chl

Probably instead of adding even more of these "QuickSet" and "setup" hacks it would be better to develop a newbie-friendly GUI tool that allows configuration of the router in the same way as modern consumer routers are configured (wizards, task-oriented screens) and configures th...

pe1chl

RouterOS is not for the users that require wizards for everything...

pe1chl

That does not actually work... and it is not supported by the Linux firewall.
Even in "ipset" it is not possible to have a single entry with two protocols.
But you can make an ipset with 2 items, one is "tcp port 53" and the other is "udp port 53" and refer to that.

pe1chl

That is just a special case of the problems in the logging system in general. It really needs to be worked on.
Long ago I have submitted a ticket for that, and it was agreed that it needs work, but nothing has happened since.
(as Jotne also rightfully complains about)

pe1chl

That is why I wrote "resolver" instead of just resolver on Fri Jan 26, 2024 2:03 pm above. It isn't only a resolver. But, some of the other mentioned products (at least "unbound") have similar functionality. In many routers, the capability to serve a .local zone and to forward qu...

pe1chl

The problem with that idea is that for every network card some user has, and for every new network card on the market, the whining about "can you please include the driver for my card??" will begin. And not only for network cards, but also for all other hardware in the system (disk devices...

pe1chl

The current "resolver" already includes many things that are not part of a standard resolver, like static entries, forwards for a domain, DoH, etc. But unbound can do them all, plus more. I don't know which of the others would have all those capabilities, but maybe there are indeed more. S...

pe1chl

That is what I mean! E.g. "unbound" provides everything the RouterOS resolver can do now, plus additional things that are still on the list of things-to-do, like DNSSEC support. I'm sure once work is done on that, all the bugs come back to haunt them.

pe1chl

Well of course the expected operation is "when A record is requested an CNAME record exists in the cache but destination of CNAME record does not, re-request the appropriate pointed record and wait for the response, and return the result to the client only after that response has been received ...

pe1chl

Apparently your production router has the wireless package installed, and your test router does not. It is a "normal problem" with MikroTik. You usually cannot do "reset configuration and import script" because there can be minor errors and they are not handled. You could overcom...

pe1chl

Seeing on the changelog of both 7.13.3 and this 7.14beta how many problems are being fixed that were introduced in 7.13 or later, I still think the 7.12.1 release should be promoted to long-term. There apparently are a lot of changes being made, and a lot of associated mistakes (for whatever reason)...

pe1chl

Well, I don't have the problem you mention. So there must be some relation to configuration and/or use.

pe1chl

Short TTLs ~0-5s are used for load balancing, but the web is full of really long TTLs. NS TTLs are usually hours, if not days like TLD delegations. SOA TTLs may also be really long, but I don't know if ROS resolver is doing negative caching - hopefully not, since it's easy do do wrong. CNAMEs usual...

pe1chl

You can't expect to cache the whole Internet. So some cache management is required. Common approaches are LRU and displacement of records with shortest remaining TTL. The latter would probably not be a good approach today. Currently, TTL from the upstream DNS servers is usually either about one hou...

pe1chl

Sure when there is no more cache space it would be best when the DNS resolver drops old records first.
However, by doing the above tuning you can likely avoid that situation occurring altogether.

pe1chl

You can already set a "Cache Max TTL" when you have a lot of DNS cache and are unable to increase the cache size due to memory limitations of the router. E.G. set it to 02:00:00. On typical router models used in heavy-use situations you can easily set the cache size 10x higher than default...

pe1chl

Note that "I would want to open the session file in a text editor" refers to a desired change by MikroTik to make the winbox session files into an editable form like JSON. At the moment they are binary files and cannot be repaired. Did you already try to remove the file (or move it somewhe...

pe1chl

*) wifi-qcom - improved system stability when using FastPath (introduced in v7.13); No serious software developer would write such commit or changelog messages. There are some standard phrases used in those changelog messages. It can be good because it reduces the line length. "improved system...

pe1chl

Above it is already mentioned that it is 1000UF 35V
Of course you need to buy a premium brand and a type with a low ESR and 105C temperature capability.
But I would first get the PSU and open it to make sure yours is the same.

pe1chl

the changelog is rather vague. Changelog quality is piss-poor. I think an easy way to improve this would be to link to the relevant bug tracker case (MikroTik has one of these, right?) which would hopefully have more tech stuff for people to read over if they want. I have proposed several times tha...

