Newbie following Capsmanguide - cant get it to work

Scoobie2002 · October 14, 2025, 2:52pm

I have been trying a lot lately to get things working in my Mikrotik setup. Thanks to truely devoted help here, i succeeded in these quests. I have learned to listen better and read very exactly what is being said. So when i decided to get Capsman working in my setup (Hex with two -will be three- connected WAP AX'es) i decided to do so exáctly as the instruction tells me. I used the video of MikrotikMasters in which they explain step by step how to configure the devices. As i ultimately am only using three WAP AX'es, i don't need a Switch; so i decided to first only use 1 WAP AX on port 5 and learn how to add the other two on port 3 and 4 in a later stadium. So oke, álmost excatly as in the video. The Hex poe port1 is connected to my home network.

After fully taken the steps to configure the Hex, i could only ping on my TEST-PC and not visit any website. As that would indicate a DNS problem i changed the DNS in the DHCP setting from 10.0.10.1 (server adress) to 8.8..8.8. :

/ip dhcp-server network
add address=10.0.10.0/24 dns-server=8.8.8.8 gateway=10.0.10.1

After this change i had internet and could visit websites. Why wouldn't my Hex poe serve out Adresses and be a DNS server? I did check the box that says external requests are allowed...

My Hex Poe config:

# 2025-10-14 15:36:07 by RouterOS 7.19.6
# software id = 95K1-GQ8Y
#
# model = RB960PGS
# serial number = 123456789
/interface bridge
add frame-types=admit-only-vlan-tagged name=lan-bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name="ether1 WAN"
set [ find default-name=ether2 ] name="ether2 TEST PC"
set [ find default-name=ether5 ] name="ether5 SWITCH"
/interface vlan
add interface=lan-bridge name=vlan10-MGMT vlan-id=10
add interface=lan-bridge name=vlan20-CORP vlan-id=20
add interface=lan-bridge name=vlan30-GUEST vlan-id=30
/interface wifi channel
add band=5ghz-ax frequency=5180 name=5GHZ::CH36 width=20mhz
add band=5ghz-ax frequency=5200 name=5GHZ::CH40 width=20mhz
add band=5ghz-ax frequency=5220 name=5GHZ::CH44 width=20mhz
add band=5ghz-ax frequency=5240 name=5GHZ::CH48 width=20mhz
add band=5ghz-ax frequency=5745 name=5GHZ::CH149 width=20mhz
add band=5ghz-ax frequency=5765 name=5GHZ::CH153 width=20mhz
add band=5ghz-ax frequency=5785 name=5GHZ::CH157 width=20mhz
add band=5ghz-ax frequency=5805 name=5GHZ::CH161 width=20mhz
add band=5ghz-ax frequency=5825 name=5GHZ::CH165 width=20mhz
add band=5ghz-ax disabled=no frequency=5180,5200,5220,5240 name=5GHZ::UNII-1 \
    width=20mhz
add band=5ghz-ax disabled=no frequency=5745,5765,5785,5805,5825 name=\
    5GHZ::UNII-3 width=20mhz
add band=5ghz-ax disabled=no frequency=\
    5180,5200,5220,5240,5745,5765,5785,5805,5825 name=5GHZ::NON-DFS width=\
    20mhz
add band=2ghz-ax frequency=2412 name=2GHZ::CH1 width=20mhz
add band=2ghz-ax frequency=2437 name=2GHZ::CH6 width=20mhz
add band=2ghz-ax frequency=2462 name=2GHZ::CH11 width=20mhz
add band=2ghz-ax disabled=no frequency=2412,2437,2462 name=2GHZ::AUTO width=\
    20mhz
/interface wifi datapath
add disabled=no name=datapath-corp vlan-id=20
add disabled=no name=datapath-guest vlan-id=30
/interface wifi security
add authentication-types=wpa2-psk disabled=no name=sec1-corp
add authentication-types=wpa2-psk disabled=no name=sec-guest
/interface wifi configuration
add channel=5GHZ::NON-DFS country=Portugal datapath=datapath-corp disabled=no \
    mode=ap name=cfg-5Ghz security=sec1-corp ssid=MM5ghz
add channel=2GHZ::AUTO country=Portugal datapath=datapath-corp disabled=no \
    mode=ap name=cfg2Ghz security=sec1-corp ssid=MM2ghz
add datapath=datapath-guest disabled=no mode=ap name=cfg-GUEST security=\
    sec-guest ssid=MM-GUEST
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=10.0.10.2-10.0.10.254
add name=dhcp_pool1 ranges=10.0.20.20-10.0.20.200
add name=dhcp_pool2 ranges=10.0.30.2-10.0.30.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=vlan10-MGMT lease-time=10h name=dhcp1
add address-pool=dhcp_pool1 interface=vlan20-CORP lease-time=10h name=dhcp2
add address-pool=dhcp_pool2 interface=vlan30-GUEST lease-time=10h name=dhcp3
/interface bridge port
add bridge=lan-bridge interface="ether2 TEST PC" pvid=10
add bridge=lan-bridge frame-types=admit-only-vlan-tagged interface=\
    "ether5 SWITCH"
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface bridge vlan
add bridge=lan-bridge tagged="ether5 SWITCH,lan-bridge" untagged=\
    "ether2 TEST PC" vlan-ids=10
add bridge=lan-bridge tagged="ether5 SWITCH,lan-bridge" vlan-ids=20,30
/interface wifi capsman
set ca-certificate=auto certificate=auto enabled=yes interfaces=vlan10-MGMT \
    package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifi provisioning
add action=create-enabled disabled=no master-configuration=cfg-5Ghz \
    slave-configurations=cfg-GUEST supported-bands=5ghz-ax
add action=create-enabled disabled=no master-configuration=cfg2Ghz \
    slave-configurations=cfg-GUEST supported-bands=2ghz-ax
/ip address
add address=10.0.10.1/24 interface=vlan10-MGMT network=10.0.10.0
add address=10.0.20.1/24 interface=vlan20-CORP network=10.0.20.0
add address=10.0.30.1/24 interface=vlan30-GUEST network=10.0.30.0
/ip dhcp-client
add default-route-tables=main interface="ether1 WAN"
/ip dhcp-server network
add address=10.0.10.0/24 dns-server=8.8.8.8 gateway=10.0.10.1
add address=10.0.20.0/24 dns-server=10.0.20.1 gateway=10.0.20.1
add address=10.0.30.0/24 dns-server=10.0.30.1 gateway=10.0.30.1
/ip dns
set allow-remote-requests=yes
/ip firewall address-list
add address=192.168.3.0/24 list=ALLOWED
/ip firewall filter
add action=drop chain=input in-interface="ether1 WAN" src-address-list=\
    !ALLOWED
/ip firewall nat
add action=masquerade chain=srcnat out-interface="ether1 WAN"
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=ROUTER01

