MikroTik

gutekpl

Step by step, iot=10, guests=100, leaving home traffic untouched. /interface bridge add name=br vlan-filtering=yes 1.PNG /interface vlan add interface=br name=MAIN vlan-id=10 add interface=br name=GUEST vlan-id=20 2.PNG /interface wifi datapath add bridge=br name=MAIN vlan-id=10 add bridge=br name=G...

gutekpl

Ok, so sadly not everything is working as expected and problem is not just cosmetic. Did you follow MT instructions ? Just copy them so you understand what's been done why. I followed them like 20 times with adjustments to my situation and always ending up with whole network not working. Either I go...

gutekpl

Yep, every time I do them line by line (adjusted to my config) I am ending up with red warnings in wifi tab saying something like vlans managing is not working and no devices are connecting to caps. Anyway I tried one more trick and I left my capsman in the state it was earlier, but went back to pla...

gutekpl

I am playing with it back and forth since couple of hours and cant get it working

gutekpl

I reseted config of the caps with "CAPS mode" option enabled and now cliients are connecting, but those connected through caps are ending in the bad dhcp pool and displaying bad bridge port. Not far from the end, just cosmetics I believe :) BAD: 1.PNG GOOD: 2.PNG Posting export from main d...

gutekpl

I think I will try to reset one of the caps to default settings to see if the problem lays on cap or on capsman side.

gutekpl

Looks like I configured new capsman on hap ax2, I added itself as a cap and my wifi is working again, at least on devices connected to this paticular device. Regarding caps seems I ran into some troubles, I removed wireless package, installed qcom-ac, followed chapter "CAP using "wifi-qcom...

gutekpl

I would really like to advice you to use a single bridge and add VLAN filtering according to this great topic: https://forum.mikrotik.com/viewtopic.php?t=143620 To be honest my network is configured much higher above my competences, I received a lot of help here and on some network blogs and I knew...

gutekpl

Thank You Sir for Your answers. Posted new topic here
viewtopic.php?t=214850

gutekpl

Hi, I need to migrate capsman from my old router which was hap ac2 to new one which is hap ax2. From my understanding it could still work with my current caps (two cap ac's and one wap ac) as they are arm based, but uninstallation of wireless package and installation of wifi-qcom-ac will be needed. ...

gutekpl

Ahh, so I need to upgrade my access points. Is there some easy way to migrate from old to new capsman preserving settings?

gutekpl

Hi. Please clarify because I am little bit lost now. For few years I had hap ac2 running capsman with few caps connected (two cap ac and one wap ac). Needed to migrate main router to hap ax2 due to lack of disk space error on hap ac2. Can hap ax2 still control my caps or I need to completely reconfi...

gutekpl

Is it possible for that to work on hAP AC2 + few cAP AC?

gutekpl

Hi. Any chance of switching from RouterOS to SwOS on hex poe lite?
I occasionally bought used one to power on camera in garage, no need any advanced options, this is being handled on other MT devices.

gutekpl

Got the same. I have VPN set up on my hap ac2 and certificates expiry was set to 1yr, I was renewing them some time ago and problem probably occurred somewhere around that but I am not sure. What should I check?

gutekpl

What you look for is the list of transforms proposed by the peer and by the Mikrotik side, you'll find rows like AES:AES, SHA:MD5 etc. This is what was caught with Your command. Nothing about SHA/MD5/AES :( # sep/ 8/2022 8:39:26 by RouterOS 7.5 # software id = S87N-E2ZU # 08:39:30 ipsec,debug =====...

gutekpl

Activate debug log

700 lines of text in 1 second, mostly hex values, what to look for?

to see what the phone proposes.

Android phone works OK. It's Windows 11 laptop which causes problems. Error on client side sound like "policy match error".

gutekpl

You can but you have to set match-by=certificate on the identities so that they could be distinguished from each other. Nice. The funny thing is that it was already stated in tutorial, I did miss it somehow. Anyway I am now one step further. Getting "no proposal chosen" warning after &quo...

gutekpl

Hi, And what if I am using certificate authentication based on IKEv2? I have configured my VPN basing on https://mikrotikon-pl.translate.goog/vpn-ikev2-na-routerze-mikrotik-dla-systemow-windows-i-android/?_x_tr_sl=pl&_x_tr_tl=en&_x_tr_hl=pl&_x_tr_pto=wapp and it work very well from my an...

gutekpl

The setting you're looking for isn't available in your account.