pe1chl

That is the kind of issue that you can usually solve by throwing away the session file for that device and start again... But I don't want to do that, in such a case I would want to open the session file in a text editor, look for the section for ip firewall mangle, delete it, and then re-configure ...

pe1chl

If you insist on using local source for time sync of your network, you can use a low-cost device (e.g. RPi) running "normal" linux with NTP server which allows to use local clock as reference clock. You can then try to discipline local clock using NMEA telegrams if you will. I don't think...

pe1chl

What's new in 7.14beta8 (2024-Jan-22 21:07):

*) package - reduced "wireless" package size for ARM, ARM64, MIPSBE, MMIPS devices;

Did anyone already check by how much?
(i.e. how much more free space do you have after upgrade to this version on a device with wireless package)

pe1chl

That is why I write I have a big investment in session files! For every router I have a session file (either <own> for that router or a common one for several routers) where all the open windows show what I want to view, with the correct columns (those FP columns deleted, for example), the appropria...

pe1chl

Even if we make a winbox that is not the same as the good old Windows 95 inspired version, you can always just keep using the old one :)

Of course until at some point the authentication or some other fundamental protocol detail is changed in some newer RouterOS version, as has happened before...

pe1chl

Remember that in v6 when a chain of filters ends, the default action is "accept". In v7, the default action at the end is "reject". So, when you had filters in v6 that only modify some BGP parameters or rejected some networks, it would work because the implicit accept at the end ...

pe1chl

I use sessions all the time. Usually with <own> but sometimes with a file that describes a specific model and usage scenario (and thus is shared between different devices). I have a big investment in sessions files that are completely customized and I hate it when I lose one and have to re-do it... ...

pe1chl

I don't think there is further progress than what is written above...

pe1chl

7.13 crashing when winbox is left open is a known bug

pe1chl

There will always be enhancements that will be missed when staying at an older version. Not relevant.

pe1chl

Actually I would prefer when changes like what I mentioned Tue Dec 12, 2023 4:15 pm are implemented (to allow connection to some device directly from a desktop icon).
And also to change the .viw files to a readable/editable format (e.g. .json)...

pe1chl

But with proper ICMP troubleshooting is so much nicer and it is so much friendlier to the software as it allows immediate and accurate error reporting to the user. Unfortunately, a widely used desktop operating system decides to hide the useful error information from the user... (and also it does n...

pe1chl

Yeah, sometimes they backported fixes that did not even work in the release they came from. I guess developers are human. But it would be nice if we could get commitment to maintain 7.12.x with critical fixes until the showstopping bugs in 7.13+ have been ironed out a bit. Maybe when 7.16 is release...

pe1chl

I assume "forking" now a long term branch would increase their development effort. not immediately, but within months the branches diverge and and will be hard to apply only patches while the stable branch keep going on. It should not be that hard. Of course there will be no development i...

pe1chl

What do you mean "teaser"? That is just a wine install, that has been possible for a long time.

pe1chl

It all depends on what you want to accomplish... which is not very clear from your description. Firewall rules will not affect what is happening inside the network that you have sketched. Only when there is more to it than you show us (e.g. the "main" router also has an internet connection...

pe1chl

Indeed, they are in denial. We can only hope that 7.12.1 will be labeled long-term and maintained with security fixes...

pe1chl

1) Check the bridge’s protocol-mode, with AX2/AX3 it MUST be default value (rtsp).

Why?

pe1chl

That "Repeater" seems not to be routing (IP address is from the same subnet). In that case "firewall mangle" rules are not processed, because the traffic is not routed but only bridged. You can set the option "Use IP firewall" in the bridge global settings, but be caref...

pe1chl

There was a time when switches and access points (really old SXT devices come to mind) had 128 MB in them - what the *** happened with that? At some point devices with 16MB appeared, usually really low-end devices. But at some point even much more expensive devices got released with 16MB, and they ...

pe1chl

Also, what do you mean with "one is acting as a range extender"?
Is it operating as a router or did you configure it as a bridge?

pe1chl

One reason probably is that 16MB is a boundary for some old storage technology and having more than 16MB requires more pins from the SoC that can also be used e.g. to drive LEDs. So to keep costs down, it seemed attractive to have 16MB storage only. I think it would be a good idea to define a releas...

pe1chl

I agree. Using NMEA to provide "GPS time" is usually much worse than using NTP over internet. I do have an NTP appliance (LeoNTP) at home and my MikroTik routers perfectly obtain time from it (and work as a server once they are locked). There is no "issue", it just works OK. (the...

