MikroTik

I am seeing a really odd issue/conflict between the new iPhone XS and the Mikrotik WAP ac (RouterBOARD wAP G-5HacT2HnD) currently running 6.43.2.

The iPhone XS does not work well with the Mikrotik on 5GHz, the problem seems worst on 80MHz channels (Ceee) and the absolute worst is in the higher frequency channels. In general the iPhone XS does not work reliably with the Miktorik in the 5GHz, the only other access point I have to test with is an Asus RT-N56U that only supports 40MHz channels. The phone works "fine" on the Asus, but most of the time on the Mikrotik it fails to communicate.

It is odd that none of my other devices have this issue, including iPad Air, iPhone SE, iPhone 8, iPhone X....those all work fine. So it is either something about the Mikrotik is out of expectation or the iPhone XS is, but it is odd that the iPhone XS works fine on the ASUS as well.
(I just switched it to the 5ghz-onlyac as a troubleshooting step, it was on default to allow A/N/AC during most testing)

Any pointers appreciated, I am hoping it is something stupid simple at this point.

I notice you don't have a country set for your wireless interface. You should set that, otherwise the interface may be able to select a frequency that is not allowed in your country and the phone may then refuse to connect. There are other potential issues, but that jumps out as a possibility.

I notice you don't have a country set for your wireless interface. You should set that, otherwise the interface may be able to select a frequency that is not allowed in your country and the phone may then refuse to connect. There are other potential issues, but that jumps out as a possibility.

This model is hard coded to "united states3". I have 3 of these, but oddly one does allow country selection (even though it is supposed to be hard coded).

It is really odd that if I use 2.4GHz with all settings "similar" between the two networks, the 2.4GHz works every time (within the bandwidth constraints of 2.4GHz). I prefer to not use 2.4GHz due to performance and interference in the urban environment.

To make this even more unusual, it works for "local" network traffic (e.g. the phone can open up the Webfig of my router) but fails for anything over the Internet...even though all other devices work fine. To test locally I open the Webfig splash page for my router (RouterBOARD 750G r3) and for the Internet test it is as simple as using the whatip.me site.

Noise floor using the "Frequency Usage" report on the AP I am actively connecting to shows -104 to -100, with the highest frequencies (that I am attempting to use in this AP location) having the lowest usage.

This problem gets even more unusual, as it really seems to be something about the IPv6 tunnel I have from Hurricane Electric. Which even makes less sense when it works over 2.4GHz.

Maybe a defective phone? see this:
https://www.macrumors.com/2018/09/24/ip ... ty-issues/

Whatever the problem is, it only affects 802.11AC connections. "N" works perfectly. Really odd. Experiencing these exact symptoms when connected via "AC".

Just tested an EU XS with a hAP AC 6.40.9, works flawlessly, 100/115 MBps using 5GHz AC 40MHz.

Looks like device specific, definitely pointing to the iphone.

To rule everything out, Is System > Routerboard Current Firmware same version as Upgrade one?

I’ve tried it with both current and bug fix packages and router board firmware. Have you tested with 80mhz channels?

Hi,

I just wanted to cross post a similar thread where others have reported the same issues with HAP AC's.

I too use 80MHz Channels and HE IPv6 tunnels. I haven't tried changing these.

The thread is here viewtopic.php?f=2&t=139524

I don't believe the phone is at fault as I use Unifi AC Pros on 80MHz channels at work and a test one at home and the phone works fine when connected to them.

OMG... I cannot believe I just stumbled actress this link.

We are having the exact same problems as mentioned by @effndc.

We have 9 MK APs of various types. All running 6.43, with matching 6.43 firmware. All running multiple SSID 5Ghz/80MHz channels (along with 2.4GHz service) with the same SSID name (plus a bunch of virtual channels of various SSID names). Been stable for a very long time. We have a number of iPhoneX, iPads, MacBook Pros, etc and for the past month, some iPhone Xs and iPhone XsMax. Everything works perfectly EXCEPT the "s" models. These units are barely usable on the MK framework. As mentioned, the "s" models work good on the local LANs, but Internet usage is a constant nightmare. Browsers don't connect, iCloud and other services report "unable to connect," email reports unable to reach servers, etc, etc, etc.

We have been working with Apple tier II and III to solve this problem, supplying them with logs and such. We have exchanged one Xs and one XsMax to make sure we are not dealing with defective hardware. We have groomed apps in the event one or more was causing a problem. We have done "restore to new iPhone" more times than I can remember. I have checked every MK config, including the "wireless", "bridges" all firewalls (IPv4 and IPv6) to the point that I am have bad dreams about them. The iPhoneXs and iPhoneXsMax are unusable on the MK framework at this time...

However, I did find a totally unacceptable workaround. As I was going through the settings of an iPhoneXsMax and wanted to see if I could get to our remote network on the East Coast (I am out West). I established a L2TP VPN connection to our Boston location (which also has MK) and it connected just fine. The interface is configured to send all traffic via the tunnel. I noticed after a few mins that I no longer had issues... it was totally working for everything. So, I dropped the VPN and established a new VPN to my local router (which is generally only used for inbound connections.) Again, working 100%...yup 100%... when I dropped the connection, back to not working again.

This is an urgent problem that need to be addressed asap. The new iPhones are not viable on the MK framework at this time. If MK believes this is an Apple issue, I have a way to get it to the appropriate people, but I must have details of what needs addressing... but given these new Apple devices seem to have no issue on other frameworks, I think this is a MK issue.

Maybe this is of interest to XS users:

https://support.apple.com/en-us/HT209084

@philamonster I can confirm that IOS 12.0.1 does fix the disconnct problem contained in the release notes link you suggested. However, it does not fix the issue being discussed in this topic.

Xs models are still seeing issues using when attached to Mikrotik 5GHz 80MHz AC configurations.

Version 6.44beta14 has been released.
*) wireless - improved stability for 802.11ac;

Have you tried latest 6.44beta release, too?

Version 6.44beta14 has been released.
*) wireless - improved stability for 802.11ac;

Have you tried latest 6.44beta release, too?

Already seen and tried without luck

I agree with @harvey: 6.44beta does not fix this problem.

Only workaround right now is to configure your radios to any of the 5GHz-A/N settings. No "AC". This impacts all 5GHz users, but lets the new Xs models at least function.

I don't have an iPhone Xs to test with but does knocking the 5Ghz down to a 40Mhz channel width make any difference? I could see this potentially being an issue for some of our customers. I do run the 2.4 and 5Ghz on separate SSIDs so can just tell them use the 2.4Ghz radio for now.

Any of the "AC" bands are a problem at all channel widths. We see it on both 20/40/80MHz and 20/40MHz channel widths (regardless of center channel config). The Xs models will work if you use any of A/N bands and any channel width. AC is the problem.

Our config uses the same SSID for both 2.4GHz and 5GHz, so our users do not have a choice of radios.

I have exactly same problem with my iPhone XS (bought from official european distributor). Problem exists on iOS 12.0 and 12.0.1.

My Mikrotik cAP AC is running 6.43.2 - software and firmware, and previously was running one of the recent 6.43 release candidates.
This is specific problem of Mikrotik and iPhone XS, as my other phones (iPhone X, iPad Pro) running same iOS version (12.0.1) are working fine with this Mikrotik AP, also my ASUS RT-AC86U is working properly with iPhone XS.

This setup (cAP AC) was stable for months and only iPhone XS is having problems here.

I'm using:

5GHz-A/N/AC
20/40/80MHz XXXX
5180
L2MTU 1600
MTU 1500

I have exactly same problem with my iPhone XS (bought from official european distributor). Problem exists on iOS 12.0 and 12.0.1.

My Mikrotik cAP AC is running 6.43.2 - software and firmware, and previously was running one of the recent 6.43 release candidates.
This is specific problem of Mikrotik and iPhone XS, as my other phones (iPhone X, iPad Pro) running same iOS version (12.0.1) are working fine with this Mikrotik AP, also my ASUS RT-AC86U is working properly with iPhone XS.

This setup (cAP AC) was stable for months and only iPhone XS is having problems here.

I'm using:

5GHz-A/N/AC
20/40/80MHz XXXX


5180
L2MTU 1600
MTU 1500

Yup... You are seeing exactly what we have been discussing... only the Xs and XsMax impacted. And the problem seems to exist across all of the Mikrotik platforms. Although it seems to strongly suggest this is a MIkrotik problem, I am not 100% certain that Apple may also be doing something that is out of spec. My other office is 100% Cisco, and the Xs and XsMax works fine.

Until they fix it, trying setting your radio to:

5GHZ-A/N
20/40MHZ XX
<any frequency, etc will work>

-or-

I have found that if you create an L2TP VPN service on your router, and connect the "Xs" to it, that seems to work even on AC setups... but that is totally unacceptable to me.

