just playing around with RouterOS on a hEX Refresh. trying to set up a simple dhcp client on ether1, to connect it to a dhcp server. just for learning.
I must be missing something obvious because the client is permanently searching. never gets an address.
Ive checked the dhcp server: if I plug in a PC, gets a address right away.
Ive tried it on a couple of different hardwares running dhcp servers, same behaviour. its like Im missing a stupid thing.
ether1 is on its own, not part of a bridge. tried unchecking peer DNS, and peer NTP, and tried enabling/disabling Default Route. weird. must be something obvuious Im missing.
please help!
An export of the config would be helpful:
/export file=anynameyoulike
Remove serial and any other private info, post between Preformatted text tags by using the </> button.
# 2025-09-11 12:20:43 by RouterOS 7.19.6
# software id = J95K-PZ6W
#
# model = E50UG
# serial number = xxxx
/interface bridge
add admin-mac=F4:1E:57:7A:E6:73 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1 use-peer-dns=no \
use-peer-ntp=no
add add-default-route=no allow-reconfigure=yes comment=bla interface=ether1 \
use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Pleease use code tags instead of direct "< pre >" ones.
There are a lot of usefull buttons in the edit window.
Config seems fine...what is the status of the interface? Is the negotiation succesful?
interface shows that ether1 is R=Running. I see odd numbers flashing up in Tx & Rx bps but mostly these are at 0.
How can I look further into negotiation? are there logs?
I usually check status of the interface with Winbox.
You could activate dhcp debug logging to get some more insights.
OK, gotcha. found it. status shows Auto-negotiation "DONE"
I think this just means it has connected OK at the physical level.
dhcp still shows searching...
I am using primarily winbox as the user interface.
I added another DHCP client, default settings, but this time I put it on the bridge interface (which bridges ether2-5).
it went to "bound" straight away. - which is to say, it got a dhcp address as expected.
WHAT is going ON?!
I mean the Howto's describe using these RouterOS boards as internet routers, by configuring the WAN port alone as DHCP (if your ISP does that rather than PPPoE)
Maybe you plugged your cable into the wrong port? ether5 for example, instead of ether1? 
Look in the Interface -> Ethernet table in WinBox and see which ports are marked as Running (R).
checked double checked and triple checked. starting to seem like I have a low level gremlin in one of my hex's:
fortunately I have 2 (ultimate aim was a project to use them with zerotier tunnelling)
same configuration:
# 2025-09-26 23:13:11 by RouterOS 7.19.6
# software id = J95K-PZ6W
#
# model = E50UG
# serial number = xxxxxx
/interface bridge
add admin-mac=F4:1E:57:7A:E6:73 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/certificate settings
set builtin-trust-anchors=not-trusted
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
/ip dhcp-client
add comment="uplink on port marked Internet" interface=ether1
add comment="testing client on bridge(2-5)" interface=bridge
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/system identity
set name=tris-hex-2
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
I load (restore from backup) that in to hex 'A' and it works as expected (can get a DHCP bind almost instantaneously on ether1 or on the bridge by any of the ethers2-4 (I have my laptop plugged in on eth5)
I load same thing in to hex 'B', (which is the unit Ive been working on hitherto) and it will get a dhcp bind on the bridge via ethers2-4, but never gets a bind using ether1.
I have tried another bridge with only ether1 on it, and putting the dhcp client on that bridge - no bind
it seems like there is something wrong with that port. the port goes into R state when it has a cable connected, the telltale LED on the hex illuminates.
I cannot detect the hardware with winbox when I plug in to ether1, but that behaviour applies to my "good" hex 'A' also...
I will try hardware resets and go again....
I have reset both hEX units to default config (power off, reset button in, power on holding reset, when USR light starts flashing release reset)
from default config, I winbox'ed in and removed default config
then went in with bare MAC
uploaded same config (restore from backup file) (pasted in post above) to both
one of them will dhcp bind on ether1
the other one will not.
must be a duff unit - any other tests I can run on the port to confirm this suspicion?