pe1chl

Obviously they don't dude. It was a joke. My point stands, want Linux vanilla networking? Go for Debian or OpenWRT. MikroTik is a vendor, and they will do what ALL vendors in the market do, i.e. integrated routing stack. In the market for hAP ac2 (a basic home router/AP with NAT), it is very unusua...

pe1chl

Simply don't get it. These are personal settings that are not available at all. The hole "Notifications" is not working. For example I want to get a notification when someone reply me / on my post and etc. You click now you preferences and after submit - NOTHING! Is a BUG or just disabled...

pe1chl

No, hAP ac2 is finished. The flash space has run out and MikroTik is unwilling to do something about it (see discussion in 7.14beta topic).

pe1chl

And it goes out of topic again. If you want to discuss routing packages do it in one of already existing topics or create a new one. It is not off topic! It is on the topic "current RouterOS releases consume too much flash space" and thus is related to the 7.14beta topic. In 7.12.1 this p...

pe1chl

I am. Therefore your statement is false. Me too. 😁 Look, I am using BGP myself. On my RB4011. But I don't think that there many users that would do that on their hAP ac2. And if there are, they can still install the package for it and omit something else they do not need. I don't use Wireguard. or ...

pe1chl

Yes, I just visited the site and it loaded in a single try. First time in a week.

pe1chl

Then change that back! In v6 and in general Linux there certainly was and IS a layer that does the routing itself and a separate process or processes that manages the auto-routing like BGP. At the moment you are in the situation that the bad decision to use 16MB (or less) flash memory causes problem...

pe1chl

routing is essential to install even connected and static routes for router to be able to forward anything at all. it does not makes sense to run router without a "routing package", which will render router useless. OH COME ON!!! You cannot be working at MikroTik when you make remarks lik...

pe1chl

At the moment it uses 159.148.147.239 but I think that started when the problems occurred and the "happy eyeballs" algorithm switched from IPv6 to IPv4. Normally I use IPv6. However I think there should be no difference, it should both work OK. (in the past it has happened a few times that...

pe1chl

So still need some more modularization. For example: probably 99.9% of users don´t need MPLS/BGP/PPP/... on an AP. I can understand why PPP is to be in the main package. It is used as an underlying protocol for several other protocols. But MPLS and auto-routing (BGP/OSPF/RIP/IS-IS) certainly are ca...

pe1chl

Not here either. When I open the forum I now get a jumble of icons in sort of the right colors, instead of the plain white page. That already happened earlier this week as well. It certainly looks like there is some rate limiting, and the burst of loads required to get all the stylesheets and icons ...

pe1chl

I don't see that happening... that would destroy their walled garden of acceptable packages.
E.g. Android does not allow that either (and facilities to partly allow it in ancient versions were quickly removed).

pe1chl

is the forum ever going to work OK again? Or is it just the new situation that we need to refresh 3-4 times before the page is shown OK?

pe1chl

I don't understand the need to set Tx power separately for all different rates. There is a chip max Tx power for each rate, and there is a calculated Tx power depending on the desired (and allowed) EIRP combined with the antenna gain. Whenever the calculated Tx power exceeds the chip max Tx power fo...

pe1chl

But we cannot get this to propagate to OpenVPN Connect Client 3.4.2

Did you try with the OpenVPN community (free) edition? Because that "OpenVPN Connect Client" (commercial version) is not completely compatible with the classic protocol.

pe1chl

Well, I would not know how it could meaningfully auto-layout different windows with a so much varying content and optimal size... For a window with "IP addresses" or many other similar windows you can use a tiny window. For something like routes or firewall you need a much larger window. A...

pe1chl

who not need it (99% of the users) you should review your statistics 🤣 Personally, I have never felt the urge to use my router as a file server. And it would be too primitive and slow for that anyway. If it was a DLNA media server I could understand that, but as far as I know MikroTik does not offe...

pe1chl

Yes, the situation probably is the most urgent for hAP ac2. It is a relatively recent device, it has less flash storage than some others (15.3 instead of 16MB), and it has the optional WiFi package available. But when the original wireless is used, it is bothered with the management windows for the ...

pe1chl

I'm pretty sure it's just a cosmetic one or might be something related to the Wireless->Wifi auto-conversion? (I'm not even sure there is one, I alway start from scratch ..so..). The device works fine though, I quickly checked the export and everything seemed ok. There is no Wireless->Wifi conversi...

