WiFi extender setup

RouterOS Wireless Networking
1

Hello All

I have 4011 creating my wifi. Now I needed to extend range to outdoor and decided for following combination:

RBSXTsq2nD (lets call him sxt in further text) as 'client' connected to my home 4011 (via wifi) and wire connected to L22UGS-5HaxD2HaxD-15S (lets call him 15s in further text).

I believe I have setup all correctly but obviously not, because phone connects to 15s and says "no internet". There is no internet also in case I use fixed IP on phone. The IPs are (should be) assigned by 4011, pool is big enough.

There is nothing fancy in the setup, the ethernet and wireless are bridged, few firewall rules but ONLY for input chain, SXT uses station bridgebut I tried also station pesudobridge. The 15s is in AP mode and sends the same SSID, same password and all parameters are the same as in 4011 so it should be seen by phone as identical network.

From home network (e.g. PC/notebook) I can reach SXT and 15s Winbox without problem (proves air connection 4011 --- SXT works). Can not reach internet from phone or any other client connected to 15s. SXT and 15s do not provide any NAT, DHCP, this all should provide 4011. All devices have fixed management IP's that are NOT in DHCP range(s). Time is synced on all devices. I deleted all jumbo frames definitions on the part of network relevant.

The SXT faces the main router and 15s is exactly in oposite direction (like touching their backs). Wired connection is like this SXT - POE injector - RJ45 coupler - injector - 15s (no switch/router or any active element between SXT and 15s). Cables are heavy rugged outdoor cables cat 6A.

Has anyone working configuration like this? What I'm doing wrong?

To explain little bit background speed is absolutely not important for me, 100kbit is perfectly OK, but I need long reach, for this reason 5GHz is switched off everywhere (it reaches only single digit meters in my environment).

I spend already more than 2 days troubleshooting this and no result. The config is really very primitive, compared to 4011 which has ~17 bridges, mangle, firewall, routing... it should work on 1st try, and now after 2 days I'm exactly where I was 47 hours ago. Any help greatly appreciated.

2

Well, if you post your configurations (at least of the SXT and of the 15s, as long as the main 4011 has a working DHCP server that one isn't needed), maybe someone could tell you.

Instructions here:
Forum rules - #5 by gigabyte091

3

Hope all sensitive information removed.

SXT first:

# model = RBSXTsq2nD
/interface bridge
add mtu=1974 name="HomeWiFi bridge"
/interface ethernet
set [ find default-name=ether1 ] l2mtu=2028 mtu=1974
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name="HomeWiFi bridge" \
    supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no frequency=auto l2mtu=2028 mode=station-pseudobridge mtu=1974 \
    security-profile="HomeWiFi bridge" ssid=HomeWiFi
/interface bridge port
add bridge="HomeWiFi bridge" interface=wlan1
add bridge="HomeWiFi bridge" interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ipv6 settings
set accept-redirects=no accept-router-advertisements=no allow-fast-path=no \
    disable-ipv6=yes forward=no
/interface wireless connect-list
add interface=wlan1 mac-address=xx:xx:xx:xx:xx:xx ssid=HomeWiFi
/ip address
add address=192.168.54.197/26 comment="Admin IP" interface="HomeWiFi bridge" \
    network=192.168.54.192
/ip firewall filter
add action=drop chain=input comment="BLACKLIST drop lvl3 IP" dst-port=8291 \
    protocol=tcp src-address-list=Blacklist_IP_LVL3
add action=add-src-to-address-list address-list=Blacklist_IP_LVL3 \
    address-list-timeout=3d chain=input comment="BLACKLIST lvl2 to lvl 3 IP" \
    connection-state=new dst-port=8291 protocol=tcp src-address-list=\
    Blacklist_IP_LVL2
add action=add-src-to-address-list address-list=Blacklist_IP_LVL2 \
    address-list-timeout=1h chain=input comment="BLACKLIST lvl1 to lvl 2 IP" \
    connection-state=new dst-port=8291 protocol=tcp src-address-list=\
    Blacklist_IP_LVL1
add action=add-src-to-address-list address-list=Blacklist_IP_LVL1 \
    address-list-timeout=10m chain=input comment="BLACKLIST lvl1 IP" \
    connection-state=new dst-port=8291 protocol=tcp
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.54.193 routing-table=\
    main suppress-hw-offload=no
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.71.1
/tool mac-server
set allowed-interface-list=none

Then 15s:

