Apple devices & Mikrotik

I have 2 iPhones, 2 iPads, 2 MacBookPro in my home and one PC. I tried to use TP-Link, Linksys and now Mikrotik devices as WiFi AP and always have the following problem:
After some time of work every Apple device lost connection with AP on IP level and there is no such problem with PC at all. The connection appears as established (and I can see the signal strength) on AP and device but no traffic is present there. I tried sniff WiFi interface on Mikrotik in order to confirm it. No ARP, no IP, no ping from AP, no traffic at all. If I reconnect to WIFi from the device it will work great again (for some time, it may be few seconds or few hours).

I use iOS 4, 5 and 6 on devices. I use AES CCM only. Preamble Mode is “both”.

How to debug it?

Try 4.17 on ap. Was like magic on one of my hotspots.

Now I use 5.20. So you believe that older RouterOS version is better, isn’t it?

to none mikrotik devices, 4.17 is much better.

I have 2 iPad2, 1 iPod, 1 iPhone4, 1 iPhone4s and a iPhone5 connected. Only device that ever had issues is the iphone5 and there is a confirmed issue with aes on some iphone5 devices(I have issues). The iPod did have connect issues but setting it up again removed the issues. I have ios5 and iOS6 on devices and ros 5.20

I have also never had a problem with any of my apple products which include iPhones, iPads, and MBPs.

Post /export compact and we can take a look at your settings.

Also check which Wireless chipset the Apple devices have. Around 50% of them use Broadcom, others use Atheros. Check which ones are having the issues. You can see this in MacOS menu “About this mac → More info → System report”

IOS 6 has a confirmed bug with running mixed TKIP & aes on iphone4s and lower, so turn off TPIK in your router(should really be off anyway). iPhone5 has general wifi issues on some of the hardware and apple has not released any information but confirmed the issue. Workaround here is to run TKIP only since the defect affects aes only. Apple has not confirmed yet if its a HW issue or a software issue.

Here is my config:

