From Estonia 
.
I ordered atl 5G modem and now thinking to update also wifi access point.
It will be shipped from Azurtem France 
Which mikrotik wifi router can also supply PoE ATL 5G R16 modem?
Currently have tp link Deco X50 5G and this loses internet connection or does not connect over wifi to clients. Waste of time and 
Do you connect your computers, phones, etc. through wifi or do you need ethernet (cable) connections too?
Hi,
I use like 12 or more wifi devices: tvbox, phone, laptops and 2,4 ghz air conditioner and other IoT switches + security camera over POE switch
Very likely you don't really need a "router", you can use an access point instead (Mikrotik access points are actually very good routers, but also your ATL is a router, besides a modem).
Which one to use depends a lot on what kind of coverage you want/need and the actual placement of the device.
The generic desktop/shelf ones are hap Ax2 or Ax3 (omnidirectional).
Ceiling the cap Ax (omnidirectional)
Wall (or desktop/shelf) the wap Ax (beam 180° or less).
If you only need 2.4 GHz the hap Ax Lite might do too, but it is a bit on the low side (but dirt cheap).
A lot, as said, depends on how large is the area to be covered, while 2.4 GHz has better penetration, nowadays - besides being slower - often receives a lot of interference, and 5 GHz has a lots of issues with penetrating walls, so often more than one AP is needed.
I thought that access point is also router. That ATL 5G R16 can be router, I didn't know.
Anyway, thinking that hAP ac3 hopefully do the trick.
2 floor concrete brick house
Think that need at least 2 AP for setup
The Ac3 Is the older model, the newer one is Ax3.
Ax3=Wi-Fi 6 or Ax1800
Ac3=Wi-Fi 5 or AC1200
If you are fine with the older one, likely you can find some used, though - since the hardware Is robust and Mikrotik devices are still supported - second hand devices tend to be relatively pricey.
I thought about new ax3.. Ac3 is typo
Yep, but the differences won't probably be noticeable on the internet bandwidth provided by an ATL, for internal transfers Is of course another thing.
I use hAP ax3 in a remote location with LHG LTE18 + a PiHole container running on ax3 - it can provide 15W and ATL 5G R16 consumes only 10W, so it would work.
The setup was done based on this video(LTE Passthrough + Management): https://www.youtube.com/watch?v=IZFAeLbujso
I use this on LHG LTE18: routeros-scripts/doc/mod/notification-telegram.md at main · eworm-de/routeros-scripts · GitHub
Redirects error logs and messages from the mobile operator to a Telegram chat group.
Looks like this is answer and solution!
Ordered Chateau Pro. H53UiG-5HaxQ2HaxQ
Chateau Pro is an even better option. Slightly more efficient power supply(ax3@24V, Chateau Pro@48V) to the antenna and better WiFi coverage(2 internal antennas[0 + 90 degrees], covering all around the router, at the router height level, and 2 external antennas that you can twist towards dead zones, like lower/upper floors).
Yes, thats what I thought.
Those are my first MikroTik products to buy and it takes time to understand everything about products.
Somewhere saw AP products timeliness and there was clearly visible that Chateau pro is newest and more powerful
These terms are often misused and mixed in daily communication between "mere mortals"
There are different functions of network devices, in principle (and very roughly) you might divide them into the following:
-Switches: Forwards ethernet frames (L2)
-Routers: Forwards and handles IP packets (L3)
-Wireless access points: Handles wireless connections
Many of Mikrotik's devices consist of a combination of these.
For instance the hAP ax3 (among a lot others) cover all 3.
When people talk about "wireless router", what they are after is not necessarily the routing function, but merely the wireless capabilities.
My only stupid question is then what is level 1?
I see items are shipped and currently in the Poland, half a way to
Hope to teach myself about network and rourlting.
MikroTik is a great way to learn about networking — they force you since there aren't a lot of wizards & for the most part RouterOS closely tracks internet standards so generally transferable to other vendors.
Most network standards loosely follow the "OSI Model", so at high level, layer 1 is the cable[/modulation].
https://en.wikipedia.org/wiki/OSI_model#Layer_1:_Physical_layer
with something like a web browser be at top at layer 7 (and HTML being level 6). On RouterOS, you're mainly dealing with layer 3 (IP address/etc) and layer 2 (ethernet frames/"VLANs"/LTE).
With the general idea that network standards don't cross the layers. So it means the IP address at layer 3 work with any layer 2 things like ethernet or LTE and IP layer 3 has no specific knowledge about whether it's ethernet or something else.
Good morning!
I received ATL 5G 16 and Chateau pro Ax.
Got them connected over winbox & Lan cable to pc. Pot modem to Lan5, because there is only PoE for modem.
Then changed ATL IP manually to 192.168. 88.30 match Chateau IP range and got them connected and configured WiFi AP.
Now ATL modem and Chateau connected to internet over modem and got updated to newest version but I can not access internet over wifi or Lan.
What I need to configure in inbox to get internet?
You will need to provide the configuration of BOTH devices, so that someone can have a look at them and (hopefully) spot the missing part(s).