I did set 802.11A/N with 40MHz channel width as a temporary workaround.

I believe I have noticed that connecting iPhone XS via VPN over Mikrotik router on 802.11ac radio also "workarounds" the problem. I cannot prove it as I don't have time for this now, but it seems like some MTU/Packet size related issue to me, especially that websites don't work properly but SPEEDTEST app shows ~ 300Mbps in download.

MIKROTIK support should easily reproduce this problem.

Best regards,
Greg

I did set 802.11A/N with 40MHz channel width as a temporary workaround.

I believe I have noticed that connecting iPhone XS via VPN over Mikrotik router on 802.11ac radio also "workarounds" the problem. I cannot prove it as I don't have time for this now, but it seems like some MTU/Packet size related issue to me, especially that websites don't work properly but SPEEDTEST app shows ~ 300Mbps in download.

MIKROTIK support should easily reproduce this problem.

Best regards,
Greg

Your findings are fully consistent with what I am seeing; however, I can report that more than websites are affected. We are seeing the issues with other non browser web applications, such as connecting to iCloud and AppStore (where it says it cannot connect), email using Exchange and iMap (where we get server "errors" at the botton of the screen and "updates" are as much as an hour old), streaming with Netflix, CNN, BBC and even SPEEDTEST. With regards to SPEEDTEST, we have seen it timeout looking for servers (local and remote) on numerous occasions. You should try SPEEDTEST at random a few more times. The problem is transient, and things seems to work on/off/on/off, etc... It's strange that connectivity and other tests (such as Ping) seem to work on our local LAN without issue, although I have not spent a lot of time testing this nuance.

It would be really nice if this got fixed!

I was asked by support person to check if it is an AC or 80MHz wide channel deciding factor. I did test it and in my case it seems the problem exists also on AC 40MHz wide channel.

The only common factor for me is ipv6. With it off problem goes away. Currently running ac at 80mhz and all fine. As soon as I unable ipv6 it dies. If you disable ipv6 also make sure your clients are not being allocated and don’t have an ipv6 address too.

I was asked by support person to check if it is an AC or 80MHz wide channel deciding factor. I did test it and in my case it seems the problem exists also on AC 40MHz wide channel.

I tried the same thing... no change with 40 MHZ wide channel... I still have all AC disabled.

The only common factor for me is ipv6. With it off problem goes away. Currently running ac at 80mhz and all fine. As soon as I unable ipv6 it dies. If you disable ipv6 also make sure your clients are not being allocated and don’t have an ipv6 address too.

I origionally thought it might have something to do with IPv6; however, I am not sure I can easily disable IPv6. We have an assigned static prefix and a number of our devices (such as disk arrays, etc.) are passing a lot of native traffic over IPv6. The general PC/Macs are also.

Our neighbor has a full commercial UBNT deployment. This problem is not happening over there, which I have personally verified. The suggestion came up last week that in the absence of any comment from Mikrotik (and they have stopped responding to inquiries related to my support ticket), we should consider changing platform away from Mikrotik. Who is at fault is irrelevant; we just need our networks to work. I have been tasked to pull some quotes from vendors to do this, but I really would rather not. We have a holiday shutdown planned where we could do the conversion, but that would mean no holiday for my staff... .

****** Mikrotik, PLEASE COMMENT....

The only common factor for me is ipv6. With it off problem goes away.

By 'off' you mean complete disabling of 'ipv6' package or just disabling IPv6 DHCP Server / ND so that devices don't get ipv6 routable addresses?

The only common factor for me is ipv6. With it off problem goes away.

By 'off' you mean complete disabling of 'ipv6' package or just disabling IPv6 DHCP Server / ND so that devices don't get ipv6 routable addresses?

I’m using 6to4 so I disable the sit interface, disable the ip address on the wan and lan including the advertise. I then force the client to loose its ipv6 address and that’s enough. Ipv6 package is still active.

The only common factor for me is ipv6. With it off problem goes away.

By 'off' you mean complete disabling of 'ipv6' package or just disabling IPv6 DHCP Server / ND so that devices don't get ipv6 routable addresses?

I’m using 6to4 so I disable the sit interface, disable the ip address on the wan and lan including the advertise. I then force the client to loose its ipv6 address and that’s enough. Ipv6 package is still active.

Interesting workaround; however, not a good solution for us. Disabling A/N/AC and going with just A/N @ 40Mhz works, although we don't get the performance we would like...

Did anyone tried to debug the problem a bit deeper? Like sniffing phone's packets to see what goes wrong.

Did anyone tried to debug the problem a bit deeper? Like sniffing phone's packets to see what goes wrong.

I have tried, but I found nothing conclusive. I have also supplied logs to Apple.

Somebody please set my expectations. I have opened a ticket with Mikrotik (Ticket#2018101122002554), but I have not seen any reasonable responses. I have collaborated with folks in this topic thread and even brought up the subject in the "v6.44beta [testing] is released! (viewtopic.php?f=21&t=139057).

It seems like this issue is not being taken very seriously by Mikrotik... should I assume that this problem is not going to get fixed?

Frustrated...

By saying the local traffic works - it works with multiple hops inside your network (no NAT/Masquerade)? So as soon as the traffic goes over the NAT/Masquerade you start seeing the problem?
It is possible the problem related to the TCP traffic as the L2TP VPN uses UDP protocol.

We are now trying to reproduce the problem with the minimal configuration to make the problem reproduce all the time not just random time.
What is the best website or app to see the problem more frequently to appear?

Could you help us by telling the below info which works or doesn't work for you:
1. Does it happen with all the center channel frequencies?
2. AC with one chain enabled and 20mhz width
3. AC with one chain enabled and 20/40 width
4. AC with one chain enabled and 20/4080 width
5. AC with two chain enabled and 20mhz width
7. AC with two chain enabled and 20/40 width
8. AC with two chain enabled and 20/4080 width

By saying the local traffic works - it works with multiple hops inside your network (no NAT/Masquerade)? So as soon as the traffic goes over the NAT/Masquerade you start seeing the problem?
It is possible the problem related to the TCP traffic as the L2TP VPN uses UDP protocol.

We are now trying to reproduce the problem with the minimal configuration to make the problem reproduce all the time not just random time.
What is the best website or app to see the problem more frequently to appear?

Could you help us by telling the below info which works or doesn't work for you:
1. Does it happen with all the center channel frequencies?
2. AC with one chain enabled and 20mhz width
3. AC with one chain enabled and 20/40 width
4. AC with one chain enabled and 20/4080 width
5. AC with two chain enabled and 20mhz width
7. AC with two chain enabled and 20/40 width
8. AC with two chain enabled and 20/4080 width

Thanks for responding!

I just observed that pinging local devices seems to work, but nothing analytical has been tested to prove that local traffic is working correctly. I agree that it might be a TCP problem. Things are broken for most websites and applications (e.g. imap/pop mail, google.com, yahoo.com, iCloud login, Apple App store, etc). Sometimes these site/apps timeout, other times they partially load, and occasionally they go through; however, SpeedTest does work but it can take a long time to find a server, if not just time out like the others. Once it does find a server and starts, it functions properly. The actual SpeedTest packets may be going over UDP. So, the problem is not specific to any one website or application.

I am seeing this on all of the configs you have listed above:
1: yes... broken at all center channels, including XXXX
2-4: (chain 0 only): Broken at all widths (20 20/40 and 20/40/80)
5-8: (chain 0, chain 1): Broken at all widths (20 20/40 and 20/40/80)
Extra: (chain 0, chain 1, chain 2): Broken at all widths (20 20/40 and 20/40/80)
Extra2: Everything works fine if you turn off AC and just use 5GHz A/N (at all channel and chain configurations)

I am sure that if you put one of these Apple Xs devices on your net, you should be able to quickly see the problem I have done all of the above tests on a hAP 962UiGS-5HacT2HnT running 6.43.4, but my other MT models show the same issue. The test device is just an acting as an AP bridge, with no routing or NAT. I set-up this unit specifically for this test. We have a core router that is not broadcasting any WiFI, and the configuration on that unit has remained unchanged throughout this process. Any NAT/Masquerade is upstream from the APs on the core router. So, with this test unit in AC mode we see the problem; however, the other APs with AC disabled are working fine.

netispguy, thank you for sharing us the information. For now we are unable to reproduce the issue, the websites opens ok, the, speedtest is ok as well.
Do you have ipv6 also running or just IPv4?
Which DNS server you are using - some local one from the Router our some other public DNS?
If you try to access some local lan - routed network services, do they work ok? Or problem happens when you go over the NAT?
Have you noticed some specific websites that fails to load?

Uldis, couple facts that I have observed. Just FYI I'm using "cAP AC" running 6.43.2.

