MikroTik

accarda

Thanks, I will propose also this option to the folks, even though I'm pretty much sure the provider won't do much but who knows. Anyway I have tested using Ros traffic generator to check how UDP traffic would be mapped when going outside siteA and for this profile they all use low port range from 16...

accarda

Thanks for sharing this about MNO practice, I'm not an expert in this area. Currently for this particular site the company running the voice/UDP service is using one of those virtual MNO to reduce costs. Sure about using LTE connections to run some service behind CGNAT, in this particular case all L...

accarda

Hi all, I'm checking an issue with an installation where UDP traffic is exchanged across different sites, between a master and several edge sites. In particular I'm having issues with an LTE connection where the UDP "connection" does not occur properly. As I have access to both the master ...

accarda

This doc specifically explains many key concepts about L3HW: https://help.mikrotik.com/docs/spaces/ROS/pages/62390319/L3+Hardware+Offloading The dependency on L2HW ( https://help.mikrotik.com/docs/spaces/ROS/pages/62390319/L3+Hardware+Offloading#L3HardwareOffloading-Layer2Dependency ), some basic co...

accarda

Instead of using some unassigned prefix ranges, you can get a free account with Hurrricane Electric (tunnelbroker.net) and get two /64 and two /48 prefixes for yourself. No one force you to use the tunnels provided by HE, you can just use those prefixes internally within your network Actually I'm c...

accarda

Unfortunately in case of dual stack network, using ULA instead of global v6 address makes the OS preferring IPv4 over IPv6. I didn’t know this until I needed to use fd00 addresses and found out all my clients preferred ipv4. Then I found this RFC https://datatracker.ietf.org/doc/html/rfc6724#page-24...

accarda

I received a notification from Mikrotik about the case I submitted that they fixed it and will be released soon.

accarda

I have re-installed again v7.14 so that now I was able to generate a supout to provide Mikrotik. In my case once the router restarts I get these type of error messages related to the IPIP interfaces: failed to set vrf for interface ipip-if, please check if selected vrf instance is enabled Hopefully ...

accarda

Actually I think v7.14 creates several issues with interfaces and VRF. I have issues in my config with IPIP interfaces not working properly after v7.14. Basically the IPIP interface does not get installed in the VRF table, but it stays in the main routing table. Also at startup I get an error that u...

accarda

In addition to the bug reported about IPIP interfaces not working correctly with VRF, also IP service does not work fine with VRF anymore.
I have IP service www on VRF and does not respond to requests anymore, while all is fine with 7.13.5

accarda

I have noticed an issue with IP tunnel interfaces and VRF. When creating such interface it does not get instantiated in the proper VRF. At startup I get an error in the log: failed to set vrf for interface <IP tunnel if>, please check if selected vrf instance is enabled. VRF is enabled and I have al...

accarda

I have also tried to keep FT disabled and FT over DS enabled, but roaming stops to work on some device (1 iPhone, windows and mac laptops). When I disable both, all my devices have roaming working properly. I have a different setup than what was described by OP, as I use multiple VLAN within single ...

accarda

I have just tried to disable FT and I had the same good unexpected result like you. Actually for me FT has worked fine for almost all mobile devices (iPhone, iPad etc) except one specific iPhone (the only WiFi6 phone that I have) by setting FT as indicated in MT docs. To fix that issue with iPhone I...

accarda

Yes, the peer's allowed IPs determine what can pass through the tunnel from the other end to you, but not the routing. That's must be there. In your case you already have the needed routing for your 3 WG peers, as 10.1.1.0/24 is installed on each of them automatically. So when you set your allowed I...

accarda

When you setup a WG tunnel from your router prospective, nothing gets created automatically in its routing table, except the subnet where you have assigned the IP to the WG interface. That's the only route that you will see in your router as far as WG. The allowed IP in the peer setting defines what...

accarda

If you don't want to use SRC-NAT for second WAN, then your only way to have traffic through WAN2 to reach internet is that you can define routing rules in the WAN2 device. As I said before, if you can manage that router and set the return routes from that device back to your MikroTik router (where y...

accarda

As I said, if you disable SRC NAT on the second WAN, all LAN devices trying to use that route won't get to internet, since your WAN2 router does not know anything about your LAN devices. NAT with masquerading for WAN2 fixes that. Also when using MANGLE and at the same time you have fasttrack enabled...

accarda

If you have 2 WANs and you can't define routes on the WAN devices, you will have to set SRC NAT for both your WANs and masquerading if they have dynamic IPs. If you have disabled one SRC NAT, then you won't have internet if your LAN is trying to get to internet through that WAN which does not have S...

accarda

In general when dealing with 2 WANs and the need to direct certain traffic to certain WAN, you have to create also a second routing table where you install the default route for the second WAN in there. Then with mangle rules you can address with routing marks to reach the second routing table for t...

accarda

I see in your mangle rules you have indicated 2 wrong addresses at the beginning of each block: 192.167.10.7 (instead of 192.168.10.7) and 192.167.10.55 (instead of 192.168.10.55).
You can start debugging your problem by fixing those first.

accarda

Beside the current issue that you have now, hopefully you can recover the unit somehow. On the L3HW notes, despite what I suggested you with ports being part of bridge and vlan members, today I have seen something which goes against this. I have 2 ports used as WANs which are not part of bridge neit...

accarda

You also need to remember that whenever you do some change to L2 (settings in VLAN, bridge etc) you also have to sync up with L3HW. So before any change to L2, disable L3HW globally for the switch, then apply your changes and finally re-enable L3HW for the switch. This is also indicated in that docu...

accarda

L3HW offloading relies on L2HW offloading and that ports are members of the same bridge where you enable bridge vlan filtering, which I don't see from your config. This piece is missing from your config: /interface bridge add name=bridge vlan-filtering=yes Without it enabled, settings in /interface ...

accarda

This would require using the staging server, which I think you can't set on this RouterOs API for letsencrypt. From Letsencrypt When troubleshooting or testing the deployment of your applications we encourage you to configure your ACME client to use our staging environment. Rate limits for our stagi...