[root@mktk] > /export compact

oct/07/2012 16:14:19 by RouterOS 5.20

software id = *

/interface wireless
set 0 arp=reply-only band=2ghz-b/g/n default-authentication=no default-forwarding=no dfs-mode=no-radar-detect disabled=no disconnect-timeout=10s
distance=indoors frequency=2437 ht-rxchains=0,1 ht-txchains=0,1 l2mtu=2290 mode=ap-bridge name=WiFi preamble-mode=long radio-name=AA11 ssid=
AA11 wireless-protocol=any wmm-support=enabled
/interface bridge
add admin-mac=D4:CA:6D:* arp=reply-only auto-mac=no l2mtu=1598 name=bridge-local
/interface ethernet
set 0 arp=reply-only name=“ether1 - WAN”
set 1 arp=reply-only name=“ether2”
set 2 arp=reply-only master-port=“ether2” name=“ether3”
set 3 disabled=yes master-port=“ether2” name=ether4-slave-local
set 4 disabled=yes master-port=“ether2” name=ether5-slave-local
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods=passthrough management-protection=allowed management-protection-key=
" mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key="" wpa2-pre-shared-key="****”
add authentication-types=wpa-psk,wpa2-psk eap-methods=passthrough name=no supplicant-identity=“”
/ip dhcp-server
add add-arp=yes authoritative=yes disabled=no interface=bridge-local lease-time=4w3d name=default
/ip pool
add name=LAN ranges=192.168.111.10-192.168.111.254
/ppp profile
set 1 use-encryption=required
/queue tree
add disabled=yes name=In parent=global-in priority=6
add disabled=yes name=Out parent=global-out priority=6
add disabled=yes name=Other-In packet-mark=no-mark parent=In priority=6
add disabled=yes name=Other-Out packet-mark=no-mark parent=Out priority=6
add disabled=yes name=VoIP-In packet-mark=VoIP parent=In priority=2
add disabled=yes name=VoIP-Out packet-mark=VoIP parent=Out priority=2
/system logging action
set 1 disk-file-count=50 disk-lines-per-file=10000
/interface bridge port
add bridge=bridge-local interface=“ether2”
add bridge=bridge-local interface=WiFi
/interface wireless access-list
add comment=“Mac1” interface=WiFi mac-address=60:33:4B:* signal-range=-100..100
add comment=“iPhone1” interface=WiFi mac-address=CC:08:E0:* signal-range=-100..100
add comment=“iPad1” interface=WiFi mac-address=A4:67:06:* signal-range=-100..100
add comment=“iPad2” interface=WiFi mac-address=A4:67:06:* signal-range=-100..100
add comment=“iPhone2” interface=WiFi mac-address=90:84:0D:* signal-range=-100..100
add comment=“Mac2” interface=WiFi mac-address=00:1C:B3:* signal-range=-100..100
/ip address
add address=192.168.111.1/24 interface=bridge-local
/ip arp
add address=111.184.161.1 interface=“ether1 - WAN” mac-address=00:21:55:*
add address=192.168.111.254 interface=bridge-local mac-address=60:33:4B:*
add address=192.168.111.248 interface=bridge-local mac-address=A4:67:06:*
add address=192.168.111.251 interface=bridge-local mac-address=CC:08:E0:*
add address=192.168.111.247 interface=bridge-local mac-address=C4:2C:03:*
add address=192.168.111.246 interface=bridge-local mac-address=00:90:3E:*
add address=192.168.111.253 interface=bridge-local mac-address=A4:67:06:*
add address=192.168.111.250 interface=bridge-local mac-address=90:84:0D:*
add address=192.168.111.249 interface=bridge-local mac-address=00:1C:B3:*
/ip dhcp-client
add default-route-distance=101 disabled=no interface=“ether1 - WAN” use-peer-dns=no use-peer-ntp=no
/ip dhcp-server config
set store-leases-disk=1d
/ip dhcp-server lease
add address=192.168.111.254 always-broadcast=yes client-id=1:60:33:4b:* comment=“Mac1” mac-address=60:33:4B:* server=default
add address=192.168.111.251 client-id=1:cc:8:e0:* comment=“iPhone1” mac-address=CC:08:E0:* server=default
add address=192.168.111.248 client-id=1:a4:67:6:* comment=“iPad1” mac-address=A4:67:06:* server=default
add address=192.168.111.247 client-id=1:c4:2c:3:* comment=“Mac1 LAN” mac-address=C4:2C:03:* server=default
add address=192.168.111.246 client-id=1:0:90:3e:* comment=AudioCenter mac-address=00:90:3E:* server=default
add address=192.168.111.253 client-id=1:a4:67:6:* comment=“iPad2” mac-address=A4:67:06:* server=default