EDIT. Ok it now appeared as available after enabling two factor authentication. Seems it may be the solution to this.

gutekpl

Hi, As in topic google have just removed support for logging to gmail mailbox just with login and password via smtp. They informed about it twice, and now since two days all my routers stopped sending logs via email. Are there plans to implement oauth on mikrotik devices or we need to move to other ...

gutekpl

Hi, Maybe a noobish question, but I am not much into networking. I remember that sometime ago I played with wifi security at home and when I wanted it to require certificate for each connected client it needed FreeRadius to be active and hosting client identities or something like that. I passed bec...

gutekpl

Thanks for posting that link. I deleted everything I had and followed instructions from that link and it worked right away.

gutekpl

I had working VPN configured on hap ac2 via one click in Mikrotik home Android app and it was accessible from my mobile phone via l2tp profile. Now I upgraded the phone to new one, and in Android 12 there is no l2tp vpn anymore. I found tutorial to set up ikev2 vpn - https://mikrotikon-pl.translate....

gutekpl

Thank you, less of scary logs indeed.

gutekpl

Thank You, disabled. And how about SSTP?
I see that enabling VPN via app enabled those three together.

x.PNG

gutekpl

Hi, I recently set up VPN on my hAP AC^2 to get access to monitoring/NAS from the world. From what I heard this is the best solution to access private environment insted of exposing it directly to the internet via public IP. I am not networking pro so I used new Mikrotik Home app and checked "e...

gutekpl

This was some leftover from testing, I have this field back on default. Configuration is messy I know, because there are 4 devices with 4 presets which gives 16 different configs. However as I wrote, when I switch config from working cAP to wAP it still doesn't work, so that bring us to my original ...

gutekpl

Anything that may indicate the problem?

gutekpl

WIFI Frequencies may not match channel number specified in name, I was playing with them lately and didnt update names. # apr/30/2021 12:11:23 by RouterOS 6.48.2 # software id = S87N-E2ZU # # model = RBD52G-5HacD2HnD # serial number = B4A00AE5300B /caps-man channel add band=2ghz-b/g/n comment=hAP fr...

gutekpl

Noone?

gutekpl

Few words of HW setup - hAP AC^2 as mother device running CAPsMAN. Two cAP AC's running in CAP mode, all works perfectly. Few words of configuration - master radios are used for home 2.4/5 networks, both of them have their slaves - 2.4ghz is for iot devices, 5ghz is for guests. Bought wAP AC to gard...

gutekpl

I have Linksys PoE switch powering 5 cameras and 3 mikrotik access points. Linksys is powered from UPS, therefore all devices work during power outage. Thing is that I don't need APs to work during outage, I want my cameras to work few minutes longer. Do I need second PoE switch not attached to UPS ...

gutekpl

hEX PoE lost health info in 6.48

hex.PNG

gutekpl

So far so good :)

gutekpl

Woops, hEX PoE became unaccessible today. I couldn't connect to it from my PC via IP/MAC. I did reboot via MAC telnet from my main router and after reboot it was still unaccessible and without IP address. Again via MAC telnet from main router I disabled rules 0-8 and it instantly got IP address from...

gutekpl

You are indeed forum guru. Thank You once more, it works like a charm now. All cameras accessible with all rules enabled and when I change MAC camera stops responding. Posting final settings, maybe someone will find it useful one day. Environment described few posts above.. Przechwytywanie.PNG Thank...

gutekpl

First of all thank You for Your patience. I totally understand what You wrote and it makes perfect sense in my logic, but sadly doesn't work. My setup: eth1 - connection with rest of the network eth2 - cam1 eth3 - cam2 eth4 - disabled eth5 - cam3 Settings on hEX PoE: Przechwytywanie.PNG This setup b...

gutekpl

I created "redirect to cpu" rule on switch1/eth2 but now when I provide cam MAC it stops working (only cam traffic is redirected to CPU) which is exactly opposite of what I want to achieve. In my understanding solution would be same switch rule with !MAC where all MACs except cam's would b...

gutekpl

Cameras are in same LAN as PC so I understand I am interested in forward rule

I created drop rule for both directions and changed MAC to different (oirignal ends up with 17) and I still can access camera via IP in browser, so it is not working as it should be.