- The problem persists even after yesterdays update to iOS 12.1
- I am convinced the problem is in DNS communication (!) - somehow suppressed by Mikrotik cAP AC 802.11ac link - why I think so? - you will read below.
- I am using manually configured DNS on my iPhone XS - set to 8.8.8.8
- The DNS and whole "networking" works fine for short time after initial connection to "Mikrotik cAP AC 5GHz 802.11ac" wireless network interface.
- On the iPhone XS initially there is only IPv4 from DHCP Server which is main router - ASUS RT-AC86U
- After some time on my iPhone XS I can see two IPv6 addresses assigned with one IPv6 gateway - which I have no clue where they come from, as my "cAP AC" doesn't have IPv6 module/package enabled nor my ASUS RT-AC86U has IPv6 solicitation configured, nor my ISP is using IPv6 - and it seems after that IPv6 the web browsing stops working, but may be not related.
- I have discovered that when the issue occurs, I can still browse through websites that I have recently opened - like the IP address of the domain is in iPhone's XS cache and I can open new pages of the same website but not new websites or HTTP based applications - IMHO this points to DNS connectivity issues.
- IPv6 addresses also appears after connecting to 2.4GHz interface of the same "cAP AC" and I have zero problems with connectivity or DNS
- Zero issues observed on the iPad Pro when connected to the 802.11ac interface of "cAP AC" - so this is exclusively issue with iPhone XS

I believe somehow the DNS queries or replies from the DNS servers are dropped by Mikrotik when connected to wireless interface configured to 802.11ac.

If my Speedtest app has domains cached and I can use it on my iPhone XS connected to 802.11ac Mikrotik's interface, I can get high performance test results - like 300Mbps down and 95Mbps up, which is my ISPs service that I have.

For other members of this forum. I don't have time right know to set this up, but maybe try to mirror traffic on Mikrotik to external IP address with Wireshark and capture traffic that is generated when the issue occurs.

best regards,
Greg

netispguy, thank you for sharing us the information. For now we are unable to reproduce the issue, the websites opens ok, the, speedtest is ok as well.
Do you have ipv6 also running or just IPv4?
Which DNS server you are using - some local one from the Router our some other public DNS?
If you try to access some local lan - routed network services, do they work ok? Or problem happens when you go over the NAT?
Have you noticed some specific websites that fails to load?

I am shocked you do not see this problem. I have a couple of questions for you:
1. Are you testing on an iPhone Xs or XsMax running at least 12.0.1?
2. Are you using a "US" version? My exact version number for my test AP is: RouterBOARD 962UiGS-5HacT2HnT-US. All of my current AP devices are "US" versions.

With regards to your questions:
- For the latest test, the 962UiGS-5HacT2HnT has IPv6 was totally disabled from the package list. Even with it disabled, I still get the same issues.
- I have tried numerous DNS servers, all public. 8.8.8.8 (Google) and 75.75.75.[75-76] (Comcast) are the most common ones I use. I do NOT think this is a DNS problem since with I turn AC off, everything works normally, even with the same DNS configuration.
- All of my other devices that are NOT iPhone Xs variants work normally using all AC configurations, either locally or remote.
- YES!!! I just tested to 4 servers on my local LAN. It appears that I can get to all of my local servers without any issue. It seems that when I NAT/masquerade out to the Internet the problem happens. The error is generally one of a) for websites: "... could not open page because the server stopped responding", or b) for applications: "...failed to connect".
- When going to the Internet, it is not site specific. I am seeing the issue with most website and applications.
- I submitted a Supout.rif to Rudolfs via ticket Ticket#2018101122002554 last night.
- My core router is: 493G (with a 5Ghz radio card added in) running 6.43.4. We have not used the radios in this unit for some time...it is just being used as the edge router. We have both IPv4 and IPv6 static IP addresses.
-100% of everything works on the iPhone Xs[Max] when I turn AC off!

*** Thanks for your continued support!

Hello,
I have two iPhone XS units and I'm seeing the same issues result with random DNS failure especially while refreshing from the phone.
Things has gotten better with 12.1 but I had the issues since initial IOS version (v12) and Mikrotik was at v6.43.2 (now upgraded to 6.43.4)
I have 3xHap AC units and IPv6 package is uninstalled I can still see on the phone that the status of IPv6 addresses is not consistent
And it's not IPv6 addresses that are local (end in fe80)

-Ofer

Uldis, couple facts that I have observed. Just FYI I'm using "cAP AC" running 6.43.2.

- The problem persists even after yesterdays update to iOS 12.1
- I am convinced the problem is in DNS communication (!) - somehow suppressed by Mikrotik cAP AC 802.11ac link - why I think so? - you will read below.
- I am using manually configured DNS on my iPhone XS - set to 8.8.8.8
- The DNS and whole "networking" works fine for short time after initial connection to "Mikrotik cAP AC 5GHz 802.11ac" wireless network interface.
- On the iPhone XS initially there is only IPv4 from DHCP Server which is main router - ASUS RT-AC86U
- After some time on my iPhone XS I can see two IPv6 addresses assigned with one IPv6 gateway - which I have no clue where they come from, as my "cAP AC" doesn't have IPv6 module/package enabled nor my ASUS RT-AC86U has IPv6 solicitation configured, nor my ISP is using IPv6 - and it seems after that IPv6 the web browsing stops working, but may be not related.
- I have discovered that when the issue occurs, I can still browse through websites that I have recently opened - like the IP address of the domain is in iPhone's XS cache and I can open new pages of the same website but not new websites or HTTP based applications - IMHO this points to DNS connectivity issues.
- IPv6 addresses also appears after connecting to 2.4GHz interface of the same "cAP AC" and I have zero problems with connectivity or DNS
- Zero issues observed on the iPad Pro when connected to the 802.11ac interface of "cAP AC" - so this is exclusively issue with iPhone XS

I believe somehow the DNS queries or replies from the DNS servers are dropped by Mikrotik when connected to wireless interface configured to 802.11ac.

If my Speedtest app has domains cached and I can use it on my iPhone XS connected to 802.11ac Mikrotik's interface, I can get high performance test results - like 300Mbps down and 95Mbps up, which is my ISPs service that I have.

For other members of this forum. I don't have time right know to set this up, but maybe try to mirror traffic on Mikrotik to external IP address with Wireshark and capture traffic that is generated when the issue occurs.

best regards,
Greg

I have noticed a few differences than you are seeing:
- When I go to a site that has already been loaded, I do get cached version; however, if I force a "reload" of the site, the problem occurs. I also have the same issue going to other pages on the same website regardless of whether or not I have previously loaded the site.
- I am not at all convinced it is a DNS problem. Why would DNS be an issue using 5GHz A/N/AC and NOT be an issue using 5GHz A/N? Also, I have tried going to websites using their IP address (where DNS is mostly not involved,) and I get the same issue.
- With regards to IPv6 keep the following in mind (look for an IPv6 addressing primer online for more in-depth explanations)
- The IPv6 address protocol is designed to allow "self assignment." Unlike IPv4 where self assignment is really an error when no DHCP server supplies a "lease", IPv6 allows devices to get information (from other IPv6 devices on your network) to set it own unique address. IPv6 also heavily uses "local link" addresses with fe80:: as the prefix. These are "private" IP addresses much like IPv4 uses network 10 or 192.168.X.X. If a device fails to see a valid IPv6 router to the Internet (and thus a public prefix), it will use a local-link address. Most devices (IOS devices included) will shape two addresses. In accordance with IPv6 protocols, first address will be generated based on the unique MAC address of you iPhone. The second address is a "masking" address that sort of scrambles the first address so that your true MAC address is not exposed out on the Internet. The method by which this "masking" is done is documented with the IPv6 addressing protocol.
- So, you will see three addresses on your iPhone: 1) What your iPhone believes to be the IPv6 router (default route), 2) An IPv6 address based on the unique MAC address of your WiFi radio, and 3) a "masked" IP address to use as more secure address when going to a public network.
- Apple IOS does NOT allow you to manually set IPv6 parameters, which pisses me off on a daily basis. (Note: Mac OS X does allow manual IPv6 address configurations).

-Scott

I can also confirm that IOS 12.1 does not fix the problem.

Netispguy,

thanks for the lecture about IPv6 but I already know that. I’m a system engineer for a large network equipment vendor and I work close with developers - I've seen things people didn't even dream off, so I know what “magic” things can happen under the hood when processing packets (usually these are bugs) - that’s why I still believe this is processing of DNS requests/replies related issue.

You've mentioned even cached sites doesn’t work for you. Bare in mind that almost every regular site is using different domains when loading web page as sources for ads, images, scripts etc so even previously opened one can be stuck when you loose proper DNS connectivity. Same thing if you’re using IP address of web server instead of FQDN. You need very simple web page to test it.

Try using my website http://109.74.108.40/ , you should see a text ":)" even other sites won't open on your iPhone XS.