accarda

From what I see in your config, you haven't defined the entry for vlan1000 in /interface bridge vlan You need to define vlan1000 in there as well, like you have defined for vlan99. As you have indicated the pvid in /interface bridge port you can avoid specifying the untagged port, as those with pvid...

accarda

Actually no at the time of seeing this "graph" issue. The timeline of what happened to me was: - Initiated the migration from v6 to v7 at an early stage (Mikrotik did improve after some initial time) - got RB4011 mostly working on v7 except some routing item disappeared and few others - we...

accarda

I think what netinstall does which reset won't, is that it clears up some internal DB where RouterOs stores stuffs. During an initial migration of RB4011 from Ros6 to Ros7 (years ago), there was some issue even though everything was apparently still working. From time to time during one v7 update, R...

accarda

At this point all about VLAN assignment works fine using Access list and single SSID (which was my main goal with this setup); I mitigated the roaming issue on that single iPhone by applying the RSSI threshold to it within the Access list, so that AP kicks it out when no longer in range. However is ...

accarda

As quick test I have reverted CAPsMAN config without using Access list to define VLANs and stick to VLAN per SSID as shown in MikroTik doc: CAPsMAN - CAP VLAN example https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample: I have tried on single VLAN/SSID and on tha...

accarda

Thank you @andriys for that mention. I have now included also connect-priority=0/1 in my security settings; however that iPhone devices is still sitting on the same AP as when initially connected. I will try to play little bit more with TX power to reduce it, but what I guess it will happen is that ...

accarda

Thanks for the hint, but I saw that option when I initially set CAPsMAN and decided to leave it at default as I want to keep the VLAN id based on initial assignment. Even if I'm not using RADIUS but the Access list, VLANs get assigned when client is authorized and I can see VLAN id is properly retai...

accarda

Apparently only WiFi6 clients do not roam to the next APs with this setup, while old WiFi5 devices switch from one AP to the other while moving around. I have tried with some iPhone/iPad (WiFi5 only) and they get the correct VLAN and can roam while moving; when I try with an iPhoneSE (which supports...

accarda

Hi all, I was experimenting with some different settings to enable WiFi on AX APs, using CAPsMAN and assigning VLANs through Access List MAC address definition on a single SSID. In term of VLAN assignment I can see that each device, based on their MAC address, gets assigned a properly VLAN as config...

accarda

I have setup the same at my end and it's nothing different than setting any other address allocation that you receive on that sit interface. Once you have your setup ready based on the remote IP as provided by HE and you have set default route via HE remote end, then you just need to setup your addr...

accarda

About this new WiFi, I have a question: if you have both devices, compliant with new WiFi and not AND you are currently managing everything via CAPsMAN on a router (say RB4011 non WiFi model) would you be able to run both CAPsMAN, new for wifi compatible devices and legacy v2 for those that will sti...

accarda

Thanks for sharing your opinion on this. Yes I agree with you that engaging OSPF is too much for just failover, but I wanted to improve my setup after some test. Initially I had used the recursive routing approach with couple of target IPs, but time to time I have got some false positive results lea...

accarda

In my SOHO network I have similar devices (hAP ac², hAP ac3), I'm running ROS v7.x and I don't have problems having VLANs and RSTP active at the same time.
I have a single CRS switch as root bridge and all other APs/switches are acting as non root bridges.
So such config works properly.

accarda

Hi all, I'd like to check an implementation I made on a SOHO network to manage WAN failover using OSPF. Based on attached diagram, R1 has 2 routing tables (main and table2) and I'm managing the default route through OSPF+BFD for fast switching between R2 and R3 (connected to internet) in case of fai...

accarda

@accarda Thanks. I was under impression that I tested the solution, but... it seems that full regex syntax does not apply here. Ended up with :if (!$ADDR~"fe80") do={ Because that operator works differently, depending which data you are passing to it. From Mikrotik doc ( https://help.mikr...

accarda

You should change your IF statement:
:if ($ADDR~"fe80") do={

and it will find those items containing the link local address, so you can use it in if then else to apply the rest on the else part.

accarda

If I’m not mistaken the external ANT connectors on Chateau 5G are connected to the modem for the 5G bands only (it should be for N78), while for LTE part the modem uses its internal antennas. While Chateau 12 uses those external antennas for the LTE part, so signal will be much stronger that in the ...

accarda

Hi, better approach would be to have all ETH1-5 within the same single bridge and then define ETH1 and ETH2 for tagged traffic and the other for untagged as in your scheme, using bridge VLAN filtering. This would be possible as with Ros7 the switch chip MT7621 is now supporting bridge VLAN filtering...

accarda

I got two CCR2216 connected to each other at 100Gbps and tried the btest the max I got was 15Gbps processor at 100% and only an IP configured on the router for testing. Hi, as indicated by MikroTik, when running such test is better to do it through the "router under test", like indicated ...

accarda

If you read carefully that example that I indicated from MT, you will see that L3HW is disabled for the WAN port.
Try to match that example with your case, which is not so different from their case.

accarda

Have you checked this article from MikroTik about Inter VLAN routing with L3HW enabled ?