Przechwytywanie.PNG

gutekpl

On hEX PoE which my cameras are connected to I created rules as below in section bridge-> filters, but I still can connect to them from my PC if I change MAC in rule for test purposes. Is it because from my side they are treated as destination not source and it is ok (I don't have opportunity to con...

gutekpl

I managed to setup RADIUS server on my QNAP NAS and connected hEX PoE with it (I could authenticate on router using user from RADIUS), but nothing else. I was playing with it nearly 2h and I think there is issue on camera side - it doen't have EAP-TTLS which I set on hEX. Przechwytywanie.PNG I think...

gutekpl

I see IEEE 802.1X enable checkbox on my hikvision cam along with some parameters like protocol, version, user, password, so I assume it is supported. What now? Should I find tutorial how to setup IEEE 802.1X on mikrotik yes? Is it better to set it directly on hex poe managing only those 3 cams, or b...

gutekpl

I have hex poe with pretty default configuration powering on my 3 outdoor cameras. Ether1 plugged to my network and ether 2,3 and 5 connected to cameras. poe.PNG I was thinking about restricting those ports to my devices MAC only so if anyone unplugs my camera and connects other device it won't get ...

gutekpl

Hi.
And what if I will plug ETH1 of RB260 to some PoE Switch with 802.3af / 802.3at? Because of passive PoE I am afraid auto-negotiation will fail to set proper voltage? Or it will work OK?

gutekpl

Ok, so in order to maintain 802.3 af/at on Eth2-5 of hEX I need to fed it with 48V, thats clear.
Can I do it with PoE injector+48V supply via ethernet cable? Or it needs to come through DC input?

Is this solution a good practice or I should go with different approach?

gutekpl

Hi, I am a bit confused with all that PoE standards, so I would appreciate some help. I have ethernet cable which is plugged into Linksys LGS116P switch at home and it is powering IP camera mounted outside, everything works well and this is clear. Now I want to mount second camera in same place wher...

gutekpl

Seems You were right. It should work since begining. Traffic between networks was blocked by this: bl.PNG So I created address list called iot, added there all hosts form home network which should be able to access raspberrypi in iot network and added it as exception for above. Now it works. al.PNG

gutekpl

If you're trying to say that you isolated iot network just by not giving some devices default gateway, then bad news, you really didn't. It's not very likely that those devices will be guessing what the gateway is and trying to get out that way. But if they did, they could succeed. No, I separated ...

gutekpl

Well that would require changing mask from /24 to /16 isn't it? With /24 I can access only IPs withing range x.x.x.1-254, right? And those networks are separated for a reason. If some chinesse hackers sitting 20 meters underground have backdoor on some of their iot devices I don't want them to have ...

gutekpl

Hello. I need some help as my knowledge about networks tells me that this is possible but I dont know how. I have 2 networks at home (well actually 3, but third one is irrelevant in this case): - hap ac2 eth1-4 + wifi "home" vlan1, ip pool 192.168.1.0/24 - some basic home devices like note...

gutekpl

Why not just use a telegram bot to receive ping notifications? That was my first idea and I did it that way as I already have few telegram informations implemented. It was working pretty ok on test IP 8.8.8.88. All "unreachable" messages arrived to me via telegram. But when I moved it fro...

gutekpl

Stopping seeding of linux iso's makes port scanning stop within 2 minutes. I resume it starts again. My guess is that one of peers has some malicious software installed and it uses seeders list as target for attack.

gutekpl

Came back home and studied Shodan a bit more. If I understand correctly I am added there not as "host", but as comment to other host entry: Bez tytułu.png I checked Deluge running on my raspberry pi and indeed it used 52676 port during current session. So if my thinking is correct then som...

gutekpl

UPnP disabled since begining.

