Hi,
First of all I am new to Mikrotik so excuse me any “dum” questions!!
I have my home setup with a RB951Ui-2HnD as main router and CAPS MANAGER,
and a second one as CAP na hAP lite.
I have setup the system ok (with your silent help, Reading the fóruns and Wiki´s), evething is running ok expect two things.
- on the CAP if i try to check for update version I get “ERROR: could not resolve dns name” if I try to use the ping tool on the CAP I can ping the network inside but i can not ping the CAPSMANAGER neither na outsider ip or URL.
I can bypass the ping problems this if i use the bridge1 interface and arp ping, but i get the same DNS error.
I can connect to the internet with no problems, the only problema i have left is chromecast not connecting to the WIFI but I beleive the first problema need to be resolved before I can solve the other one.
What am I doing wrong.
I leave my configurations bellow.
CAPSMAN
# apr/05/2016 15:13:27 by RouterOS 6.35rc45
# software id = YZTI-7DGK
#
/caps-man channel
add band=2ghz-b/g/n extension-channel=disabled frequency=2412 name=channel1 width=20
add band=2ghz-b/g/n extension-channel=disabled frequency=2437 name=channel6 width=20
/interface bridge
add admin-mac=E4:8D:8C:83:B3:5F arp=proxy-arp auto-mac=no name=bridge-local
/interface ethernet
set [ find default-name=ether1 ] name=ether1-gateway tx-flow-control=auto
set [ find default-name=ether2 ] name=ether2-master-local
set [ find default-name=ether3 ] master-port=ether2-master-local name=ether3-slave-local
set [ find default-name=ether4 ] master-port=ether2-master-local name=ether4-slave-local
set [ find default-name=ether5 ] master-port=ether2-master-local name=ether5-slave-local
/interface wireless
# managed by CAPsMAN
# channel: 2437/20/gn(20dBm), SSID: MATWIFI, CAPsMAN forwarding
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-eC country=portugal frequency=\
auto mode=ap-bridge ssid=MATWIFI wds-default-bridge=bridge-local wireless-protocol=802.11
add mac-address=E6:8D:8C:83:B3:63 master-interface=wlan1 name=wlan2 ssid="MATWIFI's Guests"
/ip neighbor discovery
set ether1-gateway discover=no
/caps-man datapath
add bridge=bridge-local client-to-client-forwarding=yes local-forwarding=no name=datapath1
add bridge=bridge-local local-forwarding=no name=datapath2
/caps-man security
add authentication-types=wpa-psk,wpa2-psk,wpa-eap,wpa2-eap encryption=aes-ccm,tkip name=security1 \
passphrase=*************
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm name=security2 passphrase=*********
/caps-man configuration
add country=portugal datapath=datapath1 mode=ap name=cfg1 security=security1 ssid=MATWIFI
add country=portugal datapath=datapath2 mode=ap name=cfg2 security=security2 ssid=MATWIFI_GUEST
/caps-man interface
add arp=enabled channel=channel6 configuration=cfg1 disabled=no l2mtu=1600 mac-address=\
E4:8D:8C:83:B3:63 master-interface=none mtu=1500 name=cap1 radio-mac=E4:8D:8C:83:B3:63
add arp=enabled channel=channel1 configuration=cfg2 disabled=no l2mtu=1600 mac-address=\
E6:8D:8C:83:B3:63 master-interface=cap1 mtu=1500 name=cap1-1 radio-mac=00:00:00:00:00:00
add arp=enabled channel=channel1 configuration=cfg1 disabled=no l2mtu=1600 mac-address=\
E4:8D:8C:C8:0B:7C master-interface=none mtu=1500 name=cap2 radio-mac=E4:8D:8C:C8:0B:7C
add arp=enabled channel=channel1 configuration=cfg2 disabled=no l2mtu=1600 mac-address=\
E6:8D:8C:C8:0B:7C master-interface=cap2 mtu=1500 name=cap2-1 radio-mac=00:00:00:00:00:00
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" mode=dynamic-keys \
supplicant-identity=MikroTik wpa-pre-shared-key=******** wpa2-pre-shared-key=********