pe1chl

Services like SMB should be moved into a separate package. Those who want to use it can install it and those who not need it (99% of the users) can gain some space. To facilitate this, extend the "system->packages" menu with a list of not installed packages with associated button to instal...

pe1chl

(Device: hAP ac^2) Log: script error: error - contact MikroTik support and send a supout file (2) error while running customized default configuration script: no such item I had that problem as well, a month ago, when I upgraded to 7.13. So I did what it mentions and sent a supout file. Reply: &quo...

pe1chl

The issue still exist.
Maybe the forum server is the victim of a DDoS attack?

pe1chl

SFP whack-a-mole seems to continue...

pe1chl

I guess for some people it is always possible to invent a new problem...

pe1chl

I am slightly confused by posts that say to change the package will mean that all prior wifi config is removed; I guess it's not one size fits all, my device came back up without issue. You did not change the package. So that does not apply to you. It only applies to those that have previously used...

pe1chl

You should have left that device behind on a v6 release... I recommend 6.47.9
For your v7 adventures, buy a new router.

pe1chl

Not only for difference between versions, also in other areas the documentation is sometimes extremely lacking. See for example "/queue simple". There is no documentation AT ALL, its manual section has only an example that uses only 1/5 of the available parameters. What the other parameter...

pe1chl

Well, it was written in the changelog, but in a very cryptic way and between many similar lines so it did not stand out.
*) console - replace reserved characters in file and script names with underscores;

pe1chl

I think "home users" are best served with automatic upgrades and configuration updates. Many home routers will be running with default config and have changed only things like admin password, wifi ssid+password, and internet connection parameters (like PPPoE client). When not any other cha...

pe1chl

When you want to volunteer to test such things, you can always do so. A bit of a weak point in RouterOS is that changes in the default config are never applied to existing routers, not even when the configuration of those routers still was at default settings. So the typical scenario is: router is u...

pe1chl

Yes, that is the problem I have as well.
At first it was only a white page with text and links (i.e. no CSS at all), now it is a partly correct and partly incorrect page.
(so probably some CSS files load and others do not)
Also a lot of the small images that are used in the layout are failing to load.

pe1chl

Are there no others that have issues with the forum? With prosilver theme I get a different page layout for every reload, usually without any CSS but sometimes OK. With Canvas theme I get a lot of missing graphics. I already tried disabling IPv6 (because when the problem would occur only on IPv6 lot...

pe1chl

One of the problems is that there is no offline converter for configurations from v6 to v7. When you have existing hardware running v6 you can upgrade that and it will mostly convert the configuration, but when you have bought a shiny new CCR2116 that can only run v7 you cannot paste the export of a...

pe1chl

I am using the prosilver theme and the board now shows as if it has no stylesheets... With some effort I could change to Canvas but it does not load completely OK either... Maybe the forum software was re-installed for some reason? Are there plans to fix that or do we continue in the downward spiral...

pe1chl

It was slow but now it is broken.
I am using the prosilver theme and the board now shows as if it has no stylesheets...
With some effort I could change to Canvas but it does not load completely OK either...
Maybe the forum software was re-installed for some reason?

pe1chl

Yes, I hope that MikroTik consider to promote 7.12.1 to "long-term" and apply possible security fixes in the future. The 7.13+ versions have those issues and it looks like it is going to take time to iron them out, in the meantime "we" want to have a version we can keep running i...

pe1chl

Yes, on the newer wAP AC models it can be done. You need the model with ARM processor, not the MIPSBE.
Of course there are also other workarounds to get working what you like, as discussed on the forum.

pe1chl

station-bridge does not work between "interface wifi" and "interface wireless".
They need to be the same type. And as you have a cAP ax, it can only be "interface wifi".

pe1chl

There is no way to recover the password. You will need to hard-reset the router and load your latest backup. And then look at the firewall. It is not good practice to allow login to the admin interface (telnet, ssh, http, winbox, api) from the entire internet. Either allow a small number of fixed IP...

pe1chl

Again: when an RB4011 (or any device) is upgraded from 7.12.1 to 7.13, an unusable WiFi menu is added. This takes up space on the device (a real problem on e.g. the hAP ac2!!!) WiFi menu is usable to manage CAPsMAN. You can ignore it, just like you can ignore BGP menu, SNMP menu and others. Unfortu...

Search found 11931 matches