gutekpl

I checked shodan and I am listed there with that port 52676 - what does it mean? Where did it came from? Entry was added there yesterday, but I am getting flooded since 3 days - just when I did upgrade to 6.46.2 from 6.46.

gutekpl

BTW That IP Address may be a QNAP server http://93.105.141.14:8080/cgi-bin/ Do you have a QNAP NAS running? Now it became a bit creepy as I have QNAP running in my network. I hope it is just coincidence, as it works just as DVR for outside cam recording and no aditional services are configured on i...

gutekpl

Hi, I am using MT devices around year now and I like to check my main router logs from time to time. There was always some port scanner entries from Firewall, some IP scanned few ports and disappeared for some time. Sometimes there were 3-4 different scanning source IPs per day, sometimes there was ...

gutekpl

Are You reffering to this part?

:set contents ($contents . "\n" . $time)

How to avoid it? Is there any other way to save new data at the end of the file?

gutekpl

Ok, I think I managed to get it working :D :local file :local time :local date :set time [/system clock get time] :set date [/system clock get date] :local file ([:pick $date 7 11]."-".[:pick $date 0 3]."-".[:pick $date 4 6]) :if ([/ping 8.8.8.8 count=5] = 0) do={ :log error &quo...

gutekpl

Hi guys. Out of curiosity I want to test my ISP stability/uptime. Easiest way I think of is to run scheduler with ping 8.8.8.8 every few seconds, and report if there is output other than normal ping reply. This is what I came up with: :local file :local time :local date :set time [/system clock get ...

gutekpl

Welcome to the Mikrotik botnet... If you don't like this "feature", make sure internet interface detection, cloud and auto time sync and timezone are all disabled. That fixed it for me, have blocking firewall rule and it's been sitting there with 0 hits for months... Yup, internet detecti...

gutekpl

Try disabling Time Zone Autodetect if you haven't already.
Code: Select all
/system clock set time-zone-autodetect=no

Disabled it at night yesterday. Growth of requests at morning is still high.

gutekpl

You really don't want your router to communicate with mikrotik ? Why?

Didn't say anything like that. I just like to know what is going on if I have such possibility.

gutekpl

I found that on wiki when googled for cloud.mikrotik.com. I have "DDNS enabled" and "Update time" both unchecked on all three devices.

gutekpl

Hi, Installed pi-hole yesterday to get some control on my home network traffic and I noticed that cloud.mikrotik.com is topping query list after one day. What happens there that all mikrotik devices are constantly connecting there? I have 3 MT devices and pi-hole is running for like 16 hours, which ...

gutekpl

Przechwytywanie.PNG

Is this winbox or os issue? Timestamp is wrong and dynamic which means if I log in after 5 minutes, it will show this time + 5 minutes. Always 3 days ahead.

gutekpl

wAP ac LTE - powerful and versatile dual-band wireless access point with LTE support My original plans was to put standard wAP AC outside home as garden access point. Can wAP ac LTE be configured to act both as garden AP and LTE backup ISP when main ISP (fibre coming to hap ac2 via media converter)...

gutekpl

Quick question - does it matter which side is plugged into ISP line entering home or it should work both sides the same?

gutekpl

Works, Thank You once more.

gutekpl

In scripts I created dwnFlagCleaner :global downloadFlag set downloadFlag "0" And in traffic monitor I now have this maxDown if ($downloadFlag != "1") do={ global telegramMessage "Download 100mbps reached!" /system script run SendToTelegram set downloadFlag "1"...

gutekpl

Hah, I read that manual which I pasted above searching for mac address variable, but turns out that other variables I needed now are also there! if ($leaseBound = "1") do={ global telegramMessage "$"lease-hostname" ($leaseActMAC) got address $leaseActIP from DHCP_guest"...

gutekpl

They are being set automaticaly during dhcp registration process lease-script (string; Default: "") Script that will be executed after lease is assigned or de-assigned. Internal "global" variables that can be used in the script : leaseBound - set to "1" if bound, otherw...

gutekpl

The thing is I am not parsing that mac anyhow, Its builtiin feature which I use. If I was parsing it already then probably my knowledge would be enough to modify it by myself

gutekpl

I want to monitor my download to check how often I reach max bandwidth and basing on that decide whether to increase speed at my ISP or not. I created simple traffic monitor, set trigger to above 100M and pasted this script: global telegramMessage "100mbps reached!" /system script run Send...

gutekpl

Thank You. One more thing. Even if it works very well now, best practice is best practice and should be followed all the time, so... Is it better to leave it as it is - all three devices (hap/cap/cap) on same channels, or maybe I should split channels between devices? something like: hap: 1 / 36 cap...

gutekpl

Hi, I installed wireless analyzer today on android phone, and noticed that my wireless networks uses only 2 of 4 channels I set in CAPsMAN settings. I have 4 channels configured: 1 - home 2.4g 11 - home internet of things 36 - home 5g 44 - guests it looks like this: prze.PNG Then in configuration I ...

gutekpl

Here is complete script, but it is only responsible for sending it via telegram, so I did not posted it before as I think it doesn't matter. :global telegramMessage :local botid :local chatid set botid "xyz" set chatid "123" if ($telegramMessage != "") do={ /tool fetch ...

gutekpl

I have a simple script which informs me via Telegram whenever I have new device connected via guest wifi. global telegramMessage "$leaseActMAC connected as guest and received $leaseActIP address." /system script run SendToTelegram My guest DHCP lease is set to 6h and I get 2 messages per d...

gutekpl

Well, garden is for mobile devices mostly and all of them as for now work on 5ghz so it may be worth going this way.

But is omnitik really much better than wAP? I see they have very simmilar cpu, same AC speed, same OS, just a bit more ram, what is the game changer?

gutekpl

I am doing some cleaning on my hAP Ac^2 configured as main router with capsman running on it. I have already disabled ipv6, hotspot, mpls and advanced-tools. I checked Routing submenus on the left and I have nothing configured there, so I am wondering can I disable it and if yes is it safe to disabl...

gutekpl

Get Groove 52 ac
DO NOT DO THIS!
Groove has only one radio, therefore you have to select - either 2GHz or 5GHz. It can't do both at the same time like any usual AP.

I noticed that. Going for wAP AC.

gutekpl

I think new mobile app solved that issues.

gutekpl

this is a old issue. its 99% sure due to bad signal.

I don;t think so. It's currently affecting my MiBOX which lies around 50cm from cAP AC and has full signal strength.

Earlier had this for random devices on random times. Changed 05min to 1h now, will see. using CAPsMAN on 6.44.0

gutekpl

I have capsman based on 2 devices - hap ac2 + cap ac and few sonoffs (basic, dual, pow), each one of them works fine, without any issues while pairing. I used standard quick pairing in ewelink app. You can paste You capsman config screenshots, so I can compare them with mine settings if You like.

gutekpl

Didn't thought about insects, You may be correct indeed, that they can make some mass after longer time. So I have now around 70MB free ram on my other cAP AC with few packages disabled , does that mean that wAP will have only 6MB free with same config? Isn't that too low? Anyone have any experience...

gutekpl

It will be mounted outside, but under roof so protected from rain/snow and direct sunlight in summer when sun is high. Tested ambient temperature starts from -40 for both, cAP ends on 50C while wAP on 70C, but as they are white and will be protected from direct sun I dont think that 20C makes a big ...

gutekpl

Enabling it turned on my internet speed graph in mobile app. However thing I cannot understand is difference in speeds between pppoe-out1 and ether1 - for my understanding that should be exactly the same, as my ISP cable is plugged into eth1.

gutekpl

It looks for me exactly like on screen.

Info about new version is shown automaticaly.