This is the example part, but it’s worth reading the whole article.
https://help.mikrotik.com/docs/display ... onExamples

accarda

Did you try this?
print where x.x.x.x in dst-address and active

accarda

Sure then. But those 2 operators that I mentioned are known for disconnecting clients every 12/24H and I tested this on couple of installation with different routers/modem. So if Alessio is using one of them, it’s operator behavior to apply such disconnection, while if he is using something else, th...

accarda

From my personal experience I can tell you that both Wind3 and Iliad are disconnecting at least every 24h, if not 12h sometime (at least in my area). So it's the operator, not the modem. In my case I was able to make that happen at night and it stays for 24H most of the time, until next disconnectio...

accarda

What has been done in Italy to provide such solution to business users is based on Multi path TCP and you can read some info about an open project on this https://www.openmptcprouter.com/ However the solution is not cheap as it involves a data center and several VPN connections to it based on how ma...

accarda

From your example you are pointing to the wrong list.
Your list is k8s-v4-ingress, but you are pointing to another value k8s-ingress in the DNS entry.

accarda

Have you considerate the possibility to run a script that sets the NAT rule, based on the address list entry ? In this case a script reads the address list that you have on item #2 and creates a NAT rule as indicated on item #1; then the script can remove such rule, either after 5 min or if the addr...

accarda

I have just tried again, but I get the same issue. So I have connected to the router by setting winbox's session to "none" (I guess it's what you have asked to try), but when I open /ip/firewall/raw I don't see scrolling bars, until when I switch to another tab and come back. Same behaviou...

accarda

Ok, I will try later this evening and let you know, as I can always reproduce this problem with firewall tabs.

accarda

In my case the issue of not seeing all data from firewall tables (in my case it's not limited to specific tab), when using Ros v7.x (I'm now on v7.7), is that on sections where there are lot of rows, Winbox does not show the lateral scrolling bar once I open a tab. But if I switch to another tab and...

accarda

I'd like to report some behaviour that I have noticed while updating couple of devices, a CHR and RB4011. On both I'm running VXLAN where I have attached PPPoE interface. Initially after upgrading CHR first, VXLAN didn't work properly with RB4011, so PPPoE server was not reached. After updating also...

accarda

In that case he would need to check what the other router was passing as DNS servers through DHCP server… may be it was passing router’s IP itself, but we can only guess at this point.

accarda

Because in your setup you had MT to be your DNS, but you forgot to add DNS servers where your MT should have made query to.
So your clients pointed to a resolver which didn't have upstream DNS to query.

/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4,9.9.9.9

accarda

Ok, I will take your advice about :local currentWANIP $WANIP instead of setting 0.0.0.0, better logic.

accarda

After the recent outage of /ip/cloud I've decided to include one more check before sending the update to HE server, so here is the latest code that I use: :global WANIP :local cloudStatus [/ip/cloud/get status] :local currentWANIP :if ($cloudStatus = "updated") do={ :set $currentWANIP [/ip...

accarda

I have just got reply from MikroTik support; the issue is now resolved.
I checked my routers and now the DDNS service is working again.

accarda

I have also reported this to MikroTik support, so they can check their server status.

accarda

Hello everyone,
is there an issue with DDNS at the moment ?
I have my routers with DDNS and status "updating", but apparently the service is down or the router is not able to reach it.
Does anybody else have issues with the service ?

accarda

In particular, I would like the ports 80 and 8888 of the device 192.168.2.10 to be reachable from a device connected to sub 1 For this particular aspect you need to set a DST NAT rule on your MikroTik to forward traffic from WAN to specific LAN host: /ip firewall nat add action=dst-nat chain=dstnat...

accarda

From Mikrotik side if you used default config you should be ok, because RouterOS creates automatically routes for connected networks. So from Mikrotik can you reach internet through Fritz ? I guess you should be able to, already. From Fritz you need to make sure that you send the route for destinati...

accarda

The problem is that you need to define a route on Fritz to reach subnet 192.168.2.0 through connection to the hAP (to 192.168.1.200).
So you need to check on Fritz how to set a static route to hAP.

accarda

:set WANIP $currentWANIP

You’re right since no operation, other than assignment.
Point noted, thanks.

accarda

I use something like this to force a change to HE only when the public IP changes. :global WANIP :local currentWANIP [/ip/cloud/get public-address] :if ($currentWANIP != $WANIP) do={ /tool/fetch url="as indicated by HE info page" src-address=<private IP wan> keep-result=no :set $WANIP ($cu...

accarda

You will create the additional configuration in CAPsAN to define your virtual interfaces, then from the provision sub-menu you will add the master config and you can also include one or more slave configuration. In this way CAPsMAN will manage both interfaces, master, slaves and they will appear to ...

accarda

It seems like you don't have the default route being set on your client. I'm using IPv6 and on my machine I have defined the default route manually (I have assigned manually IPv6 addresses) and I can ping that IPv6 address. This is also that domain being resolved. ; <<>> DiG 9.11.5-P4-5.1+deb10u8-Ra...

accarda

You can read about wireguard here https://help.mikrotik.com/docs/display/ROS/WireGuard which requires Ros v7.x

accarda

OK good to hear that.
Enjoy the IPv6 stuffs, I have also started recently mine.

accarda

Hi, I would check the prefix that you have assigned to your LAN though. From your config there is 2001:470:58e4:a:: but then in your post you mentioned that 2001:7b8:3:32:213:136:1280:22 is pingable but that /64 does not match the address on your bridge. Actually I'm using HE too, but you have to as...

accarda

accarda

This update went fine on my case. Before with the old firmware my Chateau was not able to connect to 5G even though N28 was available in my area. After the updates the router was able to connect to N28. By reading from modem’s supplier website this firmware was updating something about 5G which was ...

accarda

It seems like they have just announced on their YouTube 3 “new devices” equipped with WiFi6. They have now also hap ax2 and new chateau in AX version. https://youtu.be/nm9RjNbZJjc Since they have increased CPU, RAM and few other hardware, not really sure whether it’s the same wifi6 with external pac...

accarda

You can do it by creating a script in your router to account for all LTE traffic inbound/outbound for the given period. However, differently than for ethernet interfaces, LTE does reset all counters every time the session is restarted due to connection lost and re-established. Also you need to take ...

accarda

Personally I have never used API approach as I mostly do all my stuffs with script directly on router. However one thing you could also check is, if it fits your needs, an easy way to generate a sort of CSV file generated with a ROS script after that you have gathered the user information that you a...

accarda

You can have a look at how to use API to communicate with router and send your queries to receive the needed data: https://help.mikrotik.com/docs/display/ROS/API There is also some example using Python, which has lot of functions to manage Excel and PDF files: https://help.mikrotik.com/docs/display/...