add address=192.168.111.250 client-id=1:90:84:d:* comment=“iPhone2” mac-address=90:84:0D:* server=default
add address=192.168.111.249 client-id=1:0:1c:b3:* comment=“Mac2” mac-address=00:1C:B3:* server=default
/ip dhcp-server network
add address=192.168.111.0/24 dns-server=192.168.111.1 gateway=192.168.111.1 netmask=24 ntp-server=192.168.111.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.111.1 name=router
/ip firewall address-list
add address=192.168.111.0/24 list=mngmnts
/ip firewall connection tracking
set tcp-established-timeout=10h tcp-syncookie=yes
/ip firewall filter
add action=drop chain=input comment=SYSTEM connection-state=invalid
add action=drop chain=forward connection-state=invalid
add action=drop chain=input src-address-list=blocked_in
add action=drop chain=forward src-address-list=blocked_in
add chain=input connection-state=established
add chain=forward connection-state=established
add chain=input connection-state=related
add chain=forward connection-state=related
add chain=input limit=4,2 protocol=icmp
add chain=forward limit=4,2 protocol=icmp
add action=drop chain=input protocol=icmp
add action=drop chain=forward protocol=icmp
add action=add-src-to-address-list address-list=blocked_in address-list-timeout=1h chain=input comment=“Port Scanners” protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=blocked_in address-list-timeout=2w chain=input protocol=tcp tcp-flags=
fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=blocked_in address-list-timeout=2w chain=input protocol=tcp tcp-flags=
!fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=blocked_in address-list-timeout=2w chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=blocked_in address-list-timeout=2w chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=blocked_in address-list-timeout=2w chain=input protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=blocked_in address-list-timeout=2w chain=input protocol=tcp tcp-flags=syn,rst
add chain=forward comment=“Allow Internet Access” in-interface=“!ether1 - WAN” out-interface=“ether1 - WAN” src-address=192.168.111.0/24
add chain=input comment=“Local Services” dst-port=53,123 protocol=udp
add chain=input comment=“Remote Admins” src-address-list=mngmnts
dd action=drop chain=input comment=SYSTEM
add action=drop chain=forward
/ip firewall mangle
add action=mark-connection chain=prerouting comment=VoIP connection-state=new disabled=yes dst-address=**** new-connection-mark=VoIP_con
add action=mark-packet chain=prerouting connection-mark=VoIP_con disabled=yes new-packet-mark=VoIP passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat out-interface=“ether1 - WAN”
/ip neighbor discovery
set “ether1 - WAN” disabled=yes
set “ether2” disabled=yes
set “ether3” disabled=yes
set WiFi disabled=yes
set bridge-local disabled=yes
/ip route
add distance=100 dst-address=10.0.0.0/8 type=blackhole
add distance=100 dst-address=172.16.0.0/12 type=blackhole
add distance=100 dst-address=192.168.0.0/16 type=blackhole
/ip service
set telnet disabled=yes
set ftp disabled=no
set www disabled=yes
/system clock
set time-zone-name=Europe/Bucharest
/system identity
set name=mktk
/system leds
set 0 interface=WiFi
/system logging
set 0 action=disk
set 1 action=disk
set 2 action=disk
/system ntp client
set enabled=yes primary-ntp=* secondary-ntp=*
/system ntp server
set enabled=yes
/system watchdog
set automatic-supout=no no-ping-delay=15m watch-address=8.8.8.8 watchdog-timer=no
/tool mac-server
add interface=“ether2”
add interface=“ether3”
add interface=ether4-slave-local
add interface=ether5-slave-local
add interface=WiFi
add interface=bridge-local
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=“ether2”
add interface=“ether3”
add interface=ether4-slave-local
add interface=ether5-slave-local
add interface=WiFi
add interface=bridge-local
/tool mac-server ping
set enabled=no
/tool sniffer
set file-limit=10000KiB file-name=/sniff.txt filter-direction=any interface=WiFi memory-limit=1000KiB