Internet traffic is shown after tuning on internet detection in interfaces - detect internet.

gutekpl

No, I removed .11a just after posting that post - realized it is not used anymore. Anyway problem solved, turns out that in MikroTik the best way is to not touch options which You are not sure how works. I removed "control channel" and "extension channel" and speeds are now ok. T...

gutekpl

Hey. hAP AC2 is my main router on which wifi worked at full speed until it was configured "localy" (in wireless instead of capsman). In order to extend wifi range I bought cAP AC. There was some mess with configuration, because of my three vlans and multiple ssid, but I finally managed it....

gutekpl

This is a pretty old topic so maybe something changed in this case. I currently don't have money for synology 918 so I thought about buying single wd red 4tb, putting it into usb enclosure and connecting to mikrotik hap ac2 as smb storage. Will it handle? I don't need nothig fancy like for monitorin...

gutekpl

I recently rebuild my home network with mikrotik hap ac2 as a brain of this operation. Now, when I have configured all vlans, guest and IoT networks, etc. I started thinking about signal range extension. I found MikroTik RouterBOARD RbcAPGi-5acD2nD, cAP ac and here is the main question of this topic...

gutekpl

Thank You. It didn't work at beginning when I applied network IP in allow rule same as in fasttrack but without "!", but when I used whole guest bridge it works. But as I am very curious person one more thing did cross my mind. If the guest-accept rule is now above fasttrack, then it shoul...

gutekpl

Switched places 7 with 8 and now it works. Is that good way too? Or should I copy this allow rule and for guest network place it above fasttrack and for rest leave it under fasttrack as it was?

gutekpl

Hello. I just spent some time digging why simple queues doesn't work and then I found that fasttrack doesn't come along with them. Actually I didn't have idea what fasttrack is so I read some stuff and I liked it. However I would also like to have my guest wifi limited to 5MB. Guest pool network is ...

gutekpl

Well, I'm suggesting you create two SSID names, Home and Home24G. Name them whatever you want. How this solves splitting devices connected to Home24G between home vlan1 and iot vlan100? I would understand if You suggest "IoT" 2.4 SSID, "HOME" 2.4 and 5 SSIDs overlaping each othe...

gutekpl

So the solution from picture attached below is not possible to achieve, right?

gutekpl

Then You got me wrong. Both master radios have same SSID with same password, so home client device just connect with the one which is best for it. In case of my new phone it uses 5ghz, in case of old notebook it uses 2.4ghz, etc. Same was with guest SSID, but it is no longer valid as I removed guest...

gutekpl

The SSIDs and of course wpa2 psk passwords should be different. So in Your example I have 3 SSIDs, right? home - common for 2.4 and 5 master radios guest - for slave radio 5 iot - for slabe radio 2.4 Am I right? If I have master and slave 2.4 with same SSID then how would client device know to whic...

gutekpl

I wanted guest 2.4ghz and guest 5ghz in same vlan because I thought its the simplest solution. They will have same ssid and be transparent. However as I am thinking now I dont need 2.4 for guestd as guest wifi is mostly for mobile devices and those all should now have 5ghz so we can reduce that. Sla...

gutekpl

I know that guest wifi is just a fancy name for logic behind that. I also know that hidden ssid isnt for protection. Anyway, lets skip it, thats not the point in here. I pasted link above to show how did i create guest wifi where guy used seperate bridge for that. If assumptions in this tutorial are...

gutekpl

Guest WiFi on seperate VLAN was done following this tutorial:
https://www.youtube.com/watch?v=1ZJ-pM89N7o

gutekpl

You can set up VLAN membership per device ... but that involves entering MAC address of every single "special" device I am aware of that and totally OK with reserving lease once per device lifetime. Just can't find the way to do it, I cannot select same interfaces (wlan1+2) second time fo...

gutekpl

I just did. Thanks for tips contained in there and for Your approach which is easy to understand even for normal people, not only for network geeks, my VLAN knowledge has now grown a bit. However I did find there only refference to my first idea which is seperate SSID per VLAN. I would really love t...

gutekpl

I am thinking now about my idea number two and I suppose it is wrong too, because DHCP is two way communication, so if even if dhcp server from network 192.168.1.0/24 will assign someone IP from 192.168.100.0/24 it will lose connection with that client immidiately and there won't be handshake or wha...

gutekpl

Hello. I am new to mikrotik but already amazed with it's possibilities. Here is picture of what I want to accomplish at home: 192.168.1.0/24 default network (in my mind called vlan1), bridging eth2-5 + both wlans (2.4ghz and 5ghz) - already working, has own dhcp server with pool .1.100-.1.250, high ...

Search found 107 matches