Community discussions

MikroTik App
 
User avatar
mtivi
Trainer
Trainer
Posts: 11
Joined: Mon Oct 03, 2016 5:54 pm
Location: Russia, Perm
Contact:

Re: v6.40rc [release candidate] is released!

Wed May 31, 2017 5:36 pm

Now in ip firewall:
/ip firewall address-list
add address=100.64.0.0/10 comment="defconf: RFC6890" list=bad_ipv4
/ip firewall raw
add action=drop chain=prerouting comment="defconf: drop from bogon IP's" in-interface-list=WAN src-address-list=bad_ipv4
I don't like this.

This valid address for WAN interface for end user.

Many ISP use CGN network.
 
Ramas
just joined
Posts: 3
Joined: Fri May 26, 2017 8:04 pm
Location: Lithuania

Re: v6.40rc [release candidate] is released!

Wed May 31, 2017 9:26 pm

The Shared Address Space address range is 100.64.0.0/10
Shared Address Space can only be used in Service Provider networks or on routing equipment that is able to do address translation across router the interfaces when addresses are identical on two different interfaces

---
Ramas
 
sup5
Member
Member
Posts: 359
Joined: Sat Jul 10, 2010 12:37 am

Re: v6.40rc [release candidate] is released!

Wed May 31, 2017 10:55 pm

IP addresses from the shared transition space are given out to end-users/customers in case the provider lacks public IPv4-addresses.
This is commonly referred as NAT444.
 
kujo
Member Candidate
Member Candidate
Posts: 169
Joined: Sat Jun 18, 2016 10:17 am
Location: Ukraine
Contact:

Re: v6.40rc [release candidate] is released!

Thu Jun 01, 2017 10:00 am

Hi!
Do we need add in last position of chain=bad_tcp RETURN rule?
/ip firewall raw add action=return chain=bad_tcp
 
alexjhart
Member Candidate
Member Candidate
Posts: 197
Joined: Thu Jan 20, 2011 8:03 pm

Re: RE: Re: v6.40rc [release candidate] is released!

Thu Jun 01, 2017 7:11 pm

Hi!
Do we need add in last position of chain=bad_tcp RETURN rule?
/ip firewall raw add action=return chain=bad_tcp
Return is the default when reaching the end of a custom chain, I assume that applies here too, making it unnecessary. So the answer would be no.
 
amokkatmt
newbie
Posts: 33
Joined: Mon Oct 24, 2011 3:31 pm

Re: v6.40rc [release candidate] is released!

Sat Jun 03, 2017 4:37 pm

How this " !) ipsec - added support for dynamic "action=notrack" RAW rules for policies;" can be disabled? I need to src-nat ipsec decrypted client traffic in roadwarrior setup. Because of those rules NAT is bypassed and things are broken.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: v6.40rc [release candidate] is released!

Sat Jun 03, 2017 5:16 pm

I agree with previous post. It's not just NAT, what if I need "one-way tunnel", i.e. allow new connections from network A to network B, but not from network B to network A? Now I can allow one way, allow established connections and block the other. But these new dynamic raw rules break this. It's a nice feature, but it needs to be optional.
 
x4nd3m4c
just joined
Posts: 3
Joined: Fri May 26, 2017 2:09 pm

Re: v6.40rc [release candidate] is released!

Sun Jun 04, 2017 5:12 am

Just installed version 6.40rc15 to fix the PPPoE server problem on my RB1100AHx2 and now my OVPN client can't connect using TLS.
It does work with version 6.38.5
Please fix it.
 
User avatar
boldsuck
Frequent Visitor
Frequent Visitor
Posts: 60
Joined: Sun Sep 01, 2013 1:07 am
Location: Germany

Re: v6.40rc [release candidate] is released!

Mon Jun 05, 2017 7:35 pm

New default-IPv6 firewall from v6.40rc15
/system default-configuration print:
/ipv6 firewall {
address-list add list=bad_ipv6 address=::1 comment="defconf: lo"
address-list add list=bad_ipv6 address=fec0::/10 comment="defconf: site-local"
address-list add list=bad_ipv6 address=::/96 comment="defconf: ipv4 compat"
address-list add list=bad_ipv6 address=2001:db8::/32 comment="defconf: documentation"
address-list add list=bad_ipv6 address=3ffe::/16 comment="defconf: 6bone"
address-list add list=bad_ipv6 address=::224.0.0.0/100 comment="defconf: other"
address-list add list=bad_ipv6 address=::127.0.0.0/104 comment="defconf: other"
address-list add list=bad_ipv6 address=::/104 comment="defconf: other"
address-list add list=bad_ipv6 address=::255.0.0.0/104 comment="defconf: other"
             
raw add chain=prerouting action=accept disabled=yes comment="defconf: enable for transparent firewall"
raw add chain=prerouting action=drop src-address-list=bad_ipv6 comment="defconf: drop packets with bad src ipv6"
raw add chain=prerouting action=drop dst-address-list=bad_ipv6 comment="defconf: drop packets with bad dst ipv6"
raw add chain=prerouting action=jump jump-target=icmp6 protocol=icmpv6 comment="defconf: jump to ICMPv6 chain"
raw add chain=prerouting action=drop src-address=ff00::/8 comment="defconf: drop if src is multicast"
raw add chain=prerouting action=accept dst-address=ff02::/16 comment="defconf: accept local multicast scope"
raw add chain=prerouting action=drop dst-address=ff00::/8 comment="defconf: drop other multicast destinations"
raw add chain=prerouting action=accept in-interface-list=WAN comment="defconf: accept everything else from WAN"
raw add chain=prerouting action=accept in-interface-list=LAN comment="defconf: accept everything else from LAN"
raw add chain=prerouting action=drop comment="defconf: drop the rest"
"defconf: rfc4890 drop ll if hop-limit!=255"
'action=accept'? If I understand RFC 4890 correctly, should be 'action=drop' here.
Perhaps a native English-speaking one understands this better:

Davies & Mohacsi Informational [Page 12]

RFC 4890 ICMPv6 Filtering Recommendations May 2007

4.2. Interaction of Link-Local Messages with Firewall/Routers and
Firewall/Bridges

Firewalls can be implemented both as IP routers (firewall/routers)
and as link layer bridges (e.g., Ethernet bridges) that are
transparent to the IP layer although they will actually be inspecting
the IP packets as they pass through (firewall/bridges).

Many of the messages used for establishment and maintenance of
communications on the local link will be sent with link-local
addresses for at least one of their source and destination. Routers
conforming to the IPv6 standards will not forward these packets;
there is no need to configure additional rules to prevent these
packets traversing a firewall/router, although administrators may
wish to configure rules that would drop these packets for insurance
and as a means of monitoring for attacks. Also, the specifications
of ICMPv6 messages intended for use only on the local link specify
various measures that would allow receivers to detect if the message
had passed through a router, including:

o Requiring that the hop limit in the IPv6 header is set to 255 on
transmission. Receivers verify that the hop limit is still 255,
to ensure that the packet has not passed through a router.

o Checking that the source address is a link-local unicast address.
 
raw add chain=icmp6 action=accept protocol=icmpv6 hop-limit=not-equal:255 dst-address=fe80::/10 comment="defconf: rfc4890 drop ll if hop-limit!=255"
raw add chain=icmp6 action=accept protocol=icmpv6 icmp-options=1:0-255 comment="defconf: dst unreachable"
raw add chain=icmp6 action=accept protocol=icmpv6 icmp-options=2:0-255 comment="defconf: packet too big"
raw add chain=icmp6 action=accept protocol=icmpv6 icmp-options=3:0-1 comment="defconf: limit exceeded"
raw add chain=icmp6 action=accept protocol=icmpv6 icmp-options=4:0-2 comment="defconf: bad header"
raw add chain=icmp6 action=accept protocol=icmpv6 icmp-options=144:0-255 comment="defconf: Mobile home agent address discovery"
raw add chain=icmp6 action=accept protocol=icmpv6 icmp-options=145:0-255 comment="defconf: Mobile home agent address discovery"
raw add chain=icmp6 action=accept protocol=icmpv6 icmp-options=146:0-255 comment="defconf: Mobile prefix solic"
raw add chain=icmp6 action=accept protocol=icmpv6 icmp-options=147:0-255 comment="defconf: Mobile prefix advert"
raw add chain=icmp6 action=accept protocol=icmpv6 icmp-options=128:0-255 limit=5,10:packet comment="defconf: echo request limit 5,10"
raw add chain=icmp6 action=accept protocol=icmpv6 icmp-options=129:0-255 limit=5,10:packet comment="defconf: echo reply limit 5,10"
raw add chain=icmp6 action=accept in-interface-list=LAN protocol=icmpv6 icmp-options=133:0-255 limit=5,10:packet hop-limit=equal:255 comment="defconf: rfc4890 router solic limit 5,10 only LAN"
raw add chain=icmp6 action=accept in-interface-list=LAN protocol=icmpv6 icmp-options=134:0-255 limit=5,10:packet hop-limit=equal:255 comment="defconf: rfc4890 router advert limit 5,10 only LAN"
Uncertain whether this is necessary? I accept Router Advertisements from my ISP here:

raw add chain=icmp6 action=accept in-interface=pppoe-out1 protocol=icmpv6 icmp-options=134:0-255 limit=5,10:packet hop-limit=equal:255 dst-address=ff02::/16 src-address=fe80::/16 comment="ISP Gateway: Router advert limit 5,10"
raw add chain=icmp6 action=accept in-interface-list=LAN protocol=icmpv6 icmp-options=135:0-255 limit=5,10:packet hop-limit=equal:255 comment="defconf: rfc4890 neighbor solic limit 5,10 only LAN"
raw add chain=icmp6 action=accept in-interface-list=LAN protocol=icmpv6 icmp-options=136:0-255 limit=5,10:packet hop-limit=equal:255 comment="defconf: rfc4890 neighbor advert limit 5,10 only LAN"
Must not the drop rule be the last in the raw icmp6 chain?
raw add chain=icmp6 action=drop protocol=icmpv6 comment="defconf: drop other icmp"
raw add chain=icmp6 action=accept in-interface-list=LAN protocol=icmpv6 icmp-options=141:0-255 limit=5,10:packet hop-limit=equal:255 comment="defconf: rfc4890 inverse ND solic limit 5,10 only LAN"
raw add chain=icmp6 action=accept in-interface-list=LAN protocol=icmpv6 icmp-options=142:0-255 limit=5,10:packet hop-limit=equal:255 comment="defconf: rfc4890 inverse ND advert limit 5,10 only LAN"
filter add chain=input action=accept protocol=icmpv6 comment="defconf: accept ICMPv6 after RAW"
filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
filter add chain=input action=accept protocol=udp port=33434-33534 comment="defconf: accept UDP traceroute"
filter add chain=input action=accept protocol=udp dst-port=546 src-address=fe80::/16 comment="defconf: accept DHCPv6-Client prefix delegation."
filter add chain=input action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE"
filter add chain=input action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH"
filter add chain=input action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP"
filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN"
filter add chain=forward action=drop protocol=icmpv6 hop-limit=equal:1 comment="defconf: rfc4890 drop hop-limit=1"
filter add chain=forward action=accept protocol=icmpv6 comment="defconf: accept ICMPv6 after RAW"
filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
filter add chain=forward action=accept protocol=139 comment="defconf: accept HIP"
filter add chain=forward action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"
}
 
anuser
Long time Member
Long time Member
Posts: 601
Joined: Sat Nov 29, 2014 7:27 pm

Re: v6.40rc [release candidate] is released!