After this, i hoped to see my factory resetted WAP AX in port5 of the Hex in WInbox; i didn't - only the hex. In the video they did?! How? I tried to connect the WAP AX by its ethernetport 1 and also in its ethernetport 2 whilst still being in port 5 of the hex; both no luck.

The video is easy, clear and very well explained but it doesnt work in my situation. I have two questions:

why did i have to change the DNS as mentioned ?
why can't i see the WAP AX and the video guy could? How to solve this, i cant continue...

erlinden · October 14, 2025, 3:23pm

How did you come up with this firewall? If public facing it is…well, basically non existent.

Can you share the wAP AX config as well? It has to have vlan filtering enabled as well and the CAPS should be looking on vlan10-MGMT for its CAPsMAN.

In regards to the DNS question…the router doesn’t seem to have (a) DNS server(s) configured.

Scoobie2002 · October 14, 2025, 6:44pm

I would like it this way as i will move it to another network next week.

I can but it is the factory cleaned config - nothing in there that i changed - just freshly resetted to factory defaults. I imagine that i could still find the WAP AX in Winbox. I understand that i lack the knowledge as to why it isnt and i would love to learn why that is so. I understand i cant login to the WAP with an IP adress, but would think its MAC adress would show in winbox?

Isn't checking the allow-remote-requests=yes option designed to do that trick?

Thank you for your help. I'm trying to learn!

erlinden · October 15, 2025, 6:43am

If the router is public facing you are in trouble.

The wAP AX does need custom settings, as described in the tutorial you used (though they use cAP AX, the configuration is equal). It won’t work out of the box when in CAPS Mode. The settings (after resetting with no default config:

/interface bridge add name=LAN-bridge vlan-filtering=no
/interface vlan add name=vlan10::MGMT vlan-id=10 interface=LAN-bridge
/ip dhcp-client add interface=vlan10::MGMT

/interface bridge port add bridge=LAN-bridge interface=ether1
/interface bridge vlan add bridge=LAN-bridge vlan-ids=10,20,30 tagged=LAN-bridge,ether1
/interface bridge set LAN-bridge vlan-filtering=yes frame-types=admit-only-vlan-tagged

/interface wifi cap
set enabled=yes interfaces=all discovery-interfaces=vlan10-mgmt certificate=request

/interface wifi
set [ find default-name=wifi1 ] configuration.manager=capsman .mode=ap datapath.bridge=LAN-bridge disabled=no
set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap datapath.bridge=LAN-bridge disabled=no

You are nearly correct on the DNS part, by setting allow-remote-requests you can allow others to use the router as DNS server. BUT…your router has no DNS servers to connect to, so it is not able to resolve anything other then any static DNS entry.