Best regards,
Greg

Netispguy,

thanks for the lecture about IPv6 but I already know that. I’m a system engineer for a large network equipment vendor and I work close with developers - I've seen things people didn't even dream off, so I know what “magic” things can happen under the hood when processing packets (usually these are bugs) - that’s why I still believe this is processing of DNS requests/replies related issue.

You've mentioned even cached sites doesn’t work for you. Bare in mind that almost every regular site is using different domains when loading web page as sources for ads, images, scripts etc so even previously opened one can be stuck when you loose proper DNS connectivity. Same thing if you’re using IP address of web server instead of FQDN. You need very simple web page to test it.

Try using my website http://109.74.108.40/ , you should see a text ":)" even other sites won't open on your iPhone XS.

Best regards,
Greg

Freezer,

Meant no disrespect nor to lecture. When you stated "After some time on my iPhone XS I can see two IPv6 addresses assigned with one IPv6 gateway - which I have no clue where they come from.." I took it as you did not understand how IPv6 worked on the iPhone. I apologise if I misunderstood what you were saying.

- I tried your IP address and did get the ":)". It seems to also work consistently as you stated. I don't have good access to a simple website...I have a lot of cPanel based VPS servers and using a FQDN is pretty much a requirement when hosting multiple sub/add-on domains using a shared address... and I don't have the time to tweak the Apache configs to force using an IP for children domains.

- I am still not totally convinced it is DNS related. Can you explain to me why DNS would break while using 5GHz AC configurations, but work on all other non-AC 5GHz (and 2.5Ghz) configurations? Maybe something is messed up when using AC in combination with NAT/Masquerade (as was mentioned by @uldis) , causing what appears to be DNS issues. And why does it it appear to work on AC configurations when using L2TP and other UDP heavy applications? And why on just these new iPhones? My general intuition would suggest that it is a layer [1-3] issue and not service orientated; however I am 100% okay with being wrong in this assumption and would be happy to hear that DNS (any anything else) was the cause. We just need this fixed!

-Scott

Netispguy,

great, I’m glad it worked for you.

First of all, my MikroTik cAP AC is working in pure bridge mode, zero NAT, zero firewall rules so I don’t believe it is NAT related.

I’m suspecting the new iPhone XS is sending DNS requests in different manner - maybe the L2 frame has some extra fields for DNS requests and MikroTik has a bug in processing that particular type of frames when in AC mode - not sure. When using VPN, the DNS requests are encapsulated packets so these are different than the one when you’re not using VPN.

To confirm my theory that it is DNS related issue, install some ping tools on your iPhone XS, like Ping lite, move to AC mode and try to ping FQDN that you didn’t visit before on the iPhone XS. In my case I don’t get the IP address from the DNS server or I get it after very very long time - which seems too long for iOS http protocol to wait and it times out before any browser or app can get the response from DNS. Meanwhile try to ping any public IP address that is replying to ICMP. It should always work for you when in AC mode.

Regarding IPv6,

My iPhone XS and other apple devices are getting non link local IPv6 addresses assigned, that’s why I have zero clue where are they coming from as I don’t have IPv6 enabled router in my network. Also all these devices have exactly same link local IPv6 gateway IP address. I guess one of my CPE devices is giving IPv6 address but I didn’t have time to nail down which one is it.

Best regards,
Greg

unfortunately we are still unable to reproduce it locally.
Maybe you could disable the encryption - use the wireless connection without encryption.
Use 20mhz channel width.
Then use another AC router and start the wireless sniffer on that channel.
Connect with iphone xs to the AP using AC and then try to reproduce the problem. Write down at what time the problem happened or what you were trying to open so we could see that later in the sniffer file. Stop the sniffer and then send that sniffer file to support@mikrotik.com

Freezer,

What do you think about MT not being able to reproduce the problem?

-Scott

Netispguy,

great, I’m glad it worked for you.

First of all, my MikroTik cAP AC is working in pure bridge mode, zero NAT, zero firewall rules so I don’t believe it is NAT related.

I’m suspecting the new iPhone XS is sending DNS requests in different manner - maybe the L2 frame has some extra fields for DNS requests and MikroTik has a bug in processing that particular type of frames when in AC mode - not sure. When using VPN, the DNS requests are encapsulated packets so these are different than the one when you’re not using VPN.

To confirm my theory that it is DNS related issue, install some ping tools on your iPhone XS, like Ping lite, move to AC mode and try to ping FQDN that you didn’t visit before on the iPhone XS. In my case I don’t get the IP address from the DNS server or I get it after very very long time - which seems too long for iOS http protocol to wait and it times out before any browser or app can get the response from DNS. Meanwhile try to ping any public IP address that is replying to ICMP. It should always work for you when in AC mode.

Regarding IPv6,

My iPhone XS and other apple devices are getting non link local IPv6 addresses assigned, that’s why I have zero clue where are they coming from as I don’t have IPv6 enabled router in my network. Also all these devices have exactly same link local IPv6 gateway IP address. I guess one of my CPE devices is giving IPv6 address but I didn’t have time to nail down which one is it.

Best regards,
Greg

Freezer,

I do have PingLite on my iPhone and verified what you are saying. I am always able to ping external hosts using direct IP addresses when in AC mode (while sites requiring DNS are not responding correctly.)

I agree with your IPv6 assessment. There must be another device configured for IPv6 that is doing ND or something.

- With so many people seeing this issue, I am surprised that MT is unable to simulate the problem. I do not have time at the moment to do any additional testing as requested by MT; however seeing that MT is unable to verify that there is even an issue, I am pessimistic that we will see a solution anytime soon. With the problem being so obvious under what I would consider a basic ap-bridge configuration, I don't understand why they don't immediatly see it? All I know is that these new "s" devices are showing up more and more. That being said, we have ordered a few Ubiquity devices to see how well they integrate into our framework. We will continue to use our MT core router (at least for now).

- One more thing, a lot of folks around here use "wifi" calling on the iPhones. For a long time, I have had complaints that the connections would "drop out" from briefly to over 15 seconds. Basically, you hear silence like the other side went away...then they would return. I have experienced this issue myself and always pointed blame at our carrier (AT&T); however, since we disabled AC and went to A/N, this issue has 100% gone away. Just an observation...

-Scott

Observing the same issue on hap ac. It is configured as wisp ap, wlan is set to use a/n/ac, 80mhz eCee 5280 channel. IPv6 is configured on another mikrotik device.

So iphone xs connected to 802.11ac network can’t even ping external resources using their FQDN, due to failed name resolution. My DNS servers are located on the same L2 segment as iphone, both available via ipv6/ipv4, so this does not look like nat/routing/etc issue. At the same time, ping by ip works fine as well as ping by FQDN when connected to 2.4ghz network on the same AP. Moreover, ipad, macbook, etc. work without any issues.

I tried to disable ipv6 in the network it does not help: ipv4 only setup has the same issues.

I also tried to capture all traffic that is related to mac address of the iphone (via Tools/Packet sniffer), and I can’t even see DNS requests: name resolution silently fails without any packets captured by AP.

So looks like next step is try to capture packets via wireless sniffer, to see if something interesting there.

Yes, any helpful data would be beneficial, since we cannot repeat any of the described issues. I also have an Xs and some other people here do, none of us have seen any issues with hAPac, wAPac or other routers, we have done extensive testing here in the office and also use these devices at home.

The only possibility is that this is region related (iPhones are different), config related or ... I don't even know what else.

Yes, any helpful data would be beneficial, since we cannot repeat any of the described issues. I also have an Xs and some other people here do, none of us have seen any issues with hAPac, wAPac or other routers, we have done extensive testing here in the office and also use these devices at home.

The only possibility is that this is region related (iPhones are different), config related or ... I don't even know what else.

I have a couple of XS units that were bought in the US and an three units of international HAP AC and I'm seeing these issues with all the routers
Once I modified the wireless parameters to exclude AC everything went away but AFAIK iPhones do not have a region variance other than China models
The only variance is cellular/wireless/bluetooth firmware that is loaded by the region of the Phone as defined in Settings->General->Language & Region->Region
if I can provide any additional details please let me know.

-Ofer

MT: Have you still not been able go verify this problem? It has not gone away.

We want to understand if this happens with particular iPhone models. Could you please send us the iPhone model and part numbers on which you experience the issue? You can also do it privately by sending it to support@mikrotik.com.

The strings should be something like this:

• MT9H2ET/A
• A2097

This particular device performs as expected, no issues seen.

We want to understand if this happens with particular iPhone models. Could you please send us the iPhone model and part numbers on which you experience the issue? You can also do it privately by sending it to support@mikrotik.com.

The strings should be something like this:

• MT9H2ET/A
• A2097

This particular device performs as expected, no issues seen.

This one is an iPhone XsMax that does not work for sure:

- MT5G2LL/A
- A1921

Hi Arturs,

my iPhone XS model is :

A2097
MT9N2PM/A

Greg

We want to understand if this happens with particular iPhone models. Could you please send us the iPhone model and part numbers on which you experience the issue? You can also do it privately by sending it to support@mikrotik.com.