Mon Jun 05, 2017 11:29 pm

I noticed that "caps scanner" button within CAPSMAN => registration table. Hitting that button and selecting any master interface results in "ERROR: feature is not implemented"?
 
itsieber
just joined
Posts: 1
Joined: Tue Jun 06, 2017 10:12 am

Re: v6.40rc [release candidate] is released!

Tue Jun 06, 2017 10:17 am

Hey Guys

Since the last update, all mi 5G Wifis don't coming up.

I have Reset all 5 AP's to factory. Also the factory config will only have the state "running up". And thats it.

2g don't have the Problems!

greets
Andy
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1623
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Tue Jun 06, 2017 3:09 pm

Version 6.39.2 [current] has been released:
viewtopic.php?f=21&t=122322
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1623
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Tue Jun 06, 2017 3:10 pm

Version 6.40rc18 has been released.
Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

Changes since previous version:
*) conntrack - fixed IPv6 connection tracking enable/disable;
*) defconf - added IPv6 default firewall configuration (IPv6 package must be enabled on reset);
*) defconf - improved IPv4 default firewall configuration;
*) fastpath - improved performance when packets for slowpath are received;
*) hotspot - added "address-list" support in "walled-garden" IP section;
*) ike1 - added support for "framed-pool" RADIUS attribute;
*) ike1 - kill phase1 instead of rekey if "mode-config" is used;
*) ike1 - removed SAs on DPD;
*) ike1 - send phase1 delete;
*) ike2 - added RADIUS attributes "Framed-Pool", "Framed-Ip-Address", "Framed-Ip-Netmask";
*) ike2 - added support for "mode-config" static address;
*) ike2 - prefer traffic selector with "mode-config" address;
*) l2tp - fixed handling of pre-authenticated L2TP sessions with CHAP authentication;
*) log - improved "l2tp" logs;
*) log - optimized "wireless,info" topic logs;
*) lte - improved SMS delivery report;
*) ppp - improved MLPPP packet forwarding performance;
*) socks - fixed crash while processing many simultaneous sessions;
*) tr069-client - fixed lost HTTP header on authorization;
*) wireless - allow VirutalAP on Level0 (24h demo) license;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after crash.
 
User avatar
nz_monkey
Forum Guru
Forum Guru
Posts: 2096
Joined: Mon Jan 14, 2008 1:53 pm
Location: Over the Rainbow
Contact:

Re: v6.40rc [release candidate] is released!

Wed Jun 07, 2017 11:09 am

Thank you for all the work on IPSEC
 
nescafe2002
Forum Veteran
Forum Veteran
Posts: 897
Joined: Tue Aug 11, 2015 12:46 pm
Location: Netherlands

Re: v6.40rc [release candidate] is released!

Wed Jun 07, 2017 12:30 pm

Regarding ipsec.. :)

Is connection tracking on ipsec traffic considered 'bad practice'?

I like to firewall my ipsec tunnels (block incoming, allow outgoing) and therefore need to accept established and related connections. Not sure how to handle this without connection tracking.

Edit:
Seems resolved in rc19:
*) ipsec - added "firewall=add-notrack" peer option (CLI only);
Last edited by nescafe2002 on Thu Jun 08, 2017 10:36 am, edited 1 time in total.
 
aboiles
Frequent Visitor
Frequent Visitor
Posts: 56
Joined: Sat Nov 07, 2015 6:52 pm

Re: v6.40rc [release candidate] is released!

Wed Jun 07, 2017 8:36 pm

Scheduler issue with v6.40 rc18.
Tested and confirmed only on CHR.
If the entry is set to run at startup with a recurrence, it will NOT run at all.
If the same entry is set to ONLY run at startup, it runs correctly.
If the same entry is set for recurrence ONLY, it runs correctly.
Change it to run both and it fails to run at all.
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1623
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Thu Jun 08, 2017 2:56 pm

Version 6.40rc19 has been released.
Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

Changes since previous version:
*) ike1 - send phase1 delete;
*) ike2 - added RADIUS attributes "Framed-Pool", "Framed-Ip-Address", "Framed-Ip-Netmask";
*) ipsec - added "firewall=add-notrack" peer option (CLI only);
*) l2tp-server - added "one-session-per-host" option;
*) ovpn - improved performance when receiving too many options;
*) wireless - fixed registration table "signal-strength" reporting for chains when using nv2;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after crash.
 
marianob85
just joined
Posts: 19
Joined: Wed Feb 08, 2017 9:47 pm

Re: v6.40rc [release candidate] is released!

Thu Jun 08, 2017 5:48 pm

Version 6.40rc19 ( upgraded from 6.40rc15)
No USB power on RB750Gr3
 
sup5
Member
Member
Posts: 359
Joined: Sat Jul 10, 2010 12:37 am

Re: v6.40rc [release candidate] is released!

Thu Jun 08, 2017 9:11 pm

*) wireless - fixed registration table "signal-strength" reporting for chains when using nv2;
The TX-Power value has been fixed.
The RX-Power on Ch1 is still a copy of the value of Ch0

See the actual output of a wireless link.
Red Colour: wrong
Green Colour: corrrect

Site A:
[admin@LHG5] /interface wireless registration-table> pr stats
0 interface=wlan1 ap=yes [...]
signal-strength=-62dBm signal-to-noise=51dB
signal-strength-ch0=-62dBm signal-strength-ch1=-62dBm
tx-signal-strength-ch0=-68dBm tx-signal-strength-ch1=-77dBm
[...]

Site B:
[admin@SXT-5] /interface wireless registration-table> pr stats
0 interface=wlan1 radio-name="LHG" ap=no bridge=yes [...]
signal-strength=-67dBm signal-to-noise=50dB
signal-strength-ch0=-68dBm signal-strength-ch1=-68dBm
tx-signal-strength-ch0=-62dBm tx-signal-strength-ch1=-74dBm
[...]
 
idlemind
Forum Guru
Forum Guru
Posts: 1146
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: v6.40rc [release candidate] is released!

Fri Jun 09, 2017 7:25 pm

Now in ip firewall:
/ip firewall address-list
add address=100.64.0.0/10 comment="defconf: RFC6890" list=bad_ipv4
/ip firewall raw
add action=drop chain=prerouting comment="defconf: drop from bogon IP's" in-interface-list=WAN src-address-list=bad_ipv4
I don't like this.

This valid address for WAN interface for end user.

Many ISP use CGN network.
The Shared Address Space address range is 100.64.0.0/10
Shared Address Space can only be used in Service Provider networks or on routing equipment that is able to do address translation across router the interfaces when addresses are identical on two different interfaces

---
Ramas
I just upgraded my hEX to latest and I'm not seeing anything in the default configuruation script for enhancements to the IPv4 now.
          /ip firewall nat add chain=srcnat out-interface-list=WAN ipsec-policy=out,none action=masquerade comment="defconf: masquerade"
           /ip firewall {
             filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
             filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
             filter add chain=input action=accept protocol=icmp comment="defconf: accept ICMP"
             filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN"
             filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy"
             filter add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy"
             filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
             filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked"
             filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
             filter add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="defconf:  drop all from WAN not>
           }
Like the others have stated, this is valid address space. It can be used by a service provider to address their equipment, like a DNS server or NTP server for example. It also could be used for CPE addressing. In fact it should be preferred when a service provider does not have a device public addressing for IPv4 over using RFC1918 addressing. You are more likely to have issues with users when you use RFC1918 addressing instead of RFC6598 addressing. This brings me to my last point, if this configuration update is coming back the comment should be altered to reflect the either both RFC680 which simply indicates it's allocated addressing and or RFC6598, the actual document for it's use, or just RFC6598.

Thoughts?
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: v6.40rc [release candidate] is released!

Sat Jun 10, 2017 11:33 pm

Grrrrrrrrr spend a lot of time on 6.40RC18 because the IKe2 with Android was not working any more and it was working on the 6.40RC13.
Could not find the problem it and it looked if the data was not finding it's way to the NAT and in the connection tab I only had the IKe2 connection but not the addresses from the ipsec-pool. Updated to 6.40RC19 and all return working again.

I had some frustration with importing the exported configuration files because a few lines had fields that had empty values...this is something I have suggested before to fix however I don't think it will ever happen and I wrote about in the Winbox 3.11 topic.

Very frustrating to be able to export the config and when you want the import it won't go because of all kind of errors.

Update: I do now export and then import directly the just exported file to see if I can import it the next time so that have an correct configfile.

I have now a syntax error on the this configline: add address=/48 advertise=no from-pool=ISP-v6prefix interface=pppoe-out1 this is dynamic configured and as soon the IPv6 comes up the prefix will in front of the /48.
When I change the line to ::/48 then I get: failure: already have interface with such name

I don't need that address manual entered so I removed the complete line now.

Not nice, my RB750Gr3 crashed and had to be reset and I had to reload the .backup file that I had ready. First time it would not accept and luckily in on the second try it worked.

Finally completed the portknocking part for IKe2 and now the knocked open part can now be closed by a script running every minute. I kept down the CPU usage to not seek for to remove external address when the remove IKe2 connections addresstable is empty.

I had the pleasure to have an other empty field in the configscreen so that had to knock always twice. I now closed the the open field and now it works on the first knock sequence. I really hope that one time this lack of checking on applying will be complete.
Last edited by msatter on Mon Jun 12, 2017 11:38 am, edited 1 time in total.
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 7044
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: v6.40rc [release candidate] is released!

Mon Jun 12, 2017 10:14 am

Now in ip firewall:
/ip firewall address-list
add address=100.64.0.0/10 comment="defconf: RFC6890" list=bad_ipv4
/ip firewall raw
add action=drop chain=prerouting comment="defconf: drop from bogon IP's" in-interface-list=WAN src-address-list=bad_ipv4
I don't like this.

This valid address for WAN interface for end user.

Many ISP use CGN network.
The Shared Address Space address range is 100.64.0.0/10
Shared Address Space can only be used in Service Provider networks or on routing equipment that is able to do address translation across router the interfaces when addresses are identical on two different interfaces

---
Ramas
I just upgraded my hEX to latest and I'm not seeing anything in the default configuruation script for enhancements to the IPv4 now.
          /ip firewall nat add chain=srcnat out-interface-list=WAN ipsec-policy=out,none action=masquerade comment="defconf: masquerade"
           /ip firewall {
             filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
             filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
             filter add chain=input action=accept protocol=icmp comment="defconf: accept ICMP"
             filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN"
             filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy"
             filter add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy"
             filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
             filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked"
             filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
             filter add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="defconf:  drop all from WAN not>
           }
Like the others have stated, this is valid address space. It can be used by a service provider to address their equipment, like a DNS server or NTP server for example. It also could be used for CPE addressing. In fact it should be preferred when a service provider does not have a device public addressing for IPv4 over using RFC1918 addressing. You are more likely to have issues with users when you use RFC1918 addressing instead of RFC6598 addressing. This brings me to my last point, if this configuration update is coming back the comment should be altered to reflect the either both RFC680 which simply indicates it's allocated addressing and or RFC6598, the actual document for it's use, or just RFC6598.

Thoughts?
ipv4 firewall was reverted.
 
idlemind
Forum Guru
Forum Guru
Posts: 1146
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: v6.40rc [release candidate] is released!

Mon Jun 12, 2017 6:27 pm

ipv4 firewall was reverted.
Thanks, mrz! Any improvement in the default firewall is worth while. You got us all excited with the IPv6 one so now we're playing with the changes in both IPv4 and IPv6. I look forward to seeing more improvements!

DHCPv6 Server
DHCP / DHCPv6 out of the box integration with DNS resolver (not the script approach)
... other stuff I can't think of at the moment!
 
biatche
Member Candidate
Member Candidate
Posts: 128
Joined: Tue Oct 13, 2015 6:50 am

Re: v6.40rc [release candidate] is released!

Tue Jun 13, 2017 7:59 am


ipv4 firewall was reverted.
why was it reverted anyway
Last edited by biatche on Tue Jun 13, 2017 10:31 pm, edited 1 time in total.
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 2865
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: v6.40rc [release candidate] is released!

Tue Jun 13, 2017 8:17 am

@biatche:
Writing as moderator:
Could you PLEASE DO NOT CITE FULL POST if it is not needed. Can you count ratio of your words to citation ? It is almost 0%.
Do you think that it is necessary to make such long citations ? Do you think that full post need to be repeated post under post ? Do you think we have problem following thread ? If you need to emphasize on particular words from long post then just cite these words.
Please edit your post and treat this as prewarning.
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1623
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Tue Jun 13, 2017 12:35 pm

Version 6.40rc20 has been released.
Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

Changes since previous version:
*) dhcp - added "debug" logs on MAC address change;
*) ike2 - added support for "Mikrotik_Address_List" RADIUS attribute;
*) lte - added "accounting" logs for LTE connections;
*) lte - improved reliability on SXT LTE;
*) wireless - fixed rare crash on cap disable;
*) wireless - fixed registration table "signal-strength" reporting for chains when using nv2;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after crash.
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: v6.40rc [release candidate] is released!

Tue Jun 13, 2017 1:28 pm

@biatche:
Writing as moderator:
Could you PLEASE DO NOT CITE FULL POST if it is not needed. Can you count ratio of your words to citation ? It is almost 0%.
Do you think that it is necessary to make such long citations ? Do you think that full post need to be repeated post under post ? Do you think we have problem following thread ? If you need to emphasize on particular words from long post then just cite these words.
Please edit your post and treat this as prewarning.
Maybe the the forum can be updated to a new way of answering. Added could be "Answering to this posting" next to post reply and quote.

In the new posting on the top there is a automatically generated line that states "In reaction to post xxxxxx" and the xxxxxx is a number that is clickable and links to the post answered to.
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 26322
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Tue Jun 13, 2017 1:29 pm

you can remove the unnecessary parts from the quote, leave only the author and relevant details.
 
th0massin0
Member Candidate
Member Candidate
Posts: 156
Joined: Sun May 11, 2014 4:16 am
Location: Poland

Re: v6.40rc [release candidate] is released!

Tue Jun 13, 2017 1:47 pm

Version 6.40rc20 has been released.
Before an upgrade:
Changes since previous version:
*) lte - added "accounting" logs for LTE connections;
*) lte - improved reliability on SXT LTE;
Does the SXT LTE fix is the same as is current (6.39.2) firmware or is it something else?
 
uldis
MikroTik Support
MikroTik Support
Posts: 3446
Joined: Mon May 31, 2004 2:55 pm

Re: v6.40rc [release candidate] is released!

Tue Jun 13, 2017 1:52 pm

This RC version has some additional stability improvements to SXT LTE compared to v6.39.2
 
User avatar
boldsuck
Frequent Visitor
Frequent Visitor
Posts: 60
Joined: Sun Sep 01, 2013 1:07 am
Location: Germany

Re: v6.40rc [release candidate] is released!

Tue Jun 13, 2017 8:19 pm

Why were the RAW rules omitted? There are problems because of the dynamic IPsec rules?

On RB2011 from v6.40rc8 - rc20
After System Reset_Configuration and new first setup on RB2011 + adding an pppoe-out client.
/system default-configuration
/ipv6 firewall
filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"
filter add chain=forward action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN" 

/ip firewall
filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN"
The setup script then returns:
> export
/ipv6 firewall
filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"
filter add chain=forward action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"

/ip firewall
filter add chain=input action=drop in-interface=pppoe-out1 comment="defconf: drop all not coming from LAN"

Is not better to write directly WAN instead of !LAN at all 3 rules. The interface list for a zone based firewall are there.
 
biatche
Member Candidate
Member Candidate
Posts: 128
Joined: Tue Oct 13, 2015 6:50 am

Re: v6.40rc [release candidate] is released!

Tue Jun 13, 2017 10:27 pm

@biatche:
Writing as moderator:
Could you PLEASE DO NOT CITE FULL POST if it is not needed. Can you count ratio of your words to citation ? It is almost 0%.
Do you think that it is necessary to make such long citations ? Do you think that full post need to be repeated post under post ? Do you think we have problem following thread ? If you need to emphasize on particular words from long post then just cite these words.
Please edit your post and treat this as prewarning.
i didnt bother to look at the content.. i just hit "reply with quote" button. maybe you could fix the way that button works. mrz multi quoted himself #122. so whatever, ill change it.
 
biatche
Member Candidate
Member Candidate
Posts: 128
Joined: Tue Oct 13, 2015 6:50 am

Re: v6.40rc [release candidate] is released!

Tue Jun 13, 2017 10:36 pm

@biatche:
Writing as moderator:
Could you PLEASE DO NOT CITE FULL POST if it is not needed. Can you count ratio of your words to citation ? It is almost 0%.
Do you think that it is necessary to make such long citations ? Do you think that full post need to be repeated post under post ? Do you think we have problem following thread ? If you need to emphasize on particular words from long post then just cite these words.
Please edit your post and treat this as prewarning.
Maybe the the forum can be updated to a new way of answering. Added could be "Answering to this posting" next to post reply and quote.

In the new posting on the top there is a automatically generated line that states "In reaction to post xxxxxx" and the xxxxxx is a number that is clickable and links to the post answered to.
exactly. i typed all of it with haste, looking only at the content i typed. i didn't bother to look at all the automated quoted text. i believe that's what a moderator is here for in the case a forum button doesn't work as efficient as it can be.
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 2865
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 1:04 am

That is the problem ... you do not bother.Why should you ? Maybe moderator should edit your posts for your convenience as you do not bother ?
Do you think that driver job is just driving a car without necessity to follow traffic rules as police is for obeying them ?
Have you checked difference in funcionality of "Post replay" button versus "Reply with quote" ?
Cite.PNG
You do not have the required permissions to view the files attached to this post.
 
brwainer
newbie
Posts: 47
Joined: Tue Feb 02, 2016 2:55 am

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 1:16 am

That is the problem ... you do not bother.Why should you ? Maybe moderator should edit your posts for your convenience as you do not bother ?
Do you think that driver job is just driving a car without necessity to follow traffic rules as police is for obeying them ?
Have you checked difference in funcionality of "Post replay" button versus "Reply with quote" ? Cite.PNG
Please cite or link the rules of the forum that indicate that full-quoting is not allowed. There is no visible forum rules either in the forum headers, footer, nor in the terms of registration given to a new user (at ucp.php?mode=register ). On every other forum I visit, full quoting is actually recommended and preferred unless the message you are quoting is more than a few paragraphs, or has embedded images. The terms say that Mikrotik (and moderators) can edit a post, but nowhere does it say that an account might face consequences for content that is allowed.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 1:29 am

Allowed or not, it's annoying. All that endless scrolling over quotes, just to see another "me too" type of reply below, that's just wrong. On the other hand, I do agree that multi-topic threads like this one are exceptions, and little more quotes than normal are fine. Still, no need to overdo it.

Btw, it would be probably wise if some moderator split this quoting discussion in another thread.
 
brwainer
newbie
Posts: 47
Joined: Tue Feb 02, 2016 2:55 am

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 1:34 am

Allowed or not, it's annoying. All that endless scrolling over quotes, just to see another "me too" type of reply below, that's just wrong.
I can agree, especially on mobile, that full quoting can be annoying if the resulting reply is limited in content.
On the other hand, I do agree that multi-topic threads like this one are exceptions, and little more quotes than normal are fine. Still, no need to overdo it.
This is precisely where "Reply with Quote" should be used. When there are multiple on-topic discussions in a single thread, quoting allows the reader to maintain understanding of the context. Especially if you call out the part you are referring to exactly, such as this.
Btw, it would be probably wise if some moderator split this quoting discussion in another thread.
I agree, I responded off-topic in this thread since it was responding to a moderator whose message was off-topic.
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 2865
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 1:37 am

I do not say that quoting is not allowed. There is no such rule. I just ASK to not cite full post just under this post. Do you rally need this to follow the thread ? Aren't you able to go back to previous posts to read them ? It is not an argument that "other forums" used to use full post quoting.
I am asking users to make forum more ergonomic.
Forum's new default skin is quite wordy and tablet/smartphone friendly. It implies that nowadays IMHO it should be measured in meters not in post count. Aren't your fingers tired scrolling meters of screens just beause someone needs to cite post under post with no special need ?
 
brwainer
newbie
Posts: 47
Joined: Tue Feb 02, 2016 2:55 am

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 1:47 am

I do not say that quoting is not allowed. There is no such rule.
Tue Jun 13, 2017 1:17 am:
@biatche:
Please edit your post and treat this as prewarning.
So why would that be a prewarning if it is allowed and there is no rule? I take no offense to what you are trying to do, I agree that it would be best if everyone used quoting only strategically. I have an issue that you called it a "prewarning" which coming from a moderator means that repeat offenses would become a warning and then a ban or other restriction. I was silent on the issue until I read that line.
 
biatche
Member Candidate
Member Candidate
Posts: 128
Joined: Tue Oct 13, 2015 6:50 am

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 7:45 am

look people. its true that its annoying and convoluted. i didnt bother to check because i was in a hurry. i typed it and left my laptop immediately. at the same time, some 'reply with quote' buttons in other forums wouldn't quote the entire thing but only the last quote. in some others, its fully quoted but has some javascript sort of effect that makes it appear less convoluted.

whatever, its my fault, mrz didn't do anything incorrect. apologies that your eyes hurt. the forum design and rules are perfect.

now maybe we should just focus on 6.40 and not multiquotes.
@biatche:
Please edit your post and treat this as prewarning.

