Hi Guys, Firstly I am a total beginner at Router OS and networking.
I have pieced together the following config from reading various topics on the forum and trying to pick up things as I go.
I would be very grateful if some kind soul could give it a once over for any glaring mistakes before I apply it to my router.
I am also adding a rough sketch of the network I am hoping to achieve, (router, switch, CCTV, 2x cAP lite and 2x isolated network)
I am hoping to send TV traffic through IKEv2/IPSEC VPN and other 3 ports through normal PPPOE connection.
Hi mkx,
Ok I didn’t know that, I thought it would just be easier to separate them as I wanted one of the subnets to go through the IPsec VPN, would it simplify things to go the Vlan route?
If you do CSS segmentation properly it probably won’t make any difference. Your design might actually give better overall performance, hEX S seems to struggle with VLAN tagging and untagging.
Just noticed PoE mark on your diagram: you won’t be alke to power CSS off hEX S. Max rated output PoE power of hEX S is 500mA and at 24V it gives 12W. CSS power consumption OTOH is 19W. If you really need to power CSS over UTP, you better get a RBGPOE power injector and use power adapter supplied with CSS.
Having only a few ether ports connected does make a difference. Experience with ether SFP modules shows that ether ports consume quite some energy. So you should expect to experience some random problems (packet drops, link downs, even device reboots) after you connect more devices and power consumption goes up. Even more, it could affect hEX S (worst case: PoE out damage).
IMO cAP lite is much better candidate tob e powered off hEX … but then it depends how you want to have LAN topology. Could be you’ll end up with another RBGPOE or powering CSS directly off power adapter (preferred solution if you have suitable power outlet near CSS location) - mind that UTP cables have pretty high losses which means (among other things) higher load on power adapter (faster ageing) and higher electricity bill.
Ok thanks mkx, so I am now powering the switch from the RBGPOE and have moved the cAP Lite to Eth5 from the HexS.
Apart from the port 1 on the switch only auto negotiating at 100mb all seems good. (I only have 100mb fibre anyway)
The cAP lite seems to be getting sufficient power also.
I am now re-writing the original config, however when I initially tried it on my hex s after a few typos sorted I had a working network but no internet,
maybe in the firewall rules id say.
RBGPOE should allow gigabit ethernet. Did cAP ac negotiate 1Gbps while being powered through the same RBGPOE unit? What about UTP cable between hEX S and CSS, what is its length, are connectors really (and I mean really) properly done? Any RJ45 wall outlet not done quite properly?
My own experience is that wiring should really be done by the code, specially if cables are longer than a few metres: I’ve had electrician pull the UTP cables (cat 5e) and connect wall outlets while I did the patch panels. All connections worked, only the farther-most played games occasionally. After a while I borrowed a professional UTP cable tester and none of them were adhering the 1Gbps standard. When I researched the problem, I found out that the electrician untwisted all pairs in wall outlets in length of 10-15 cm. After I re-twisted the wire pairs, all connections certified for 1Gbps operations.
Ok so the cable length between Hex and CSS is only 12" at the most, the patch leads may be the issue they were some Cat5E cheap ones I think.
I will look into changing these I think anyway just for power stability for the switch.
EDIT- Switch went down twice in an hour, have replaced leads now with some longer and better quality ones, so we will see.
How can I tell what speed is negotiated on the cAP Lite from Hex S now using winbox?
Here is the new config BTW if you could have a quick look i would really appreciate it,
Go to Interfaces → Ethernet, click interface you want to check and go to Status tab.
As to the config: most of it looks fine, just a few (cosmetic?) remarks:
connection-state property in the rule above should not be necessary. You’ve already dealt with packets belonging to established, related , untracked and invalid connections. What remains is new connections.
For consistency of config, you should use out-interface-list=WAN, just like it’s used in other firewall rules.
I’d try to run this script a bit less frequently … unless it’s really vital to have almost zero delay when WAN IP changes.
Thanks for the pointers on the config, will sort those out this evening.
The switch shut down again so I have managed to move adaptors around and power it from mains.
The Eth connection from Hex is now showing 1G.
Go to Interfaces → Ethernet, click interface you want to check and go to Status tab.
Strangely the rate is showing as 100mb too from Hex to cAP?
I had the wiring done by a friend of mine who works in networking but reading your comment about the termination in the back box I may have a look myself at the terminations.
So I applied the config and all is good apart from no internet on eth1 to 5.
Can reach google.com and 8.8.8.8 with traceroute via pppoe but not with Eth ports.
When I try with Eth ports I get “host unreachable from (Draytek 130 IP address)”
I have checked every thing is applied from config correctly I think.
Am I missing some glaring error?