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=dhcp ranges=192.168.1.1-192.168.1.100
add name=vpn ranges=192.168.1.101-192.168.1.110
/ip dhcp-server
add add-arp=yes address-pool=dhcp always-broadcast=yes authoritative=yes disabled=no interface=\
bridge-local lease-time=1d name=DHCP_principal
/ppp profile
set *FFFFFFFE incoming-filter="" local-address=192.168.1.1 remote-address=vpn use-compression=yes \
use-mpls=yes
/caps-man access-list
add action=accept client-to-client-forwarding=yes disabled=no interface=all mac-address=\
00:00:00:00:00:00 signal-range=-70..120 ssid-regexp=""
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes require-peer-certificate=yes upgrade-policy=\
suggest-same-version
/caps-man provisioning
add action=create-dynamic-enabled master-configuration=cfg1 slave-configurations=cfg2
/interface bridge filter
# no interface
add action=drop chain=forward in-interface=wlan2
# no interface
add action=drop chain=forward out-interface=wlan2
/interface bridge port
add bridge=bridge-local interface=ether2-master-local
add bridge=bridge-local interface=wlan1
add bridge=bridge-local interface=wlan2
/interface ethernet switch host
add mac-address=00:08:9B:C2:B1:44 ports=ether5-slave-local switch=switch1
/interface l2tp-server server
set allow-fast-path=no authentication=mschap1,mschap2 enabled=yes ipsec-secret=ekimuth#07 \
max-sessions=unlimited use-ipsec=yes
/interface ovpn-server server
set cipher=blowfish128,aes128,aes192,aes256 default-profile=default-encryption enabled=yes
/interface pptp-server server
set enabled=yes
/interface sstp-server server
set authentication=mschap1,mschap2 default-profile=default-encryption enabled=yes
/interface wireless cap
set caps-man-certificate-common-names=CAPsMAN-E48D8C83B35E certificate=CAP-E48D8C83B35E \
discovery-interfaces=bridge-local enabled=yes interfaces=wlan1 lock-to-caps-man=yes
/ip address
add address=192.168.1.1/24 comment="Endere\E7o Rede Principal" interface=ether2-master-local network=\
192.168.1.0
add address=192.168.1.2/24 comment="Endere\E7o Guest wifi" interface=ether2-master-local network=\
192.168.1.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid disabled=no interface=\
ether1-gateway
/ip dhcp-server config
set store-leases-disk=immediately
/ip dhcp-server lease
add address=192.168.1.10 client-id=ff:eb:3f:f4:81:0:1:0:1:1c:dd:61:2:b8:27:eb:3f:f4:81 comment=\
"REPETIER SERVER" mac-address=B8:27:EB:3F:F4:81 server=DHCP_principal
add address=192.168.1.223 client-id=1:0:0:74:a4:ef:df comment="Scanner Ricoh" mac-address=\
00:00:74:A4:EF:DF server=DHCP_principal
/ip dhcp-server network
add address=192.168.1.0/24 caps-manager=192.168.1.1 comment="default configuration" dns-server=\
8.8.8.8,192.168.1.1,8.8.4.4 gateway=192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes cache-max-ttl=1d cache-size=4048KiB servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.1.2 name=router
/ip firewall filter
add action=drop chain=forward comment="Isola rede local da Guest" disabled=yes dst-address=\
192.168.2.0/24 src-address=192.168.1.0/24
add action=drop chain=forward comment="Isola rede local da Guest" disabled=yes dst-address=\
192.168.1.0/24 src-address=192.168.2.0/24
add action=drop chain=input comment=\
"As duas regras seguintes impedem requests externos de DNS ao router" dst-port=53 in-interface=\
ether1-gateway protocol=tcp
add action=drop chain=input dst-port=53 in-interface=ether1-gateway protocol=udp
add chain=input comment="default configuration" protocol=icmp
add chain=forward comment="default configuration" connection-state=established,related,new