I wonder if mrz was given a prewarning too.
Last edited by biatche on Wed Jun 14, 2017 8:16 am, edited 1 time in total.
 
biatche
Member Candidate
Member Candidate
Posts: 128
Joined: Tue Oct 13, 2015 6:50 am

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 8:15 am

wheres the delete post button? looking to delete this post.
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 26322
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 9:05 am

What are you guys even talking about? Just use the forum Default Theme where long Quotes are automatically resized! It is your own choice to set the theme to one designed in the late nineties, and that comes without any such features.

This is how I see a very long inline quote. Notice the scroll on the right:
screen 7.jpg
You can't have two things - more javascript and less javascript! You want features, do not use custom skin. All forum features go into the default skin only.
I would also like to point out, that this topic is about RC releases and your posts are about to be deleted.
You do not have the required permissions to view the files attached to this post.
 
amokkatmt
newbie
Posts: 33
Joined: Mon Oct 24, 2011 3:31 pm

Re: RE: Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 9:18 am

What are you guys even talking about?
Tapatalk (Android app for the phpBB) is atvertised when browsing forum from mobile browser. And it does not shrink quotes.
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 26322
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: RE: Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 9:22 am

What are you guys even talking about?
Tapatalk (Android app for the phpBB) is atvertised when browsing forum from mobile browser. And it does not shrink quotes.
I have no control over what 3rd party tools do. Just don't use it.
 
amokkatmt
newbie
Posts: 33
Joined: Mon Oct 24, 2011 3:31 pm

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 9:25 am

Ok, it is 3rd party, but it is advertised and adviced to use by forum.mikrotik.com
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 26322
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 9:31 am

it is advertised
This is the plugin misbehaving. Fixed it.
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1623
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 3:37 pm

Version 6.40rc21 has been released.
Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

Changes since previous version:
!) wireless - added Nv2 AP synchronization feature (for experimental use)(CLI only);
*) capsman - added "current-registered-clients" and "current-authorized-clients" count for CAP interfaces (CLI only);
*) certificate - added "crl-use" setting to disable CRL use (CLI only);
*) CCR / CRS2xx - fixed Optech sfp-10G-tx module compatibility with SFP+ ports;
*) dude - fixed server crash;
*) export - added default "init-delay" setting for "/routerboard settings" menu;
*) ping - fixed ping getting stuck (after several thousands of ping attempts);
*) rb750gr3 - fixed USB power;
*) userman - lookup language files also in "/flash" directory;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after crash.

Visit this link in order to find out more about new wireless feature:
https://wiki.mikrotik.com/wiki/Manual:N ... ronization
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1764
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 4:00 pm

Version 6.40rc21 has been released.
!) wireless - added Nv2 AP synchronization feature (for experimental use)(CLI only);
Visit this link in order to find out more about new wireless feature:
https://wiki.mikrotik.com/wiki/Manual:N ... ronization
And that is one unexpected development.... and just before the vacation....
 
User avatar
CyberTod
Long time Member
Long time Member
Posts: 510
Joined: Wed Jan 25, 2012 10:23 am

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 4:09 pm

!) wireless - added Nv2 AP synchronization feature (for experimental use)(CLI only);
Sounds very promising.
 
sakirozkan
Frequent Visitor
Frequent Visitor
Posts: 54
Joined: Sat Jun 14, 2014 12:19 pm

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 6:00 pm

Version 6.40rc21 has been released.
!) wireless - added Nv2 AP synchronization feature (for experimental use)(CLI only);

Visit this link in order to find out more about new wireless feature:
https://wiki.mikrotik.com/wiki/Manual:N ... ronization
Good experiment..
 
Zod
Frequent Visitor
Frequent Visitor
Posts: 91
Joined: Mon Apr 23, 2012 11:02 pm

Re: v6.40rc [release candidate] is released!

Wed Jun 14, 2017 11:38 pm

A step closer but requires AP's to be on the same frequency though :(
 
uldis
MikroTik Support
MikroTik Support
Posts: 3446
Joined: Mon May 31, 2004 2:55 pm

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 9:28 am

A step closer but requires AP's to be on the same frequency though :(
There is no need for synchronization if your APs on the same tower uses different frequencies as then there is no big interference between them.
 
User avatar
CyberTod
Long time Member
Long time Member
Posts: 510
Joined: Wed Jan 25, 2012 10:23 am

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 9:39 am

Actually there is. If there are 2 antennas on the same tower and let's say 1m between them even on different frequency and some angle between them - there is interference, speaking from experience.
 
mistry7
Forum Guru
Forum Guru
Posts: 1480
Joined: Tue Oct 13, 2009 11:57 am
Location: Germany

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 11:43 am

Hi,

i tested sync mode for nv2, but it did not run for me

I set AP1 to sync-master, client connectiong all OK
But when i set AP2 or AP3 to sync-slave, the Clients did not come back.
Log says nothing AP says runnig but no clients are connecting
on AP1 Master i see nothing that communication with AP2 or AP3 for sync is done.

mistry7
 
doush
Long time Member
Long time Member
Posts: 665
Joined: Thu Jun 04, 2009 3:11 pm

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 1:01 pm

A step closer but requires AP's to be on the same frequency though :(
There is no need for synchronization if your APs on the same tower uses different frequencies as then there is no big interference between them.
@Uldis
You should know better than this.
There is interference even if you are 200mhz away from an AP.
 
uldis
MikroTik Support
MikroTik Support
Posts: 3446
Joined: Mon May 31, 2004 2:55 pm

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 1:07 pm

Hi,

i tested sync mode for nv2, but it did not run for me

I set AP1 to sync-master, client connectiong all OK
But when i set AP2 or AP3 to sync-slave, the Clients did not come back.
Log says nothing AP says runnig but no clients are connecting
on AP1 Master i see nothing that communication with AP2 or AP3 for sync is done.

mistry7
Please enable the wireless,debug logs on the Master AP and also on the Slave APs.
What does the wireless monitor interface say on the AP2 or AP3?
 
uldis
MikroTik Support
MikroTik Support
Posts: 3446
Joined: Mon May 31, 2004 2:55 pm

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 1:08 pm

A step closer but requires AP's to be on the same frequency though :(
There is no need for synchronization if your APs on the same tower uses different frequencies as then there is no big interference between them.
@Uldis
You should know better than this.
There is interference even if you are 200mhz away from an AP.
If the APs are very close together then yes.
At the moment the current implementation works only on the same wireless frequency. We could think how to sync the APs that are on different frequencies but located on the same tower and connected to the same ethernet network.
 
User avatar
CyberTod
Long time Member
Long time Member
Posts: 510
Joined: Wed Jan 25, 2012 10:23 am

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 1:49 pm

If the APs are very close together then yes.
At the moment the current implementation works only on the same wireless frequency. We could think how to sync the APs that are on different frequencies but located on the same tower and connected to the same ethernet network.
That is exactly what we need. Sync on the same tower of course, but on different frequencies too. The fact that you are thinking about testing with different frequencies too is very good to hear.
 
User avatar
soulflyhigh
Member Candidate
Member Candidate
Posts: 179
Joined: Wed Sep 08, 2010 11:20 am

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 2:16 pm

If the APs are very close together then yes.
At the moment the current implementation works only on the same wireless frequency. We could think how to sync the APs that are on different frequencies but located on the same tower and connected to the same ethernet network.
That is exactly what we need. Sync on the same tower of course, but on different frequencies too. The fact that you are thinking about testing with different frequencies too is very good to hear.
I completely agree with this.
Even if some additional (GPS capable) piece of hardware is needed (per site/tower) it would be worth it.
With properly implemented synchronization SNR goes up, throughput goes up, everybody is happy :) .

Regards,
M.
 
User avatar
honzam
Forum Guru
Forum Guru
Posts: 2394
Joined: Wed Feb 27, 2008 10:27 pm
Location: Czech Republic

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 2:29 pm

At the moment the current implementation works only on the same wireless frequency. We could think how to sync the APs that are on different frequencies but located on the same tower and connected to the same ethernet network.
+1
 
HaQs
Member Candidate
Member Candidate
Posts: 153
Joined: Sat Oct 20, 2007 3:26 pm
Location: POLAND

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 6:20 pm

+1 for nv2 sync all MT wireles on this some tower
 
mistry7
Forum Guru
Forum Guru
Posts: 1480
Joined: Tue Oct 13, 2009 11:57 am
Location: Germany

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 6:50 pm

Hi,

i tested sync mode for nv2, but it did not run for me

I set AP1 to sync-master, client connectiong all OK
But when i set AP2 or AP3 to sync-slave, the Clients did not come back.
Log says nothing AP says runnig but no clients are connecting
on AP1 Master i see nothing that communication with AP2 or AP3 for sync is done.

mistry7
Please enable the wireless,debug logs on the Master AP and also on the Slave APs.
What does the wireless monitor interface say on the AP2 or AP3?
You give the Answer some topics later, it works only on the same Frequenzy, this config is not possile, at the moment.
 
xrayd
Frequent Visitor
Frequent Visitor
Posts: 58
Joined: Thu Feb 27, 2014 7:28 pm

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 7:14 pm

Version 6.40rc21 has been released.

!) wireless - added Nv2 AP synchronization feature (for experimental use)(CLI only);
Very good news!! Thanks! :)
I've been waiting for ages!
 
User avatar
bajodel
Long time Member
Long time Member
Posts: 551
Joined: Sun Nov 24, 2013 8:30 am
Location: Italy

Re: v6.40rc [release candidate] is released!

Thu Jun 15, 2017 7:43 pm

.. [CUT].. We could think how to sync the APs that are on different frequencies but located on the same tower and connected to the same ethernet network.
absolutely +1

Another thing; on current stable/rc scheduler has some issues, if you create new item it works but if you create from 'copy' it never runs on scheduled time.
 
server8
Long time Member
Long time Member
Posts: 592
Joined: Fri Apr 22, 2011 1:27 pm

Re: v6.40rc [release candidate] is released!

Fri Jun 16, 2017 9:09 am

Same channel means that the slave APs listen the radio of the master AP before to talk, it's a good trick but it's light years far away from the commercial solutions of the other vendors :-(
 
aTan
Frequent Visitor
Frequent Visitor
Posts: 54
Joined: Tue Nov 01, 2011 11:55 am

Re: v6.40rc [release candidate] is released!