The strings should be something like this:

• MT9H2ET/A
• A2097

This particular device performs as expected, no issues seen.

As I mentioned both iPhones XS were bought in the US and have the following model and part number,

• MT972LL/A
• A1920

-Ofer

I wanted to chime in here since I'm also experiencing the exact same issue.

• MT9E2ZD/A
• A2097

It looks like the problem is happening on more than just US phones. At least two on the forum with A2097 are seeing the issue.

The model numbers "Axxx" differ in cellular technologies (e.g. CDMA, GSM, etc), LTE Bands and SIM card architecture. The part numbers (e.g. MTxxxxx/A) specify carrier, color and memory configurations.

iPhone XS:
A1920: US, Canada, Hong Kong and Puerto Rico
A2097: Europe and Asian markets (United Kingdom, Spain, Russia, Italy, France, Singapore, Taiwan, etc.)
A2098: Japan
A2100: China

iPhone XSMAX:
A1921: US, Canada and Puerto Rico
A2101: Europe and Asia
A2102: Japan
A2104: China and Hong Kong

MT9E2RU/A
A2097

This isn’t limited to iPhone, I’m able to reproduce this with the new iPad Pro 11”, MU1F2TY/A. This is the 4G variant.

MT: ?????

Since we are unable to repeat the issue with any new iPhones, I would like to ask everyone to describe the issue (what is happening) in more words, than just "SAME ISSUE", since many of you might have other issues. Please descibe in more detail, especially, how often does it happen and how you observe the problem.

Mtik guys,

Maybe we can schedule a session where I’ll give your engineer remote access to my cap AC and will reproduce the issue within minutes.

How about that ?

Greg

gladly. please email support and try to arrange time in GMT working hours, if possible.

Guys,

After some more digging I was finally able to discover how do I get in my LAN those weird IPv6 prefixes from.

It turned out that my Nest Thermostat is rarely sending IPv6 RAs, offering some IPv6 ULA prefixes, causing my devices to use Nest Thermostat’s ipv6 link-local address as their default IPv6 gateway where Nest is definitely not a router. I found that all Nest devices like Smoke detectors etc are doing the same thing.

This combination makes my iPhone XS basically not operational when connected via MikroTik AP set to 802.11ac. It is working fine when MikroTik AP is set to 802.11an. I believe due to some unknown bug in processing 802.11ac packets, MikroTik is preventing the iPhone XS (and most likely the new 2018 iPad Pros as somebody reported) from fallback to IPv4. Maybe it is dropping IPv6 packets, that I don’t have time to check.

All my other devices like iPad Pro 10.5” (2017), iPhone X, MacBook Pro (2017), MacBook 12 (2017), iMac 5K (2015), PC with Windows 10 don’t have problems with connectivity even with those silly IPv6 addresses and gateway assigned. Only the iPhone XS and only on the MikroTik’s AP configured to 802.11ac. I have other Asus 802.11ac AP in the same bridged network and when I’m in its range my iPhone XS works perfectly fine, even tough I still have those IPv6 addresses assigned from Nest Thermostat.

As a temporary workaround I have connected my Nest Thermostat to an isolated Guest SSID on my Asus router, so it is no longer advertising those IPv6 addresses to my home network.
Immediately I got rid of this crazy problem and can enjoy my 866Mbps connection via MikroTik’s AP!!!

To MikroTik staff : If you want to reproduce this issue I suggest you connect some Nest device to your network as the only device that advertise IPv6 prefixes and connect your iPhone XS to it using 802.11ac.
You have to wait couple minutes because Nest sends RAs every few minutes or so.
If you have other routers sending IPv6 advertisements you may still not be able to reproduce this issue, so make sure Nest is the only source of IPv6 in your LAN. Your main internet connectivity still has to be over IPv4. Make sure you’re using FQDNs in Safari when testing connection. If you don’t have any Nest equipmnent you might try to connect additional router to your LAN which will only send IPv6 RA’s and ULA prefixes but will have forwarding disabled - sort of dead end IPv6 router.

Flowers and bottles of bourbon are very welcome, if you wanna send one PM me for an address

Best regards,
Greg

Btw. This problem still existed on latest iOS 12.1.1 and on latest RouterOS 6.44beta40

Greg,

Good job tracking this down; however, I do have a question. We have nine (9) Nest thermostats. In addition, we have 11 Nest protects. We have a static IPv6 /64 address space that is fully routable. Every device that is configurable has a manually assigned IPv6 address. This includes all MT, Macs, Sony TVs, etc. As you are aware, we cannot configure IPv6 on the IOS devices. Our Core MT is the default route and most every device shows that router as the gateway, and in the case of “self assigned” the address is using the proper prefix. We pass a lot of IPv6 traffic. Since my XS devices are showing a correct public IPv6 address and gateway, it must be the LL address that are messed up. Did i get that right?

I am going to reassign all Nest devices to a new VAP and see if that solves the problem as you suggest.

Comments?

Thanks,

-Scott

Scott,

If you have a proper IPv6 default gateway (your edge router) on your iPhone XS then it would mean that the problem is actually forwarding IPv6 packets on MikroTik’s 802.11ac and has nothing to do with Nest in your office. In my case Nest is the only source of IPv6 in my LAN. Once I got rid of the IPv6 my iPhone XS and MikroTik’s 802.11ac works beautifully. Usually when there is a problem with IPv6 the CPE should fallback to IPv4 but somehow it’s not happening and everything is stuck.

Can you text me on Skype - freezer_szczecin
FYI, I’m based in Poland and got +9hrs to pacific time.

Greg

Greg,

I am presently in Whistler Canada on a short holiday. I will
be back next week and will reach out to you.

I am generally located in the San Francisco CA area.

-Scott

If you have single AP, can the problem be solved by disabling client-to-client forwarding on wifi?

Chupaka,

Do you also have Nest in your LAN or any other source of IPv6 ?

Greg

Nope, neither Nest nor iPhone

Chupaka,

So what CPE/UE do you have ? This discussion is all about connectivity issues on new Apple CPEs like iPhone XS or 2018 iPad Pro.

Hmmm IPV6 package not enabled on our clients router, also no Nest devices. However setting 5Ghz to wireless N does work. Though not ideal.

This discussion is all about connectivity issues on new Apple CPEs like iPhone XS or 2018 iPad Pro.

I understand that, I'm just trying to guess whether client isolation on AP can be a workaround for the problem.

This discussion is all about connectivity issues on new Apple CPEs like iPhone XS or 2018 iPad Pro.

I understand that, I'm just trying to guess whether client isolation on AP can be a workaround for the problem.

I plan to make some changes to the firewall to drop all ipv6 communication from the Nest Thermostat it seems a reasonable workaround for this issue

Ofer,

If you have only one AP and the firewall is processing bridged packets then blocking ICMPv6 should do the job.

Chupaka,

If client isolation blocks all the multicast traffic between clients then this should also do the job.

Ofer,

If you have only one AP and the firewall is processing bridged packets then blocking ICMPv6 should do the job.

I thought about dropping all IPv6 packets from the Nest across all my routers, I don't use IPv6 anyway and I removed that package from all the routers.

Ofer,

It doesn’t matter if you have IPv6 package or not because it is pure layer 2 transmission (like broadcast). Actually having IPv6 package might help with setting up some IPv6 firewall rules

Ofer,

It doesn’t matter if you have IPv6 package or not because it is pure layer 2 transmission (like broadcast). Actually having IPv6 package might help with setting up some IPv6 firewall rules

Just stating the details but I'll try to configure it to drop IPv6 packets I'm curious to see if it'll resolve it.

Hm interesting. All my IoT devices use another SSID, the main SSID ir only for phones and computers. If you all do the same, do you still see the issue? Do all of you actually have NEST devices?

Hm interesting. All my IoT devices use another SSID, the main SSID ir only for phones and computers. If you all do the same, do you still see the issue? Do all of you actually have NEST devices?

I do have the Nest Thermostat so I can check and see if it's actually the cause of the issue.
Seems to be reported long ago - https://forum.archive.openwrt.org/viewt ... p?id=54161

Normis,

Bare in mind that Nest in this case is just an external factor which arises some bug in MikroTik software, because same setup with my iPhone XS with same IPv6 ULA prefixes coming from Nest is working fine on ASUS router.

I do not have any Nest thermostats on my network and I still see this problem.

Hm interesting.

Good afternoon Normis.

managed to simulate the following.

RB3011 IPv4 / IPv6 (SLAAC) -> RB962 2Ghz / 5Ghz (Acces Point) -> iPhone Xs Max

iPhone Xs Max works fine on 2Ghz with dual stack.
iPhone Xs Max does not work on 5Ghz with dual stack in AC mode.