I note that the backup is a different animal to the /export config (which appears to be a script) - is there any material difference between the usage of a script and a backup file?
Have you restored binary backup to two different devices?
If yes, then it could be a problem as binary backup could have changed MACs of interfaces.
Never do not restore binary backup to another device. Rule #17 of GP & CSA for Mikrotik devices
Yes - I did restore the backup file which I made from one Hex to a second physical Hex.
I can read this file in textpad and it doesnt look like a true binary file but I guess this is what you are talking about (there is not any optiond for filetype when taking a backup in winbox)
Can I "fix" any possible damage here (eg MAC rewrite) by hardware reset?
what is the correct procedure for copying a configuration on one unit to another in order to eliminate suspect hardware bug?
Text export is the best solution
- export configuration
- check it for devices's dependend data and get rid of it: especially MACs.
- reset target device with no default configuration
- import line by line / block by block exported configuration
Search forum for import/export as it is not a trivial task for beginners with no experience what order of CtrlC+CtrlV should be used, however your configuration is quite short and should be easy to copy/paste.
Start here: Can I import my settings to another mikrotik? or Migrate config to new Mikrotik box
PS. Hardware reset clean the unwanted data. Netinstall too.
Are you saying you have tried with the standard defconf with no changes? I don't have a E50UG, but I do have an RB760iGS and its default config has a dhcp client configured on ether1, I would expect the same on the E50UG in defconf state.
Your config shows this:
What are you expecting to happen when you have both a static ip assigned to the bridge interface as well as telling it to obtain an IP address for the bridge via the dhcp-client?
Are you connected to two separate dhcp servers?
Please try with just the defconf and see if ether1 gets an ip address from the upstream router (with dhcp server) that you connect ether1 to.
this is a great idea that I have totally overlooked. so Thanks!
I have now tried exactly as you suggest.
confirm, the defconf after hardware reset provides a dhcp client on ether1, and on my "A" hEX, it "works" as expected: I connect ether1 to my domestic router's switch, and the client goes from stopped, briefly searching and then bound.
on the other hEX; my "B" unit, same factory-defaulted hardware & therefore configuration, it does not "work": when I connect ether1 to my router, the dhcp client goes from stopped to searching, and remains in that status for.... 20 minutes anyway.
I didn't think about this any further than "stick on a dhcp client somewhere else to see what happens"; and it seemed to me a valid test - on my suspect hEX (my 'B' unit), as I indicate in previous post, this dhcp client on the bridge gets a bind but the dhcp client on ether1 refuses to bind.
on my other 'A' hEX, the dhcp on the bridge will bind, and so will the dhcp client on ether1. Yes OK, the static IP on the bridge plus a dhcp assignment is clearly not the best idea for anything further, but I don't intend it to be.
I should reiterate probably: my overall aim here is to utilise 2x mikrotik hEX in conjunction with zerotier to tunnel my LAN across the country for a wider ham radio project. hEX 'A' will become my main internet router at FTTP location 'A', and probably hex B will become similar at location B on an ADSL line. but I will only have a few days at location B, so I need to design for fallback case where I just hang hex B off the DSL router's switch and give myself a separate tunelled LAN at location B in addition to the LAN that is provided straight off the ADSL router.
Agreed, you have been woefully silent on the requirements. The first post vaguely talks about playing around.
A. Draw a network diagram labelled so we know traffic flow intentions and equipment involved.
B. Identify user(s)/device(s) including admins at both locations
C. Identify traffic they need to execute
D. Detail the WANS, single/dual, public IP/Private IP and any special traffic flowing through them
E. Detail any desires for secure traffic ( for example VPN to access either router from the other location as well as from any remote location (hotel, cafe etc.)
Provide both full confgs
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys )
actually a big part of getting the hex's was just to play around for self-education. I started using cAPs to give a few customers reliable APs for mobile 4G internet installations and like the mikrotik system so much I thought I should get in more.
this project was a good way "in".
The emphasis is on learning as much as the overall functional aim.
I will condense my project into a diagram etc when I have a moment.
thanks all.