Fri Jun 16, 2017 9:23 am

Version 6.40rc21 has been released.
*) dude - fixed server crash;
I guess it is not [Ticket#2017021722001071].
 
UpRunTech
Member Candidate
Member Candidate
Posts: 209
Joined: Fri Jul 27, 2012 12:11 pm

Re: v6.40rc [release candidate] is released!

Fri Jun 16, 2017 5:42 pm

We could think how to sync the APs that are on different frequencies but located on the same tower and connected to the same ethernet network.
You could take some ideas from or use PTP (https://en.wikipedia.org/wiki/Precision_Time_Protocol) to synchronise the APs internal clocks over ethernet and hence transmission times from a collection of APs on a tower without having to mess with GPS. You only need relative not absolute time synchronisation. How well it works depends on how quickly you can get an incoming ethernet frame timestamped - but the articles all suggest sub-microsecond is possible.
 
idlemind
Forum Guru
Forum Guru
Posts: 1146
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: v6.40rc [release candidate] is released!

Fri Jun 16, 2017 6:20 pm

*) ping - fixed ping getting stuck (after several thousands of ping attempts);
As always, I love to see the progress you guys make day by day. With that said and while you're in mucking around with ping. Can you update it to support IPv6 name resolution. I suspect someone is using a legacy system call ...
[admin@rtr1] > ping count=2 www.google.com 
  SEQ HOST                                     SIZE TTL TIME  STATUS                                                                                                                                                                    
    0 172.217.8.196                              56  56 15ms 
    1 172.217.8.196                              56  56 23ms 
    sent=2 received=2 packet-loss=0% min-rtt=15ms avg-rtt=19ms max-rtt=23ms 

[admin@rtr1] > ping count=2 ipv6.google.com   
invalid value for argument address:
    invalid value of mac-address, mac address required
    invalid value for argument ipv6-address
    failure: dns name exists, but no appropriate record
[admin@rtr1] > 
Can't post attachments in this thread so ... http://imgur.com/a/pRfJW

My previous post here on the forums regarding this: viewtopic.php?f=2&t=120802&p=593973&hil ... ng#p593973
 
0ldman
Forum Guru
Forum Guru
Posts: 1465
Joined: Thu Jul 27, 2006 5:01 am

Re: v6.40rc [release candidate] is released!

Sat Jun 17, 2017 6:12 am

Another vote for sync even for adjacent channels.

Most of us *have* a lot of hardware on the tower. As it is I've got three feeds and one access point on one tower. I've got to turn the tx power down to keep noise from being an issue, which is just good practice, but sync would allow more headroom and allow use of more than four channels on the 5GHz band.

We're catching hell trying to find a clean channel in the 5GHz band on our loaded towers. Even with the entire 5GHz band, which means some of my hardware isn't Mikrotik, it still takes careful planning to pull it off without issues. This means that if someone starts interfering on a particular channel I've got problems. Sync would mean I could put them closer together even if I don't reuse the same channel.
 
0ldman
Forum Guru
Forum Guru
Posts: 1465
Joined: Thu Jul 27, 2006 5:01 am

Re: v6.40rc [release candidate] is released!

Sat Jun 17, 2017 12:33 pm

I decided to try it out on a few of my towers in a relatively noisy area. I've got six 2.4GHz access points within about 6 miles of each other.

When I try to enable nv2-sync I don't get any error messages, no messages related to nv2 at all aside from the confirmation of the command, but the sync-slaves will not allow any connections until I set them back to dynamic downlink mode.

On a positive note, 40rc21 seems to have better performance on nv2 than the previous builds.
 
mistry7
Forum Guru
Forum Guru
Posts: 1480
Joined: Tue Oct 13, 2009 11:57 am
Location: Germany

Re: v6.40rc [release candidate] is released!

Sat Jun 17, 2017 12:50 pm

Hi Oldman,


did you see the need of sync-secret?


Master AP:

/interface wireless set wlan1 nv2-mode=sync-master nv2-sync-secret=Tower1

Slave AP:

/interface wireless set wlan1 nv2-mode=sync-slave nv2-sync-secret=Tower1

mistry7
 
Zod
Frequent Visitor
Frequent Visitor
Posts: 91
Joined: Mon Apr 23, 2012 11:02 pm

Re: v6.40rc [release candidate] is released!

Sat Jun 17, 2017 3:04 pm

A step closer but requires AP's to be on the same frequency though :(
There is no need for synchronization if your APs on the same tower uses different frequencies as then there is no big interference between them.
You ARE joking right ? Does Mikrotik really think that is the case ??? Have they ever run sectors in the field ? Even with RF Armour and 20' vertical and 6' horizontal separation it is a BIG problem. It absolutely DOES matter particularly if you run 802-N cards !

This explains why Mikrotik are a year behind the competition on Sync, and why I, and many other WISPs are being forced to abandon thousands of Mikrotik radios and start installing Cambium, or Ubiquiti, or Mimosa, or Telrad instead.

So sad.
 
mistry7
Forum Guru
Forum Guru
Posts: 1480
Joined: Tue Oct 13, 2009 11:57 am
Location: Germany

Re: v6.40rc [release candidate] is released!

Sat Jun 17, 2017 11:11 pm

@zod

Yes mikrotik is thinking Wireless Works that way
 
Zod
Frequent Visitor
Frequent Visitor
Posts: 91
Joined: Mon Apr 23, 2012 11:02 pm

Re: v6.40rc [release candidate] is released!

Sun Jun 18, 2017 1:02 am

@zod

Yes mikrotik is thinking Wireless Works that way
Yes - that is painfully evident. They seem to be living in the B/G days when near channel interference didn't impact us very much. Sticking their heads in the sand and ignoring reality is not a valid business strategy !!!

Funny but I'd think they would know how their own N cards work ? Well I still have a thousand of them out there that we are ripping down and replacing with anything BUT Mikrotik as quickly as I can afford to - I guess I can send them a few hundred - maybe they can plug them in and ignore the performance impact of near channel noise like they have for the past year or more.

I really regret choosing Mikrotik over all the other options for the past 15 years.... This is just pathetic.
 
mistry7
Forum Guru
Forum Guru
Posts: 1480
Joined: Tue Oct 13, 2009 11:57 am
Location: Germany

Re: v6.40rc [release candidate] is released!

Sun Jun 18, 2017 8:28 am

Hi Zod,


I dont realy regret my choose, when i look to the competiors they all
have there Problems....

GPS Sync is now working with Airmax AC not yesterday
I dont had to reflash more then 100 CPE because of malware, another WISPs has to.


What i am realy missing is Spectral-scan and Spectral-history
I used these functions every day, interferrence is now Panic on AC-Equipment without
These Tools!
 
server8
Long time Member
Long time Member
Posts: 592
Joined: Fri Apr 22, 2011 1:27 pm

Re: v6.40rc [release candidate] is released!

Sun Jun 18, 2017 12:31 pm

GPS Sync is now working with Airmax AC not yesterday
mistry7 you are wrong https://community.ubnt.com/t5/airMAX-AC ... 63941#M454 :-)

Cambium epmp2000 has rock solid GPS sync with interference filter and it has beamforming in rx and the new expensive medusa hardware has beamformig tx/rx and mu-mimo up to 7 streams (theoretical 500Mb/s@20mhz +200Mb/s for real)

We have +5000 mikrotik CPE installed changing all the hardware is too expensive so we are waiting for mikrotik gps sync or we 'll "elevate" to cambium when 'll be available for mikrotik hardware
 
Zod
Frequent Visitor
Frequent Visitor
Posts: 91
Joined: Mon Apr 23, 2012 11:02 pm

Re: v6.40rc [release candidate] is released!

Sun Jun 18, 2017 2:23 pm

Hi Zod,

GPS Sync is now working with Airmax AC not yesterday
I dont had to reflash more then 100 CPE because of malware, another WISPs has to.

What i am realy missing is Spectral-scan and Spectral-history
I used these functions every day, interferrence is now Panic on AC-Equipment without
These Tools!
I agree that the worms/viruses are a problem for ubiquiti based networks, but if the network is designed right they should not be able to get to the radios to infect them.

Spectral history would be a nice feature to have - have you seen Mimosa's ? But sync is absolutely essential.
 
Tonda
Member Candidate
Member Candidate
Posts: 165
Joined: Thu Jun 30, 2005 12:59 pm

Re: v6.40rc [release candidate] is released!

Tue Jun 20, 2017 12:12 pm

rb750gr3 - fixed USB power;
What exactly does this mean?
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: v6.40rc [release candidate] is released!

Tue Jun 20, 2017 12:17 pm

rb750gr3 - fixed USB power;
What exactly does this mean?
viewtopic.php?f=21&t=121198&start=100#p602070

It can mean different things and most likely it the starting of USB stuff.
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1623
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Tue Jun 20, 2017 2:45 pm

Version 6.40rc24 has been released.
Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

Changes since previous version:
*) capsman - added "current-registered-clients" and "current-authorized-clients" count for CAP interfaces;
*) discovery - fixed timeouts for LLDP neighbours;
*) ethernet - fixed rare linking problem with forced 10Mbps full-duplex mode;
*) metarouter - fixed display of bogus error message on startup;
*) modem - added support for ZTE TE W120;
*) ovpn - added support for topology subnet for IP mode;
*) ovpn - added support for "push-continuation";
*) ovpn - fixed duplicate default gateway presence when receiving extra routes;
*) packages - increased automatic download retry interval to 5 minutes if there is no free disk space;
*) ppp - use interface name instead of IP as default route gateway;
*) proxy - fixed rare program crash after closing client connection;
*) quickset - added special firewall exception rules for IPSec;
*) quickset - fixed incorrect VPN address value on arm and tilera;
*) routerboard - added "caps-mode" option for "reset-configuration" (CLI only);
*) routerboard - added "caps-mode-script" for default-configuration print;
*) sms - decode reports in readable format;
*) snmp - added CAPsMAN interface statistics;
*) snmp - fixed wireless interface walk table id ordering;
*) winbox - added "session-uptime" to LTE interface;
*) winbox - added "src-address-list" & "dst-address-list" to HotSpot Walled Garden;
*) winbox - fixed wireless interface "amsdu-threshold" max limit;
*) winbox - moved LTE info fields to status tab;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after crash.
 
User avatar
juanvi
Member Candidate
Member Candidate
Posts: 165
Joined: Mon May 05, 2014 6:55 pm
Location: SPAIN

Re: v6.40rc [release candidate] is released!

Tue Jun 20, 2017 2:57 pm

Removed
Last edited by juanvi on Tue Jun 27, 2017 12:20 pm, edited 2 times in total.
 
mietus
Member Candidate
Member Candidate
Posts: 122
Joined: Mon Jan 30, 2006 11:14 pm
Location: Poland

Re: v6.40rc [release candidate] is released!