If I turn off IPv6 support on RB3011, the iPhone Xs Max works on 5Ghz.

1. turned off the multicast buffer does not help.
2. Turned off the milticast help, does not help.
3. turned off Keepallive and multicast help, does not help

Please fix this bug.

Hm interesting.

Good afternoon Normis.

managed to simulate the following.

RB3011 IPv4 / IPv6 (SLAAC) -> RB962 2Ghz / 5Ghz (Acces Point) -> iPhone Xs Max

iPhone Xs Max works fine on 2Ghz with dual stack.
iPhone Xs Max does not work on 5Ghz with dual stack in AC mode.

If I turn off IPv6 support on RB3011, the iPhone Xs Max works on 5Ghz.

1. turned off the multicast buffer does not help.
2. Turned off the milticast help, does not help.
3. turned off Keepallive and multicast help, does not help

Please fix this bug.

I'm glad you were able to confirm my conclusion !!!

-Greg

Hm interesting. All my IoT devices use another SSID, the main SSID ir only for phones and computers. If you all do the same, do you still see the issue? Do all of you actually have NEST devices?

I do have the Nest Thermostat so I can check and see if it's actually the cause of the issue.
Seems to be reported long ago - https://forum.archive.openwrt.org/viewt ... p?id=54161

I added a rule to drop all IPv6 packets from the Nest Thermostat MAC address using the bridge filter, issue seems to be resolved for now (tested for 24 hours).

@Greg,

I am back from Holiday. I will txt you soon.

My environment, which has a lot of IPv6 traffic (including IOS devices,) has nine Nest Thermostats and 11 Nest Protects (along with 9 AP's) and will be very difficult filter... My IOS devices appear to have the proper IPv6 addresses for the static IPv6 prefix on my edge router.

With regards to the Nest Protects (smoke and CO2), our local fire code requires that they all be connected together. This means that if one alarms, they all will produce an audible alert. Traditional fire detectors do this by way of a "traveler" wire; however, Nest does this wirelessly (using IPv6 I assume). In addition to triggering all of the Nest Protects, the Nest Protects also send a message to the Nest Thermostats (so they can shut down the ventilation for "forced air" type systems.) I have this function disabled on the thermostats since we have radiant heating, but there is no way to prevent the Nest Protects from sending the message.

I wish MT would admit this is an issue and aggressively attempt to fix it.

-Scott

@Scott

I guess Nest is not the root cause - it’s just a source of IPv6 addresses in people’s houses/offices. In your scenario your edge router is providing IPv6 addresses and still MT has an issue with forwarding IPv6 dns requests over their 802.11ac interfaces.

I haven’t had a single issue with my iPhone XS on MT’s 802.11ac since I got rid of IPv6 subnet by isolating my Nest Thermostat.


-Greg

in my case. I have both iPhone x and iphone xs max, and MacBookpro 2013 late, recently i notice they can't connect to one of the wap acs, which happens to be set to 5805mhz eeec automatically by capsman, country is set to my location and same as the iPhone and Mac, 5805mhz eeec just doesn't work. I solve this issue by manually picking other channels.

And im pretty sure i don't even have ipv6 menu in the whole system, x86 routeros as router, crs326 and 3 wap acs, all of them are running on latest stablt, and i don't have nest either.

i have no idea ifmy case is related.

iphone XS max earned at 6.43.8. I will test and check.

I had to turn ac off in another location yesterday. Location has active IPv6.

I have been unable to simulate this issue on any other platform (e.g, Ubnt, Cisco, etc).

Since we have a large of new iPhones, I have suspended ordering new MT until this is resolved. We are not a large commercial customer, but we have been dedicated to MT for many years.

I am extremely dissspointed MT is not addressing this issue with any other noticeable urgency.

-Scott

Mikrotik,

is there any update on this matter?

Greg

I can confirm the same behaviour iPhone XS
With Facebook app and Safari and Chrome browsers - seems worse with any site with cloudfare LB
MT9K2AA/A
A2097

This is a phone bought and used in SA
I have 3 hpAC RB's all with v6.43.8 (Model RouterBOARD 962UiGS-5HacT2HnT)

I followed the advice here and set to 20/40MHZz Ce Band and iPhone XS now works on the wireless with apps and browsing (its been like this for 8 hours) which has resolved months of torture.
Downside is I don't get the full performance on the wireless.
This seems to have improved stability to Apple TV 4K on video streaming from the iPhone XS.
I have my offices at my home too, with local servers where the full AC is needed on the wireless.

I have used other gear from other brands without this issue.

I don't have any Nest equipment on the network.
ipv6 packages are disabled on the RB's.
The one RB is a gateway device to internet which also provides DHCP and NAT the other 2 dont have anything else other than being in bridge mode. I typically connect to the other 2 RB's and not the gateway.

This is a bug on RB's AC 80MHz.

PS. the new iPhones XS etc use Intel Chipsets now and not the Qualcomm of previous generation.

I think I have a similar issue on my iPad 6th generation with iOS 12.1.1. I'm on RouterOS and RouterBOOT 6.42.10 with two wap AC access points running with CAPsMAN.
The 2,4 GHz network works like a charm, but connected to 5 GHz, I get IPv4 and IPv6, signal strength is good, but data flows very slow or not at all. Rebooting the iPad, airplane mode or disabling and re-enabling wifi doesn't help at all. Also, direct connections via IPv4 (e.g. to WebFig) doesn't work, so it doesn't look like DNS related.

Switching from 5ghz-n/ac to 5ghz-onlyn in my CAPsMAN configuration cures the problem immediately.

I didn't have more time to find out if it's related to one specific access point or channel, PMKID or DFS channel settings, but the problem sounds similar to what others experience in this thread. I try to provide more information.

I can confirm the same behaviour iPhone XS

yes, the problem is not solved on 6.43.8 5Ghz, dual stack ipv4/ipv6, it works very slowly, it even slows down the MacBook Pro 15 2017.

Apparently Mikrotik is not willing to admit they have an issue with new Apple devices (iPhone XS, iPhone XS Max, iPad Pro 2018) and are playing dummies.

I haven’t got any reply to my opened ticket with Mikrotik even tough I have delivered them data from sniffed wireless traffic. It is not my job to debug their products, nevertheless I did it just to HELP them nail down the problem but that’s still not enough for them. They seem to be waiting for a full solution on a silver plate so they can apply it.

I’ve also seen couple comments on one of the FB groups where Mikrotik engineers where ignoring this issue and pushing it on Apple.

Mikrotik has also stop responding to my open ticket as well.

I have an open ticket with Apple regarding this and they are 100% pointing the problem at Mikrotik, claiming they do not have this issue with a single other vendor.

I have to honestly say that not withstanding the loss of performance, turning off ac has had a dramatic affect within our environment. It seems that things like a VOIP, VPN, browsing, etc. are also much more stable. Network performance complaints (for *all* Apple users) have decreased by 95% since going to a/n!

-Scott

Apparently Mikrotik is not willing to admit they have an issue with new Apple devices (iPhone XS, iPhone XS Max, iPad Pro 2018) and are playing dummies.

I haven’t got any reply to my opened ticket with Mikrotik even tough I have delivered them data from sniffed wireless traffic. It is not my job to debug their products, nevertheless I did it just to HELP them nail down the problem but that’s still not enough for them. They seem to be waiting for a full solution on a silver plate so they can apply it.

I’ve also seen couple comments on one of the FB groups where Mikrotik engineers where ignoring this issue and pushing it on Apple.

Greg, can you please send me the link to the FB discssion?

Thanks,

-Scott

I translated the RB962 to work with CAPsMAN, I see that the AC mode works stably on the iPhone XS Max. Hmm

Having the same issues on a MT542ZD/A A2101 iphone XS max over here as well.
Also having a dual stack setup and the issue seems to be that the DNS queries are not getting to the server/gateway.
However everything works fine with a VPN (anyconnect/ openvpn).
Also the 1.1.1.1 dns app from the app-store fixes the issue (looks to work with a locally terminated VPN to do DNS hijacking).
However it is a bit ridiculous to have to be forced to use inside my own network.

Will try the disabling of the AC network as suggested in this thread, thanks for the suggestion.

Will try the disabling of the AC network as suggested in this thread, thanks for the suggestion.

RB3011 CAPsMAN -> RB962 AC dual stack ipv6 / ipv4. Already day everything works stably. If the same run without CAPsMAN, iPhone XS Max does not work in AC mode.

TimurA - After trying a thousand different configurations that were suggested here and some common sense ones, your suggestion of using CAPsMAN worked! Finally.

Confirmed with iPhone XS Max, iPhone XS, and iPad Pro 2018. Without CAPsMAN, 5GHz AC communication is unusable. Always used latest Testing firmware hoping for a fix.

I have CCR1016-12S-1S+(ROUTER) ---> RB922UAGS-5HPacD (AP)

Rate on the iPhone XS Max in the Registration Table in CAPsMAN is:
TX RATE: 866.6Mbps-80MHz/2S/SGI
RX RATE: 866.6Mbps-80MHz/2S/SGI

Hello,

I've notice issues with my iPhone XS Max after installing Mikrotik cAP ac RBcAPGi-5acD2nD. ( firmware v6.43.8 )
When i am connected to 5 ghz network i have some of my apps working but Safari/Google Chrome doesn't open websites, no error its like endless loading.
I am attempting to open facebook through safari and no luck, but facebook app itself is working ( A bit slower then it should tho )
If i connect to 2.4 no such issues there, all is working.

Other devices in the network doesn't seems to have this issue but neither my phone connected to other ac networks.

I've tried turning off ipv6 advertisement and ensured my phone has no ipv6 address, but i still had this loading issues. my iOS is updated to latest available version: 12.2.1

I am not sure if my problem is same as yours
Here's configuration export of wireless

Confirmed with iPhone XS Max, iPhone XS, and iPad Pro 2018. Without CAPsMAN, 5GHz AC communication is unusable. Always used latest Testing firmware hoping for a fix.

Hello lelmus, great! For a week now I have two access points in capsman working stably with iphone XS Max, with dual stack ip.
We are waiting for what MikrtoTik will say.

Please don’t force me to use CAPsMan!

I escalated this problem to my distributor. I let him know I am not ordering any new equipment until this is resolved.

I have RB962UiGS-5HacT2HnT with RouterOS 6.43.8 and a new iPad Pro 11'' 2018 (MTXP2LLA, latest iOS) and confirm the issue discussed above. The iPad connects to my 5GHz-AC network successfully, but Safari stops loading pages shortly afterwards while the connection seems to be active. All my other Apple devices including iPhone 7 and X, iPad Mini 4, MacBook Pro 2017 connect to the 5GHz-AC network and load pages without noticeable issues. As a workaround I switched to a 2GHz-N network on iPad Pro. Hope MikroTik team will acknowledge and fix this issue.

Update: Submitted a ticket (#2019011022006488) as well.

Guys,

can every single one of you send an email to support@mikrotik.com and open a case with them ? Otherwise Mikrotik guys won’t acknowledge this problem and none of them would work on this until official tickets are assigned.

Seems Mikrotik guys are treating this forum more like courtesy exchange point rather than an official problem reporting/solving channel.

Please copy your ticket number here. Mine is :

2018101622004329
Opened on 16 October 2018.
Last reply from MT was on 15 Nov 2018 - which is a bit embarrassing, because I’ve sent them additional captured data and they still haven’t got back to me.

I opened my support ticket on 11-October-18. Since then I have inquired many times. I have received a couple of responses asking for addition details; however, I am not going to post them (because although I am not happy with Mikrotik, I don’t feel I should embarrass them.)

My last communication with Mikrotik was also 15-November-18.

[Ticket#2018101122002554]

For a week now I have two access points in capsman working stably with iphone XS Max, with dual stack ip.

Is it CAPsMAN with local or remote forwarding? Does changing it change the picture?

I submitted a support ticket [Ticket#2019010922003975] as well

Is it CAPsMAN with local or remote forwarding? Does changing it change the picture?

datapatch installed in "Local Forwarding" and "Client to Client Forwarding".
i.e. customer management is given to Access Point.

For a week now I have two access points in capsman working stably with iphone XS Max, with dual stack ip.

Is it CAPsMAN with local or remote forwarding? Does changing it change the picture?

I used remote forwarding. Here’s the site that helped me setup:
https://techtrickszone.com/2018/08/01/m ... and-setup/

I tried CAPsMAN local forwarding and internet speeds increased. I now get 300Mbps down and 400Mbps up. Would like more but not bad.

I received this correspondence from Mikrotik overnight US time. I would say this shows they admit there is an issue; however, their suggestions don’t work for us. I responded the using CAPsMan, or just turning off ac were better workaround while they fix the problem.

————
“Hello,

Sorry for the long delay.
Could you please make sure that your Apple devices do not have an IPv6 Addresses attached to it?
To check it, go to Settings -> WiFi -> Click the "info" button on the wireless connection and check if there is no IPv6 addresses.
If they are there, can you try to remove them from your network or isolate the MikroTik device and make sure that no IPv6 addresses are given out from it and recheck again if the problem persists?”

Best regards,
————————-

-Scott

I received this correspondence from Mikrotik overnight US time. I would say this shows they admit there is an issue; however, their suggestions don’t work for us. I responded the using CAPsMan, or just turning off ac were better workaround while they fix the problem.

The manufacturer had to conduct all the tests himself.
We said that there is a problem! And do not force us to drive dances.

One idea in case this really happens just without CAPsMAN: It sets a few defaults (e.g. WMM) that otherwise have to be set manually. Maybe it's related to that? Just a wild guess though...

One idea in case this really happens just without CAPsMAN: It sets a few defaults (e.g. WMM) that otherwise have to be set manually. Maybe it's related to that? Just a wild guess though...

floeff, No, it does not work, I checked already.

Thanks to everyone for their input. The issue has been found and fixed, sorry for such a long time needed to fix the issue. It should be released in the next public beta version.

Thanks to everyone for their input. The issue has been found and fixed, sorry for such a long time needed to fix the issue. It should be released in the next public beta version.

Great news, what was the issue?

Apple uses a new chip, so presumably, a new driver too. This new driver did not follow RFC recommendation in one fragmenting method. We will try to contact them about it, but currently, we made a workaround.

Apple uses a new chip, so presumably, a new driver too. This new driver did not follow RFC recommendation in one fragmenting method.

Then why did it work in CAPSMAN? Logically, the iphone xs max was not supposed to work in any mode.

CAPsMAN uses different defaults for some settings and does not use some other settings entirely.

Great News! I am looking forward to the release with the fix/work-around. Hopefully soon?

-Scott

I don't know why this forum seems to so inconsistently subscribe me to email notifications on replies.

In my case, my iPhone XS refuses to use my network period if I have my Hurricane Electric IPv6 tunnel active. I don't know if it is some broken pMTU thing on iPhone XS, which is rather strange as my iPhone X, iPhone 8, iPad Air and iPhone SE all work fine...it is _only_ the iPhone XS that entirely loses network functionality via WiFi if I have my IPv6 enabled. I believe the iPhone XS uses Intel's latest modem, which perhaps it has an issue with IPv6 as Intel seems to think that IPv6 is irrelevant and their IT department doesn't even support it to be enabled on laptops/desktops/etc or allow it on their Internal networks.

Otherwise, my iPhone XS seems to work ok using manual WiFi configs on all of my WAP ac's...though one of my WAP ac's seems to have some other problem, as it is supposed to be a US model but allows international band selection and is just all around unreliable.

I'm looking forward to any RouterOS changes that may have work arounds!

I don't know why this forum seems to so inconsistently subscribe me to email notifications on replies.

In my case, my iPhone XS refuses to use my network period if I have my Hurricane Electric IPv6 tunnel active. I don't know if it is some broken pMTU thing on iPhone XS, which is rather strange as my iPhone X, iPhone 8, iPad Air and iPhone SE all work fine...it is _only_ the iPhone XS that entirely loses network functionality via WiFi if I have my IPv6 enabled. I believe the iPhone XS uses Intel's latest modem, which perhaps it has an issue with IPv6 as Intel seems to think that IPv6 is irrelevant and their IT department doesn't even support it to be enabled on laptops/desktops/etc or allow it on their Internal networks.

Otherwise, my iPhone XS seems to work ok using manual WiFi configs on all of my WAP ac's...though one of my WAP ac's seems to have some other problem, as it is supposed to be a US model but allows international band selection and is just all around unreliable.

I'm looking forward to any RouterOS changes that may have work arounds!

Have you tried to see if it works using IPv6 with "ac" disabled on your WiFi radio (i.e. just 5GHz-A/N)?

Have you tried to see if it works using IPv6 with "ac" disabled on your WiFi radio (i.e. just 5GHz-A/N)?

I don't recall if I had, I just tested it now and interestingly enough my wireless throughput is improved by 20% or more with AC disabled. Currently everything is "working" with IPv6 active (with AC enabled or not). I likely don't need AC anyhow since I am only running 40MHz channels to try to avoid RF congestion, I will run with IPv6 enabled and AC disabled for a few days to see what happens.

Just tested a new iPhone XS Max ... had issues with WiFi on the hAP AC and 6.42.11. Was necessary to set Band to 5Ghz-only-N.

Just tested a new iPhone XS Max ... had issues with WiFi on the hAP AC and 6.42.11. Was necessary to set Band to 5Ghz-only-N.