accarda

By checking at the Quectel forum I found some zip package provided by FAE support which includes a PDF with release notes. New features RG502QEAAAR13A01M4G_01.001.01.001 Added the function of reporting DFOTA upgrade progress on the Debug port. Added AT+QNWCFG="clr_rplmn" to delete the RPLM...

accarda

Had the same problem after modem firmware upgrade using Webfig. I have been waiting before updating the firmware on my unit, as I saw some issue. Do you know what has been changed/improved, if any, with this firmware update ? I couldn’t find much info on Quectel forum and not really sure which impr...

accarda

Hi everyone, I'm monitoring a new Chateau5G installation and I have noticed that LTE session gets restarted time to time. Now I have captured the an extensive log (except raw data, too many items/sec) and here is what I see when the lte1 interface goes down for couple of seconds: Aug/01/2022 09:39:1...

accarda

On your step #2, set the IP address to something different than network address, so like 192.168.100.1/24.
What you want to do is doable with no issue at all and once the proper address is assigned ROS will create proper routing info the for the new bridge2 interface.

accarda

Hi all, I'm just reporting some strange behavior I have seen on a Chateau5G with latest ROS 7.4, but not latest modem firmware (still on RG502QEAAAR11A06M4G). As this was a first installation in a new location, I was playing with cell-lock to find some better combination of LTE bands; however since ...

accarda

Is the DDNS linked to a specific interface, exclusively, with no way for Mikrotik to update it (other than scripting, I suppose) automatically in the event one WAN goes down? Or will Mikrotik update the DDNS to point to the remaining interface? If you have enabled DDNS from IP -> Cloud, that IP ent...

accarda

I had used it once, initially, but I disabled it after one software update where I got RB4011 screwed due to detect internet swapping interfaces in interface-list, which caused being locked out due to firewall. My reason of using it was that when using MikroTik app, detect internet gives you an easy...

accarda

Issue was about a privacy setting on iPad OS that manages whether or not each app can access local network devices.

accarda

Hi everyone, I have an strange issue with a specific ipad device, which is not able to do regular network traffic only within the subnet where it's connected to. For example, if I run a ping from this ipad to the router's IP for that subnet, no traffic is generated by the ipad (I have checked with p...

accarda

Thank you mkx for the very detailed answer.
For testing, after I have received the short list of cells, I have initiated a LTE scanner and after all operators have been found, cel monitor was able to show again the full list.

accarda

I have noticed a behavior on SXTR with R11e-LTE6 (running v7.2 now, but saw this also with previous Ros) that by checking LTE cell monitor, the list of available physical cells changes based on some traffic initiated by the router. If I reboot the router, after it gets connected to the cell, when I ...

accarda

Since Ros 7.x.x I see this bug with file deletion and what is displayed in Winbox. I have a backup script that creates files "some-name_date" and saves to disk. Then each week the previous file is deleted before creating the new set for upload to FTP server. If I'm already logged with Winb...

accarda

I can tell you that the switch chip VLAN setup works also on ros v7.1.1 as I’m using it on both hAP AC2/AC3 with Ethernet ports and WLAN virtual ssid.

accarda

One way could be to enable VLAN on that device by using switch chip config instead of bridge VLAN filtering.
In such case VLAN filtering will be OFF, and hw offloading will be ON.
I have done the same on my hAP AC2/AC3 for the same reason.

accarda

From the config you have activated VLAN filtering on that bridge and so HW offloading can not be ON.
Check this table where you can see which option allows HW based on your switch chip model.
https://help.mikrotik.com/docs/display ... Offloading

accarda

Just to complete this discussion, CHR was able to contact the account server and renew the license before reaching the deadline with no issues and automatically. Also I had to re-install the CHR months later, which created a new system ID. From there I started again a new P1 license trial and from a...

accarda

You could use tool/netwatch to set a test (which is based on ping) to 1.1.1.1, where you can specify an action in the down tab of scripting section to save the timestamp on log.

See more about netwatch https://help.mikrotik.com/docs/display/ROS/Netwatch

accarda

Actually I went through my setup and then I was able to make RoMON see now all my devices as used to be before with ros 6.xx. My issue was with devices where I do have VLAN being set, but in my case using the switch chip setup (in my case I'm running this on hAP ac2, hAP ac3 for example). In order t...

accarda

You can start by reading about scripting from here: https://help.mikrotik.com/docs/display/ROS/Scripting There you can also find a way to intercept errors when your code is part of a do section by using on-error statement. https://help.mikrotik.com/docs/display/ROS/Scripting#Scripting-Catchrun-timee...

accarda

In my case with a total of 13 devices, after that they have been all migrated to v7.1.1, only 4 are still reachable through RoMON, the other 9 are no longer seen. Switching back to v6.x and all 13 returned visible and accessible through RoMON. So something is not right and it depends, but I don't kn...

accarda

Have you checked that the waiting time on 5GHz is not due to the fact that your channel gets into the radar band ?
In such case AP takes longer, while verifying for radar presence, before enabling the AP.

accarda

I have a similar issue after moving to v7.1.1, but not on all my devices. What I have noticed is that I still see on RoMON devices with v7.1.1 where I haven't defined VLAN in the switch chip setup, but instead I used VLAN aware bridge (or I don't have VLAN being defined). Something is not working as...

accarda

Thanks for confirming it worked for you as well. Most likely the first time that you tried there was something not synched properly. However the first part of this thread has both the main script and its function to work together and the code has not changed since then. Script is supposed to be load...

accarda

Hi Taylor, please disregard the proposed change to the function searchIPList and stick with the original code (which I include again to avoid confusion). :global searchIPList do={ :local listName $1 :local ipAddr $2 :if ([:len [/ip firewall address-list find list=$listName]] > 0) do={ :foreach found...

accarda

Actually searchIPList is a function (inside a global variable), therefore you can't call it like that. From terminal you can call it with this :put [$searchIPList list IP] where list is your address-list name and the IP that you want to check. So you run it by passing the 2 parameters needed for it ...

accarda

Not really sure as I have it in place on a router that it's still on v6.x. However if there is anything not fully compatible with v7, it will be on the main script (not the function to search for duplicate IPs). I have tested the searchIPList on ros v7.1.1 and it worked fine in finding a duplicate I...

accarda

Actually you can remove the global function searchIPList from your script -> environment menu in Winbox and load this new version instead.
But as I said it didn't change much other than setting an output value when there is not matching with the address in the list.
All the rest is the same.

accarda

I have checked the function searchIPList with an address list and it worked in finding only duplicates. Be aware that the function works only on IP addresses without CIDR notation. So if you had any address with CIDR notation, the function would not give you the duplicate flag on exit. I have tried ...

accarda

In Ros v7.1.1 you need to make sure that for those affected invalid routes target-scope is set with value greater than scope (even just +1 it's enough).
By doing so your setup will return valid routes.

accarda

About NAT I was referring to my case where I establish a VPN connection from SXT to CHR (on datacenter) to get around the CGNAT that I have on my LTE connection. In this case when I need to reach some internal port, I need to open it on CHR first and then on LTE before reaching the RB4011; if I had ...

accarda

Actually recursive route works in v7.1.1 (I'm using it on my router), but you need to make sure that target-scope is set with a value higher than scope. This is not taken care by the migration script, so initially the route is marked as invalid; then you can fix it by setting the target-scope (just ...

accarda

Hi, in my case it works when I add all my networks into the address-list; this is the same approach provided by an automated script that migrates a working BGP setup on ros v6 into v7. It creates an address-list called bgp-networks and adds all networks in there. Then you recall that list in BGP con...

accarda

Looking at my 2nd, updated pic...I am not quite sure if the dual route scenario works, as the second endpoint, pointing to wg1 on the CHR, which is also the default gw of the VOIP server is not on the same routing table. The RB4011 will see the wg1 of CHR directly via 10.255.255.2 but not the secon...

accarda

I have migrated some more device to Ros v7.1.1 and I have noticed this issue with RoMON compatibility; I still have some device on Ros v6.48.6 though. All devices have a management VLAN being defined. All devices that are still on Ros v6 are seen on RoMON neighbors list. Devices on Ros v7.1.1 are NO...

accarda

This has been covered many many times. target-scope now has to be greater than scope instead of being greater than or equal to scope. Increase your target-scope by 1 and it should work.

Thanks for the heads up, I was missing this info.

accarda

I have tried to implement a recursive route (like in ros v6), but I don't see it working, unless the syntax has completely changed.
The route gets IUSH as invalid and unreachable.
Is this not implemented yet in ros v7.1.1 ?

accarda

Wireguard would make a lot of sense if you're using V7 on both side. Yes, indeed, therefore I have migrated also my CHR into Ros v7.1.1. I tried to establish such site-to-site connection, even though I had some trouble initially as I have changed the UDP port after that both server/peer were create...

accarda

Thanks mkx, I have noticed that all inbound traffic is blocked when checking conn tracking and lte1 traffic. This is my backup connection, the primary one uses a business grade SIM and in that case I get full public IP without CGNAT. I will see to enable a wireguard VPN to a CHR that I have in order...

accarda

Thanks for the hint, it was worth a try. Actually that function is on v7.x, so I updated the router to it and tried also with different APN values, which ended up with same results not providing an IP on LTE interface. Went back to the working one, but still under CGNAT after testing few ports. Anyw...

accarda

Thanks for sharing your thoughts. About firewall settings and the like I have checked them and are ok, as I was using them already with a VPN established to my CHR to bypass the CGNAT issue with previous APN setting. Actually I do have another SIM used on another LTE router (which is a leased one, n...

accarda

romon doesn't work btw v6 and v7

I have only 1 router migrated to v7.1.1, but either if I set RoMON agent to be one of v6 or the v7 router, I can log into all the others with no issues, including the v7 one.

accarda

Hi all, finally I was able to find out an APN to set to my SXT LTE6 router different than the standard "internet" value and I can see it's working (because all other APNs indicate for my provider didn't give me IP from modem). Previously with "internet" APN I was getting a privat...

accarda

Just went through some experiment from Ros v6.49.2 to v7.1.1 and had to discover that now network tab has been replaced by output.network field (from connection -> filter tab). All the advertise networks must be placed into an address-list and then in such field you can assign that list. Then I had ...

accarda

@pe1chl just for the sake of completing this, I have repeated again the same setup and steps, starting "almost" fresh from v6.49.2. In fact before making the first move to v7.1.1 I had created a backup for v6.49.2, which never included any trace of v7.1.1, which resulted in a clean starti...

accarda

@pe1chl in my case I had this hEX-S running LT and never tried v7.x, so no possibility that some trace of v7 was in it. Then I moved first to latest 6.49.2 just to make sure I had all with latest step before v7. My move to v7.1.1 (first time) was all ok and BGP worked fine, even though after creati...

accarda

I have just tried to experiment with v7.1.1 using a hEX S router, which has a very basic config. Started from Ros v6.49.2 and had only a mgmt VLAN interface, one bridge, loopback and a point to point ethernet connection to a rb4011 running 6.48.6. With this basic i installed v7.1.1 and then I create...

accarda

Hello all, I'm just posting the current version of the script for ethernet's based traffic limiter which I'm currently using, where I added also some notification via Telegram Bot. For this reason there is a global variable "notifyCount" to limit the number of Telegram notification that yo...

accarda

Time ago there was a similar request for managing data quota. Here you can find several info and a different version of script (one that I posted about mine) that you can have a look: https://forum.mikrotik.com/viewtopic.php?f=13&t=87565&p=854148#p854148 The problem with scripting is that th...

accarda

Would you be able/willing to explain what the 3 other L7 variables do? I tried to understand from your script, but can't get their meaning...: - wan-offset ? - wan-rebootlock ? - wan-refdata ? Again, thank you very much for your script :-) Sorry for the long delay, but actually I have never receive...

accarda

For the quota manager you can work with scripting to create some that suites your needs.
I think there is also some basic example in the wiki page if you search for.

accarda

Good day everyone, I'm trying to plan an activity to bring a site with a flat LAN into a site with subnets by using VLANs for some type of traffic. My problem is that the site has several switches (of different brands as well) and I will be remote, which is not ideal to manage such thing. All MK swi...

accarda

I still think a welcome new feature would be a "script" target for error logging. Like this: /system logging add action=script topics=ipsec,error script="ipsecerrorscript" Then whenever a message with topic ipsec,error is generated the script is run and it gets the log item info...

accarda

Hello,
I have used a CHR with P1 license to run bandwidth test to another router with fiber connection 1000/300 at their side; I was able to max-out that router with UDP traffic in both directions.

Armando

accarda

How do I also use keep-result=no in the script, as is done in the first example? I tried it after the word fetch and at the end after the last entry sub2" - neither worked and both prevented the script from working. I use this statement to send Telegrams with that option included: :local botId...

accarda

Thank you for this insight. Actually I just did a quick test like you suggested and got impressed how fast these portable gets to sleep. I ran ping from tablet to main router and ping was about 2ms; at the same time I issued a ping from router to tablet and I've got 2ms too. As soon as the ping from...

accarda

I was testing ping on the LAN from main router to WiFi clients and I have got some high response: from 2ms to 110ms, with several variations. I have tested phone, tablet, laptop all near by the AP (same room). I have 2 setup under test (2 different sites): one using VLANs and the other on a flat LAN...

accarda

Yes, your assumption is correct, I have assigned them as /32 and I have all listed from x.x.x.24 to x.x.x.31. Actually I tried again this morning few hours ago, and the address .31 didn't work at all. At this very moment I tried from the router to make a ping to 8.8.8.8 an using source addr the .31 ...

accarda

I was reading this post and I’m wondering whether one issue that I have with an IP address availability could be explained by the exchange here. My case is different, in the sense that I’ve got a /29 from ISP, which I haven’t assigned to a LAN interface, but instead I’m setting things so that I can ...

accarda

You could run the script within a loop, so that if you have portion of it where you want to keep an initial state, you can do as those variables can be set outside the looping portion. So for example you can embed your script with a code like this to make a loop: :global stopScript false :do { .... ...

accarda

Hi @Jotne, sure someone can apply different strategies to the firewall to achieve different results. In my case I have forwarded to the router only those ports used by IPSec/IKEv2 and nothing else to internal hosts. Anyway speaking of timers I have slightly modified the main script to allow a certai...

accarda

Hi all, I was creating a script that looks in the memory log and if it finds an "ipsec,error" about failed phase1 negotiation adds the address to a blacklist. In case someone else is interested, here is the script that I'm running on couple of routers. The script is made by a function to s...

accarda

Ok I will leave that setting in profile as is. Well about the max MTU, then we are not going to see much differences with another ISP, as the transport network is managed by the same telco company and all the remaining 23 fibers are coming from the same place. It will be mostly for redundancy at thi...

accarda

Good to hear this. Actually I have fixed the typo in the original snippet, so you can copy/paste also from here to get the whole working code. In my original code the foreach, which gets the policy except those with action "discard", is because I have a policy to avoid L2TP staying up when...

accarda

Thank you for this hint about TCP MSS. I have added this mangle rule now. Concerning TCP MSS, in the PPPoE profile I was keeping the default value for "Change TCP MSS"; will this kind of applying "a double MSS change" or it won't interfere ? Otherwise I guess I should set it to n...

accarda

Hi SiB, yes also with the script that I'm using on my router (which is mainly sending telegram msg to inform about some issue with PH2) gets triggered even though IPSec tunnel is active and working. Of course in term of scripting it all depends how often you run it, chances that you catch one of tho...

accarda

Thank you for this too. Yes I was reading in the past another post about these 20bytes for MPLS enablement. Currently the guy at provider told me that they are using MPLS so that the fiber's provider brings the connection to the internet exchange where they are hosting their ISP, so this was part of...

accarda

OK, so then use this modified version: :foreach i in=[/ip ipsec policy find comment="put_your_comment"] do={ :if ($i != "*FFFFFF") do={ :local state [/ip ipsec policy get $i value-name=ph2-state] :if ($state != "established") do={ /ip ipsec policy disable number=$i :del...

accarda

Actually I was reading the doc from wiki and MK says on license update: In '/system license' menu router will indicate the time next-renewal-at when it will attempt to contact server located on licence.mikrotik.com. Communication attempts will be performed once an hour after the date on next-renewal...

accarda

Hi all, I'm running a CHR and after few days of using the free license I purchased the P1 license. Therefore the CHR is still running the trial and it says "next renewal at Apr/1" and "deadline at May/1". Since my P1 license is already active on the MK site, should I run the rene...

accarda

Thank you for clarifying this for me. Actually I spoke already with the ISP, but they are using the fiber provided by a national company and they have got such limitation as well, so 1492 was the maximum that they could give us. Initially with VLAN if at MTU=1500 I have got the PPPoE at 1480, theref...

accarda

Hi, you can try this code. I use the main part of this code just to inform me when PH2 is down, but in this case I modify it to disable, wait 10 sec and re-enable the policy. Give it a try. :foreach i in=[/ip ipsec policy find where action!=discard] do={ :if ($i != "*FFFFFF") do={ :local s...

accarda

Hi all, I have recently setup a PPPoE connection over a FTTH fiber link. The ISP informed that the interface was set MTU to 1492 at its side and provided also the VLAN number to establish the connectivity. I have setup the VLAN interface with a MTU of 1512 so that the PPPoE connection got 1492 on my...

accarda

I have got a similar issue only with one of my iPad, which does not reach the router on its LAN's IP. Like in your case, the iPad can go on internet and do all the rest. In my case I partially fixed the issue by connecting that iPad to the router's loopback address instead of the one from same LAN, ...

accarda

You can also check this example viewtopic.php?f=23&t=169538 that explains how to use IKE2 with 3 sites.

accarda

Hello all, I'd like to report one issue that I had about some VLAN that stopped working, just after rebooting the router. I'm using a RB4011 with ROS 6.46.8 connected to a CRS328, where I have defined several VLANs. After rebooting the RB4011 I've got an issue with couple of VLANs related to 2 LANs;...

accarda

The problem is that from version v6.41.0 onward there was the introduction of new bridge concept that removed the master/slave on ethernet ports. This was documented in the release notes https://mikrotik.com/download/changelogs for v6.41.0. At that point a script was made available to migrate old co...

accarda

Thank you for sharing your opinion on this. Currently I have a second LTE router (managed by the provider), which uses the same 4G carrier as the SXT, but in this case the SIMcard has some sort of business profile. With this connection I get a public IP on its interface, so I'm using this to manage ...

accarda

You can use scripting in Ros to be triggered whenever DHCP assign an IP.
Read this message which has some valid use case.

https://forum.mikrotik.com/viewtopic.php?f=9&t=119469

Armando

accarda

Or if it doesn't work "Tools -> Clear Cache" .

Thanks for this, I have now also cleaned the cache just to keep things cleaner.
Thank you all for the provided suggestions.

Armando

accarda

Perhaps you have accidentally used the shortcut 'Ctrl + -"?

Thank you for this, it might be possible that that’s what happened to me. I never used those option, but I might have hit that key combination.
Now I restored the zoom and all appear as usual.
Armando.

accarda

Hello all, I’m getting a strange behavior from WinBox (latest 64bits) when I connect to a new device that I have recently set. WinBox shrink all icons and text so that it becomes very difficult to read. However if I connect to that device via Rommon, WinBox appears just fine; as soon as I connect it...

accarda

Hello all, I have done a simple script that whenever CAPs loose CAPsMAN, it disables CAP and re-enable the wlan interface to keep going for local LAN access. However I was trying to find an easy way to detect when CAPsMAN is available again, so to bring the AP again into CAPs mode. Is there anything...

accarda

If you haven’t seen this article before, it shows how those MT reports from are taken from measurements.

https://wiki.mikrotik.com/wiki/Manual: ... Generator

accarda

<t>Actually it looks like I fixed the issue.<br/> I have changed in CAPsMAN router the data path to VLAN Mode=use tag instead of no tag.<br/> Then in APs I have seen that the wlan interfaces got VLAN id10 and all admit.<br/> At this point I removed those wlan from VLAN10 from untagged to tagged and ...

accarda

Thanks for the quick replay and it's encouraging that you had a similar issue, but then resolved. Below is the current configuration, using CAPsMAN which does not allow clients to get internet (because in my opinion CAPsMAN is not setting wlan1 and wlan2 with proper VLAN info). # jan/09/2021 08:36:1...

accarda

Hello all, I'm experiencing an issue when I set my AP to work on a VLAN AND using CAPsMAN. Without CAPsMAN no issue at all, as I can configure all parameters for the VLAN on AP. It does not seem so when using CAPsMAN, even though I have tried to play with vlan sets on datapath from the CAPsMAN route...

accarda

Hello everyone, I'd like to understand whether this is possible or not, without making too much tests, risking to lock myself out as SXT is on a pole and not easy to reach now. However, currently, I have RoMON enabled and working on SXT and main router (would this always allows me to log into SXT if...

accarda

As another indication of something strange with the affected iPad, is when using the MikroTik app. From the affected iPad I can't see any MK device discovered in the app, while from the old iPad or iPhone I can see all MK devices listed there, like when checking from Winbox. So there is really all i...

accarda

I have done some check between router and switch just to trace the affected device. Device is an iPad and I have disabled the new "private IP" implementation (it was enabled up to few days ago). Now the MAC address is not changed anymore. The main router is also DHCP and I have checked tha...

accarda

Currently on all APs and switch I don't have any firewall enabled. The only FW is enabled on the main router which provides access to Internet. From LAN prospective everything is connected through the switch which has 2 ports going to the main router: SFP+ from router to switch defines the LAN (no u...

accarda

Hi all, I'm facing a strange issue in my LAN, where only from one tablet I can't seem to ping or connect (SSH) to other hosts in the LAN. If I ping from the affected tablet to the lan it goes in timeout; however if I ping from another device to the tablet it answers properly. If from tablet I try to...

accarda

Thank you Sib for your comments. Currently I have checked on SMS but I don't see any message indicating some sort of limitation, other than normal SMS for incoming missing calls. I have done another test after reading other posts, by setting a blank APN (which I read should get the APN automatically...

accarda

I don't have much experience with WiFi using MikroTik gears, so I was not able to see all problems. My installation is quite simple and "safe", meaning that I was able to define 3 5GHz channels in an indoor location where I don't have much users on 5GHz, so all my APs are sitting alone. I ...

accarda

Much better results by only controlling external radios. Yes I can see your point and it was the main reason why I have written this post, to understand whether there was any limitation from CAPsMAN vs direct config of each individual AP. For me, in order to find out the settings needed to achieve ...

accarda

Hello everyone, it's few days that I'm using a new SXT LTE6 kit and I'm having only a strange issue when I try to set the proper APN for my SIM card provider. My unit runs firmware rev R11e-LTE6_V026. According to the provider website, the APN should be mobile.vodafone.it. However whenever I enter t...

accarda

I'm currently using the following 5GHz channels: Ch.36, Ch.52 and Ch.149.
The problematic one was Ch.149 that initially was not accepted, but then playing with outdoor/indoor and few other settings, I'm now able to have all those 3 channels active and managed through CAPsMAN.

accarda

Also this link could be useful to see what bonding is about and some use case scenario to get some idea based on your equipment. https://wiki.mikrotik.com/wiki/Manual:Interface/Bonding As said in the article it's a matter of load balancing and failover setup that you will get. You can try to check o...

accarda

In term of port aggregation the use case it's different from what you are looking for. Let's say your CPE does have 2 ETHs=100mbits but your radio link is capable of 300mbits, then you can limit this bottleneck by bonding both ETH1+ETH2 at CPE and connecting 2 cables to your router you can get almos...