Tue Jun 20, 2017 4:27 pm

Any more details?

*) ethernet - fixed rare linking problem with forced 10Mbps full-duplex mode;
 
biatche
Member Candidate
Member Candidate
Posts: 128
Joined: Tue Oct 13, 2015 6:50 am

Re: v6.40rc [release candidate] is released!

Tue Jun 20, 2017 4:37 pm

still no mstp?..
 
idlemind
Forum Guru
Forum Guru
Posts: 1146
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: v6.40rc [release candidate] is released!

Tue Jun 20, 2017 4:45 pm

*) quickset - added special firewall exception rules for IPSec;
I saw that the default configuration firewall rules were back at least in 6.40rc21. My upgrade to 6.40rc24 went smoothly. Are the references to untracked connections an issue? I know in some of the earlier versions of the rules were using RAW tables, this is likely what caused the inclusion of untracked.

Next, In the IPv6 firewall filter rules you are accepting UDP 500 and 4500 along with IPsec-AH and IPsec-ESP on input and forward. In the IPv4 firewall filter you are using the IPsec policy feature of the firewall filter. Is their a reason for the difference? It seems IPv6 firewall filter supports IPsec-policy as well. Along with this I'm not sure why there isn't an ipsec-policy=in,none in the IPv4 firewall to allow the ESP packets to come in or is it expected they'll get picked up by established, related?

^^ I run this release on a hex gr3 for reference.
 
0ldman
Forum Guru
Forum Guru
Posts: 1465
Joined: Thu Jul 27, 2006 5:01 am

Re: v6.40rc [release candidate] is released!

Wed Jun 21, 2017 1:22 pm

I did. I used a good password, a stupid password, the word password, Tower1... nada.

So far I can't get anything to sync. The access points see each other in a scan with a signal of around -75dB. If I set any one of these as a client they will connect to the others.

edit: Just got it to work. Apparently if nv2 is set to auto it will not sync.

I had a rather massive drop in bandwidth, but it appeared to sync. I may need to try different channels. When I reverted the slave back to the previous channel bandwidth on both links more than doubled.
Hi Oldman,


did you see the need of sync-secret?


Master AP:

/interface wireless set wlan1 nv2-mode=sync-master nv2-sync-secret=Tower1

Slave AP:

/interface wireless set wlan1 nv2-mode=sync-slave nv2-sync-secret=Tower1

mistry7
 
mducharme
Trainer
Trainer
Posts: 1777
Joined: Tue Jul 19, 2016 6:45 pm
Location: Vancouver, BC, Canada

Re: v6.40rc [release candidate] is released!

Wed Jun 21, 2017 10:01 pm

While you are working on IPv6 stuff, can you please add 'set priority' as an action in IPv6 firewall? We badly need this functionality as we use it extensively with IPv4. Thanks!
 
FIPTech
Long time Member
Long time Member
Posts: 558
Joined: Tue Dec 22, 2009 1:53 am

Re: v6.40rc [release candidate] is released!

Wed Jun 21, 2017 10:40 pm

We could think how to sync the APs that are on different frequencies but located on the same tower and connected to the same ethernet network.
You could take some ideas from or use PTP (https://en.wikipedia.org/wiki/Precision_Time_Protocol) to synchronise the APs internal clocks over ethernet and hence transmission times from a collection of APs on a tower without having to mess with GPS. You only need relative not absolute time synchronisation. How well it works depends on how quickly you can get an incoming ethernet frame timestamped - but the articles all suggest sub-microsecond is possible.
For this to work, there are two solutions :

- the radio clock need to have an input for a sync reference, and a sync generator is needed to generate the sync carrier on the right frequency.

- the radio clock need a VCO clock, voltage controlled oscillator, so that it is possible to adjust the transmit frequency very precisely.

In both cases, the hardware need to be designed for this with some kinds of analog and or digital PLLs. It is not possible to just change the firmware and get those functions.

a sub microsecond reference is not necessary. If the oscillator in the radio is stable enough, then using the right PLL circuit and filters it is possible to keep synchronization using a quite loose external reference. This work by heavy filtering of the external clock, in combination with the stability of the internal clock of the radio module. The less internal clock drift, the more the external clock can have short range drift.

Today, there are low cost clocks circuits with low drift available, they are used for example inside GSM phones. The cost of sync is mainly at the design side, because of the relative math complexity.

I think that PTP would be enough for WIFI sync. The only advantage of the GPS is that it gives an absolute reference, without a physical link between towers. GPS reference is an absolute one. It gives the exact same synchronization that can be useful for large synced networks like PDH, SONET, SDH, GSM, or SyncE.

GPS is useful for GSM for example, because it does allow exact synchronization of distant towers, This sync is mandatory to allow transparent roaming from a tower to another one (thanks to this the GSM receiver does not need to adjust it's internal reference clock when roaming, it does only need to change the channel. With sync between towers the receiver can do this instantaneously without audio cut because the PLL does not need to adjust the frequency for the new tower. Only a channel frequency change is necessary, based on the same running clock, and a fast phase adjustment is enough to lock very fastly on the new carrier.

To my knowledge for Wifi, there is no need for this kind of sync because the receivers always fully resync to the new channel during roaming. They are not able to roam transparently on the new carrier, even if there are some existing 802.11 protocols to speed up roaming, the receiver need to lock on the frequency channel before to be able to roam. Fast roaming 802.11 protocols are only here to help the receiver to make decisions about witch AP to choose, when to do it, and then reduce the time needed for key management and exchange. They are not designed to adjust a reference clock at the radio level.

So for wifi, sync is only useful i think to reduce interferences on the same sync tower or the same roof. Not to sync a wide network.

This is why i don't see the point in using an absolute reference distributed by satellite (GPS). A relative reference is enough, and this reference can be distributed with PTP and a specialized PLL hardware in the radio module.

This could be low cost using PTP and a dedicated PPL circuit in the radio module to inject a master reference clock in all slaves.
 
nvwifi
just joined
Posts: 5
Joined: Fri Jul 22, 2016 3:31 am

Re: v6.40rc [release candidate] is released!

Thu Jun 22, 2017 7:26 am

So for wifi, sync is only useful i think to reduce interferences on the same sync tower or the same roof. Not to sync a wide network.
Mimosa is claiming tower to tower sync for micropop's that can see each other. That's wifi(ish) right?

$100 Omnitiks sound a lot nicer than $900 A5's for micropop's every 600 ft in a heavy folliage city.

I could swear in Denver that Uldis said tower to tower micropop sync would be possible as long as they were on the same frequency (like Mimosa is doing). Is this being worked on?
 
server8
Long time Member
Long time Member
Posts: 592
Joined: Fri Apr 22, 2011 1:27 pm

Re: v6.40rc [release candidate] is released!

Thu Jun 22, 2017 8:21 am

To use radio to sync the AP is crazy if you have an interference on the channel (in dense urban area is very easy) you lost the slave or slaves..... GPS sync reduce interference on the tower, reduce interference beetwen the towers, allow dense deployment and the last but not least allow sync beetween operatoros that use MKT and the same duty cycle.

Without GPS sync MKT 'll loose the WISP wireless market very soon :-(
 
FIPTech
Long time Member
Long time Member
Posts: 558
Joined: Tue Dec 22, 2009 1:53 am

Re: v6.40rc [release candidate] is released!

Thu Jun 22, 2017 11:14 am

To use radio to sync the AP is crazy if you have an interference on the channel (in dense urban area is very easy) you lost the slave or slaves..... GPS sync reduce interference on the tower, reduce interference beetwen the towers, allow dense deployment and the last but not least allow sync beetween operatoros that use MKT and the same duty cycle.

Without GPS sync MKT 'll loose the WISP wireless market very soon :-(
GPS is good but does have drawbacks :

- it does not remove the need for a precise VCO oscillator and a PLL circuitry in the radio module to slave the carrier frequency.

- it's quite expensive, each tower needs a GPS receiver

- it depends about the US government, the Europe system Galileo is still not yet ready. So a multi constellation GPS, using GPS and Glonas, is better for systems who needs long term usability and short term reliability. This rise a bit the GPS module price.

In the end, as soon as you design or use a radio module that can accept a GPS reference frequency input, it's not a big challenge neither cost to add PTP sync. If the hardware is rightly designed, PTP is only a software addition.

I think that to satisfy product cost, it should be doable to design a product that can use a choice of GPS input, and PTP (precision time protocol) input. Because the circuitry needed for time reference input in the radio module is mandatory in both cases. Then it would be the user choice to use GPS or PTP input, depending if towers can be linked through Ethernet wire or not.

Last, it should be doable to distribute PTP not only by Ethernet wire, but as well through another radio channel, for example LTE. This remove a bit more the need for GPS sync.

https://en.wikipedia.org/wiki/Precision_Time_Protocol

Sync Ethernet is another possibility to distribute a clock, but needs expensive SyncE SFP. Not really a low cost solution...
This mean that PTP is certainly preferable, in conjunction with a low short term drift local oscillator in the radio module to compensate for PTP and distribution channel jitter.

How does work the actual Mikrotik sync implementation ? Is it working at the TDM level, trimming NV2 time slots to compensate for carriers drifts ?

Using a true carrier sync gives another advantage even for 802.11 : using synced receivers, it would be possible to have instantaneous roaming on different channels. The same as for GSM networks for example. But this is another story and is perhaps not really super useful, because there are 802.11(802.11 r,k,v) protocols that gives today a quite fast roaming, fast enough to be able to make VOIP calls without loosing audio during roamings. But is is important to understand that syncing transmitters on different channels, will help receivers to switch faster from one channel to another one, because they do not need to lock their reference clock to the new channel carrier. A simple (and fast) phase adjustment should be enough to lock on the new channel.
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 7044
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: v6.40rc [release candidate] is released!

Thu Jun 22, 2017 12:50 pm

*) quickset - added special firewall exception rules for IPSec;
Next, In the IPv6 firewall filter rules you are accepting UDP 500 and 4500 along with IPsec-AH and IPsec-ESP on input and forward. In the IPv4 firewall filter you are using the IPsec policy feature ...
Quickset rules are explicitly for L2TP/IPSec, IPv6 rules are generic for any type of IPSec configuration.
 
idlemind
Forum Guru
Forum Guru
Posts: 1146
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: v6.40rc [release candidate] is released!

Thu Jun 22, 2017 7:28 pm

Quickset rules are explicitly for L2TP/IPSec, IPv6 rules are generic for any type of IPSec configuration.
What's the thought process for the difference in posture? I'd imagine you'd want your policies to be consistent across IP stacks.
 
scampbell
Trainer
Trainer
Posts: 487
Joined: Thu Jun 22, 2006 5:20 am
Location: Wellington, NZ
Contact:

Re: v6.40rc [release candidate] is released!

Mon Jun 26, 2017 9:42 pm

NV2 Sync appears to be working ok on my trial site, but...

While you can only configure it with CLI to work, if you change anything else in Winbox relating to Wireless it loses the CLI configured NV2 settings on close.

Can we get this fixed ASAP please ?

Also /interface wireless monitor 0 shows the Synch on the slaves it would not display anything relating to the Synch clients on the master - is this correct ?

On synch-master:

/interface wireless> mon 0
status: running-ap
channel: 5745/20/ac
wireless-protocol: nv2
noise-floor: -108dBm
registered-clients: 1
authenticated-clients: 1
notify-external-fdb: no
-- [Q quit|C-z pause]

On Synch-slave:
/interface wireless> mon 0
;;; West Sector
status: running-ap
channel: 5745/20/an
wireless-protocol: nv2
noise-floor: -113dBm
registered-clients: 1
authenticated-clients: 1
nv2-sync-state: synced
nv2-sync-master: 00:0C:42:8D:45:83
nv2-sync-distance: 1
nv2-sync-period-size: 2
nv2-sync-downlink-ratio: 50

current-tx-powers: 6Mbps:27(27/30),9Mbps:27(27/30),12Mbps:27(27/30),18Mbps:27(27/30),
24Mbps:27(27/30),36Mbps:27(27/30),48Mbps:25(25/28),54Mbps:24(24/27),
HT20-0:27(27/30),HT20-1:27(27/30),HT20-2:27(27/30),HT20-3:27(27/30),
HT20-4:27(27/30),HT20-5:27(27/30),HT20-6:25(25/28),HT20-7:23(23/26)
notify-external-fdb: no
-- [Q quit|C-z pause
 
UpRunTech
Member Candidate
Member Candidate
Posts: 209
Joined: Fri Jul 27, 2012 12:11 pm

Re: v6.40rc [release candidate] is released!

Tue Jun 27, 2017 6:34 am

For this to work, there are two solutions :
- the radio clock need to have an input for a sync reference, and a sync generator is needed to generate the sync carrier on the right frequency.
- the radio clock need a VCO clock, voltage controlled oscillator, so that it is possible to adjust the transmit frequency very precisely.
I think you have the wrong idea about the sync. My impression is that protocols like NV2 are TDMA. The purpose of syncing the transmitters on a tower would be to coordinate that they are transmitting and listening in unison to ensure weak signals from a client aren't drowned out by an adjacent AP. The Time of Day clocks in each AP probably run at microsecond or better accuracy so all you are trying to do is make sure that the transmit interrupt (or DMA transfer to a radio's own tx buffer) all happens in the same instant. It isn't to try and make sure their transmit centre frequency is locked precisely to 2.412GHz for instance.
 
uldis
MikroTik Support
MikroTik Support
Posts: 3446
Joined: Mon May 31, 2004 2:55 pm

Re: v6.40rc [release candidate] is released!

Tue Jun 27, 2017 8:39 am

scampbell, everything is correct - on the Master AP it will not show any information on the monitor. The only info on the Master you will see in the log entry that Slave AP wanted to sync.
On the Slave AP it will show to what AP it synced.

We will try to fix the Winbox support for those new nv2 settings in one of the next RC versions.
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1623
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Tue Jun 27, 2017 3:24 pm

Version 6.40rc25 has been released.
Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

Changes since previous version:
*) chr - fixed MAC address assignment when hot plugging NIC on XenServer;
*) fastpath - fixed router rebooting itself (introduced in 6.40rc24);
*) firewall - added "none-dynamic" and "none-static" options for "address-list-timeout" parameter (CLI only);
*) firewall - removed unique address list name limit;
*) ipsec - do not deduct "dst-address" from "sa-dst-address" for "/0" policies;
*) lte - added support for Huawei E3531-6;
*) modem - fixed info command when it is executed at the same time as modem restarts/disconnects;
*) tile - fixed copying large amount of text over serial console;
*) trafficgen - added "lost-ratio" to statistics;
*) webfig - fixed wireless "scan-list" parameter not being saved after applying changes;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after crash.
 
biatche
Member Candidate
Member Candidate
Posts: 128
Joined: Tue Oct 13, 2015 6:50 am

Re: v6.40rc [release candidate] is released!

Tue Jun 27, 2017 7:34 pm

will we be seeing MSTP in 6.40 (a latter RC) perhaps? is it in planning?
 
andriys
Forum Guru
Forum Guru
Posts: 1526
Joined: Thu Nov 24, 2011 1:59 pm
Location: Kharkiv, Ukraine

Re: v6.40rc [release candidate] is released!

Tue Jun 27, 2017 7:50 pm

will we be seeing MSTP in 6.40 (a latter RC) perhaps? is it in planning?
Has it been promised?
In case it has, can you provide a link, please?
If not, please stop spamming with the topic not directly related to the 6.40rc series.
 
brwainer
newbie
Posts: 47
Joined: Tue Feb 02, 2016 2:55 am

Re: v6.40rc [release candidate] is released!

Tue Jun 27, 2017 9:48 pm

Has it been promised?
In case it has, can you provide a link, please?
6.39 (Stable) Changelog:
!) bridge - reverted bridge BPDU processing back to pre-v6.38 behaviour; (v6.40 will have another separate VLAN-aware bridge implementation)
viewtopic.php?f=21&t=121196

The changelog doesn't promise MSTP specifically, but I think what biatche is asking is a valid question: Is the new "VLAN-aware bridge implementation" still planned for 6.40, or will it be pushed out to a later update?
 
biatche
Member Candidate
Member Candidate
Posts: 128
Joined: Tue Oct 13, 2015 6:50 am

Re: v6.40rc [release candidate] is released!

Tue Jun 27, 2017 10:39 pm

will we be seeing MSTP in 6.40 (a latter RC) perhaps? is it in planning?
Has it been promised?
In case it has, can you provide a link, please?
If not, please stop spamming with the topic not directly related to the 6.40rc series.
viewtopic.php?f=1&t=120946#p595389

bottom quote

discuss. oh right, my mistake. some form of VLAN-aware STP implementation. not MSTP.
 
vlatko
newbie
Posts: 48
Joined: Sat Feb 12, 2005 11:28 am

Re: v6.40rc [release candidate] is released!

Wed Jun 28, 2017 12:33 pm

I'm interested in nv2 AP sync, but not yet able to test new options
Please someone from the microtik to explain in details
If at one location we have 4 mikrotrik sectors that are mutually visible in the signal range from for example, -60 to -70dbi.
On the site is also present on all channels a disturbing noise ranging from -70dbi to better (lets say -80dbi average)
What is minimal necessary difference betwen sync signal and disturbing noise on same channel to properly sync funcionality.
also in this harsh conditions we have possibly aggregated troughput for all 4 sectors in range 4x25Mbps=100Mbps average
what is expected aggregated troughput on all 4 sectors in ap sync case
thanks
 
FIPTech
Long time Member
Long time Member
Posts: 558
Joined: Tue Dec 22, 2009 1:53 am

Re: v6.40rc [release candidate] is released!

Wed Jun 28, 2017 1:47 pm

For this to work, there are two solutions :
- the radio clock need to have an input for a sync reference, and a sync generator is needed to generate the sync carrier on the right frequency.
- the radio clock need a VCO clock, voltage controlled oscillator, so that it is possible to adjust the transmit frequency very precisely.
I think you have the wrong idea about the sync. My impression is that protocols like NV2 are TDMA. The purpose of syncing the transmitters on a tower would be to coordinate that they are transmitting and listening in unison to ensure weak signals from a client aren't drowned out by an adjacent AP. The Time of Day clocks in each AP probably run at microsecond or better accuracy so all you are trying to do is make sure that the transmit interrupt (or DMA transfer to a radio's own tx buffer) all happens in the same instant. It isn't to try and make sure their transmit centre frequency is locked precisely to 2.412GHz for instance.
Yes NV2 is TDMA modulation. So Mikrotik NV2 sync seems to be similar in design with OpenTDMF sync. In this case, APs synchronize their slot boundaries. This is possible using a something like IEEE 1588 PTP protocol for example to share a quite precise (in the microsecond range) clock reference.

Some interesting details here :

https://www.microsoft.com/en-us/researc ... aready.pdf

https://www.microsoft.com/en-us/researc ... less-lans/

This kind of synchronization does not need carrier sync. This mean that there is no hardware modification at the radio level. So the cost is kept low.

But this is only working with a TDMA protocol, and still does not allow very fast roaming for clients, because when they roam they need to lock on a new channel carrier, not in sync with the previous one. So the PLL in the receiver needs some time to lock on the new frequency. If carrier are synced, even if APs are on different frequencies, receivers can lock almost instantaneously on the new channel.

In the GSM network for example, all towers and receivers are in sync at the carrier level. This mean that the receiver can switch to another channel very fast, this mean that there is no audio cut.
Wimax as well can use this kind of sync.

It seems to me that carrier sync gives more advantages as well to reduce interferences between adjacent antennas and adjacent base sites.
 
uldis
MikroTik Support
MikroTik Support
Posts: 3446
Joined: Mon May 31, 2004 2:55 pm

Re: v6.40rc [release candidate] is released!

Thu Jun 29, 2017 3:28 pm

vlatko, Minimal difference between noise and signal - depends on nature of noise - if it is continuous wave or "packet" based. If your AP is able to "see" in scan master AP in the presence of noise signal, you are fine.
You can not predict throughput because it is not clear what is the effect of interfering signal. You should try and use what gives the best results.
 
sparker
just joined
Posts: 23
Joined: Mon Jan 23, 2012 5:48 pm
Location: Russia / Chelyabinsk

Re: v6.40rc [release candidate] is released!

Fri Jun 30, 2017 7:01 am

will we be seeing MSTP in 6.40 (a latter RC) perhaps? is it in planning?
Has it been promised?
In case it has, can you provide a link, please?
If not, please stop spamming with the topic not directly related to the 6.40rc series.
+1
v6.40 will have another separate VLAN-aware bridge implementation
Are looking forward to
 
FIPTech
Long time Member
Long time Member
Posts: 558
Joined: Tue Dec 22, 2009 1:53 am

Re: v6.40rc [release candidate] is released!

