Help and Thanks in Advance

nutomikro · December 7, 2025, 12:53pm

Hello Everyone,

I recently was asked to look at a friends network setup. As his IT guy was giving him some problems. I am new to MikroTik and I understand the layout of system. I do see in Winbox Cube AP, Cube 1 , and Cube 2 that goes to the cAP ac into the house. Now in Winbox it shows ip address 192.168.88.X shown in the picture I provided. Now the real Ip is 10.1.100.X which all the ips are and I also pinged the ips of 10.1.100.X and they are reachable. I believe I had to turn my computer into a host ip like 192.XX.XX to change the cube pro. I just need to make sure. If I can fix this this I will setup in another location. I do like how these products work. Please see the pictures and any help I greatly appreciate it. Have a good day.

helipos · December 7, 2025, 1:33pm

Click on the mac address instead of the IP address. You can probably connect then.

jaclaz · December 7, 2025, 1:55pm

More info here on using Winbox to connect via MAC:

Usually Mikrotik devices (routers/AP's) have a default configuration that sets the LAN IP to 192.168.88.1.
Pre-paired Cubes normally have instead one 192.168.88.2 and one 192.168.88.3.
Single Cubes may have either 192.168.88.2 or 192.168.88.3

It is not clear from the picture and information you posted why you seem to have two devices with 192.168.88.3 (this is conceptually "wrong" but very likely harmless if the cube devices are set - as they normally are - as bridge [1]).

Still it is not a good idea to have duplicate IP's on a network.

It would be more logical to change the IP's of all the Cubes to addresses in the 10.1.100.0/24 so that they can be reached by normal browser connection (Webfig) from any PC on the LAN. The standard DHCP setting on Mikrotik is to start giving addresses starting from .10 (but some configs may start from .2), you could set it to give addresses in the range 10.1.100.10-10.1.100.254 and reserve:
10.1.100.1 for the router (as you already have it)
10.1.100.2 for the Cube AP (set as static address)
10.1.100.3 for the first cube (set as static address)
10.1.100.4 for the second cube (set as static address)
and still have available .5 to .9 for other possible (future) devices with static address.

[1] if they are, they operate at L2 level, i.e. use MAC addresses and the assigned IP's are only used to access the device itself, imagine that your Cubes are an unmanaged switch, which has no IP.

nutomikro · December 7, 2025, 2:41pm

I do see that the actual real ip is as follows: in Winbox it shows this. Not sure how to get the it switched from 192. to 10.0. thanks I do not see 192.168.88.1 only below in the picture. How do I fix this issue. Thanks again

Screenshot 2025-12-07 at 9.10.26 AM

jaclaz · December 7, 2025, 3:00pm

I am not sure to understand what you are saying, but on Mikrotik devices a same interface can have more than one IP, very likely from a network that is 10.1.100.0/24 you can only see addresses belonging to it, while in Winbox you will see only the "first" address (usually it is the lowest one, but this may vary depending on how the device is setup).

Anyway, you access the device through Winbox (using MAC), and then you change/assign the IP address of the LAN facing interface (on Cubes it should be the bridge).

https://visp.net/help_documentation/assigning-a-static-ip-address/

Check that the interface (the bridge) has not other addresses set and does not run a DHCP client.

nutomikro · December 7, 2025, 3:25pm

Ok thank you. When I did try to access using Mac or Ip on 192.168.88.2 it gives me an error

jaclaz · December 7, 2025, 4:56pm

Which error?
And "what" gives you the error?
Winbox?

The two connections methods (MAC vs. IP) are different, so they should give different errors (actually at least the MAC one should work without errors).

If you try to access the IP 192.168.88.x from a LAN device set to 10.1.100.x it is entirely possible that you have an error from the PC OS network stack, as 10.1.100.x is not normally reachable from a 192.168.88.x and viceversa.

nutomikro · December 7, 2025, 6:21pm

Hello thanks for the reply. When I try the ip 192.168.88.2 or the .3 through Winbox. I see the internet is working but when we connect to cap Ac in that location it shows the wifi but says internet not available

nutomikro · December 7, 2025, 6:23pm

Is there some where I can look to see why the cAp Ac shows no internet on 192.168.88.2 or .3 when the ip shows 10.1.100.60. I think this is where the problem is. to reassign the 192.168.88.x to the 10.1.100.x thanks

holvoetn · December 7, 2025, 6:24pm

Export config.

jaclaz · December 7, 2025, 6:25pm

Instructions here:

nutomikro · December 7, 2025, 6:49pm

I think I just the answer. you can not use hex to set the information. I have to set my ip on my pc for example since I see 192.168.88.2 as the cAP. and the cube pro 1 is 192.168.88.3 and also the cube pro is 192.168.88.3 which can cause a conflict. I need to set my ip on my pc to like 192.168.88.1 or 192.168.88.4 and I will be able to configure The Cap to make it work with my network is this correct? Thanks again for your guys help.

jaclaz · December 8, 2025, 12:42pm

It is difficult to follow you.