Instructions here:
Good evening !
I copied scripts from both devices.
ATL 5G
/interface bridge
add name=bridge1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
add apn=internet.tele2.ee name=internet.tele2.ee use-network-apn=yes
/interface lte
set [ find default-name=lte1 ] allow-roaming=no apn-profiles=
internet.tele2.ee band="" nr-band=""
/ip pool
add name=default-dhcp ranges=192.168.188.10-192.168.188.254
/ip dhcp-server
add address-pool=default-dhcp disabled=yes interface=bridge1 name=defconf
/port
set 0 name=serial0
/queue type
add fq-codel-ecn=no kind=fq-codel name=fq-codel-ethernet-default
/queue interface
set ether1 queue=fq-codel-ethernet-default
/interface bridge port
add bridge=bridge1 interface=ether1
/interface list member
add comment=defconf interface=lte1 list=WAN
add interface=bridge1 list=LAN
/ip address
add address=192.168.88.30/24 comment=defconf interface=bridge1 network=
192.168.88.0
/ip dhcp-server network
add address=0.0.0.0/24 comment=defconf dns-server=0.0.0.0 gateway=0.0.0.0
netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.30 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes
ipsec-policy=out,none out-interface-list=WAN
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip upnp interfaces
add interface=bridge1 type=internal
add interface=lte1 type=external
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute"
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/routing settings
set single-process=yes
/system clock
set time-zone-name=Europe/Tallinn
/interface bridge
add admin-mac=xxxxxxxxxxx auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether5 ] name="ATL 5G"
/interface wifi
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac
configuration.country=Estonia .mode=ap .ssid=MikroTik-5G disabled=no
security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac
configuration.country=Estonia .mode=ap .ssid=MikroTik-2G disabled=no
security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
/interface ethernet switch
set 0 cpu-flow-control=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface="ATL 5G"
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
add mac-address=FE:E1:70:AF:A5:AE name=ovpn-server1
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
add address=192.168.88.30/28 interface=ether1 network=192.168.88.16
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute"
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/system clock
set time-zone-name=Europe/Tallinn
/system package update
set channel=testing
/system routerboard wps-button
set enabled=yes on-event=wps-accept
/system script
add comment=defconf dont-require-permissions=no name=wps-accept owner=*sys
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon
source="\r
\n :foreach iface in=[/interface/wifi find where (configuration.mode="a
p" && disabled=no)] do={\r
\n /interface/wifi wps-push-button $iface;}\r
\n "
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
There are multiple issues.
One of the main issues, on Chateau, you have:
/interface list member
add comment=defconf interface=ether1 list=WAN
The firewall rules are configured based on that list(WAN). Your antenna is connected to ether5, not ether1 - you need to change that to ether5.
Your Chateau DHCP Client is set like this:
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
The DHCP client should use ether5 or WAN, and be enabled(note disabled=yes).
You don't seem to have an LTE passthrough configuration on the antenna - you can either follow the YouTube video to setup LTE passthrough or leave it like this but enable DHCP server on the antenna.
If you don't setup LTE passthrough, it is recommended to setup the firewall rules on the antenna itself.
Without LTE passthrough, leaving the antenna to act as the internet firewall, you would need a setup similar to this(DHCP server on ATL, to assign an IP to Chateau):
/ip address add address=192.168.88.1/24 interface=ether1 comment="LAN to downstream"
/ip pool add name=lan-pool ranges=192.168.88.100-192.168.88.199
/ip dhcp-server add name=lan interface=ether1 address-pool=lan-pool lease-time=1h
/ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1
/ip dns set allow-remote-requests=yes
...
/ip firewall nat add chain=srcnat out-interface=lte1 action=masquerade comment="NAT LAN to LTE"
Saying all that, I would recommend to set it up for LTE passthrough though, based on the YouTube video - Chateau Pro has a more capable CPU to handle that part of the work. Just make sure to use ether5 on Chateau instead of ether1. Only ATL uses ether1 always, because it has only 1 ethernet port.
How I see it:
ether1 -> ether5 on Chateau, when referring to WAN(the cable/port through which the internet traffic is coming through)LTE passthrough mode(follow YouTube video)LTE passthrough and use ATL as a firewall/router)./ip dhcp-server network add address=192.168.1.0/24 gateway=192.168.1.1 dns-server=1.1.1.1
Looked at youtube to get idea about Winbox navigation
https://youtu.be/rwjtRLQjMjA
And Yes, thank You lilianmoraru, configured as You pointed out!
Hope that this thread helps anybody!
UPDATE!
First got relatively low internet speed: comparable with old huawei 4G B628 router.
Saw that there is constant switching between 5G and 4G.
Low signal, 5G signal lost many times.
Then from Mikrotik Youtube channel saw that there is separate firmware update for LTE modem also. Acessed over winbox menu, verified that there is modem upate, , and after this internet stable and DL speed up to 3 times higher! Havent made any antenna adjustment
Search Mikrotik Youtube channel & LTE !