I have read a number of posts on this. I have a UB5009 router connected to a hap ax3 acess point by ethernet (= AP1). This is set to bridge mode - gateway is the router on 192.168.88.1.
Extending this wireless network is another hap ax3 (=AP2). it is not connected by ethernet, it cinnects wirelessly to the network.
Wireless acess to the internet is working.
I can upgrade AP2 no problem.
When I try to upgrade AP1 it times out. I can ping and DNs resolve from AP1. I need help to upgrade it.
My config for AP1 is shown below.
\
2024-06-16 07:27:11 by RouterOS 7.14.2
software id = XTHN-KIHA
model = C53UiG+5HPaxD2HPaxD
serial number = HFF098RJ21S
/interface bridge
add admin-mac=78:9A:18:CB:D2:01 auto-mac=no comment=defconf mtu=1500 name=
bridge port-cost-mode=short
/interface wifi
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac
configuration.antenna-gain=6 .country="United Kingdom" .mode=ap .ssid=
fa7b34m .tx-power=22 disabled=no security.authentication-types=
wpa2-psk,wpa3-psk .connect-priority=0
set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac
configuration.antenna-gain=6 .country="United Kingdom" .mode=ap .ssid=
fa7b34m .tx-power=22 disabled=no security.authentication-types=
wpa2-psk,wpa3-psk .connect-priority=0
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=yes interface=bridge lease-time=10m
name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=wifi1 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=wifi2 internal-path-cost=10
path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/interface detect-internet
set detect-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=ether1 list=WAN
/ip address
add address=192.168.88.2/24 comment=defconf interface=bridge network=
192.168.88.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
/ip dns
set allow-remote-requests=yes servers=192.168.88.1
/ip dns static
add address=192.168.88.2 comment=defconf name=router.lan
add address=159.148.172.226 name=upgrade.mikrotik.com
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
/ip route
add disabled=yes dst-address=0.0.0.0/0 gateway=192.168.88.1 routing-table=
main suppress-hw-offload=no
add comment="Default route" disabled=no dst-address="" gateway=192.168.88.1
routing-table=main suppress-hw-offload=no
add dst-address=0.0.0.0/0 gateway=192.168.88.1
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.88.1 routing-table=main
suppress-hw-offload=no
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=
33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/system clock
set time-zone-name=Europe/London
/system note
set show-at-login=no