#
# model = L22UGS-5HaxD2HaxD
/interface bridge
# MTU > L2MTU
add comment="WiFi extender new signal" mtu=1974 name="WiFi bridge"
/interface ethernet
set [ find default-name=ether1 ] l2mtu=2028 mtu=1974
set [ find default-name=sfp1 ] l2mtu=2028 mtu=1974
/interface wifi configuration
add channel.band=2ghz-n .frequency=2452 .width=20mhz comment=\
    "Home WiFi configuration" country=Slovakia disabled=no mode=ap name=\
    HomeWiFi security.authentication-types=wpa2-psk .encryption=\
    ccmp,gcmp ssid=HomeWiFi
/interface wifi
set [ find default-name=wifi1 ] configuration=HomeWiFi configuration.mode=ap \
    .ssid=HomeWiFi_wifi1 disabled=no
/interface bridge port
add bridge="WiFi bridge" interface=wifi1
add bridge="WiFi bridge" interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip address
add address=192.168.54.196/26 comment="Admin IP" interface="WiFi bridge" \
    network=192.168.54.192
/ip firewall filter
add action=drop chain=input comment="BLACKLIST drop LVL3" src-address-list=\
    BLACKLIST_lvl3
add action=accept chain=input comment="Est a related" connection-state=\
    established,related
add action=add-src-to-address-list address-list=BLACKLIST_lvl3 \
    address-list-timeout=3d chain=input comment="BLACKLIST lvl2 to lvl3" \
    connection-state=new dst-port=8291 protocol=tcp src-address-list=\
    BLACKLIST_lvl2
add action=add-src-to-address-list address-list=BLACKLIST_lvl2 \
    address-list-timeout=1h chain=input comment="BLACKLIST lvl1 to lvl2" \
    connection-state=new dst-port=8291 protocol=tcp src-address-list=\
    BLACKLIST_lvl1
add action=add-src-to-address-list address-list=BLACKLIST_lvl1 \
    address-list-timeout=10m chain=input comment="BLACKLIST lvl1 create" \
    connection-state=new dst-port=8291 protocol=tcp
add action=accept chain=input dst-port=8291 protocol=tcp
add action=drop chain=input
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.54.193 routing-table=\
    main suppress-hw-offload=no
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.71.1
/tool mac-server
set allowed-interface-list=none
4

/interface wifi
vs.
/interface wireless

only station-pseudobridge could work, and you likely need to disable rstp on the bridge to make It work.
No idea if your non-standard MTU may be part of the issue.
Let's wait for suggestions from members more familiar than myself with these setups

5

I don’t know if the circuit will work with such an MTU; I would set it to the standard 1500.
Your circuit doesn’t work—read up on the limitations of pseudo-bridge mode. You need to create an EOIP tunnel between the 4011 and the 15S, and on the SXT, exclude one interface from the bridge.

PS Although, if you set the SXT to “station bridge” mode, it should work.

6

I also see the difference, but it might be (???) correct or intentional, let me explain my understanding

4011 - NO WiFi in menu, only WIRELESS exists
SXT - WiFi AND Wireless in menu, but physical interface wlan1 (with MAC and everything) exists only in WIRELESS
15s - NO wireless, only WiFi exists

I checked this multiple times and MY (big to emphasize that it might be wrong, not because its me :slight_smile: ) understanding is that this is somehow related to evolution of routeros, where
originally it was WIRELESS (represented by 4011), but then they moved to WiFi (represented by 15s), and transition period (by SXT) where is menu WiFi already visually added but it is completely unusable as the system supports only Wireless.
Would be happy to hear corrected explanation from someone with real experience.

7

You would want "transparent bridging" or "4-address mode" for these sorts of setups. This is available as "station bridge" mode.

The unfortunate fact is, however, that while both wireless (which you are correct is the older/legacy driver) and the newer wifi series of drivers (wifi-qcom-ac, wifi-qcom, wifi-mediatek, etc.) support this feature, they only support it between devices of their own generation - so only wireless-wireless and wifi-wifi.

Station pseudobridge is a hack that will basically not work. In some circumstances you can get by with it, but sooner or later you'll run into problems.

The way to go in these circumstances is an L2 tunneling protocol, like EoIP.

8

This is my station bridge config with cut down MTUs, can you please have look if there is any mistake?

SXT:

# model = RBSXTsq2nD
/interface bridge
add mtu=1500 name="HomeWiFi bridge"
/interface ethernet
set [ find default-name=ether1 ] l2mtu=1592
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name="HomeWiFi bridge" \
    supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no frequency=auto mode=station-bridge security-profile=\
    "HomeWiFi bridge" ssid=HomeWiFi
/interface bridge port
add bridge="HomeWiFi bridge" interface=wlan1
add bridge="HomeWiFi bridge" interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ipv6 settings
set accept-redirects=no accept-router-advertisements=no allow-fast-path=no \
    disable-ipv6=yes forward=no
/interface wireless connect-list
add interface=wlan1 mac-address=XX:XX:XX:XX:XX:XX ssid=HomeWiFi
/ip address
add address=192.168.54.197/26 comment="Admin IP" interface="HomeWiFi bridge" \
    network=192.168.54.192
/ip firewall filter
add action=drop chain=input comment="BLACKLIST drop lvl3 IP" dst-port=8291 \
    protocol=tcp src-address-list=Blacklist_IP_LVL3
add action=add-src-to-address-list address-list=Blacklist_IP_LVL3 \
    address-list-timeout=3d chain=input comment="BLACKLIST lvl2 to lvl 3 IP" \
    connection-state=new dst-port=8291 protocol=tcp src-address-list=\
    Blacklist_IP_LVL2
add action=add-src-to-address-list address-list=Blacklist_IP_LVL2 \
    address-list-timeout=1h chain=input comment="BLACKLIST lvl1 to lvl 2 IP" \
    connection-state=new dst-port=8291 protocol=tcp src-address-list=\
    Blacklist_IP_LVL1
add action=add-src-to-address-list address-list=Blacklist_IP_LVL1 \
    address-list-timeout=10m chain=input comment="BLACKLIST lvl1 IP" \
    connection-state=new dst-port=8291 protocol=tcp
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.54.193 routing-table=\
    main suppress-hw-offload=no
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Bratislava
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.71.1
/tool mac-server
set allowed-interface-list=none

15s

# model = L22UGS-5HaxD2HaxD
/interface bridge
add comment="WiFi extender new signal" mtu=1500 name="WiFi bridge"
/interface ethernet
set [ find default-name=ether1 ] l2mtu=1592
set [ find default-name=sfp1 ] l2mtu=2028 mtu=1974
/interface wifi configuration
add channel.band=2ghz-n .frequency=2452 .width=20mhz comment=\
    "Home WiFi configuration" country=Slovakia disabled=no mode=ap name=\
    HomeWiFi security.authentication-types=wpa2-psk .encryption=ccmp,gcmp \
    ssid=HomeWiFi
/interface wifi
set [ find default-name=wifi1 ] configuration=HomeWiFi configuration.mode=ap \
    disabled=no
/interface bridge port
add bridge="WiFi bridge" interface=wifi1
add bridge="WiFi bridge" interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip address
add address=192.168.54.196/26 comment="Admin IP" interface="WiFi bridge" \
    network=192.168.54.192
/ip firewall filter
add action=drop chain=input comment="BLACKLIST drop LVL3" src-address-list=\
    BLACKLIST_lvl3
add action=accept chain=input comment="Est a related" connection-state=\
    established,related
add action=add-src-to-address-list address-list=BLACKLIST_lvl3 \
    address-list-timeout=3d chain=input comment="BLACKLIST lvl2 to lvl3" \
    connection-state=new dst-port=8291 protocol=tcp src-address-list=\
    BLACKLIST_lvl2
add action=add-src-to-address-list address-list=BLACKLIST_lvl2 \
    address-list-timeout=1h chain=input comment="BLACKLIST lvl1 to lvl2" \
    connection-state=new dst-port=8291 protocol=tcp src-address-list=\
    BLACKLIST_lvl1
add action=add-src-to-address-list address-list=BLACKLIST_lvl1 \
    address-list-timeout=10m chain=input comment="BLACKLIST lvl1 create" \
    connection-state=new dst-port=8291 protocol=tcp
add action=accept chain=input dst-port=8291 protocol=tcp
add action=drop chain=input
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.54.193 routing-table=\
    main suppress-hw-offload=no
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Bratislava
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.71.1
/tool mac-server
set allowed-interface-list=none

Behaves the same, phone connects but says "NO INTERNET". If I change MAC on phone, force fixed IP, status is the same, no internet.

9

Thanks for explanation, do you suggest that EoIP is the only way? In my situation the 4011 handles few GB of continuous streams using jumbo frames that are higher priority than this outdoor network. And the EoIP will unnecessary load 4011 CPU.

If there is no other option I would go with "old school" and buy 2x10€ router from scrap yard :slight_smile: One will get pannel antenna and act as client, and the other will be crating the same wifi + NAT + DHCP + rule that MAC of the first one can not connect (completely different network, but with same SSID). It will be not nice, some features will not work, but have this 'hack' setup on few places currently and I'm sure it will be cheaper and faster.

I'm sorry to say that (because I love mikrotik and recommend to everyone), but now I'm really disappointed! Several 100s € solution can not do better than 20€ from scrapyard. Maybe real engineers should get bigger word than designers painting Winbox4 in fancy colors, making rounded bezels and other unnecessary and non ergonomic changes.

In any case than you for explanation, somehow I did not known the information that it is not compatible across versions. This explains a lot.

10

If you want a proper setup where you have the same SSID, same L2 domain, etc., then EoIP is the way to do that. Some manufacturers suggest VXLAN, but it's a distinction without a difference.

If it was my setup, I'd try it out. The CPU load of it is grossly exaggerated from the time when Mikrotiks had weak MIPSBE cpus. High performance arms like in the 4011 fare much better.

The situation with transparent bridging is very similar with other manufacturers: only select devices can work together. Unfortunately the frame format was never standardized, and actually Mikrotik, with their two domains, has better internal compatibility than most.

This situation is not to suggest that your devices would be incompatible as ap and station (plain station.) They will very happily work together like that, you just have to accept that you'll have a separate SSID, separate network, dhcp server and NAT. If you can accept that, things become simple.

If it's not totally clear, the critical difference between the (plain) station and the station bridge modes is that in the plain (and compatible) mode, there can only be a single IP/MAC on the client side, which makes it mandatory to use the extender as a full router.

11

Yep, it's a mess with wireless and wifi, luckily new devices are still wifi compatible JFYI:

Maybe you can trick lurker888 into making a simple but complete howto ... :astonished_face:

12

I was hoping to get the EoIP user experience without really using the EoIP because this way I understood it from the mikrotik 'advertising'...

You are right that EoIP is right way to go and worth trying. Will try this version.

For me the biggest danger is that 4011 is really important for me and I do not want to make any 'harmfull' changes, also I'm afraid that this can have unexpected side effects with complicated (pre, -, post) routing, VLANs, jumbo frames, multiple DHCP servers/clients, GWs...

Usually I configured EoIP on 'dedicated' machines having few rules, 1 bridge - nothing can go wrong there and if it goes wrong nothing happens. BUT the 4011 is different.

If you have experience can you please give me warning about "traps" of EoIP in complicated setups? Of course I will make backup before I start playing.

13

And please what about MAC jumping?

Historically I had some problems with it, if MAC has jumped from one interface to another Mikrotik got confused and the device was few minutes 'lost': it can send whatever wanted and it was delivered to destination, but nothing came back (my guess: response was sent to the previously used interface).

I have not investigated any more, because this happened very rarely during 'experimenting'. In real life, the PCs usually do not change interface :wink:

With EoIP the MAC jumping will become standard (!) between wlan2 and eoip1 interfaces - can Mikrotik (4011) handle this?

Related question - how the connection will be marked (for IP > Firewall)? Will it be new or estabilished AFTER the MAC jump?

14

The nice thing about EoIP is that the basic scenario is pretty simple.

I would suggest that you create a separate SSID for the EoIP tunnel only. Later, if you wish, you can make this hidden so you don't have to look at it. You don't enroll this interface in any bridge, but you simply assign an IP address to it, like 192.168.100.1/30. You should set disable-running-check on this.

Then you create the corresponding client on the other side, there you assign 192.168.100.2/30. You create the eoip tunnel between the two IPs. You should of course allow the tunnel in the firewalls. It's easy by specifying the in-interface and the protocol (47 - gre). If the eoip tunnel is up, keepalive should take care of setting the interfaces to R - running.

Now you can simply put the two sides of the eoip interfaces into bridges. On the AP side, the bridge that you are already using. On the extender side, a bridge in common with the interface that handles the clients.

This should give you a working config. Some improvement can be had by increasing the MTU for wifi interfaces that carry the EoIP traffic to 1560 - this allows packets to be encapsulated without fragmentation.

Other than allowing the EoIP traffic itself, no other firewall modifications are necessary.

MACs traveling between interfaces is not a problem. They are handled by the FDBs of the bridges. When clients transition from one AP to the other, they issue GARPs. The APs don't have to do anything special, because the client isn't roaming in the "fast transition" sense.