Why Do I Constantly Have to Reboot cap AXs to Fix WiFi?

[helpmytik]

My Rb5009 is running CAPSman. I have 3 cap AXs in the home, one VLAN with a 2.4 and 5g bans, and another vlan with the same, different SSIDs. The 2.4g and 5g SSID devices are constantly loosing internet. I have to reboot them to fix. But, the other masked SSID continues to work fine. What's going on?

# 2026-06-13 12:48:14 by RouterOS 7.21.4
# software id = C86P-TNCF
#
# model = RB5009UG+S+
# serial number = XXXXXXXXXX
/interface bridge
add name=IOT.BRIDGE
add name=LAB.BRIDGE
add admin-mac=F4:1E:57:C1:XX:XX auto-mac=no name=LOCAL.BRIDGE
add name=MANAGEMENT.BRIDGE
/interface ethernet
set [ find default-name=ether1 ] comment="WAN[ATT]" l2mtu=1514
set [ find default-name=ether2 ] comment=CRS312.NON-POE.SW l2mtu=1514
set [ find default-name=ether3 ] comment=CRS328.POE.SW l2mtu=1514
set [ find default-name=ether4 ] comment=PI-HOLE.RASPI l2mtu=1514
set [ find default-name=ether5 ] comment=HOME.ASSISTANT l2mtu=1514
set [ find default-name=ether6 ] l2mtu=1514
set [ find default-name=ether7 ] l2mtu=1514
set [ find default-name=ether8 ] l2mtu=1514
set [ find default-name=sfp-sfpplus1 ] l2mtu=1514 mac-address=\
    28:25:5F:89:XX:XX
/interface sstp-client
add connect-to=64.227.XXX.XX name=XXX-XXXXXXX user=CONSULT
/interface wireguard
add comment=BTH-VPN listen-port=31135 mtu=1420 name=back-to-home-vpn
/interface vlan
add comment=IOT.VLAN interface=ether2 name=ether2-VLAN2000 vlan-id=2000
add comment=LAB.VLAN interface=ether2 name=ether2-VLAN3000 vlan-id=3000
add comment=MANAGEMENT.VLAN interface=ether2 name=ether2-VLAN4000 vlan-id=\
    4000
add comment=IOT.VLAN interface=ether3 name=ether3-VLAN2000 vlan-id=2000
add comment=LAB.VLAN interface=ether3 name=ether3-VLAN3000 vlan-id=3000
add comment=MANAGEMENT.VLAN interface=ether3 name=ether3-VLAN4000 vlan-id=\
    4000
/interface list
add name=WAN
/interface wifi channel
add band=2ghz-ax disabled=no name=2.4ghz width=20mhz
add band=5ghz-ax disabled=no name=5ghz width=20/40/80mhz
/interface wifi datapath
add bridge=LOCAL.BRIDGE disabled=no name=2.4ghz vlan-id=2000
add bridge=LOCAL.BRIDGE disabled=no name=5ghz vlan-id=2000
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes \
    name=2.4ghz
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes \
    name=5ghz
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=ADMIN-SSID
/interface wifi configuration
add channel=2.4ghz disabled=no mode=ap name=2.4ghz security=2.4ghz ssid=\
    2.4ghz
add channel=5ghz disabled=no mode=ap name=5ghz security=5ghz ssid=5ghz
add disabled=no mode=ap name=2.4ghz-ADMIN security=ADMIN-SSID ssid=\
    XXXXXX
add disabled=no mode=ap name=5ghz-ADMIN security=ADMIN-SSID ssid=\
    XXXXXX
/ip pool
add name=default-dhcp ranges=192.168.XX.XX-192.168.XX.XXX
add name=dhcp_pool1 ranges=192.168.XXX.X-192.168.XXX.XXX
add name=dhcp_pool2 ranges=192.168.XXX.X-192.168.XXX.XXX
add name=dhcp_pool3 ranges=192.168.XXX.X-192.168.XXX.XXX
add name=dhcp_pool4 ranges=192.168.XXX.X-192.168.XXX.XXX
/ip dhcp-server
add address-pool=dhcp_pool1 interface=LOCAL.BRIDGE name=dhcp1
add address-pool=dhcp_pool2 interface=IOT.BRIDGE name=dhcp2
add address-pool=dhcp_pool3 interface=LAB.BRIDGE name=dhcp3
add address-pool=dhcp_pool4 interface=MANAGEMENT.BRIDGE name=dhcp4
/disk settings
set auto-media-interface=LOCAL.BRIDGE auto-media-sharing=yes \
    auto-smb-sharing=yes
/interface bridge port
add bridge=LOCAL.BRIDGE interface=ether2
add bridge=LOCAL.BRIDGE interface=ether3
add bridge=LOCAL.BRIDGE interface=ether4
add bridge=LOCAL.BRIDGE interface=ether5
add bridge=LOCAL.BRIDGE interface=ether6
add bridge=LOCAL.BRIDGE interface=ether7
add bridge=LOCAL.BRIDGE interface=ether8
add bridge=LOCAL.BRIDGE interface=sfp-sfpplus1
add bridge=MANAGEMENT.BRIDGE interface=ether2-VLAN4000
add bridge=IOT.BRIDGE interface=ether3-VLAN2000
add bridge=LAB.BRIDGE interface=ether3-VLAN3000
add bridge=MANAGEMENT.BRIDGE interface=ether3-VLAN4000
add bridge=IOT.BRIDGE interface=ether2-VLAN2000
/ip neighbor discovery-settings
set discover-interface-list=all
/interface list member
add interface=ether1 list=WAN
/interface wifi capsman
set enabled=yes interfaces=MANAGEMENT.BRIDGE
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=\
    2.4ghz-ADMIN slave-configurations=2.4ghz supported-bands=2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=5ghz-ADMIN \
    slave-configurations=5ghz supported-bands=5ghz-ax
/ip address
add address=192.168.XXX.1/24 comment=LAN.ADMIN interface=LOCAL.BRIDGE \
    network=192.168.XXX.0
add address=192.168.XXX.1/24 comment=IOT.GATEWAY interface=IOT.BRIDGE \
    network=192.168.XXX.0
add address=192.168.XXX.1/24 comment=LAB.GATEWAY interface=LAB.BRIDGE \
    network=192.168.XXX.0
add address=192.168.XXX.1/24 comment=MANAGEMENT.GATEWAY interface=\
    MANAGEMENT.BRIDGE network=192.168.XXX.0
/ip cloud
set back-to-home-vpn=enabled ddns-enabled=yes ddns-update-interval=10m
/ip cloud back-to-home-user
add allow-lan=yes file-access=full file-access-path="/BTH Files" name=\
    Thinkpad.X1 public-key="mfYTKv+="
add allow-lan=yes file-access=full file-access-path="/BTH Files" name=\
    Thinkpad.X1.Linux public-key=\
    "7AKpArES1Ws="
/ip dhcp-client
add comment=ATT.FIBER.WAN default-route-tables=main interface=ether1 \
    use-peer-dns=no
/ip dns
set allow-remote-requests=yes servers=192.168.XXX.XXX,1.1.1.1,8.8.8.8
/ip dns static
add address=192.168.XX.X comment=defconf name=router.lan type=A
/ip firewall address-list
add address=192.168.XX.0/24 disabled=yes list=management.addresses
add address=192.168.XXX.0/24 list=management.addresses
add address=192.168.XXX.0/24 list=management.addresses
/ip firewall filter
add action=accept chain=input comment=\
    "Permit: Established, related, and untracked input traffic." \
    connection-state=established,related,untracked
add action=drop chain=input comment="Drop: Invalid input traffic." \
    connection-state=invalid
add action=accept chain=input comment="Permit: ICMP input traffic." protocol=\
    icmp
add action=accept chain=input comment="Permit: BGP input traffic." dst-port=\
    179 protocol=tcp
add action=accept chain=input comment=\
    "Permit: OSPF input traffic from list backbone.interfaces." \
    in-interface-list=WAN protocol=ospf
add action=accept chain=input comment=\
    "Permit: Input traffic from list management.addresses" src-address-list=\
    management.addresses
add action=accept chain=input comment=\
    "Permit: BFD input traffic from backbone.interfaces." dst-port=3784 \
    in-interface-list=WAN protocol=udp
add action=accept chain=input comment=\
    "Permit: Bandwidth test server input traffic." dst-port=2000 protocol=tcp
add action=drop chain=input comment="Drop: All other input traffic."
add action=accept chain=forward comment="ACCEPT: ESTABLISHED AND RELATED" \
    connection-state=established,related
add action=accept chain=forward comment="ACCEPT: ADMIN TO SUBNETS" disabled=\
    yes src-address-list=management.addresses
add action=accept chain=forward comment="ACCEPT: OUT TO PIHOLE" dst-address=\
    192.168.XXX.250
add action=accept chain=forward comment="ACCEPT: ADMIN TO IOT" dst-address=\
    192.168.XXX.0/24 src-address=192.168.XXX.0/24
add action=accept chain=forward comment="ACCEPT: MGMT VLAN TO IOT" \
    dst-address=192.168.XXX.0/24 src-address=192.168.XXX.0/24
add action=accept chain=forward comment="ACCEPT: ADMIN TO LAB" dst-address=\
    192.168.XXX.0/24 src-address=192.168.XXX.0/24
add action=accept chain=forward comment="ACCEPT: MGMT VLAN TO LAB" \
    dst-address=192.168.XXX.0/24 src-address=192.168.XXX.0/24
add action=accept chain=forward comment="ACCEPT: OUT TOWARDS INTERNET" \
    out-interface-list=WAN
add action=drop chain=forward comment="DROP: IOT TO ADMIN" dst-address=\
    192.168.XXX.0/24 src-address=192.168.XXX.0/24
add action=drop chain=forward comment="DROP: IOT TO MGMT VLAN" dst-address=\
    192.168.XXX.0/24 src-address=192.168.XXX.0/24
add action=drop chain=forward comment="DROP: IOT TO LAB" dst-address=\
    192.168.XXX.0/24 src-address=192.168.XXX.0/24
add action=drop chain=forward comment="DROP: EVERYTHING ELSE"
/ip firewall nat
add action=masquerade chain=srcnat comment="GENERAL INTERNET MASQ" \
    out-interface=ether1
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !*2000011
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !*2000011
/system clock
set time-zone-name=America/Chicago
/system identity
set name=EDGE.RTR
/system package update
set channel=long-term
/tool mac-server
set allowed-interface-list=*2000011
/tool mac-server mac-winbox
set allowed-interface-list=*2000011
/tool romon
set enabled=yes

[Kingfisher63]

Not sure if it has anything to do with the problem, but apparently the LAN interface list got deleted (it is now referenced as *2000011 in 4 places).

[helpmytik]

Hmmm. I looked back at backups and none have any other Interface List aside from WAN.

[erlinden]

Get rid of the bridges (except one) and configure VLAN as it is supposed.

Here is a great topic on VLAN's:

Using RouterOS to VLAN your network

Title: Using RouterOS to VLAN your network Welcome: This article is for system integrators, network administrators, and product enthusiasts looking for the definitive guide on how to design and setup VLAN networks using MikroTik. Follow along the light reading material and diagrams that make learning about VLAN an enjoyable topic. See the theory and then deep dive into the actual commands to implement it all. We'll discuss Access, Trunk and Hybrid ports, switching and routing, and guest acces…

[helpmytik]

Thanks for the feedback, but that would be a challenge for me. I had help setting up my config. I have read that article, more than once, but I just don't have enough networking knowledge to setup the config correctly. I have a spare L009 I will try to practice on, but for my daily network, I would need help.

[tadawson]

I have an RB5009, three CAP AX, and an haP ax2 in my world running 7.22.3 and CapsMan, and it's as solid as a rock. The only issue I ever had was the Mikrotik grabbing frequencies outside of what some devices know, effectively making them look dead, and had to create specific channel listings to be sure that all stayed in band. Not doing VLANS to segregate the AP's, but I do have 5 VLANs running on the RB5009. The combo can work well . . .

[infabo]

I see one thing: the datapaths are defined - but they are not assigned anywhere. Completely useless.

And the other one: use one vlan aware bridge instead of these 2 bridges on ether2.

[helpmytik]

Would you mind sharing your config with me?

[helpmytik]

Where would/should the datapaths be defined?

[infabo]

On /wifi/configuration.

[helpmytik]

Should they only be assigned to the VLAN2000? That's what both the 2.4ghz and 5ghz datapaths show.

[infabo]

I have no idea unfortunately. I am reading on smartphone.

[tadawson]

I didn't . . . left that blank - didn't see a need. datapaths were left at whatever they default to from setting the basic capsman config on the AP's. About all I hand set there was the ntp client and a reboot notification script, and and a few logging things. I exported just /interface/wifi/configuration since a level up gets into loads of lines with stati leases and ACL's . . . Perhaps when I get back on a real computer and not this tablet and can clean it up, if you want to see more.

[tadawson]

wificonf.rsc (2.1 KB)