Wi-FI Connection issues

viktorkrp · Mon Aug 05, 2024 2:25 pm

I faced an issue with my Mikrotik RB962UiGS-5HacT2HnT. My Windows equipment and an old LG TV stopped connecting to the Wi-FI or started connecting from time to time. I reset the router, checked all configurations, and spent a lot of time looking for the causes of the issue. Finally, I paid attention that when a pc tried to connect to the router, it displayed an IP address like 192.186.88.105 and router API displays that the PC tried to connect with IP like 192.168.88.23, e.g., different IP addresses. PC disappeared from the list of connected Wi-Fi equipment after trying to connect. There were no specific settings in the DHCP server in the router, the DHCP could generate addresses in the 192.168.88.10 - 192.168.88.254 by default. I decided to change the diapason to 192.168.88.100 - 192.168.88.254 and everything started working! Why? Why did it stop working, and why did it start working with the restricted diapason? The only change I did was the latest 7.15.3 MikroTic software version installation. Thanks.

Lupowsky · Mon Aug 05, 2024 5:32 pm

hello, i'm new here but i have a few ideas that i would share:
1 - When you upgrade the software sometimes something change, some default variable may still be there some maybe not. I suggest to do a compare betwen the 2 version to see what changed;
2 - I think your problem might be in the network you are using ( es. /24,/25 ecc in either pc or RB), try to check the netmask of your pc first and then the address/route on RB

i hope to not missguide you...

Mon Aug 05, 2024 6:03 pm

I decided to change the diapason…

We borrowed that word into English, but it's used in reference to tuning forks and such, getting an orchestra into tune. What application does it have here, in this context?

…everything started working! Why?

You don't give enough details for more than speculation.

Dueling DHCP servers, one on the router, one on the hAP ac?

Static/dynamic IP conflict in the .10-99 host range?

Gremlins?

If you want a definitive answer, you'll have to provide more details. You can start with showing your hAP ac configuration (/export) and telling more about this "router" of yours, which is presumably not the hAP ac.

infabo · Mon Aug 05, 2024 6:46 pm

You have a second DHCP server on your network

jaclaz · Mon Aug 05, 2024 6:51 pm

We borrowed that word into English, but it's used in reference to tuning forks and such, getting an orchestra into tune. What application does it have here, in this context?

Well, it is probably a translation from the OP native language.
diapason->fork->something between two values=range
it makes sense, as an example in italian one could say "valore compreso in una forchetta" that would translate to "value included in a fork".

Gremlins are improbable, they tend to be more destructive, sounds more something a disgruntled kobold would do.

@viktorkrp
Instructions to post the configuration:
viewtopic.php?t=203686#p1051720

@infabo
... and likely a non MIkrotik one, this is actually the first time Mikrotik's "different" way to assign DHCP leases (from the highest address) has some practical advantage.

viktorkrp · Mon Aug 05, 2024 7:28 pm

@all thank you for your replies

@jaclaz, thanks for the instruction. I add the whole config to the end of this message.

I have been using the router for a long time without any configuration changes, only updates. Issues started yesterday.

Windows devices almost can't connect to the router when:

/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254

Windows devices successfully connect to the router when:

/ip pool
add name=dhcp ranges=192.168.88.100-192.168.88.254

Android devices can connect in both cases without any issues.

There is also the result of the ipconfig command in a Windows device environment:

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : xxxx::xxxx:xxxx:xxxx:xxxx%4
   IPv4 Address. . . . . . . . . . . : 192.168.88.246
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.88.1

The router configuration:

# 2024-08-05 19:09:19 by RouterOS 7.15.3
# software id = XXXX-XXXX
#
# model = RB962UiGS-5HacT2HnT
# serial number = XXXXXXXXXXXX
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    country=ukraine disabled=no distance=indoors frequency=auto installation=\
    indoor mode=ap-bridge noise-floor-threshold=-110 ssid=Nab528-2GHz \
    wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX country=ukraine disabled=no distance=indoors frequency=\
    auto installation=indoor mode=ap-bridge ssid=Nab528-5GHz \
    wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk group-ciphers=\
    tkip,aes-ccm mode=dynamic-keys supplicant-identity=MikroTik \
    unicast-ciphers=tkip,aes-ccm
/ip pool
add name=dhcp ranges=192.168.88.100-192.168.88.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Kyiv
/system note
set show-at-login=no
/system routerboard settings
set silent-boot=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

jaclaz · Mon Aug 05, 2024 8:34 pm

Ok, so you router is 192.168.88.1 (the bridge interface to which all ports but ether1 are added).
The ether1 has a Dhcp client running and gets its IP from the ISP, and very likely a dynamic route is created to access internet.

The leased DHCP address range is (now) 192.168.88.100-192.168.88.254.

The Windows device example you posted got a 192.168.88.246 IP address from the DHCP.

Everything seems good and pretty much "default".

What is strange is that the Mikrotik DHCP server assign leases (usually) starting from the highest address in the range, i.e.:
192.168.88.254
192.168.88.253
192.168.88.252
...
192.168.88.246

So it should not change whether the range is 192.168.88.100-192.168.88.254 or 192.168.88.10-192.168.88.254 (the default one).

It is possible that you have another DHCP server (accidentally) enabled on the network, but unless it is another Mikrotik device, generally speaking they provide DHCP leases in ascending order, *like*:
192.168.88.10
192.168.88.11
192.168.88.12
...

So a conflict is unlikely to happen unless you have a lot of disconnections/reconnections and the DHCP leased address changes.

Can you post the output of

/ip arp print

(obfuscate the MAC numbers, what is interesting to know is which IP addresses are in the list).

And then
1) reset the DHCP range to 192.168.88.10-192.168.88.254
2) if there are more than a few lines in the previous /ip arp print output run the command to completely clear the arp table :

/ip arp remove [ find ]

3) and after some time, and some connection attempts from the various devices, print again the arp list

There have been in the past issues with "stale" arp entries,
viewtopic.php?t=195759
maybe your strange behaviour is connected to that.

Mon Aug 05, 2024 9:09 pm

What is strange is that the Mikrotik DHCP server assign leases (usually) starting from the highest address in the range

ISC dhcpd did that. At the time I was last using it, it was the most popular FOSS DHCP server in the world.

I don't remember what order dnsmasq assigns leases in, the most common FOSS thing I see these days.

jaclaz · Tue Aug 06, 2024 12:00 am

Maybe I didn't express myself correctly.

Since Mikrotik DHCP server assigns addresses from the top, there should be no difference in the behaviour when changing the range bottom, I find strange that a range 192.168.88.10-192.168.88.254 behaves differently from a range 192.168.88.100-192.168.88.254.

If the addresses are given in descending order they should be the same, starting from 254 and going down, no matter what the lower range value is.
And in any case in a home network there should be a few devices only and only a brunch of address leased, while in theory you need more than 150 before getting below the current 100 lower limit.

viktorkrp · Tue Aug 06, 2024 10:03 pm

@jaclaz, here is the result of the "/ip arp print" command execution before any changes:

 #    ADDRESS         MAC-ADDRESS        INTERFACE  STATUS   
 0 DC 192.168.88.252  XX:XX:XX:XX:XX:XX  bridge     reachable
 1 DC 192.168.88.15   XX:XX:XX:XX:XX:XX  bridge     stale    
 2 D  192.168.88.22   XX:XX:XX:XX:XX:XX  bridge     failed   
 3 D  192.168.88.240  XX:XX:XX:XX:XX:XX  bridge     failed   
 4 D  169.254.198.40  XX:XX:XX:XX:XX:XX  bridge     failed   
 5 D  192.168.88.247  XX:XX:XX:XX:XX:XX  bridge     failed   
 6 D  192.168.88.17   XX:XX:XX:XX:XX:XX  bridge     failed   
 7 DC 192.168.88.254  XX:XX:XX:XX:XX:XX  bridge     stale    
 8 D  192.168.88.24                      bridge     failed   
 9 DC 100.64.0.1      XX:XX:XX:XX:XX:XX  ether1     reachable
10 DC 192.168.88.242  XX:XX:XX:XX:XX:XX  bridge     reachable
11 DC 192.168.88.249  XX:XX:XX:XX:XX:XX  bridge     reachable
12 D  192.168.88.12   XX:XX:XX:XX:XX:XX  bridge     failed   
13 D  192.168.88.19   XX:XX:XX:XX:XX:XX  bridge     failed   
14 D  192.168.88.237  XX:XX:XX:XX:XX:XX  bridge     failed   
15 D  192.168.88.26   XX:XX:XX:XX:XX:XX  bridge     failed   
16 DC 192.168.88.244  XX:XX:XX:XX:XX:XX  bridge     stale    
17 DC 192.168.88.251  XX:XX:XX:XX:XX:XX  bridge     reachable
18 D  192.168.88.14   XX:XX:XX:XX:XX:XX  bridge     failed   
19 D  192.168.88.21                      bridge     failed   
20 D  192.168.88.239                     bridge     failed   
21 DC 192.168.88.246  XX:XX:XX:XX:XX:XX  bridge     reachable
22 DC 192.168.88.253  XX:XX:XX:XX:XX:XX  bridge     reachable
23 D  192.168.88.16   XX:XX:XX:XX:XX:XX  bridge     failed   
24 D  192.168.88.23   XX:XX:XX:XX:XX:XX  bridge     failed   
25 DC 192.168.88.241  XX:XX:XX:XX:XX:XX  bridge     stale    
26 D  192.168.88.248  XX:XX:XX:XX:XX:XX  bridge     failed   
27 DC 192.168.88.11   XX:XX:XX:XX:XX:XX  bridge     stale    
28 D  192.168.88.18   XX:XX:XX:XX:XX:XX  bridge     failed   
29 DC 192.168.88.236  XX:XX:XX:XX:XX:XX  bridge     reachable
30 D  192.168.88.25   XX:XX:XX:XX:XX:XX  bridge     failed   
31 DC 192.168.88.243  XX:XX:XX:XX:XX:XX  bridge     stale    
32 DC 192.168.88.250  XX:XX:XX:XX:XX:XX  bridge     stale    
33 D  192.168.88.13   XX:XX:XX:XX:XX:XX  bridge     failed   
34 D  192.168.88.20   XX:XX:XX:XX:XX:XX  bridge     failed   
35 DC 192.168.88.238  XX:XX:XX:XX:XX:XX  bridge     stale    
36 D  192.168.88.27   XX:XX:XX:XX:XX:XX  bridge     failed   
37 DC 192.168.88.245  XX:XX:XX:XX:XX:XX  bridge     stale    
38 D  192.168.88.34   XX:XX:XX:XX:XX:XX  bridge     failed

Addresses like 192.168.88.34 were generated when the range was 192.168.88.10-192.168.88.254. The router started generating addresses like 192.168.88.254 when I changed the range to 192.168.88.100-192.168.88.254.

I executed the commands /ip arp remove [ find ] and changed the range back to 192.168.88.10-192.168.88.254. In addition, I executed the commands "ipconfig /release", "ipconfig /renew" on one of my Windows PC. After the updates the command "/ip arp print" returned the following result:

#    ADDRESS         MAC-ADDRESS        INTERFACE  STATUS    
 0 DC 100.64.0.1      XX:XX:XX:XX:XX:XX  ether1     reachable 
 1 D  192.168.88.249                     bridge     incomplete
 2 DC 192.168.88.244  XX:XX:XX:XX:XX:XX  bridge     stale     
 3 D  192.168.88.246  XX:XX:XX:XX:XX:XX  bridge     incomplete
 4 DC 192.168.88.253  XX:XX:XX:XX:XX:XX  bridge     stale     
 5 DC 192.168.88.236  XX:XX:XX:XX:XX:XX  bridge     reachable 
 6 DC 192.168.88.238  XX:XX:XX:XX:XX:XX  bridge     reachable 
 7 DC 192.168.88.245  XX:XX:XX:XX:XX:XX  bridge     reachable 
 8 DC 192.168.88.235  XX:XX:XX:XX:XX:XX  bridge     reachable 
 9 DC 192.168.88.243  XX:XX:XX:XX:XX:XX  bridge     stale     
10 DC 192.168.88.242  XX:XX:XX:XX:XX:XX  bridge     stale     
11 DC 192.168.88.250  XX:XX:XX:XX:XX:XX  bridge     stale     
12 DC 192.168.88.254  XX:XX:XX:XX:XX:XX  bridge     stale     
13 DC 192.168.88.251  XX:XX:XX:XX:XX:XX  bridge     reachable 
14 DC 192.168.88.241  XX:XX:XX:XX:XX:XX  bridge     stale     
15 DC 192.168.88.247  XX:XX:XX:XX:XX:XX  bridge     reachable 
16 D  192.168.88.24                      bridge     failed

So the router continued generating addresses like 192.168.88.24 for new devices. The PC displayed that it has the 192.168.88.105 IP address, that there is no Internet, and that the connection is not secure.

I updated the router software version to 7.16rc1. That did not help. The router continued generating the wrong IP addresses. I changed the version back to 7.15.3 and reset the configuration (I reset the config before writing to this forum and it did not help, but it helped when I did it again). After this, the router started generating the right IP addresses. I compared initial and final exported configurations with WinMerge, there were not any differences. The router has worked correctly for more than a day now. I have been using this router since 2016. This is the first strange behavior I faced with it. Thanks for the help.

jaclaz · Wed Aug 07, 2024 11:16 am

So it must be some "erratic" behaviour that happens on 7.15.3 BUT ONLY after an update to it AND NOT with a fresh configuration.

But this is only half of the story, besides the using the lower range, an IP like 192.168.88.24 has not in itself anything "wrong" and there is no apparent reason why a Windows (but not an Android) client would have issues to connect with that address assigned, and as well the 192.168.88.105 had issues (even if it is in the higher range).

Happy that you solved the problem, and good that you reported the issue, but I think that it will remain only as a "mystery" data point, as it looks a lot like one of those non-reproducible quirks.

pe1chl · Wed Aug 07, 2024 11:54 am

What is strange is that the Mikrotik DHCP server assign leases (usually) starting from the highest address in the range
ISC dhcpd did that. At the time I was last using it, it was the most popular FOSS DHCP server in the world.

The order depends on the size of the subnet and I think also on the actual subnet address. Very frustrating.
I remember when that first occurred in ISC DHCP and apparently it was due to some kind of hashing they did.
There were several complaints on their bugtracker about it, several times it was said that they would not fix it, but I think in the end they did. (of course now the program is no longer supported)

Likely MikroTik has forked the code long ago, or maybe uses only some functions from ISC and have built their own server around it.
That seems to be common in RouterOS. We see behavior that reminds of some older open source software but it has not been kept in sync with developments of that software, so newer features of it are not in RouterOS and when they appear there, they are not the same.

Wi-FI Connection issues

Wi-FI Connection issues

Re: Wi-FI Connection issues

Re: Wi-FI Connection issues

Re: Wi-FI Connection issues

Re: Wi-FI Connection issues

Re: Wi-FI Connection issues

Re: Wi-FI Connection issues

Re: Wi-FI Connection issues

Re: Wi-FI Connection issues

Re: Wi-FI Connection issues

Re: Wi-FI Connection issues

Re: Wi-FI Connection issues

Who is online