MikroTik

looka

I don't have any of those devices yet and I prefer to verify my setup before buying everything...

looka

All sources coerce in this case. For all I read, there is power negotiation between PSE and PD (via LLDP or the resistor I guess) and the PSE valid output is 44-50V. Which means my fear may be valid - what if Hex negotiates too little power and / or voltage for the device it powers (via passive poe ...

looka

Just fresh at this and don't want to jump to conclusions. I think you aim at "uni ap at+ injector will provide 48 V & 0.65 A, if client introduces itself as at+ client, else 0 V", but want to be sure there is no gotchas. My setup: active PoE (at+) injector -> MT hex s -> 10m cable -> u...

looka

Yes, Metod, I'm worried about this "same output as input voltage". What if active injector decides 44V is enough (and what are criteria for him to do so) ?

looka

i think i understand - "active" protocol only assures that 1) recepient actually requests poe 2) voltage drop on the line is taken into account, up to certain amount. it does not mean that device will request certain voltage, say 10V, and at will be able to provide it. 48 V is nominal for ...

looka

Is there a way to tell PoE injector to supply specific voltage?
I use Hex S, which supports 48 V and will use Unifi U-POE-at injector, which is capable of 48 V. I need that voltage, because I'm feeding that voltage via PoE out port to a device that requires 48 V.

looka

yes, i noticed that... however, i must say i'm not so in love with mt anymore. while they're working on a fancy wave 2 tech, which will bring some joy to newer products, ubqt, tp-link and others have their gen.6 wifi devices on the shelves. also, everything is so bloody difficult to achieve with mt....

looka

i know, silly question. "masquerade is a special src-nat for dynamic public IPs".

but, if I have more than one public IP and only one rule, which masquerades all traffic, is it going to work? which IP does the masquerade choose and how?

looka

1st update: to enable Authentication tab on the network interface, Wired AutoConfig service needs to run: https://www.virtualizationhowto.com/201 ... ntication/

looka

could anyone provide a complete example of how to setup windows client + mt dot1x server (+radius package)?

- what does the "accounting" parameter to in the /interface dot1x ? if yes, then the auth request shall be forwarded to the server (radius). what happens if this setting is set to no?

looka

that's really interesting question.

i only have hap ac and its wifi range is, i think, lower than an archer's C7. which is somehow "looked down to" by mt community.

looka

Hi, just a crazy idea - would it be possible to use mAP or mAP lite as an occasiona-use network cable tester? https://wiki.mikrotik.com/wiki/Manual:Interface/Ethernet#Detect_Cable_Problems But, as often with MT documentation, I can't quite make whether this feature is implemented on mAP or mAP lite ...

looka

Hi, i'm testing an external service and i want to use MT router to simulate a couple of echo clients. how can i reflect all traffic to a range of ip's back to original sender? simple reflecting traffic, but to any (client) ip and with swapped destination and source ports. i know this can be done for...

looka

i agree here with the fact, that having only 5 ports is annoying. even low-level companies offer 8-port routers, while with mt things get intere$$ting with more ports...

looka

i think i have gpon - i took sfp out of my isp' router and shoved into my hex s. it works nicely, there is a dhcp on top.

looka

It's CCQ and not supported in capsman, support says. fyio.

looka

867, sorry. it was meant as a reference to maximum theoretical speed for 2x2 ac - meaning there is no way it can go faster.

looka

there you have it, one ap with potential only up to 887 or so mbps and other one that gets capped by cpu at that speed. the choice is all yours.
ask on another forum maybe

?

looka

i've never reached Eddie's speeds on my hap ac, more like 400mbps +-100, visible distance. my client is a 2x2 intel card.
is the speed you mention on ac2 based on 3x3 client experience?

looka

so it's hap ac vs ac2.
hap ac2 is cheaper, i think, and has faster processor. but if wifi is not good, you're better off with ac.
check around and report, which one has a better wifi

looka

of the wap/hap ac? i think wifi slightly better with wap, but hard to say. tested in different environments... on the other hands, hap has more ports, if you need a switch as well.