CAPSMAN RB3011, client RB4011 and RB962. When switching iphone XS Max or new iPad from RB962 in roaming to RB4011, the Wifi of 5 GHz is cut down on RB4011


RB4011 5GHz is disabled if the devices are on different channels. If they stand on the same, RB962 and RB4011, everything works.

The fixes are not released yet. They will be only in 6.44

The fixes are not released yet. They will be only in 6.44

Hello Normis. Good, we'll still waiting.
And,
when the device RB4011 is connected to the CAPsMAN, the wrong mac address is shown.

So far my iPhone XS has been the most stable it has been on my WiFi network since disabling AC, and IPv6 has been working perfectly fine since the change as well (where I had my tunnel disabled since getting my XS).

It looks like the fix may be included in the latest beta relaease: 6.44beta75 (2019-Feb-08 08:02). I have not test yet.

I installed 6.44beta75 on a spare hAP AC. I don't have time to fully test, but it looks like things are now working correctly for 5GHz-A/N/AC at 20/40/80MHz XXXX!

I ran into similar issues on a 2018 ipad pro, but it seems that 6.44beta75 resolves the issue.
Need to run some more thorough tests (on hAP ac) to evaluate stability and performance

Rudi

I ran into similar issues on a 2018 ipad pro, but it seems that 6.44beta75 resolves the issue.
Need to run some more thorough tests (on hAP ac) to evaluate stability and performance

-

It looks like the fix may be included in the latest beta relaease: 6.44beta75 (2019-Feb-08 08:02). I have not test yet.

-

I installed 6.44beta75 on a spare hAP AC. I don't have time to fully test, but it looks like things are now working correctly for 5GHz-A/N/AC at 20/40/80MHz XXXX!

Yes, 6.44beta75 contains the update I mentioned previously:
*) wireless - improved connection stability for new model Apple devices;

If you still encounter the described issues on this thread with the new Apple products, please contact Support .

Initial test with 6.44 beta 75 is looking fine.

I am having issues with L2TP connections but do see there is a lot of changes on the IPSEC side of things.

When do Mikrotik hope to have the fix in a production build so that we can get out to our clients please?

I have been having the same issue with iPhoneXs. I infect got apple to send me a replacement too. I found the issue on the replacement as well. This is unique to iPhoneXs as I have no issues on iPhone7, SE, MacBook Air, etc.

So on my RB4011iGS with ROS ver6.43.12, I set the 5GHz radio channel width to 802.11 N/AC and 20/40Mhz bandwidth and now the IPv6 works fine on my iPhoneXs.

Updated my RB4011iGS to ROS v6.44rc, and now the 5GHz 802.11ac with IPv6 now works fully. Awaiting the stable version of ROS v6.44 now.

I have upgraded all of my AP's to 6.44rc4 and everything is finally working with 5Ghz AC! I have not upgraded my core router yet since I have a number of IPsec interfaces (and I want the stable released version for that one.)

ROS ver6.44 stable is now available. This should settle this 5GHz 802.11AC IPv6 communication issue.

ROS ver6.44 stable is now available. This should settle this 5GHz 802.11AC IPv6 communication issue.

yes, all is well!

The problem persists, only RB4011 the interface 5GHz crashes when the device (XS,XS Max, iPad Pro) migrates to another device. Stop working 5ghz interface.

Ticket#2019022722003126

The problem persists, only RB4011 the interface 5GHz crashes when the device (XS,XS Max, iPad Pro) migrates to another device. Stop working 5ghz interface.

Ticket#2019022722003126

This is completely unrelated. You can make a new topic about it.

You can make a new topic about it.

okay, viewtopic.php?f=7&t=145834

Freezer (Greg), Are you seeing this also?

viewtopic.php?f=7&t=145834&p=719369#p719369

Just set manual frequency 5180, router set high frequencies unsupported by your phone.

Hello,

I've notice issues with my iPhone XS Max after installing Mikrotik cAP ac RBcAPGi-5acD2nD. ( firmware v6.43.8 )
When i am connected to 5 ghz network i have some of my apps working but Safari/Google Chrome doesn't open websites, no error its like endless loading.
I am attempting to open facebook through safari and no luck, but facebook app itself is working ( A bit slower then it should tho )
If i connect to 2.4 no such issues there, all is working.

Other devices in the network doesn't seems to have this issue but neither my phone connected to other ac networks.

I've tried turning off ipv6 advertisement and ensured my phone has no ipv6 address, but i still had this loading issues. my iOS is updated to latest available version: 12.2.1

I am not sure if my problem is same as yours

Code: Select all

0 name="EAP2G" mtu=1500 l2mtu=1600 arp=enabled interface-type=virtual master-interface=PSK2G mode=ap-bridge ssid="secure.mynetwork.ltd" vlan-mode=no-tag vlan-id=1 wds-mode=disabled wds-default-bridge=none
wds-ignore-ssid=no bridge-mode=enabled default-authentication=yes default-forwarding=yes default-ap-tx-limit=0 default-client-tx-limit=0 hide-ssid=no security-profile=EAP

1 R name="EAP5G" mtu=1500 l2mtu=1600 arp=enabled interface-type=virtual master-interface=PSK5G mode=ap-bridge ssid="5g.secure.mynetwork.ltd" vlan-mode=no-tag vlan-id=1 wds-mode=disabled wds-default-bridge=none
wds-ignore-ssid=no bridge-mode=enabled default-authentication=yes default-forwarding=yes default-ap-tx-limit=0 default-client-tx-limit=0 hide-ssid=no security-profile=EAP

2 name="Guest" mtu=1500 l2mtu=1600 arp=enabled interface-type=virtual master-interface=PSK2G mode=ap-bridge ssid="guest.mynetwork.ltd" vlan-mode=use-tag vlan-id=100 wds-mode=disabled wds-default-bridge=none
wds-ignore-ssid=no bridge-mode=enabled default-authentication=yes default-forwarding=yes default-ap-tx-limit=0 default-client-tx-limit=0 hide-ssid=no security-profile=Guest

3 R name="PSK2G" mtu=1500 l2mtu=1600 arp=enabled interface-type=IPQ4019 mode=ap-bridge ssid="cap.mynetwork.ltd" frequency=auto band=2ghz-g/n channel-width=20/40mhz-XX secondary-channel="" scan-list=default
wireless-protocol=802.11 vlan-mode=no-tag vlan-id=1 wds-mode=disabled wds-default-bridge=none wds-ignore-ssid=no bridge-mode=enabled default-authentication=yes default-forwarding=yes default-ap-tx-limit=0 default-client-tx-limit=0 hide-ssid=no
security-profile=PSK compression=no

4 R name="PSK5G" mtu=1500 l2mtu=1600 arp=enabled interface-type=IPQ4019 mode=ap-bridge ssid="5g.cap.mynetwork.ltd" frequency=5180 band=5ghz-n/ac channel-width=20/40/80mhz-XXXX secondary-channel="" scan-list=default
wireless-protocol=802.11 vlan-mode=no-tag vlan-id=1 wds-mode=disabled wds-default-bridge=none wds-ignore-ssid=no bridge-mode=enabled default-authentication=yes default-forwarding=yes default-ap-tx-limit=0 default-client-tx-limit=0 hide-ssid=no
security-profile=PSK compression=no

Here's configuration export of wireless

Code: Select all

# jan/08/2019 20:15:26 by RouterOS 6.43.8
# software id = .....
#
# model = RouterBOARD cAP Gi-5acD2nD
# serial number = ......
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" mode=dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa2-eap management-protection=allowed mode=dynamic-keys name=EAP supplicant-identity=cap01
add authentication-types=wpa-psk,wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=PSK supplicant-identity=""
add authentication-types=wpa-psk,wpa2-psk eap-methods="" mode=dynamic-keys name=Guest supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-g/n channel-width=20/40mhz-XX disabled=no frequency=auto mode=ap-bridge name=PSK2G security-profile=PSK ssid=cap.mynetwork.ltd wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-n/ac channel-width=20/40/80mhz-XXXX country=bulgaria disabled=no frequency-mode=regulatory-domain mode=ap-bridge name=PSK5G security-profile=PSK ssid=5g.cap.mynetwork.ltd wireless-protocol=802.11 wps-mode=\
disabled
add disabled=no keepalive-frames=disabled master-interface=PSK2G multicast-buffering=disabled name=EAP2G security-profile=EAP ssid=secure.mynetwork.ltd wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
add disabled=no keepalive-frames=disabled master-interface=PSK5G multicast-buffering=disabled name=EAP5G security-profile=EAP ssid=5g.secure.mynetwork.ltd wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
add disabled=no keepalive-frames=disabled master-interface=PSK2G multicast-buffering=disabled multicast-helper=disabled name=Guest security-profile=Guest ssid=guest.mynetwork.ltd vlan-id=100 vlan-mode=use-tag \
wds-cost-range=0 wds-default-cost=0 wps-mode=disabled