Does Winbox connect to the devices correctly (via MAC)?

If yes, connect to the device and change their addresses as per the instructions posted here:

What is not clear in them?
If there is something that you don't understand, ask.

Maybe you want to try doing it in two phases:

ADD an address to the bridge (leaving the current one as is)
if everything works as expected, then remove the old address

nutomikro · December 8, 2025, 1:09pm

Hello,

Thanks everyone for replying and helping me figure this out. With winbox through the wifi I can connect to the hEx using the mac address. But i see the cubes 192.168.88.2, .3 and .3. I can not connect to the 192.168.88.2, 3.3 IP’s. Do i have to directly connect using a ethernet cable on the router and change my ip on my to say 192.168.88.4 to actually connect to the cubes? Please advise. I’m not sure what the previous IT guy did I am still figuring this out. It should of been plug and play but it says not internet when i go to the location in the house but it works everywhere else on the property. Thanks again.

jaclaz · December 8, 2025, 1:25pm

On a normally configured network (and devices) Winbox can connect via MAC to any device it can list.
So in winbox if you click on the MAC numebr near the 192.168.88.2 and 192.168.88.3 you see you should be able to connect to the devices regardless of the IP.

Connection through IP is only possible if the PC has an address in the relevant subnet.
Also on the PC you can normally ADD (not change/replace) an IP address to the network card.

Normally you wouldn't use wi-fi to connect to devices that are not fully configured.

There must be an ethernet cable that connects the hex to another device.

Simply take it out of the hex and connect it to your pc or - if you have more ports in a bridge on the hex, connect your PC to one of these ports.

What you call "Cube AP" is a Cube SA?
https://mikrotik.com/product/cubesa_60pro_ac
And then you have two Cube Pro's connected to it wirelessly?
https://mikrotik.com/product/cube_60pro_ac

Or something else?
You posted a picture of a cAP AC:
https://mikrotik.com/product/cap_ac

If you could post a simple diagram of your network (a picture of a hand drawn one will do) showing how the devices are connected it will help.

Also, since you can connect to the hex, start by posting the configuration of the hex.

nutomikro · December 8, 2025, 2:53pm

Thanks Jaclaz they are wireline pro cube one outisde house the other wireline cube pro is on a another building.cap ac is inside the house. Thats the cube ap to cube 1 one building thenn goes to cube 2 another house and capac is inside the house connected to cube 2. Hope this helps. I will direct connect to the hex router and change my pc ip address to 192.168.88.4 should work correct? The ill be able to program the cubes to the 10. 1.100.x instead of 192.168.88.x . Thanks

nutomikro · December 8, 2025, 5:17pm

Here is the diagram

nutomikro · December 8, 2025, 5:22pm

Sorry for the delay here is the export of the config. 