Fri Jun 30, 2017 9:40 am

We could think how to sync the APs that are on different frequencies but located on the same tower and connected to the same ethernet network.
You could take some ideas from or use PTP (https://en.wikipedia.org/wiki/Precision_Time_Protocol) to synchronise the APs internal clocks over ethernet and hence transmission times from a collection of APs on a tower without having to mess with GPS. You only need relative not absolute time synchronisation. How well it works depends on how quickly you can get an incoming ethernet frame timestamped - but the articles all suggest sub-microsecond is possible.
Some other interesting background for synchronization :

http://community.cambiumnetworks.com/t5 ... td-p/37884

https://www.cse.wustl.edu/~jain/cse574- ... index.html

Synchronization is a complex subject, with many different possibilities, from full absolute carrier sync, to relative sync, to TDMA sync, where some other capabilities can be implemented to enhance for example interference detection (channel frequency changes, adaptive transmission power...).
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1623
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Fri Jun 30, 2017 4:12 pm

Version 6.40rc28 has been released.
Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

Changes since previous version:
*) console - fixed different command auto complete on <tab>;
*) ethernet - fixed occasional broken interface order after reset/first boot;
*) export - added router model and serial number to configuration export;
*) export - fixed "/interface list" verbose export;
*) export - fixed "/ipv6 route" compact export;
*) export - fixed MPLS "dynamic-label-range" export;
*) export - fixed SNMP "src-address" for compact export;
*) fastpath - improved removing process of dynamic interface;
*) hAP ac lite - removed nonexistent "wlan-led";
*) lte - added info command support for the Jaton LTE modem;
*) ppp - added initial support for ZTE K4203-Z;
*) ppp - added initial support for ZTE ME3630-E;
*) safe-mode - fixed session handling when Safe Mode is used on multiple sessions at the same time;
*) supout - fixed IPv6 firewall section;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after crash.
 
synard
just joined
Posts: 1
Joined: Mon Oct 28, 2013 9:06 am

Re: v6.40rc [release candidate] is released!

Sat Jul 01, 2017 2:27 pm

hi
i'm using mikrotik v6.40rc28.

something wrong with address list.
when im using script to add address list and timeout limit has reach 0. it doesn't remove. still in there.
i tried to add manually it's also the same.
but when i using filter, it's work. please fix this in next release.
 
biatche
Member Candidate
Member Candidate
Posts: 128
Joined: Tue Oct 13, 2015 6:50 am

Re: v6.40rc [release candidate] is released!

Sat Jul 01, 2017 5:08 pm

while doing some testing on dual wan (a lot of plugging and unplugging of ethernet cable / disabling of interfaces), i've also found that /ip route entries may SOMETIMES show as 'unreachable' but via command line it appears to be reachable. so probably a visual bug in winbox... fixed by reopening the ip > route window.
Last edited by biatche on Sat Jul 01, 2017 5:15 pm, edited 1 time in total.
 
pe1chl
Forum Guru
Forum Guru
Posts: 10197
Joined: Mon Jun 08, 2015 12:09 pm

Re: v6.40rc [release candidate] is released!

Sat Jul 01, 2017 5:13 pm

Please do some minimal work on the IPv6 routing to allow running IPv6 on 2 internet connections.
At the minimum: implement "/ipv6 route rule" to allow having 2 route tables each with their own default route, selected by (internal) source address.
Better: also implement "/ipv6 firewall nat" with netmap or similar action to allow a static internal address to be mapped to alternative external addresses.
I think the functionality is already in the current kernel, it only requires UI work.
 
pe1chl
Forum Guru
Forum Guru
Posts: 10197
Joined: Mon Jun 08, 2015 12:09 pm

Re: v6.40rc [release candidate] is released!

Sat Jul 01, 2017 5:16 pm

More IPv6: updating and activation of licenses do not work over IPv6. Please fix that so it is possible to run a router with only IPv6 connectivity to the internet.
 
User avatar
bajodel
Long time Member
Long time Member
Posts: 551
Joined: Sun Nov 24, 2013 8:30 am
Location: Italy

Re: v6.40rc [release candidate] is released!

Sat Jul 01, 2017 7:16 pm

Please do some minimal work on the IPv6 routing..
+1
 
idlemind
Forum Guru
Forum Guru
Posts: 1146
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: v6.40rc [release candidate] is released!

Sun Jul 02, 2017 1:42 am

Please do some minimal work on the IPv6 routing..
+1
+1, moar IPv6 :)
 
anuser
Long time Member
Long time Member
Posts: 601
Joined: Sat Nov 29, 2014 7:27 pm

Re: v6.40rc [release candidate] is released!

Mon Jul 03, 2017 4:30 pm

Version 6.40rc20 has been released.
*) wireless - fixed rare crash on cap disable;
.
problems still appears (currently with v6.40rc28) => Ticket#2017042722000941
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1623
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Tue Jul 04, 2017 12:12 pm

Version 6.40rc32 has been released.
Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

Changes since previous version:
*) dhcpv4-client - added "gateway-address" script parameter;
*) dhcpv4-server - fixed lease renew for DHCP clients that sends renewal with "ciaddr = 0.0.0.0";
*) fasttrack - fixed fasttrack over interfaces with dynamic MAC address;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after crash.
 
mysz0n
Member Candidate
Member Candidate
Posts: 137
Joined: Tue Mar 03, 2009 2:14 am

Re: v6.40rc [release candidate] is released!

Tue Jul 04, 2017 1:02 pm

It has been a while since the last DUDE update/
Have you stopped working on the dude? or are you working on some major update?
 
zyzelis
Member Candidate
Member Candidate
Posts: 213
Joined: Sun Apr 08, 2012 9:25 pm

Re: v6.40rc [release candidate] is released!

Tue Jul 04, 2017 7:17 pm

IF mikrotik guys are working with dhcp part of ROS, its time to answer - when mikrotik will implement dhcp option 82?
Actually is interested lease issue by circuit-id.
Mikrotik stuff, c'mon you did half of work, go on and finish.
 
Kindis
Member
Member
Posts: 434
Joined: Tue Nov 01, 2011 6:54 pm
Location: Sweden

Re: v6.40rc [release candidate] is released!

Tue Jul 04, 2017 11:59 pm

*) fasttrack - fixed fasttrack over interfaces with dynamic MAC address;
This fixed fasttrack over bonded interfaces using dynamic mac. Great work :)
 
User avatar
juliokato
Member Candidate
Member Candidate
Posts: 228
Joined: Mon Oct 26, 2015 4:27 pm
Location: Brazil

Re: v6.40rc [release candidate] is released!

Wed Jul 05, 2017 12:40 am

IF mikrotik guys are working with dhcp part of ROS, its time to answer - when mikrotik will implement dhcp option 82?
Actually is interested lease issue by circuit-id.
Mikrotik stuff, c'mon you did half of work, go on and finish.
Me too interested.
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8709
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: v6.40rc [release candidate] is released!

Wed Jul 05, 2017 12:43 am

IF mikrotik guys are working with dhcp part of ROS, its time to answer - when mikrotik will implement dhcp option 82?
Actually is interested lease issue by circuit-id.
we've been using this since 2008 :) you just need external RADIUS :D
 
sindudas
newbie
Posts: 36
Joined: Thu Aug 16, 2012 2:59 pm

Re: v6.40rc [release candidate] is released!

Wed Jul 05, 2017 2:28 pm

Bug on Winbox, configuring VLAN on a CRS326-24G-2S+ With firmware 6.39.2 and 6.40rc32.

If you try to set a new VLAN with all ports, on winbox you only can put 25 interfaces, but switch has 27 including CPU.
Setting via CLI its possible, but when you open on Winbox, the field Ports shows in Red.
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1623
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Wed Jul 05, 2017 4:12 pm

sindudas - You should be able to add up to 30 interfaces. Are you sure that simply menu did not go out of your computer display?
 
andlommy
just joined
Posts: 22
Joined: Tue Feb 12, 2013 12:14 am

Re: v6.40rc [release candidate] is released!

Wed Jul 05, 2017 9:13 pm

RB2011 in a bootloop after v6.40rc13 upgraded from v6.40 rc9 :(
 
zyzelis
Member Candidate
Member Candidate
Posts: 213
Joined: Sun Apr 08, 2012 9:25 pm

Re: v6.40rc [release candidate] is released!

Wed Jul 05, 2017 10:04 pm

IF mikrotik guys are working with dhcp part of ROS, its time to answer - when mikrotik will implement dhcp option 82?
Actually is interested lease issue by circuit-id.
we've been using this since 2008 :) you just need external RADIUS :D
Hi chupaka,
i have read your posts in forum acc to radius.:) Congrats ;)
But if mikrotik targets to be KisKo alternative, shouldn't they implement their own option82 in dhcp-server, or own radius server, like cisco does?
 
IntrusDave
Forum Guru
Forum Guru
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: v6.40rc [release candidate] is released!

Thu Jul 06, 2017 6:46 am

I have a scripting issue.

if one script sets a global, another script is not able to see it. However, I can see them on the console.

Script 1
:global test "test"
Script 2
:put $test
running the scripts from the console, I would expect Script 2 to output "test", but it's output is blank.
However, running ":put $test" on the console, outputs "test"

the Wiki states:
Scripting language has two types of variables:

global - accessible from all scripts created by current user, defined by global keyword;
local - accessible only within the current scope, defined by local keyword.
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 7044
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: v6.40rc [release candidate] is released!

Thu Jul 06, 2017 6:54 am

script 2 must be:
:global test;
:put $test
 
IntrusDave
Forum Guru
Forum Guru
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: v6.40rc [release candidate] is released!

Thu Jul 06, 2017 7:19 am

script 2 must be:
:global test;
:put $test
OoooOoooohhhhh! Okay :)
 
sindudas
newbie
Posts: 36
Joined: Thu Aug 16, 2012 2:59 pm

Re: v6.40rc [release candidate] is released!

Thu Jul 06, 2017 11:47 am

sindudas - You should be able to add up to 30 interfaces. Are you sure that simply menu did not go out of your computer display?
I'm really sure that it can't be selected more than 25. It turns the down arrow in grey, disabled.
My screen is much bigger, it is not a display problem, but it does not allow to add more.
 
sindudas
newbie
Posts: 36
Joined: Thu Aug 16, 2012 2:59 pm

Re: v6.40rc [release candidate] is released!

Thu Jul 06, 2017 11:53 am

sindudas - You should be able to add up to 30 interfaces. Are you sure that simply menu did not go out of your computer display?
Image
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8709
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: v6.40rc [release candidate] is released!

Thu Jul 06, 2017 12:39 pm

Forbidden

You don't have permission to access /link/mikrotik-vlan-add.jpeg on this server.
 
pe1chl
Forum Guru
Forum Guru
Posts: 10197
Joined: Mon Jun 08, 2015 12:09 pm

Re: v6.40rc [release candidate] is released!

Thu Jul 06, 2017 2:30 pm

Did you try commandline or webfig to add ports?
[edit: I see you did]
 
sindudas
newbie
Posts: 36
Joined: Thu Aug 16, 2012 2:59 pm

Re: v6.40rc [release candidate] is released!

Thu Jul 06, 2017 2:38 pm

Forbidden

You don't have permission to access /link/mikrotik-vlan-add.jpeg on this server.
It should work now. Sorry, it was geoip restrictions :oops:
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1623
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.40rc [release candidate] is released!

Fri Jul 07, 2017 3:28 pm

New topic for 6.40rc has been made:
viewtopic.php?f=21&t=123335

Who is online

Users browsing this forum: glat, raphaps, seriquiti and 21 guests