What you can do to solve this:

/ip dns
set servers=8.8.8.8

holvoetn · October 15, 2025, 7:24am

Minor remark: it's not 100% equal.
wifi1 and wifi2 have different radios on wAP AX vs cap AX.
Also, wAP AX is able to use 160MHz channel, cAP AX not.

erlinden · October 15, 2025, 7:33am

(Ofcourse) you are absolutely right, @holvoetn. The commands on the CAPS are equal for wAP AX and cAP AX.

Scoobie2002 · October 15, 2025, 12:24pm

I added the dns server in its place as mentioned. After trying i still didnt have a connection. Besides adding the dns server i also had to alter my firewallrule to not drop established connections. After that the Hex works perfect! Thanks!!

So now i am trying to get the CAP - WAP AX setup. It seems that the code on the website is slightly different. Here the part with errors:

[admin@MikroTik] > /interface wireless cap
bad command name wireless (line 1 column 12)
[admin@MikroTik] > set enabled=yes interfaces=all discovery-interfaces=vlan10-mgmt
 certificate=request
syntax error (line 1 column 5)
[admin@MikroTik] > 
[admin@MikroTik] > /interface wifi
[admin@MikroTik] /interface/wifi> set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap datapath.bridge=lan_bridge disabled=no
input does not match any value of datapath.bridgeult-name=wifi2 ] configuration.manager=capsman .mode=ap datapath.bridge=lan_bridge disabled=no
[admin@MikroTik] /interface/wifi> set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap datapath.bridge=lan_bridge disabled=no
[admin@MikroTik] /interface/wifi> set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap datapath.bridge=lan_bridge disabled=no
[admin@MikroTik] /interface/wifi>

'wireless' doesnt exist in the WAP AX. In the Wifi tab i found the CAP button. I can enable CAP and i can set discovery-interfaces=vlan10-mgmt certificate=request. But i cant make out where to set interfaces=all?

Any clue here?

erlinden · October 15, 2025, 12:38pm

Yes...it seems there is an error in the commands I supplied (yes, copied them).
The correct statement is:

/interface wifi cap
set enabled=yes interfaces=all discovery-interfaces=vlan10-mgmt

For the underneath command, you would have to change the name of the bridge to LAN-bridge

/interface/wifi> set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap datapath.bridge=LAN-bridge disabled=no

I'll correct the supplied commands.

Scoobie2002 · October 15, 2025, 12:56pm

I tried to paste the first correction but i get an error:

[admin@MikroTik] /interface/wifi/cap> /interface wifi cap
[admin@MikroTik] /interface/wifi/cap> set enabled=yes interfaces=all discovery-interfaces=vlan10-mgmt
expected end of command (line 1 column 17)

I also notice that the certificate is no longer part of this commandline?

For the second part it looks like that Datapath and Coniguration first have to be set in Wifi. After that fact one can choose the made setting in Wifi1 and Wifi2. Although it seems to be like that?

erlinden · October 15, 2025, 1:31pm

Probably caused by a space...can you try again?

Certificate can be added later.

Scoobie2002 · October 15, 2025, 1:42pm

Still the same error? I can't see extra spaces?

savage · October 15, 2025, 1:47pm

[x@x] > /interface/wifi/cap set
caps-man-addresses caps-man-certificate-common-names caps-man-names certificate discovery-interfaces enabled lock-to-caps-man slaves-datapath slaves-static

There is no interfaces= option.

erlinden · October 15, 2025, 1:51pm

I'm making a mess of it...my appologies.

/interface wifi cap
set enabled=yes discovery-interfaces=vlan10-mgmt enabled=yes

We'll get there

Scoobie2002 · October 15, 2025, 2:18pm

i changed the vlan10-mgmt in VLAN::MGMT as that is the name used in the earlier code. And i removed the second enabled=yes ?

So datapath and config remain as well as the certificates...

@erlinden: don't appoligize.. just look at my earlier posts... i am very grateful

Scoobie2002 · October 15, 2025, 5:37pm

So i added the request, datapath and the config exactly as the website says and everything is working now!!!

Thank you very much for helping me out here. I really couldn't have done it without our help!