Some information was hided with “*”.

What I cannot understand: why there is wpa-psk appear in the authentication-types, because in the WinBox I see that it isn’t enable (attached). I have no iPhone5, most trouble devices are my iPad2. My MacBookPro have Broadcom chipset.
1.jpeg

Also enable regular WPA not just WPA2, see if it helps

We just did some testing on multiple Mac devices, it seems that the MacOS has some sort of bug (?) - When you first time connect to it without a password, it saves it. After you set a WPA password, it doesn’t want to use it, because MacOS has saved that this AP doesn’t have any password. Instead of giving you a meaningful error, it says something like “connection timeout” or similar. What helps is clearing all remembered APs from the mac, disabling the Wifi, enabling it, and connecting then.

I enabled both WPA and WPA2. The situation is a same. After few hours of IDLE one of my iPads see connection but cannot even answer to ARP request. I see that Mikrotik update his last-activity timer for this item, I saw an ARP request in that time which ask who has 192.168.111.253.

I see that Mikrotik has 802.1x for this device, is it OK? I don’t have a RADIUS.

[root@mktk] /interface wireless registration-table> print stats
0 ;;; iPad2
interface=WiFi mac-address=A4:67:06:* ap=no wds=no bridge=no rx-rate=“1.0Mbps” tx-rate=“13.0Mbps” packets=189930,129272
bytes=228440630,117644569 frames=189930,129317 frame-bytes=228823870,116873774 hw-frames=212197,189934
hw-frame-bytes=261834975,174999314 tx-frames-timed-out=0 uptime=3h37m5s last-activity=9s670ms signal-strength=-50dBm@1Mbps
signal-to-noise=57dB signal-strength-ch0=-51dBm signal-strength-ch1=-59dBm
strength-at-rates=-50dBm@1Mbps 3m10s620ms,-46dBm@HT20-0 2h46m46s10ms,-51dBm@HT20-1 21m900ms,-52dBm@HT20-2 21m11s770ms,-47dBm@HT20-3
20m50s220ms,-45dBm@HT20-4 16s340ms,-48dBm@HT20-5 20m2s250ms,-48dBm@HT20-6 19m44s530ms,-46dBm@HT20-7 9s670ms
tx-ccq=74% p-throughput=9592 last-ip=192.168.111.253 802.1x-port-enabled=yes authentication-type=wpa2-psk encryption=aes-ccm
group-encryption=aes-ccm management-protection=no wmm-enabled=yes

Sorry, but the problem still persist for at least two my iPads and one iPhone. You write about a bug in the MacOS but I don’t have that problem with WPA black password.

Is there any way to discover what is going on in the WiFi in that time when all my devices believe they are connected but it’s no so?

Also have the same issue here, only happened with IPhone 5 running IOS 6.

Do he workarounds mentioned above solve the issue?

Hi,
Actually no workarounds was mentioned. And my iPads 2 and iPhones 4 still lost connection every few minutes.

Yeah, I read above that just enabling TKIP and disabling AES is a workaround for Iphone 5 but when I tried this just now, I found that I could only telnet to the router and one other internet site and could not connect to most internet locations:

IOS 6 has a confirmed bug with running mixed TKIP & aes on iphone4s and lower, so turn off TPIK in your router(should really be off anyway). iPhone5 has general wifi issues on some of the hardware and apple has not released any information but confirmed the issue. Workaround here is to run TKIP only since the defect affects aes only. Apple has not confirmed yet if its a HW issue or a software issue.

This was also noticed in another thread:
http://forum.mikrotik.com/t/problem-with-mikrotik-and-ios6/59752/1


So back to working Iphone5 that cuts out after a while on mikrotik router.


Any other ideas?

I use only AES from the beginning and these trouble was with iOS 4, 5 and 6 for all Apple devices (MacBookPro, iPad 2, iPhone 3Gs/4). So it’s not a problem within iOS 6 or iPhone 6 at me. But this problem appears at long WiFi usage only. In my scenario - iPad 90% of the day connected to AP and use WiFi to check mail every few minutes. Then the problem happens about a once per day, but when I see clips on YouTube it happens every few minutes. My Mac and iPhone is not so affected just because Mac is not always connected to AP and iPhone is always travel with me.

On my iPhone5 I can get issues mostly when running Sonos, but also some times without Sonos running. Disabling and enabling wifi on my iphone5 will solve it for a while. I have not tried the TKIP workaround, since I have a lot of other devices connected I did not want to play with this.

Exactly this, have to disable wireless on the iphone and re-enable to get it to re-connect.


Very frustrating bug.

I agree, but in all fairness I can’t see the problem with RouterOS since the issue is present on all major router / AP systems. PRO and consumer. Apple should get the boot for it!

Yes, I was more looking for a clever work around whilst we wait for Apple to do something.

Ie using a different authentication method or disabling auth completely and using mac based access control or something.