No Connection to CAPsMAN

JPbarries · September 25, 2024, 11:32am

Hi all, as the title implies, when setting up a cap on CAPsMAN, I get an error message “no connection to CAPsMAN” I’m not sure if there is a firewall rule that might be blocking the traffic? I can ping the CapsMan router from the cap and visa versa. I’m at my ends here.

The Caps are directly connected to the router, from ether3-ether6

Any help would be greatly appreciated.

Router Config

# 2024-09-25 13:22:43 by RouterOS 7.15.3
# software id = 7UAI-U0HI
#
# model = RB5009UG+S+
# serial number = 
/caps-man channel
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=disabled \
    frequency=2412 name=2412 secondary-frequency=disabled tx-power=14
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=disabled \
    frequency=2437 name=2437 secondary-frequency=disabled tx-power=14
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=disabled \
    frequency=2462 name=2462 secondary-frequency=disabled tx-power=14
add band=5ghz-onlyac control-channel-width=20mhz extension-channel=XX name=\
    5Ghz reselect-interval=1h save-selected=yes skip-dfs-channels=no \
    tx-power=20
add band=2ghz-onlyn control-channel-width=20mhz extension-channel=disabled \
    frequency=2412,2437,2462 name=2.4Ghz secondary-frequency=disabled \
    tx-power=14
/interface bridge
add arp=proxy-arp name=Bridge-LAN
/interface ethernet
set [ find default-name=ether1 ] arp=proxy-arp name=ether1-WAN
set [ find default-name=ether2 ] name=ether2-LAN
set [ find default-name=ether3 ] name="ether3-Admin AP"
set [ find default-name=ether4 ] name="ether4-Hallway AP"
set [ find default-name=ether5 ] name="ether5-Blue AP"
set [ find default-name=ether6 ] name="ether6-Green_Orange AP"
set [ find default-name=ether8 ] name="ether8 - LTE Fail Over"
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1-WAN name=\
    "Internet In-Web Africa" use-peer-dns=yes user=********
/interface wireguard
add listen-port=13231 mtu=1450 name=Pepla_WG
/caps-man datapath
add bridge=Bridge-LAN client-to-client-forwarding=no local-forwarding=yes \
    name=Internet
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm \
    group-key-update=40m name="WiFi Security"
/caps-man configuration
add channel=2.4Ghz channel.frequency=2412,2437,2462 country="south africa" \
    datapath=Internet datapath.bridge=Bridge-LAN installation=indoor mode=ap \
    name="Config 2.4Ghz" rx-chains=0,1 security="WiFi Security" ssid=Pepla \
    tx-chains=0,1
add channel=5Ghz country="south africa" datapath=Internet datapath.bridge=\
    Bridge-LAN installation=indoor mode=ap name="Config 5Ghz" rx-chains=0,1 \
    security="WiFi Security" ssid="Pepla 5G" tx-chains=0,1
/interface list
add name=LAN
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha512
/ip pool
add name=DHCP-LAN ranges=192.168.0.11-192.168.0.239
/ip dhcp-server
add address-pool=DHCP-LAN interface=Bridge-LAN lease-time=2d name=DHCP
/routing table
add comment="Table for WireGuard - JPB" disabled=no fib name=WG-Pepla
/caps-man access-list
add action=accept allow-signal-out-of-range=10s disabled=yes signal-range=\
    -85..120 ssid-regexp=""
add action=reject allow-signal-out-of-range=10s disabled=yes signal-range=\
    -120..-86 ssid-regexp=""
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled master-configuration="Config 2.4Ghz" \
    name-format=identity
add action=create-dynamic-enabled master-configuration="Config 5Ghz" \
    name-format=identity
/interface bridge port
add bridge=Bridge-LAN interface="ether3-Admin AP"
add bridge=Bridge-LAN interface="ether4-Hallway AP"
add bridge=Bridge-LAN interface="ether5-Blue AP"
add bridge=Bridge-LAN interface="ether6-Green_Orange AP"
add bridge=Bridge-LAN interface=ether2-LAN
/ip firewall connection tracking
set enabled=yes udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface l2tp-server server
set default-profile=default use-ipsec=yes
/interface list member
add interface=Bridge-LAN list=LAN
add interface="Internet In-Web Africa" list=WAN
/interface wireguard peers
add allowed-address=192.168.89.3/32 client-dns=192.168.0.1 interface=Pepla_WG \
    name="user1" persistent-keepalive=30s private-key=\
    "******************* public-key=\
    "*******************"
add allowed-address=192.168.89.2/32 client-dns=8.8.8.8 interface=Pepla_WG \
    name="user2" persistent-keepalive=30s private-key=\
    "*******************" public-key=\
    "*******************"
add allowed-address=192.168.89.4/32 interface=Pepla_WG name="User3" \
    persistent-keepalive=30s private-key=\
    "*******************" public-key=\
    "*******************"
add allowed-address=192.168.89.5/32 interface=Pepla_WG name="User4" \
    persistent-keepalive=30s private-key=\
    "*******************" public-key=\
    "*******************"
add allowed-address=192.168.0.6/32 interface=Pepla_WG name=\
    "User5" persistent-keepalive=30s private-key=\
    "*******************" public-key=\
    "*******************"
/ip address
add address=192.168.0.1/24 interface=Bridge-LAN network=192.168.0.0
add address=41.132.65.127 disabled=yes interface="Internet In-Web Africa" \
    network=168.210.4.66
add address=192.168.89.1/24 comment=Pepla_WG interface=Pepla_WG network=\
    192.168.89.0
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1 \
    ntp-server=154.73.32.1,154.73.32.2
/ip dns
set allow-remote-requests=yes servers=192.168.0.1
/ip firewall address-list
add address=154.73.32.0/22 disabled=yes list=iewc-ip4s
add address=165.16.200.0/21 disabled=yes list=iewc-ip4s
add address=192.168.0.0/24 disabled=yes list=MGMT-RANGES
add address=192.168.88.0/24 disabled=yes list=MGMT-RANGES
add address=192.168.0.0/24 list=Local-LAN
add address=192.168.89.0/24 list="WIRE GUARD"
/ip firewall filter
add action=accept chain=input comment=\
    "Allow: Established, Related, Untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="Drop Invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" disabled=yes \
    dst-address=127.0.0.1
add action=accept chain=input comment="WireGuard Handshake" dst-port=13231 \
    protocol=udp
add action=accept chain=input comment="Winbox Router Access" dst-port=8291 \
    protocol=tcp src-address=192.168.89.0/24
add action=accept chain=input comment="admin access" in-interface=Bridge-LAN \
    src-address=192.168.0.0/24
add action=accept chain=input comment="users services" dst-port=53 \
    in-interface=Bridge-LAN protocol=udp
add action=accept chain=input comment="users services" dst-port=53 \
    in-interface=Bridge-LAN protocol=tcp
add action=drop chain=input comment="drop all else"
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-mark=no-mark connection-state=established,related hw-offload=\
    yes
add action=accept chain=forward comment=\
    "Allow Established, Related, Untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="Drop Invalid" connection-state=invalid
add action=accept chain=forward comment="Internet Traffic" in-interface=\
    Bridge-LAN out-interface="Internet In-Web Africa"
add action=accept chain=forward comment="WireGuard to LAN" in-interface=\
    Pepla_WG out-interface="Internet In-Web Africa"
add action=accept chain=forward comment=\
    "Allow Local Subnet To Enter The WireGuard Interface" out-interface=\
    Pepla_WG src-address=192.168.0.0/24
add action=accept chain=forward disabled=yes dst-port=19001 protocol=tcp
add action=accept chain=forward comment="Port Forwarding" \
    connection-nat-state=dstnat disabled=yes
add action=drop chain=forward comment="Drop all else" connection-state=""
/ip firewall mangle
add action=accept chain=prerouting disabled=yes dst-address=192.168.0.0/24
/ip firewall nat
add action=masquerade chain=srcnat
add action=masquerade chain=srcnat comment="WireGuard NAT" disabled=yes \
    out-interface=Pepla_WG src-address=192.168.89.0/24
/ip firewall service-port
set tftp disabled=yes
set irc disabled=no
set h323 disabled=yes
set sip disabled=yes
/ip ipsec profile
set [ find default=yes ] dh-group=modp2048 enc-algorithm=aes-256 \
    hash-algorithm=sha512
/ip service
set ftp disabled=yes
/ppp secret
add disabled=yes name=vpn profile=*2
add disabled=yes name=JP profile=*2
/routing rule
add action=lookup disabled=no src-address=192.168.89.0/24 table=WG-Pepla
add action=lookup disabled=yes src-address=192.168.89.2/32 table=WG-Pepla
add action=lookup disabled=yes src-address=192.168.89.3/32 table=WG-Pepla
/system clock
set time-zone-name=Africa/Johannesburg
/system identity
set name="Core Router"
/system note
set show-at-login=no

Caps Config

# 2024-09-25 13:22:22 by RouterOS 7.15.3
# software id = 24LS-K6LZ
#
# model = RBcAPGi-5acD2nD
# serial number = 
/interface bridge
add admin-mac=48:8F:5A:38:73:B3 auto-mac=no comment=defconf name=bridgeLocal
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi
# no connection to CAPsMAN
add configuration.manager=capsman datapath=capdp radio-mac=48:8F:5A:38:73:B5
# no connection to CAPsMAN
add configuration.manager=capsman datapath=capdp radio-mac=48:8F:5A:38:73:B6
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
/interface wifi cap
set caps-man-addresses=192.168.0.1 certificate=request discovery-interfaces=\
    bridgeLocal enabled=yes slaves-datapath=capdp slaves-static=no
/ip dhcp-client
add comment=defconf interface=bridgeLocal
/system clock
set time-zone-name=Africa/Johannesburg
/system note
set show-at-login=no

mkx · September 25, 2024, 11:42am

Your firewall is quite strict at dropping anything not allowed. Which is good. But you have to allow capsman protocol. From a note in documentation for capsman v2 (the old wireless capsman):

Note: CAPsMAN uses UDP port 5246 for manager traffic and UDP port 5247 for data traffic

I didn’t find similar information for the new capsman (wifi version), it could use different protocol and/or ports … probably it doesn’t use port 5247 since the new capsman doesn’t support capsman forwarding.

erlinden · September 25, 2024, 12:24pm

add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" disabled=yes \
    dst-address=127.0.0.1

Sure this has to be disabled?

JPbarries · September 25, 2024, 12:31pm

Originally, I thought that this rule needs to be disabled as the Router itself, doesn’t have WiFi capabilities and doesn’t possess WiFi interfaces. Unless I misunderstood that xD

mkx · September 25, 2024, 12:31pm

If CAP and CAPsMAN are different devices, then they won't communicate using address of 127.0.0.1 (neither of them) ... hence this rule doesn't apply.

Or is it? If CAPsMAN communicates with itself (another process perhaps), then it might use 127.0.0.1 ... @JPbarries, try to enable the rule and see if that makes any difference. My bet would still be the UDP port 5246, mentioned in my previous post, but can't find the rule which would either allow it or drop it (there's one which allows everything through bridge-IN and with corresponding src-address, so that one should allow it).

JPbarries · September 25, 2024, 12:48pm

Doesn't seem as if any traffic is hitting that rule. If you could perhaps guide me on how to create the rule that uses the specified ports in your previous post please.

I'm guessing it's an input rule with protocol upd and src. port to be 5246,5247

erlinden · September 25, 2024, 12:48pm

You are absolutely right, @mkx!

Checked everything (I could), I doubt if this rule is correct:

add action=accept chain=input comment="admin access" in-interface=Bridge-LAN \
    src-address=192.168.0.0/24

Can you, at least as a test, remove the in-interface?

JPbarries · September 25, 2024, 12:52pm

@erlinden.

Thanks for your response

I’ve disabled that rule, not quite sure what the purpose of this rule was. I was instructed from one of my other posts to have that rule created. However, the Cap still states " no connection to CAPsMAN" after I disabled the admin access rule.

erlinden · September 25, 2024, 12:58pm

By disabling the accept rule is disabled (and it is no longer accepting traffic). Instead, enable it and remove the in-interface. Again…just for testing. You can enable logging to see which traffic is passing that rule.

JPbarries · September 25, 2024, 1:10pm

@erlinden

I’ve removed the in-inteface, but the Cap still states “no connection to CAPsMAN” I even reset the CAP again to make sure

erlinden · September 25, 2024, 1:24pm

Aaah…sorry it took me this long
You have the wireless package installed and are configuring the old CAPsMAN:

/caps-man

Remove the wireless package, it’s useless.

Then, follow the guide:

#create a security profile
/interface wifi security
add authentication-types=wpa3-psk name=sec1 passphrase=HaveAg00dDay
 
#create configuraiton profiles to use for provisioning
/interface wifi configuration
add country=Latvia name=5ghz security=sec1 ssid=CAPsMAN_5
add name=2ghz security=sec1 ssid=CAPsMAN2
add country=Latvia name=5ghz_v security=sec1 ssid=CAPsMAN5_v
 
#configure provisioning rules, configure band matching as needed
/interface wifi provisioning
add action=create-dynamic-enabled master-configuration=5ghz slave-configurations=5ghz_v supported-bands=\
    5ghz-n
add action=create-dynamic-enabled master-configuration=2ghz supported-bands=2ghz-n
 