accarda

Why don't you set frequency from CAPsMAN? Yes, I do. I have set all my data including frequencies from CAPsMAN. The only problem was that it didn't allow for certain channels so far. But I have played little bit more with the AP in direct config and I have found a combination which allowed me to se...

accarda

If the radio is "controlled by caps-man"... That's the only control of the radio and create enabled seems to give you the most control of APs. Actually I'm not sure that CAPsMAN gives you the most control. At least not in term of available options. For example on the channel selection, in...

accarda

Hello, from your diagram it's not a bonding setup, but a load balancing one. With bonding you will increase the capacity of a single Ethernet line by combining more than one interface from one device with the same interfaces on the main router. In your case you need to load balance the traffic from ...

accarda

Thanks for this piece of info.
So basically if I want the full granularity control over the AP settings I should give up on CAPsMAN and go the traditional way of setting each AP individually, I suppose.

I had that impression, but I was not 100% sure about it.

accarda

Hello everyone, I'm playing with WiFi settings and implementation of a small coverage area using 3*hAP AC2. I have done all configs and enabled CAPsMAN from RB4011 to control those 3 ApPs. However it's not yet clear to me whether all wireless parameters are managed only through CAPsMAN OR there are ...

accarda

No problem. And if you want to stick with the easy scheduler, you can use 3 in total; 2 to trigger the start/stop and the one that you already have. scheduler 1 to run at 12am only once, no repetition to start triggering the email to be sent: :global sendEmail true Scheduler 2 to run at 1am only onc...

accarda

Hi Glenn, OK, I understand now your point. So you can manage it in couple of ways giving you different level of flexibility. One way could be making the main code that runs every 5 min (analyzing the log) to be executed as a loop, without using a scheduler for that. In this way the main execution wi...

accarda

What you can do is running your set of checks/statements in a script, where you put some check after that you have sent the first email, so that you are not sending such email every single time, but after another condition that you will set to reset such block. Then you can control better how to tri...

accarda

Have you tried removing the quotation around the name of the global variable ??

:global "provisioned-status" "no" into :global provisioned-status "no"

accarda

Thanks for reply. I was checking in the forum as well the wiki, but couldn't find any indication that reboot was needed. However as I have a script to switch from single/dual WAN, when I checked RPF=strict and I was set to dual-wan, initially things worked fine, but after rebooting the router I have...

accarda

Hi all, I was playing with the RP Filter setting, between strict and loose while switching from single to multi-wan and I seemed to notice that the switch took effect only after router reboot. Could any of you confirm such behavior or is it suppose to work right after the setting has changed ? Thank...

accarda

Well, playing little bit with your script even if you isolate it in a block or conditional if, the code is parsed anyway when running it on CLI, therefore all the missing commands for CAP wil produce several syntax errors. One way to solve your issue could be to split your main code into a script th...

accarda

Why don't you use the block inside on error to put the code for when CAPs is not available ? From your script you have set CAPsMAN always true, so the IF will always reach. Now if you put your code inside the on error, you will execute that part like when the IF would be false. Like in this simple t...

accarda

Hello, I use this script on my RB, which checks the IPSec phase2 status. After first execution the script goes in loop mode and checks every 10 seconds. Change XXXXX with your botId and YYYYY with chatId. Armando. :global stopScript2 false :do { :local err "0" :local site [/system identity...

accarda

Hi everyone, I have (used to have) a working L2TP/IPSec setup that was working fine up to now, when I have noticed this problem. This config is using couple of profiles to allow site-to-site (using another MK as VPN client) and road warrior access. I'm not using it all the time so it's difficult for...

accarda

Thank you Sob for the info that you have provided. I have re-arranged the rules so that now all prerouting are organized so that marking connection are grouped together and mark routing is last part of the chain; in this way I have adjusted the passthrough based on your explanation. This is how it l...

accarda

Hi all, I'm currently using a config with dual WAN for failover and load balancing traffic. The setup is working fine, but since it was based on reading articles and few other posts, I'd like to see whether there are possible improvements mainly in term of logical rule order and bad usage of passthr...

accarda

Hi all, while I was checking all connections I have noticed something strange happening on the main router, running RouterOS v6.46.6. I have 2 WANs: WAN1 is the main connection (active default route with distance 1), while WAN2 is waiting with distance 2. WAN1 is 192.168.1.2/30 and WAN2 192.168.0.2/...

accarda

You can define multiple /ppp profile rows, and each /ppp secret row may refer to a different /ppp profile row. The profile to which the configuration of the L2TP server refers is always overridden by the one from /ppp secret . Thank you very much sindy for this heads up. Actually since I still had ...

accarda

Hello everyone, I have enabled a site-to-portable site (meaning a laptop + MikroTik mAp 2nd) L2TP/IPSec with BCP enabled, so that I can have my laptop as part of the main LAN. Considering that on the server side I can enable only one instance of L2TP server at the time, is there any possibility that...

accarda

Yes of course... After get $i message, the script freeze, only for it! It read the content of sms but it don't know what to remove Ok, I don't use this sms feature so I don't have experience with specific sms option. Usually I send messages directly to Telegram without storing them anywhere else, a...

accarda

Armando, my debug analysis indicates that "/ip arp" does not have a unique (ie. common in both) key/value pair for lookup in "/interface ethernet", so then it seems it can't be done with "/interface ethernet". There must be some other location like bridge or switch ......

accarda

I am heartbroken. I'm starting to think it's a bug.... i don't know why after get body message of SMS,it's ineradicable in this script, but in this it's ok. OK, in the second code you have the remove statement inside the foreach, which is what I mentioned in the previous message. Have you tried to ...

accarda

Actually I have just tried here from the terminal as well, adding the equal sign and I get only one record, as expected. [user@rb0] > :put [/ip arp print as-value where address="192.168.0.1"] .id=*10;address=192.168.0.1;comment=;interface=ether2-;mac-address=A8:7D:10:21:FB:2A [user@rb0] > ...

Search found 229 matches