I have a strong issue with configuration of my home network based on MikroTik RB5009UPr+S+In and cAP AX, especially I mean Wi-Fi configuration based on CAPsMAN. Configuration is quite easy, based on official material from MT help page, so do YT channel.
What I would like to hightly on the beginign is that, I made same configuration for some friends family, with similar devices, there were RB5009UPr, hAP AX2 and 3, cAP AX, hEX S, wAP AC, but also configure it for CCR2004.
So we have configuration of CAPsMAN on main router and rest of devices are working as AP’s, in cases hAP it had dual function.
What is my issue in comparison, to the fact same configs is that I have really poor signal of 2.4 and 5GHz Wi-Fi, in comparison to configs of my friends. Why I’m stating it is poor, because I just switched from Asus RT-AC88U, which has 4x4 MIMO Wi-Fi, that router hang on wall of my living room, cAP AX is exactly in the same place on the wall, maybe even a little bit higher, but…
Before Asus, had no issue with covering of whole flat with signal range, there were places with a little bit weaker, but stil stable (both 2.4GHz, so do 5GHz) and in worst case for 5GHz speed test on mobile phone gave me result like 250-300/150mbps.
Now after switch to Mikrotik, I have full 2.4GHz range only in living room, other rooms show 2-3 out of 4 (radio bar from W11, either Android phone) and I have white maps of range in my flat (devices, which connected before to Asus, can’t find Mikrotik network in the same standing place, here I mean for instance smart home devices like vacuum robot or air purifier). 5GHz network I sit on a couch in front of cAP AX and my laptop shows 3 out of 4 range bar and maximum speed is like 100/150mbps - really strange!! In other rooms I have completely no 5GHz network range!!
I’m must admit I’m a little bit confused, because I got really poor results here and can’t find out what might be the reason of it. It’s strange for me, because same config has friend of mine, which is living same block, same flat layout (~55m2 surface) and we are able to connect to his WLAN from block outside and my laptop also discover his 2.4GHz network (in my flat but can’t connect due to poor signal - but is like 20-30m over block).
Please look on my configuration and give me a tint, what might I do to improve my signal range and speed capacity?
I know it should be possible to get more, because as mine friend from block, I have same ISP, same tariff 600/300mps, in his flat over radio it was possible to achieve in speed test ~600/200 (I had his stuff in my flat for configuration and that time I got similar results) also over the cable (even with crappy tp-link switch by the way) I’m able to get 600/300mbps. So I’m really confused, what might be wrong with my setup, or maybe my cAP AX has kind of hardware issue and it causes this trouble, warranty replacement..?
cAP AX setup
# 2024-10-22 09:08:16 by RouterOS 7.16.1
# software id = 85FB-FT5S
#
# model = cAPGi-5HaxD2HaxD
/interface bridge
add comment="Local bridge" name=bridge_cap port-cost-mode=short
/interface ethernet
set [ find default-name=ether1 ] comment="ETH1 PoE-In from RB5009UPr+S+In"
set [ find default-name=ether2 ] comment="ETH2 PoE-Out to xXx"
/interface list
add name=LAN
/interface wifi datapath
add bridge=bridge_cap comment="Datapath to local bridge" disabled=no name=cap_datapath
/interface wifi
# managed by CAPsMAN
# mode: AP, SSID: fifrak_5G, channel: 5745/ac/Ceee
set [ find default-name=wifi1 ] comment="5GHz WLAN interface" configuration.manager=capsman .mode=ap datapath=cap_datapath disabled=no
# managed by CAPsMAN
# mode: AP, SSID: fifrak, channel: 2437/n/Ce
set [ find default-name=wifi2 ] comment="2.4GHz WLAN interface" configuration.manager=capsman .mode=ap datapath=cap_datapath disabled=no
/ip smb
set domain=FIFRAK
/interface bridge port
add bridge=bridge_cap comment="ETH1 PoE-IN to RB5009UPr+S+In" interface=ether1
add bridge=bridge_cap comment="ETH2 PoE-Out to xXx" interface=ether2
add bridge=bridge_cap comment="5GHz WLAN" interface=wifi1
add bridge=bridge_cap comment="2.4GHz WLAN" interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=!LAN
/ipv6 settings
set disable-ipv6=yes
/interface detect-internet
set detect-interface-list=all internet-interface-list=all lan-interface-list=all wan-interface-list=all
/interface list member
add comment="Local bridge" interface=bridge_cap list=LAN
/interface wifi cap
set caps-man-addresses=192.168.10.1 certificate=request discovery-interfaces=bridge_cap enabled=yes slaves-datapath=cap_datapath
/ip dhcp-client
add comment="DHCP client on local bridge" interface=bridge_cap
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge_cap type=internal
/system clock
set time-zone-name=Europe/Warsaw
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
RB5009UPr with CAPsMAN
# 2024-10-22 08:50:39 by RouterOS 7.16.1
# software id = P6E8-6DDC
#
# model = RB5009UPr+S+
/disk
set usb1 comment="240GB SSD driver on USB1" media-interface=none media-sharing=no
/interface bridge
add admin-mac=D4:01:C3:5E:93:13 auto-mac=no comment="Local bridge" name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment="ETH1 to switch"
set [ find default-name=ether2 ] comment="ETH2 to NAS"
set [ find default-name=ether3 ] comment="ETH3 PoE-Out to HA"
set [ find default-name=ether4 ] comment="ETH5 to "
set [ find default-name=ether5 ] comment="ETH5 to "
set [ find default-name=ether6 ] comment="ETH6 PoE-Out to cAP AX LAN1"
set [ find default-name=ether7 ] comment="ETH7 to "
set [ find default-name=ether8 ] comment="ETH8 to "
set [ find default-name=sfp-sfpplus1 ] comment="10G SFP+ WAN port" mac-address=50:46:5D:DF:CF:04
/interface wireguard
add comment=back-to-home-vpn listen-port=56597 mtu=1420 name=back-to-home-vpn
/disk
set usb2 media-interface=bridge media-sharing=yes smb-sharing=yes smb-user=guest
/interface list
add comment="WAN list" name=WAN
add comment="LAN list" name=LAN
/interface lte apn
set [ find default=yes ] comment="LTE APN configuration" name=lte_apn
/interface wifi channel
add band=5ghz-ac comment="Channel configuration for 5GHz AC - 5180 - 36, 5200 - 40, 5220 - 44, 5240 - 48, 5745 - 149" disabled=no frequency=5745,5240,5220,5200,5180 name=5ghz_channels skip-dfs-channels=10min-cac width=20/40/80mhz
add band=2ghz-n comment="Channel configuration for 2.4GHz N - 2412 - 1, 2437 - 6, 2462 - 11" disabled=no frequency=2462,2437,2412 name=2.4ghz_channel width=20/40mhz-Ce
/interface wifi datapath
add bridge=bridge comment="Datapath to local bridge" disabled=no name=datapath
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk comment="Security policy for WLAN" disabled=no ft=yes ft-over-ds=yes name=security_policy wps=disable
/interface wifi steering
add comment="2.4GHz roaming" disabled=no name=2.4ghz_roaming neighbor-group=dynamic-fifrak-3ee7adb3 rrm=yes wnm=yes
add comment="5GHz roaming" disabled=no name=5ghz_roaming neighbor-group=dynamic-fifrak_5G-3ee7adb3 rrm=yes wnm=yes
/interface wifi configuration
add channel=5ghz_channels comment="5GHz AC WLAN configuration" country=Poland datapath=datapath disabled=no mode=ap name=5ghz_ac_configuration security=security_policy ssid=fifrak_5G steering=5ghz_roaming
add channel=2.4ghz_channel comment="2.4GHz N WLAN configuration" country=Poland datapath=datapath disabled=no mode=ap name=2.4ghz_n_configuration security=security_policy ssid=fifrak steering=2.4ghz_roaming
/ip pool
add comment="DHCP server address pool" name=dhcp_pool ranges=192.168.10.100-192.168.10.200
/ip dhcp-server
add address-pool=dhcp_pool comment="Configuration of DHCP server" interface=bridge lease-time=3h name=dhcp_server
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/ip smb
set domain=FIFRAK
/interface bridge port
add bridge=bridge comment="Not active - 10G SPF+ WAN port" disabled=yes interface=sfp-sfpplus1
add bridge=bridge comment="2.5G ETH1 to switch" interface=ether1
add bridge=bridge comment="ETH2 to NAS" interface=ether2
add bridge=bridge comment="ETH3 PoE-Out to HA" interface=ether3
add bridge=bridge comment="ETH5 to " interface=ether4
add bridge=bridge comment="ETH5 to " interface=ether5
add bridge=bridge comment="ETH6 PoE-Out to cAP AX LAN1" interface=ether6
add bridge=bridge comment="ETH7 to " interface=ether7
add bridge=bridge comment="ETH8 to " interface=ether8
/ip neighbor discovery-settings
set discover-interface-list=!LAN
/ipv6 settings
set disable-ipv6=yes
/interface detect-internet
set detect-interface-list=all internet-interface-list=all lan-interface-list=all wan-interface-list=all
/interface list member
add comment="LAN interface on local bridge" interface=bridge list=LAN
add comment="WAN interface on SFP+ port" interface=sfp-sfpplus1 list=WAN
/interface wifi access-list
add action=accept comment="Accept strong signal" disabled=no signal-range=-90..120
add action=reject comment="Reject weak signal" disabled=no signal-range=-120..-91
/interface wifi capsman
set ca-certificate=auto certificate=auto enabled=yes interfaces=bridge package-path="" require-peer-certificate=no upgrade-policy=suggest-same-version
/interface wifi provisioning
add action=create-dynamic-enabled comment="Provisioning setup for 5GHz AC WLAN" disabled=no master-configuration=5ghz_ac_configuration name-format=%I_5GHz supported-bands=5ghz-ac
add action=create-dynamic-enabled comment="Provisioning setup for 2.4GHz N WLAN" disabled=no master-configuration=2.4ghz_n_configuration name-format=%I_2.4GHz supported-bands=2ghz-n
/ip address
add address=192.168.10.1/24 comment="Router address in LAN" interface=bridge network=192.168.10.0
/ip cloud
set back-to-home-vpn=enabled ddns-enabled=yes
/ip dhcp-client
add interface=sfp-sfpplus1
/ip dhcp-server network
add address=192.168.10.0/24 comment="Configuration of LAN" dns-server=192.168.10.1 gateway=192.168.10.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.10.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=192.168.10.0/24 comment="Acceptance router connection list" list=router_access_list
/ip firewall filter
add action=accept chain=input comment="Accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="Drop invalid" connection-state=invalid
add action=accept chain=input comment="Accept ICMP" protocol=icmp
add action=accept chain=input comment="Accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="Accept cAPs for CAPsMAN" dst-port=5246,5247 protocol=udp
add action=drop chain=input comment="Drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=input comment="LAN router acceptance" dst-port=8291,80 protocol=tcp src-address-list=!router_access_list
add action=accept chain=forward comment="Accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="Accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=Fasttrack connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="Accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="Drop invalid" connection-state=invalid
add action=drop chain=forward comment="Drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="Masquerade rule" out-interface=sfp-sfpplus1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=sfp-sfpplus1 type=external
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Europe/Warsaw
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set broadcast=yes enabled=yes multicast=yes
/system ntp client servers
add address=0.pl.pool.ntp.org
add address=1.pl.pool.ntp.org
add address=2.pl.pool.ntp.org
add address=3.pl.pool.ntp.org
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN