I'm having a weird problem with my hap ac^2. Actually it worked all quite good, and now (without changes from me) after an upgrade i have some weird problems, but i think i'm the problem ;).
The whole setup is in our shared student flat, i have an Huawei Router (bridge mode) -> hap ac^2 as main router and capsman -> cap ac in another room.
VLAN 10 for IOT
VLAN 20 for my room
VLAN 30 for guests
VLAN 40 was planed for VPN users, but it's actually not used
no VLAN - for everyone else
Now, all was quite good but since some weeks my NAS (QNAP TS-231P2 and my Raspberry Pi, both untagged in VLAN 20 - NAS on ether4, Raspy behind a switch in ether2 can't access the gateway stable, i'm always getting ~ 75% timeouts pinging from NAS/Raspy -> Gateway on hap ac^2 and also backwards hap ac^2 -> NAS/Raspy.
And, the really weird for me: With my WIndows 10 Notebook everything works perfect, no problems.
If i put the NAS/Raspy on ether 1 (so they are not in a VLAN) also everything works perfect.
Really, i'm out, i don't get it.
The standard gateway in NAS and Raspy is correct, the zero route also, they are getting the right IP Adresses, i don't have any problems inside the subnet/VLAN. Just the way threw the standard Gateway makes problems, and not all the time just in about 75% of the time...
thank you very much!
Manuel
EDIT: forgot this: with Wireshark i can see, that they are booth always broadcasting the "who is IP of Gateway"
Code: Select all
# may/18/2021 16:26:41 by RouterOS 6.48.2
# software id = FVNK-2IPL
#
# model = RBD52G-5HacD2HnD
# serial number = C6140C7A47AD
/caps-man channel
add band=2ghz-b/g/n extension-channel=XX name=channel_2
add band=5ghz-a/n/ac control-channel-width=20mhz extension-channel=XXXX \
frequency=5785 name=channel_5
/interface bridge
add name=bridge1 vlan-filtering=yes
/interface wireless
# managed by CAPsMAN
# channel: 2472/20-eC/gn(17dBm), SSID: Attention_5GLAN, local forwarding
set [ find default-name=wlan1 ] disabled=no ssid=MikroTik
# managed by CAPsMAN
# channel: 5280/20-eCee/ac/DP(20dBm), SSID: Attention_5GLAN, local forwarding
set [ find default-name=wlan2 ] disabled=no ssid=MikroTik
/interface vlan
add interface=bridge1 name=vlan_guest vlan-id=30
add interface=bridge1 name=vlan_iot vlan-id=10
add interface=bridge1 name=vlan_manuel vlan-id=20
/caps-man datapath
add bridge=bridge1 client-to-client-forwarding=yes local-forwarding=yes name=\
datapath1
add bridge=bridge1 name=datapath2_iot vlan-id=10 vlan-mode=use-tag
add bridge=bridge1 client-to-client-forwarding=yes local-forwarding=yes name=\
datapath3_manuel vlan-id=20 vlan-mode=use-tag
add bridge=bridge1 name=datapath4_guest vlan-id=30 vlan-mode=use-tag
/caps-man rates
add basic=6Mbps ht-basic-mcs=mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7 \
ht-supported-mcs="mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7,mcs-8,mc\
s-9,mcs-10,mcs-11,mcs-12,mcs-13,mcs-14,mcs-15,mcs-16,mcs-17,mcs-18,mcs-19,\
mcs-20,mcs-21,mcs-22,mcs-23" name=rate1 supported=\
11Mbps,6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps \
vht-basic-mcs=mcs0-7 vht-supported-mcs=mcs0-9
add basic=6Mbps,54Mbps ht-basic-mcs=\
mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7,mcs-8,mcs-9 \
ht-supported-mcs="mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7,mcs-8,mc\
s-9,mcs-10,mcs-11,mcs-12,mcs-13,mcs-14,mcs-15,mcs-16,mcs-17,mcs-18,mcs-19,\
mcs-20,mcs-21,mcs-22,mcs-23" name=rate2 supported="1Mbps,2Mbps,5.5Mbps,11M\
bps,6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps"
/caps-man security
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm,tkip name=\
security1 passphrase=4llMenarecreated3qual
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm,tkip name=\
security_iot passphrase=IOTidTS30
add authentication-types=wpa2-psk encryption=aes-ccm,tkip name=\
security_manuel passphrase=WvMRdidTS30w
add authentication-types=wpa2-psk encryption=aes-ccm,tkip name=\
security2_guest passphrase=gastgast
/caps-man configuration
add channel=channel_2 country=no_country_set datapath=datapath1 installation=\
indoor mode=ap name=cfg1_24 rates=rate1 rates.ht-basic-mcs="" \
rates.ht-supported-mcs="" rx-chains=0,1 security=security1 ssid=\
Attention_5GLAN tx-chains=0,1
add channel=channel_5 country=no_country_set datapath=datapath1 installation=\
indoor name=cfg2_5 rates=rate1 rx-chains=0,1 security=security1 ssid=\
Attention_5GLAN tx-chains=0,1
add channel=channel_5 country=no_country_set datapath=datapath1 installation=\
indoor name=cfg3_solo rates=rate1 rx-chains=0,1 security=security1 ssid=\
Attention_5Gsolo tx-chains=0,1
add channel=channel_2 country=no_country_set datapath=datapath2_iot \
installation=indoor name=cfg4_iot rates=rate1 rx-chains=0,1 security=\
security_iot ssid=Attention_5GIOT tx-chains=0,1
add channel=channel_2 country=no_country_set datapath=datapath3_manuel \
installation=indoor name=cfg5_manu2 rates.basic=6Mbps rates.ht-basic-mcs=\
mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7 rates.ht-supported-mcs="mc\
s-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7,mcs-8,mcs-9,mcs-10,mcs-11,mc\
s-12,mcs-13,mcs-14,mcs-15,mcs-16,mcs-17,mcs-18,mcs-19,mcs-20,mcs-21,mcs-22\
,mcs-23" rates.supported="1Mbps,2Mbps,5.5Mbps,11Mbps,6Mbps,9Mbps,12Mbps,18\
Mbps,24Mbps,36Mbps,48Mbps,54Mbps" rates.vht-basic-mcs=mcs0-7 \
rates.vht-supported-mcs=mcs0-9 rx-chains=0,1 security=security_manuel \
ssid=Attention_5Gx tx-chains=0,1
add channel=channel_5 country=no_country_set datapath=datapath3_manuel \
installation=indoor name=cfg6_manu5 rates=rate1 rx-chains=0,1 security=\
security_manuel ssid=Attention_5Gx tx-chains=0,1
add channel=channel_2 country=no_country_set datapath=datapath1 installation=\
indoor name=cfg7_gast rates=rate1 rx-chains=0,1 security=security2_guest \
ssid=Attention_5Gguest tx-chains=0,1
/caps-man interface
add channel=channel_2 channel.extension-channel=Ce channel.frequency=2412 \
configuration=cfg1_24 configuration.ssid=Attention_5GLAN disabled=no \
l2mtu=1600 mac-address=74:4D:28:BC:D9:0B master-interface=none name=\
cap1_2 radio-mac=74:4D:28:BC:D9:0B radio-name=744D28BCD90B
add channel=channel_5 channel.extension-channel=eCee channel.frequency=5520 \
channel.secondary-frequency=disabled configuration=cfg2_5 \
configuration.mode=ap configuration.ssid=Attention_5GLAN disabled=no \
l2mtu=1600 mac-address=74:4D:28:BC:D9:0C master-interface=none name=\
cap1_5 radio-mac=74:4D:28:BC:D9:0C radio-name=744D28BCD90C
add channel=channel_2 configuration=cfg7_gast datapath=datapath4_guest \
disabled=no l2mtu=1600 mac-address=76:4D:28:BC:D9:0F master-interface=\
cap1_2 name=cap1_guest radio-mac=00:00:00:00:00:00 radio-name="" \
security=security2_guest
add channel=channel_2 configuration=cfg4_iot datapath=datapath2_iot disabled=\
no l2mtu=1600 mac-address=76:4D:28:BC:D9:0B master-interface=cap1_2 name=\
cap1_iot radio-mac=00:00:00:00:00:00 radio-name=""
add configuration=cfg5_manu2 disabled=yes l2mtu=1600 mac-address=\
76:4D:28:BC:D9:0C master-interface=cap1_2 name=cap1_m2 radio-mac=\
00:00:00:00:00:00 radio-name=""
add configuration=cfg6_manu5 disabled=yes l2mtu=1600 mac-address=\
76:4D:28:BC:D9:0D master-interface=cap1_5 name=cap1_m5 radio-mac=\
00:00:00:00:00:00 radio-name=""
add configuration=cfg3_solo disabled=no l2mtu=1600 mac-address=\
76:4D:28:BC:D9:0E master-interface=cap1_5 name=cap1_solo radio-mac=\
00:00:00:00:00:00 radio-name=""
add channel.band=2ghz-b/g/n channel.extension-channel=eC channel.frequency=\
2472 configuration=cfg1_24 configuration.country=austria disabled=no \
l2mtu=1600 mac-address=48:8F:5A:BF:01:44 master-interface=none name=\
hap1_2 radio-mac=48:8F:5A:BF:01:44 radio-name=hap1_2
add channel.frequency=5280 configuration=cfg2_5 configuration.country=\
no_country_set configuration.installation=indoor disabled=no l2mtu=1600 \
mac-address=48:8F:5A:BF:01:45 master-interface=none name=hap1_5 \
radio-mac=48:8F:5A:BF:01:45 radio-name=hap1_5
add channel=channel_2 configuration=cfg7_gast datapath=datapath4_guest \
disabled=no l2mtu=1600 mac-address=4A:8F:5A:BF:01:48 master-interface=\
hap1_2 name=hap1_guest radio-mac=00:00:00:00:00:00 radio-name="" \
security=security2_guest
add configuration=cfg4_iot disabled=no l2mtu=1600 mac-address=\
4A:8F:5A:BF:01:44 master-interface=hap1_2 name=hap1_iot radio-mac=\
00:00:00:00:00:00 radio-name=""
add configuration=cfg5_manu2 disabled=no l2mtu=1600 mac-address=\
4A:8F:5A:BF:01:46 master-interface=hap1_2 name=hap1_m2 radio-mac=\
00:00:00:00:00:00 radio-name=""
add channel.frequency=5785 configuration=cfg6_manu5 configuration.country=\
no_country_set configuration.ssid=Attention_5Gx disabled=yes l2mtu=1600 \
mac-address=4A:8F:5A:BF:01:47 master-interface=hap1_5 name=hap1_m5 \
radio-mac=00:00:00:00:00:00 radio-name=""
add configuration=cfg3_solo disabled=no l2mtu=1600 mac-address=\
4A:8F:5A:BF:01:45 master-interface=hap1_5 name=hap1_solo radio-mac=\
00:00:00:00:00:00 radio-name=""
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-256,aes-128,3des
add dh-group=ecp256,modp2048 enc-algorithm=aes-256 hash-algorithm=sha256 \
name=profile_site-to-site
/ip ipsec peer
add address=asdf name=asdf profile=\
profile_site-to-site
add address=asdf name=asdf profile=profile_site-to-site
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256,sha1 enc-algorithms="aes-256-c\
bc,aes-256-gcm,aes-192-cbc,aes-192-gcm,aes-128-cbc,aes-128-gcm,3des" \
pfs-group=modp2048
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc name=\
proposal_site-to-site pfs-group=none
/ip pool
add name=pool1 ranges=10.0.0.1-10.0.0.100
add name=pool2 ranges=10.0.1.1-10.0.1.100
add name=pool3 ranges=10.0.2.1-10.0.2.100
add name=pool_vpn ranges=10.0.254.1-10.0.254.100
add name=pool4 ranges=10.0.3.1-10.0.3.100
/ip ipsec mode-config
add address-pool=pool_vpn name=vpndhcp
/ppp profile
add local-address=10.0.254.254 name=l2tp_vpn remote-address=pool_vpn \
use-encryption=required
/queue simple
add max-limit=1M/10M name=queue1 target=vlan_guest
/caps-man access-list
add action=accept allow-signal-out-of-range=10s disabled=no interface=\
hap1_iot mac-address=68:57:2D:6D:50:12 signal-range=-120..120 \
ssid-regexp=""
add action=accept allow-signal-out-of-range=10s disabled=no mac-address=\
8C:3A:E3:1B:4E:BC signal-range=-85..120 ssid-regexp=""
add action=accept allow-signal-out-of-range=10s disabled=no signal-range=\
-75..120 ssid-regexp=""
add action=reject allow-signal-out-of-range=10s disabled=no signal-range=\
-120..120 ssid-regexp=""
/caps-man manager
set enabled=yes
/interface bridge port
add bridge=bridge1 interface=ether2 pvid=20
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4 pvid=20
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=hap1_solo
add bridge=bridge1 interface=hap1_2
add bridge=bridge1 interface=hap1_5
add bridge=bridge1 interface=cap1_2
add bridge=bridge1 interface=cap1_5
add bridge=bridge1 interface=cap1_iot pvid=10
add bridge=bridge1 interface=hap1_iot pvid=10
add bridge=bridge1 interface=hap1_m2 pvid=20
add bridge=bridge1 interface=hap1_m5 pvid=20
add bridge=bridge1 interface=cap1_m2 pvid=20
add bridge=bridge1 interface=cap1_m5 pvid=20
add bridge=bridge1 interface=cap1_solo
add bridge=bridge1 interface=cap1_guest pvid=30
add bridge=bridge1 interface=hap1_guest pvid=30
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether3,ether5,cap1_iot,hap1_iot vlan-ids=10
add bridge=bridge1 tagged=\
bridge1,ether1,ether3,ether5,cap1_m2,cap1_m5,hap1_m2,hap1_m5 untagged=\
ether2,ether4 vlan-ids=20
add bridge=bridge1 tagged=bridge1,ether3 vlan-ids=30
add bridge=bridge1 tagged=bridge1,ether3 vlan-ids=40
/interface detect-internet
set detect-interface-list=all
/interface l2tp-server server
set allow-fast-path=yes authentication=mschap2 default-profile=l2tp_vpn \
enabled=yes ipsec-secret=asdf max-mru=1480 max-mtu=1460 use-ipsec=\
required
/interface list member
add interface=ether1 list=WAN
add interface=bridge1 list=LAN
add interface=vlan_manuel list=LAN
add interface=vlan_iot list=LAN
add interface=vlan_guest list=LAN
/interface wireless cap
#
set bridge=bridge1 caps-man-addresses=127.0.0.1 enabled=yes interfaces=\
wlan1,wlan2
/ip accounting
set account-local-traffic=yes enabled=yes
/ip accounting web-access
set accessible-via-web=yes
/ip address
add address=10.0.1.254/24 interface=vlan_iot network=10.0.1.0
add address=10.0.0.254/24 interface=bridge1 network=10.0.0.0
add address=10.0.2.254/24 interface=vlan_manuel network=10.0.2.0
add address=10.0.3.254/24 interface=vlan_guest network=10.0.3.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=30m
/ip dhcp-client
add disabled=no interface=ether1 use-peer-dns=no
/ip dhcp-server lease
add address=10.0.0.81 client-id=1:74:4d:28:bc:d9:9 comment=AP_Chris \
mac-address=74:4D:28:BC:D9:09 server=server1
add address=10.0.1.96 comment=Steckdose_espresso mac-address=\
68:57:2D:6D:50:12 server=server2
add address=10.0.1.95 client-id=1:20:a1:71:d1:c4:78 comment=FireTV_Stick \
mac-address=20:A1:71:D1:C4:78 server=server2
add address=10.0.2.220 client-id=1:b8:27:eb:92:17:e0 comment=\
"static on raspi" mac-address=B8:27:EB:92:17:E0 server=server3
add address=10.0.2.210 client-id=1:b8:27:eb:89:49:79 mac-address=\
B8:27:EB:89:49:79 server=server3
add address=10.0.2.200 mac-address=24:5E:BE:32:6E:5A server=server3
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=1.0.0.1,8.8.8.8 domain=wg.lan gateway=\
10.0.0.254 netmask=24
add address=10.0.1.0/24 dns-server=10.0.2.220 gateway=10.0.1.254 netmask=24
add address=10.0.2.0/24 dns-server=10.0.2.254 domain=manu.lan gateway=\
10.0.2.254 netmask=24
add address=10.0.3.0/24 dns-server=8.8.8.8,1.0.0.1 gateway=10.0.3.254 \
netmask=24
/ip dns
set allow-remote-requests=yes servers=10.0.2.220,10.0.2.201,1.0.0.1
/ip dns static
add address=10.0.0.81 comment=#DHCP name=AP_Chris.wg.lan ttl=10m
add address=10.0.2.79 comment=#DHCP name=Zimmer.manu.lan ttl=10m
add address=10.0.2.70 comment=#DHCP name=LT91-C850.manu.lan ttl=10m
add address=10.0.0.30 comment=#DHCP name=Admins-Mac-mini.wg.lan ttl=10m
add address=10.0.0.78 comment=#DHCP name=amazon-56e6d97c9.wg.lan ttl=10m
add address=10.0.0.29 comment=#DHCP name=OnePlus6T.wg.lan ttl=10m
add address=10.0.0.28 comment=#DHCP name=Galaxy-S9.wg.lan ttl=10m
add address=10.0.0.27 comment=#DHCP name=DESKTOP-JQ7LHT7.wg.lan ttl=10m
add address=10.0.2.200 comment=#DHCP name=NAS-reima.manu.lan ttl=10m
add address=10.0.0.31 comment=#DHCP name=iPhone.wg.lan ttl=10m
/ip firewall address-list
add address=10.0.0.0/24 list=Main
add address=10.0.1.0/24 list=Main
add address=10.0.2.0/24 list=Main
add address=10.0.3.0/24 list=Main
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked \
log-prefix=input_accept
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input in-interface-list=LAN protocol=tcp src-port=53
add action=accept chain=input in-interface-list=LAN protocol=udp src-port=53
add action=accept chain=input src-address=127.0.0.1
add action=accept chain=input log-prefix=input_accept src-address=\
192.168.10.0/24
add action=accept chain=input in-interface-list=LAN log-prefix=input_accept
add action=accept chain=input dst-port=500,1701,4500 in-interface=ether1 \
protocol=udp
add action=accept chain=input in-interface=ether1 protocol=ipsec-esp
add action=drop chain=input log-prefix=input_drop
add action=accept chain=forward comment=vialli connection-state=new dst-port=\
8001,445,5201,443,80,22 log-prefix=vialli protocol=tcp src-address=\
192.168.10.0/24
add action=accept chain=forward comment=landeck dst-port=443,445,5201,8080 \
log-prefix=vialli protocol=tcp src-address=192.168.21.0/24
add action=fasttrack-connection chain=forward connection-state=\
established,related disabled=yes in-interface=!vlan_guest out-interface=\
!vlan_guest
add action=accept chain=forward connection-state=\
established,related,untracked log-prefix=input_accept
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=accept chain=forward comment="pass all outgoing" log-prefix=\
outgoing out-interface=ether1
add action=accept chain=forward disabled=yes protocol=icmp
add action=accept chain=forward comment="Accept vlan_manuel -> AP" \
dst-address=10.0.0.81 in-interface=vlan_manuel
add action=accept chain=forward comment="accept firetv-plex" dst-address=\
10.0.2.200 dst-port=32400,445,139 protocol=tcp src-address=10.0.1.95
add action=accept chain=forward comment="allow vlan_iot->pihole udp" \
dst-address=10.0.2.201 dst-port=53 in-interface=vlan_iot protocol=udp
add action=accept chain=forward comment="allow vlan_iot->pihole tcp" \
dst-address=10.0.2.201 dst-port=53 in-interface=vlan_iot protocol=tcp
add action=accept chain=forward dst-address=10.0.2.220 dst-port=53 protocol=\
udp
add action=accept chain=forward dst-address=192.168.8.0/24
add action=accept chain=forward connection-nat-state=dstnat dst-port=80 \
protocol=tcp
add action=accept chain=forward comment=iperf3-speedtest dst-address=\
10.0.2.84 dst-port=5201 protocol=tcp
add action=drop chain=forward comment="drop all forward" log=yes log-prefix=\
"dp fw"
/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes \
protocol=tcp tcp-flags=syn
/ip firewall nat
add action=accept chain=srcnat comment=vialli dst-address=192.168.10.0/24 \
src-address=10.0.2.0/24
add action=accept chain=srcnat comment=ldk dst-address=192.168.21.0/24 \
src-address=10.0.2.0/24
add action=masquerade chain=srcnat out-interface-list=WAN
add action=masquerade chain=srcnat dst-address=192.168.8.1 src-address=\
10.0.2.0/24
add action=dst-nat chain=dstnat dst-port=80 protocol=tcp src-address=\
212.186.49.64 to-addresses=10.0.2.200 to-ports=80
/ip ipsec identity
add peer=vialli secret=asdf
add peer=landeck secret=asdf
/ip ipsec policy
add template=yes
add dst-address=192.168.10.0/24 peer=vialli proposal=proposal_site-to-site \
sa-dst-address=asdf sa-src-address=asdf src-address=\
10.0.2.0/24 tunnel=yes
add dst-address=192.168.21.0/24 peer=landeck proposal=proposal_site-to-site \
sa-dst-address=asdf sa-src-address=asdf8 src-address=\
10.0.2.0/24 tunnel=yes
/ip service
set www-ssl certificate=ssl disabled=no
/ppp secret
add name=reima password=asdf profile=l2tp_vpn service=l2tp
/system clock
set time-zone-name=Europe/Vienna
/tool bandwidth-server
set authenticate=no
/tool graphing interface
add allow-address=10.0.2.0/24
/tool graphing resource
add allow-address=10.0.2.0/24
/tool netwatch
add down-script="/interface disable ether1; \r\
\n:delay 10; \r\
\n/interface enable ether1; \r\
\n:log error \"No Ping - eth1 restarted\";" host=8.8.8.8