# dec/08/2025 12:05:49 by RouterOS 6.48.6
# software id = 
#
# model = RB760iGS
# serial number = 
/interface bridge
add name=LAN
/interface ethernet
set [ find default-name=ether4 ] disabled=yes name="ether4 WAN (T--Mobile)"
set [ find default-name=ether5 ] name="ether5 WAN (Comcast)" poe-out=\
    forced-on
/interface list
add name="WAN List"
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=10.1.100.10-10.1.100.254 ranges=10.1.100.10-10.1.100.254
/ip dhcp-server
add address-pool=10.1.100.10-10.1.100.254 disabled=no interface=LAN \
    lease-time=1d name=10.1.100.10-10.1.100.254
/ppp profile
add name=RWB_sstp_profile
add comment=Speedtest_Profile name=speedtest_profile rate-limit=100M/100M \
    use-encryption=no
/interface sstp-client
add connect-to=65. name=sstp-out1 password= pfs=yes \
    profile=default-encryption user=
/snmp community
add addresses=::/0 name=
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
    sword,web,sniff,sensitive,api,romon,dude,tikapp"
/interface bridge port
add bridge=LAN interface=ether1
add bridge=LAN interface=ether3
add bridge=LAN interface=ether2
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface list member
add interface="ether5 WAN (Comcast)" list="WAN List"
add interface="ether4 WAN (T--Mobile)" list="WAN List"
/ip address
add address=10.1.100.1/24 interface=LAN network=10.1.100.0
/ip arp
add address=10.1.100.148 interface=LAN mac-address=04:
add address=10.1.100.60 interface=LAN
add address=10.1.100.14 interface=LAN mac-address=04:
add address=10.1.100.60 interface=ether2 mac-address=04
/ip cloud
set ddns-enabled=yes ddns-update-interval=1m
/ip cloud advanced
set use-local-address=yes
/ip dhcp-client
add default-route-distance=50 disabled=no interface="ether5 WAN (Comcast)"
add default-route-distance=20 interface="ether4 WAN (T--Mobile)"
/ip dhcp-server lease
add address=10.1 mac-address=04:CE: server=\
    10.1.100.10-10.1.100.254
/ip dhcp-server network
add address=10.1.100.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=10.1.100.1 \
    netmask=24
/ip dns
set servers=9.9.9.9,8.8.8.8
/ip firewall filter
# no interface
add action=accept chain=input comment="Allow Remote Winbox" in-interface=*B
/ip firewall mangle
add action=mark-connection chain=output dst-address=4.2.2.2 \
    new-connection-mark=trk-mrk passthrough=yes
add action=mark-routing chain=prerouting connection-mark=trk-mrk \
    new-routing-mark=trk-bckp passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list="WAN List"
add action=dst-nat chain=dstnat comment=\
    "Remote access to Arris modem via port 8080" dst-port=8080 protocol=tcp \
    to-addresses=192. to-ports=80
/ip route
add distance=1 gateway="ether5 WAN (Comcast)" routing-mark=trk-bckp
add comment=pri distance=1 gateway=73
add distance=1 dst-address=172. gateway=192.168
add distance=1 dst-address=172. gateway=192.168
add distance=1 dst-address=192. gateway=10.1.
add check-gateway=ping distance=1 dst-address=192.168 gateway=\
    10.1.
add distance=1 dst-address=192.168.gateway=10.1.
add distance=1 dst-address=202.163.gateway=73.
/ip service
set telnet disabled=yes port=102
set ftp disabled=yes
set www disabled=yes port=1080
set ssh disabled=yes
set api disabled=yes
set winbox port=1091
set api-ssl disabled=yes
/snmp
set enabled=yes trap-community=c0
/system clock
set time-zone-name=America/New_York
/system identity
set name= hEX  "
/system package update
set channel=long-term
/system scheduler
add comment=RWB_IP_RESOLVER interval=5m name=RWB_IP_RESOLVER on-event=\
    RWB_IP_RESOLVER policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=oct/14/2022 start-time=05:09:53
/system script
add comment=RWB_IP_RESOLVER dont-require-permissions=no name=RWB_IP_RESOLVER \
    owner=L policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
    global RWBDNSIP value=[/resolve myip.opendns.com server=resolver1.opendns.\
    com]"
/tool netwatch
add down-script="ip route enable [find comment=pri]" host=4.2.2.2 interval=\
    30s up-script="ip route enable [find comment=pri]"
/user aaa
set default-group=full

nutomikro · December 8, 2025, 5:52pm

Hi JacLaz,

I tried to connect to the cube 192.168.88.2, 192.168.88.3, 192.168.88.3 and all say unreachable. I also changed my ip on my computer to 192.168.4 and still said unreachable. Thanks for any help

jaclaz · December 8, 2025, 6:19pm

So it is a hex S (not that it changes anything).

Its configuration is - let's say - "peculiar", but as long as it works for you, it is fine, though there are more than a few things I would review, besides those related to your issues with connection, and it would be a good thing to update to latest stable version of the v6.x.

In any case it runs a dhcp server on the LAN bridge with IP 10.1.100.1 (ether1,2,3) giving out addresses in the range 10.1.100.10-10.1.100.254.

You have a number of settings under /ip arp that may be part of the issue, temporarily disable them.

Your routes seem to me "a mess", but part of this impression may come from the way you anonymized the output.

Post the output of:
/ip route print
you don't need to (and shouldn't) anonymize the local addresses, they are not "personal data" and 10.0.0.0/8, i.e. 10.0.0.1 up to 10.255.255.254 and 192.168.0.0/16, i.e. 192.168.0.1 up to 192.168.255.254 are "bogons":
https://ipinfo.io/bogon
they are not on the internet and can be used by anyone on LAN.
For the actual public addresses use letters instead of partial IP's, i.e. "a.b.c.d" is more readable than "172." or "202.163."

Then, add (temporarily) an address to your LAN bridge, i.e.:
/ip address
add address=192.168.88.1/24 interface=LAN

And run again
/ip route print

a new route marked as DAC (Dynamic, Active, Connected) should appear with distance 0 for the 192.168.88.0/24 subnet.

This route should prevail, having a lower distance, over any (wrong) route you may now have pointing to 192.168.88.0/24 addresses.

And then you should be able from a PC with IP address 192.168.88.6/24 (aka 192.168.88.6 netmask 255.255.255.0) to ping/connect to devices with IP addresses 192.168.88.2 and 192.168.88.3.

You will probably have a conflict with the two devices with the same 192.168.88.3 address, simply remove power to the furthest device with that address and change the address of the nearest device to 192.168.88.5, then do the same for the duplicate 192.168.88.2 changing the nearest device to 192.168.88.4.

You should get to something like: