Rver wanting to use groovea 52ac and hap ac on poe port 5

vron · August 12, 2020, 11:10pm

Hi,
I’ve just setup my new grovea 52 ac and hap ac in my RV.
I want to be able to connect to rv park wireless at rv parks when I arrive.
I have set port 5 as wan and added port 1 to bridge on the hap ac.
Connected GrooveA 52 AC to port 5 poe out of Hap ac
Rebooted Hap ac
The Groove is setup in CPE router mode with default settings and works when attached to my laptop. I can connect to rv park wireless.
The problem is when I connect the groove to the hap ac. They can not see each other. In the box that shows other routers nothing shows up.
The hap is set up as dual home ap in router mode. I have read all posts from boaters wanting to do the same thing and they did not work for me. I probably did not follow them correctly. I am completely new to routers and routing. I Think that because both devices are on different subnets I need to setup ip routes and nat rules but I do not know how to do that. Could someone please review my configuration give suggestions if needed.
All help will be appreciated.

GrooveA 52 AC

# aug/13/2020 16:53:38 by RouterOS 6.47.1
# software id = X03D-UPPV
#
# model = RBGrooveGA-52HPacn
# serial number = A7D70B8A0BAC
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=\
    allowed name=profile1 supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=5ghz-a/n/ac channel-width=20/40mhz-XX \
    disabled=no frequency=auto mode=station-pseudobridge security-profile=\
    profile1 ssid=TengoInternet wireless-protocol=802.11
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=ether1 name=defconf
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=ether1 list=LAN
add comment=defconf interface=wlan1 list=WAN
add list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether1 network=\
    192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=wlan1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip route
add distance=1 dst-address=192.168.89.0/24 gateway=192.168.89.1
/system clock
set time-zone-name=America/Boise
/system identity
set name=Imgrut
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Hap AC

# aug/13/2020 18:29:16 by RouterOS 6.47.1
# software id = HQAL-CWFR
#
# model = RB962UiGS-5HacT2HnT
# serial number = C5610C4F6474
/interface bridge
add admin-mac=48:8F:5A:05:F5:1F auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    management-protection=allowed mode=dynamic-keys name=profile1 \
    supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] disabled=no frequency=auto mode=ap-bridge \
    security-profile=profile1 ssid=StarLord2G wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto \
    installation=indoor mode=ap-bridge security-profile=profile1 ssid=\
    StarLord5G wireless-protocol=802.11
/ip pool
add name=dhcp ranges=192.168.89.10-192.168.89.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add interface=ether5 list=WAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=sfp1 list=LAN
add interface=wlan2 list=LAN
add interface=wlan1 list=LAN
/ip address
add address=192.168.89.1/24 comment=defconf interface=ether2 network=\
    192.168.89.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether5
# DHCP client can not run on slave interface!
add disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
add address=192.168.89.0/24 gateway=192.168.89.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.89.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add distance=1 dst-address=192.168.88.0/24 gateway=192.168.88.1
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
add address=::224.0.0.0/100 comment="defconf: other" list=bad_ipv6
add address=::127.0.0.0/104 comment="defconf: other" list=bad_ipv6
add address=::/104 comment="defconf: other" list=bad_ipv6
add address=::255.0.0.0/104 comment="defconf: other" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=America/Boise
/system identity
set name=StarLord
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

w32pamela · August 15, 2020, 6:27pm

These steps are for the easy way to setup POE Out on port 5; (less typing for me)

Don’t add anything to the default firewall. The default is more than adequate for an RVer. Get the system working the simple way and then later after you have a working backup you can attempt any change you want to try.

Use Winbox.exe! Don’t use the Quick Set page for anything!
Reset configuration to defaults - System>Reset Configuration
Accept the default settings when you log back in the first time.
Go to New Terminal and enter "/export file=flash/default
Drag this file out of Winbox and drop it on your desktop. This is a good source for things like the firewall if you are going to set your configuration up from an unconfigured router.
The following steps will bridge port 1 to port 5 so either one functions as the WAN port.
Go to Bridge & add a bridge called bridge-wan.
Go to Bridge>Ports & delete ether5 from the bridge.
Add ports ether1 and ether5 to bridge-wan
Go to Interface List>Interface List and change WAN interface to bridge-wan.
Go to IP>DHCP Client and change the interface to bridge-wan
Log back in and Go to New Terminal and /export file=bridge-wan
Move bridge-wan.rsc from files to your computer and load it in a text editor like notepad or other basic text editor. You can use this file to change the IP’s from 192.168.88 subnet to 192.168.89 subnet and then import this file back onto your router. You must use a different subnet than the Groove uses.
Use your editor find function to locate every instance of “192.168.88” and change the “88” to “89”. Save your file making sure to retain the .rsc ending and drag & drop the saved file back into the “flash” folder in Files. You will need to delete the old version of “bridge-wan.rsc” before placing the new version in “flash”
15.Go to System>Reset Configuration. Check mark “No Default Configuration” and “Do Not Backup”. Open “Run After Reset” and select “flash/bridge-wan” then click “Reset Configuration”

If you’ve got everything correct with no typo’s etc then you should be able to use your Groove as you intended.

Your hAP configuration indicated that you were trying to set your router up as a bridge. This is usually best done from scratch as opposed to doing it from the default configuration.

The configuration above will give you a double NAT but this does not cause problems for the majority of boaters, RV’ers and home users.

vron · August 15, 2020, 8:57pm

Thank you so much for this solution w32 pamela. I went back to your previous posts and found that I had missed the import step. Most importantly my wife thanks you as I was driving her crazy with my obsession on trying to solve the router issue.

vron · September 9, 2020, 1:22am

This is solved as far as I am concerned.
Thanks.