#enable CAPsMAN service
/interface wifi capsman
set ca-certificate=auto enabled=yes

JPbarries · September 25, 2024, 1:48pm

@erlinden

I thought that it might have been something in line with this. As our previous router (hAP ac2) -whch did work with the existing CAPS, even after I’ve upgraded the RouterOS 6 to 7 - was replaced with the RB5009UG+S+. and now that I want to configure CAPsMAN again, I started running into these issues. I’ve set for uninstall. Just need to wait for everyone to leave the office before I can restart the router

But thanks to you and mkx for your continued support. I will attend to this and revert back

holvoetn · September 25, 2024, 2:23pm

As a side note:
whenever you change something in firewall rules, clear connections table or restart.
Or it might take a while before you see the effect.

But wireless/wifi-qcom confusion is going to be the winner here.
As of ROS7.13, you don’t even need to load wifi-qcom driver anymore for capsman controller.
Those hooks are there by default in base ROS package.

erlinden · September 25, 2024, 2:26pm

The reboot is not necessary for implementing CAPsMAN, it’s just for clean up purposes.
Do you still have the config of the hAP ac2? Then it would be sufficient to just import the /interface wifi part of that device (ewxcepot for any local config).

JPbarries · September 26, 2024, 6:54am

I do, however the RouterOS is still that of 6.49.17.

I also did change the config as you suggested, however, the CAP is still not able to see the capsman. Still getting no Connection to CapsMan, unless I did something wrong

#create a security profile

Flags: X - disabled 
 0   name="WiFi Sec" authentication-types=wpa2-psk,wpa3-psk passphrase="test123"

#create configuraiton profiles to use for provisioning

Flags: X - disabled 
 0   name="2.4Ghz" ssid="Pepla" country=South Africa security=WiFi Sec 
     security.authentication-types=wpa2-psk,wpa3-psk .passphrase="test123" 

 1   name="5Ghz" ssid="Pepla 5G" country=South Africa security=WiFi Sec 
     security.authentication-types=wpa2-psk,wpa3-psk .passphrase="test123"

#configure provisioning rules, configure band matching as needed

Columns: ACTION, MASTER-CONFIGURATION
#  ACTION                  MASTER-CONFIGURATION
0  create-dynamic-enabled  5Ghz                
1  create-dynamic-enabled  2.4Ghz

#enable CAPsMAN service

[admin@Core Router] /interface/wifi/capsman> print
  enabled: no

EDIT: LOL, As I went through the steps again, as I didn't use the command in the terminal to do the setup, but rather used the User Interface (UI) I found that the CAPsMAN was enabled on the router as there was a tick box, but as I typed in the above code to get the response and to paste the results here, I saw that the CAPsMAN was disabled, but in the UI the tick box was marked. And then as soon as I ran the code to enable the CAPsMAN on the router, BOOM!! The CAP was able to identify the CAPsMAN!!! Thank you erlinden!!!

erlinden · September 26, 2024, 6:57am

Good find! You are very welcome, enjoy it!

jaclaz · September 26, 2024, 7:27am

So, if I get this right, the CAPSMAN appeared enabled in Winbox/Webfig while it was actually disabled in the actual (CLI/terminal) configuration?

It seems like a bug that can deceive/trick lots of people.

JPbarries · September 26, 2024, 7:57am

That is correct One of the reasons I started to pull my hair out of my head. But as I went through the terminal to retrieve the code to paste in my reply, I noticed that the terminal stated that the CAPsMAN was disabled. yet the UI said it was enabled. After enabling it in the terminal the CAP immediately started to register with the CAPsMAN.

Blaine0 · January 26, 2026, 7:24am

Apologies for “necroposting” but I just ran into this exact issue on a RB750Gr3 after updating from 7.20.x to 7.21.1 . After reboot CAPs would not connect. Winbox UI showed the CAPSMAN enabled, but /interface/wifi/capsman> print showed enabled: no . This was very frustrating. I lost a few hours on this until I found this thread. Thank you.

mkx · January 26, 2026, 1:23pm

Another necropost ...

The problem is, that the screenshot is from Wireless -> CAPsMAN -> CAP Interface -> Manager ... and is thus part of legacy capsman (with CLI path /capsman) ... and this thread is about setting up (and enabling) the new capsman, available from WiFi -> WiFI -> CAPsMAN (with CLI path /interface/wifi/...)

Both screens have almost identical fields, the order is slightly different ... so it's only too easy to confuse them. But window belonging to new CAPsMAN is titled "CAPsMAN". Not too different from the one from screenshot either.