looka

hap ac is most expensive because it has the most features. i'd search which has the best wifi.

looka

then don't waste money on hap ac. check, which of cap/wap ac or hap ac2 has best wifi.

looka

hex s + audience :) there are also wap ac and cap ac to consider, if you need an ap and hate audience. but if you insist on ac-something device, i'd check which of the lot has the best wifi. i heard some people had problems with hap ac2's wifi. i only have experience with hap ac and wap ac, which ha...

looka

depends, depends and depends. hap ac is a great little aio device - has wifi, routing and sfp. i need all those 3 things and if isp's optical cable position would be different in regard to my sofa, i'd be optimizing that exact device and be happy with it. hap ac2 and hex s share same core, but diffe...

looka

hex s. i only have 100mbit line, so it's enough. i have one hap ac, which was my primary router, but a) it had slow cpu, so i had to fasttrack, which ruined queues and consequentially my qos, and b) it was placed rather unfortunately, so the wifi was quite bad as well. i moved ap to more favorable l...

looka

This is general rule of thumb, divide anything that marketing dpt says by 3 and you'll get response under prolonged non-ideal use.

looka

I'd be looking into Audience + hex s combo.
I don't see any improvements on my hap ac, which i use as ap. perhaps minor in range through walls, with the dynamic noise adaptation setting.

looka

Hi,

I'm sorry to be so thick, but where can I see ccq of a client, connected to a capsman managed cap wifi device? I have access to cap and its man.

looka

ping!

still nothing?

looka

For all DoT lovers out there, I'm bringing fresh official bad news. Received yesterday, directly from MT support:

Unfortunately, DoT is not planned to be implemented in the near future.

looka

well, i have to talk to myself - mangling is done first, then filtering. which is also the reason why, i think, connection marking lets through some packets - those packets are invalid and therefore connection manager discards is, so also connection marking does not work. the packets, that pass thro...

looka

decision of excluding own router's ip masking was to free up some cpu, since it looked as a simple thing to do.

looka

You understand enough :) masquerading public ip happens, when router (or device behind it) tries to reach IP, which is not in router's public IP network. I think the chain goes like this: local_ip -> masquerade to public_ip, or if router starts connection, then public_ip -> masquerade because destin...

looka

Well, it was a test if it is possible to do it. I found something, that stopped me from separating my server from the network - DLNA and its SSDP. SSDP misuses word "simple" quite badly. There is something, that bothers me still, but I really don't know whether because of my setup or this ...

looka

I have a strange problem - some packets seem to drip through the mark-connection mangle rule with, which is supposed to match all, despite passthrough=no setting. What's wrong? /ip firewall mangle add action=mark-connection chain=input comment="mark input as priority" new-connection-mark=c...

looka

If I move my server to another subnet, then I don't need the hairpin and because of that lookup-only-in-table rule I'm able to see original IP. But, if I do that, CPU should take the hit, because all traffic between my server and local (gigabit) devices is not switched anymore, but routed. I have he...

looka

Another route rule + hairpin NAT did the trick, yes. Thanks. But is there a direct way, without hairpining? Using this technique my server sees router's IP whenever I'm connected to it from local network. There is one last thing - can I make the server accessible from router by its domain name (whic...

looka

Okay, there are one or two problems, though - accessing my server by domain, which resolves to the external static ip from inside my network. Before this new route of mine, I was solving this problem till now using hairpin nat rule, but now it does not seem to work anymore. Is there a route or rule,...

looka

Oh that is much better for my purpose, thanks! That's my setup now: /ip address add address=<public-static-ip> interface=<public-if> /ip route add distance=1 gateway=<gateway-for-static-ip> routing-mark=server /ip route rule add src-address=<server-internal-ip>/32 table=server ...using default masqu...

looka

Well, I've checked this and I understand I'm waisting CPU with my "direct route marking" approach, but it does the same job. And everything else, but I can't get my head around one thing - in the example they have assigned network ID to interface called LAN. Any idea what is that interface...

looka

Adding a route for the lcocal bridge seems to enable accessibility, but why and can i get rid of that extra rule? it feels wrong. also, traceroute from my server still shows traffic goes throug dynamic public ip's gateway. /ip route add distance=1 dst-address=192.168.44.0/24 gateway=bridge pref-src=...

looka

I was thinking - does masquerading take into account connection's default route? In that case, is it enough to have simple masquerading rule, which would then decide which ip to take into account for both, dynamic and static public ip? Instead of src-natting for static and then masquerading for dyna...

looka

hi, i know, this has been answered, but i can't get it to work. so. I would like to route traffic from/to my server using different route than the rest of my devices. i have 2 public IPs, one dynamic by DHCP and one static. Each IP is also using its own gateway, which I'd like to use (and proove it'...

looka

don't want to be ungrateful bastard, audience is a great product and all, but... wifi5 standard seems one foot in the past by any technical means, even with the patch named wave2. qualcomm has also announced some wifi 6 socs, sooo...
can we expect a wifi 6 device soon?

looka

interesting insight, thanks. i, with my hap/wap ac have limited experience, but can you compare audience to anything else in terms of signal coverage, random drops.... or perhaps, since it uses 2 5ghz interfaces, can you see difference between them in speed or coverage? I understand also the seconda...

looka

Hi, We have a couple of heavy wi-fi users at our home, which may exshaust my hap ac's capabilities. But I have a small home and would like a more powerful device, not meshing. Is Audience a sensible replacement, or is as single-ap unit too similar to hap ac? Does audience have MU-MIMO or could it be...

looka

i'm not worried about cpu, just readability and the fact, that there is many mis-info, including some on wiki, outside about how to setup mt router.

looka

yes, that was the drawback

looka

so.... i know there is plenty of Q and also A out there about this particular setting, but I'm confused. it's commonly known/advised that one should specify destination and interface and what's not or even avoid masquerading at all, but i don't see a reason why i should not do it like this for my so...

looka

...all you need to do now is post a sign somewhere, something like ~~ <3 Welcome to hackers' paradise €> ~~ whenever you hit the wall of your knowledge or boss's schedule, best thing you can do is to whore with good ol' yes to all. /tool wol command requires "test" permissions, but note if...

looka

Indeed. Fast track only ruins qos. Qos was one of key reasons to use MT.

Sent from my E5823 using Tapatalk

looka

Yes, but as fast track is implemented now, it ruins qos, if you have more than one bridge (guests) or using VPN. Solving this is second half of the step I was talking about.

looka

Exactly. I think the fasttrack right now is half a step in right direction. I'd like to see MT to make that step till the end - it only makes sense to fasttrack heavy traffic and that one needs to be accounted in queues, not make them inpossible to use.

looka

Yes... But. There is always a but. I figured out my Hap AC maxes its CPU at around 100M download from the internet, so I fasttracked heaviest connections and used queue tree with hardware parent to give connections with no-mark lowest priority. In upload direction it isn't a problem, as I only have ...

looka

it started working when i set wan interface-list to the wan-bridge. just in case anyone sees this.
but... it does not work as i expected from queue tree point of view. parent of download traffic is still only lan-bridge and not wan-bridge, as i'd hoped it would...

looka

I'd like to use setup where my wlan interface has its own bridge and be reachable from any lan-bridge devices. The reasons... in short, I'd like to use fasttrack and queues. I have one normal bridge, where all LAN interfaces are bridged to. Internet link is on SFP1 interface, a DHCP client. I can pu...

looka

Okay.... never easy with MT. There are two ways of letting ipsec connections through. Allow protocol 50 or connections with in ipsec policy. When I'm trying with the first option, vpn connects but connections somehow do not get through. If i do it with second type rule, then everything is fine... an...

looka

Okay, 50% of mystery solved

Why is then my connection working even while I'm not allowing ipsec protocol (50) on input chain?

looka

I have a working ikev2 vpn connection setup on my ros. Every tutorial says i need to allow ports 500, 4500 UDP and IPSec ESP on input chain. Some tutorials even say port 1701 UDP needs to be opened on input chain. Than why is my connection working completely even if I don't allow 1701 nor IPSec esp,...

looka

Yes!
I've marked (and eaten) some packets in a rule above mentioned one.
Thanks.

looka

I'm marking all packets in mangle section to get a decent QoS. One of my mangle rules should detect any new connection: add action=jump chain=forward connection-state=new jump-target=forward-new And inside the forward-new chain I mark all connections with different marks. However, the above rule see...

looka

Sorry to bump this old thread, but is there anything extra to be done except NAT-ing ports to use this solution? I have problems.... I've NAT-ed UDP ports 1701,500,4500, ipsec-ah and ipsec-esp and gre. Still nothing. I have PPTP VPN working, but would like to transit to more secure solution. So I ju...

looka

Makes you a better customer than me, easier to satisfy ;). I don't think CAPsMAN has anything to do with speed, it's just management system for when you have a grid WiFi to maintain. I have only 40MB/s and still ranting due to bad CCQ, which cure i'm searching for. I have 50MB/s on upload, cause CCQ...

looka

I was ready to punch in some number for manual power output, but then I read it's bad, so I didn't :) Anyhow, the manual is also kinda vague about what that number means - is it some kind of coefficient, factor... https://wiki.mikrotik.com/wiki/Manual:Wireless_FAQ#What_TX-power-mode_is_the_best.3F w...

looka

Hate to nag our respected elder speed fanatics, but does anyone have a suggestion about my asymmetrically crippled ccq? Is it possible a bad mt wifi transmitter and in that case how would i check it?

looka

hehehe what's been leaked cannot be un-leaked:)

one last thing - what affects ccq? meaning, i have good ccq (>90%) while sending wifi towards mt, but terrible (~60%) when receiving. same spot, empty 5g band space etc. mt says -50dB on all chains, and i measured about the same on client side.

looka

mind sharing your settings? I'll see if I can lower my CPU consumption. I did my tests by copying large file between NAT on wired IF and my wifi client. ps. i've seen somewhere a "best 2018" test and the winner really was something, AC3xxx-something, 8-legged, 300€+ beast. First router to ...

looka

not in my case. 350mbps has eaten about 60% of my CPU, which makes it *roughly* proportional to 500mbps being 100%

looka

no. as it has been discovered, CPU gets capped at 500mbps and that's the end of it. that speed is reachable even with using 2-chain client, such as on my dell xps. now i only need to figure out why i can only reach that upload, while download stays below 400mbps. could it be my 2 little receiving ch...

looka

depends on the corner, really. and still half of 400mbps is 200mbps, which is still twice as what i can get over crowded 2.4g space.

looka

yes i saw... moving client for 20cm so that it hides behind a corner of a brick wall halves the transfer speed instantly. my urge to have 500mbps which i almost never use is not strong enough to drill holes :) @eddieb, the 500mbps link you mentioned you achieved - what was the environment? I guess L...

looka

mt at one end of the hall, attached on the brick wall at 2.2m height, which is 20cm under ceiling, upside down (wired interfaces facing up). client was positioned in my hand from 1 to 8m away with no change in ccq, apart from when i was walking away or towards the router. signal should be about -50,...

looka

yes.... any tips to improve it? on low speeds it's 100% (surprise, surprise) and my client connects with 866mbps, so i have chances at least in theory. it's my first mt device and i really like it, but to be honest, learning curve is a bitc* and documentation is really scattered.

looka

as the title goes. what's real wifi transfer speed of that router, hap ac? let's assume ideal conditions (no background noise, client in close proximity, updated fw, ac-only setting, Ceee wide channel...) and one ideal ac 3x3 client, which is not another mt device (meaning no cheating by means of ns...

looka

find gets you an array of results. check if this array's length is > 0

:if([:len [/file find flash]]>0) do={#stuff}

wiki scripting page is also useful.

looka

Hi, I'm struggling getting a sensible QoS right. I have a SOHO setup and queue trees with 3 tier traffic, which makes sense for me: - priority (ICMP, dns requests, TCP packets with rst, fin, ack... all the small stuff.) - normal (surfing, streaming video etc) - heavy (ftp, p2p) Marking priority traf...

Search found 77 matches