add chain=input comment="default configuration" connection-state=established,related,new
add chain=input comment="Allow limited pings" limit=50/5s,2:packet protocol=icmp
add chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=drop chain=input comment="Recusa pedidos de fora" in-interface=ether1-gateway
add action=drop chain=forward comment="N\E3o Faz Forward de Pacotes invalidos" connection-state=\
invalid
add action=drop chain=forward comment="default configuration" connection-nat-state=!dstnat \
connection-state=new in-interface=ether1-gateway
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway
add action=dst-nat chain=dstnat comment="QNAP WWW" dst-port=8082 protocol=tcp to-addresses=\
192.168.1.251 to-ports=8082
add action=dst-nat chain=dstnat comment="REPETIER SERVER WEBCAM" dst-port=8083 protocol=tcp \
to-addresses=192.168.1.10 to-ports=8083
add action=dst-nat chain=dstnat comment="REPETIER SERVER" dst-port=3344 protocol=tcp to-addresses=\
192.168.1.10 to-ports=3344
add action=masquerade chain=srcnat comment="masq. vpn traffic" disabled=yes src-address=\
192.168.89.0/24
add action=masquerade chain=srcnat comment="Acesso via DNS interno RPI REPETIER SERVER" dst-address=\
192.168.1.10 dst-port=3344 out-interface=bridge-local protocol=tcp src-address=192.168.1.0/24
add action=masquerade chain=srcnat comment="Acesso via DNS interno RPI REPETIER SERVER - VIDEO" \
dst-address=192.168.1.10 dst-port=8083 out-interface=bridge-local protocol=tcp src-address=\
192.168.1.0/24
add action=masquerade chain=srcnat comment="Acesso via DNS interno QNAP" dst-address=192.168.1.251 \
dst-port=8082 out-interface=bridge-local protocol=tcp src-address=192.168.1.0/24
/ip firewall service-port
set irc disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip upnp
set show-dummy-rule=no
/ip upnp interfaces
add interface=bridge-local type=internal
add interface=ether1-gateway type=external
/ppp secret
add name=******** password=********* profile=default-encryption
/system clock
set time-zone-name=Europe/Lisbon
/system identity
set name=Sala
/system ntp client
set enabled=yes primary-ntp=194.117.9.130
/system package update
set channel=release-candidate
/tool graphing interface
add interface=wlan1
add interface=cap1
add interface=cap1-1
add interface=cap2
add interface=cap2-1
add
add interface=wlan2
add
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=wlan1
add interface=wlan2
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=wlan1
add interface=wlan2
/tool traffic-monitor
add interface=bridge-local name=tmon1 threshold=0
CAP
# mar/28/2016 12:29:30 by RouterOS 6.35rc45
# software id = F6B5-1ECZ
#
/interface bridge
add name=bridge1
/interface wireless
# managed by CAPsMAN
# channel: 2412/20/gn(20dBm), SSID: MATWIFI, CAPsMAN forwarding
set [ find default-name=wlan1 ] ssid=MikroTik
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=wlan1
/interface l2tp-server server
set allow-fast-path=no max-sessions=unlimited
/interface wireless cap
set bridge=bridge1 caps-man-certificate-common-names=CAPsMAN-E48D8C83B35E certificate=CAP-E48D8CC80B78 \
discovery-interfaces=ether1 enabled=yes interfaces=wlan1 lock-to-caps-man=yes
/ip address
add address=192.168.1.2/24 interface=ether2 network=192.168.1.0
/ip dhcp-client
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no interface=bridge1
/ip route
add distance=1 gateway=192.168.1.1
/system clock
set time-zone-name=Europe/Lisbon
/system identity
set name=Quarto
/system package update
set channel=release-candidate
/system routerboard settings
set cpu-frequency=650MHz protected-routerboot=disabled
Thank you in advance for your time in helping me.
Miguel Matias