MikroTik

You need to add the pppoe-out1 into the WAN interface list so that NAT works.

The DHCP client on ether1 is no longer needed.

I've just heard that after a really successful 1st conference in March 2024 the MTPC is back for a 2nd time.

March 6th-7th 2025 in Prague.

There is an earlybird discount, so get your places booked.

I'm really looking forward to it !

More details at https://mtpc.world/

At first glance the signal is much too low for that distance. I would set the frequency to 5500 and start with a 20MHz channel width. The signal on the chains should be mid- 60s to be useful, and at that distance I would expect better. Have you tested at the distance but not behind glass ? even temp...

Great ! Anyone else ?

Looks like lots of interesting speakers:

https://mtpc.world/conference-agenda/

So is anyone else going ?

Is anyone else going to the Mkrotik Professionals conference in Prague ?

Be great to meet up there !

https://mtpc.world/

So who fancies meeting for beer in Prague ? March 7th and 8th https://mtpc.world/

The devices will only reply to each other if they have the IP of the mikrotik as their default route, or they have specific static routes for the other subnet via the mikrotik IP address.

You have disabled fasttrack, and also have an over complicated mangle setup.

Try enabling fast track, and disabling the mangle rules.

Looking forward to seeing everyone in Prague in March !

Traffic on the LAN does not go via the firewall, unless you have bridge filtering enabled. Have you checked things like you have the correct subnet mask etc eg the IP on the bridge should be 192.168.88.1/24 Also check the DHCP leases. Check on the connected machines that they also are getting the co...

https://help.mikrotik.com/docs/display/ROS/Flashfig

We supply the hAP AX3 with the following UK Mikrotik PSU as standard:

https://linitx.com/product/mikrotik-24v ... hite/16601

Hope that helps
Nick

The closest subnet will be used for each route match, so if you don't have the equivalent routes in for ospf as well as BGP then only the BGP route will be used. You could just filter routes and only accept a default route from each BGP peer, then there will be 3 default routes and you can control t...

If you have added a routing rule using a new routing table, make sure you have a copy of the connected route to subnet 2 in the new table. Also make sure that it is not caught by any outgoing src-nat rule when going to subnet 2 Yes this is true. So what client ask is that one subnet goes through WAN...

Do not specify to-ports on your dst-nat rules !

I setup a 5009 as a capsman and a hap ax2 as the cap, see below for my config: CAPSMAN: /interface wifiwave2 security add disabled=no name=sec1 .... /interface wifiwave2 configuration add channel.band=2ghz-ax country="United Kingdom" disabled=no name=2ghz security=sec1 ssid=CapsmanTest2 ad...

You can use one of the spare IPs from the /28 set it with /32 on the end, on the WAN interface, and then use a src-nat rule to src-nat the traffic to that IP when going out on that interface

You probably need station-bridge on one end and bridge on the other

When I test with BTest over local network (i have two cAP ac in attic and second one on 1st floor) I noticed that my main router CPU stays all the time at 100%. I had a quick look at your config and although you have the LAN ports in the bridge, you don't seem to be using hardware offload, so all L...

You should set Extension Channel to be disabled.

If you fully reset a routerboard, and select no default config then it will have no IP address.

You will need to use winbox and click on the mac address when it appears in neighbours.

Also if you don't see it when connected to ether1, try a different port.

Do you also have wireless enabled on the laptop ?

Try switching it off.

You can specify it when you create the l2tp-client:

 /interface l2tp-client add add-default-route=yes default-route-distance=10

You should read up on the features available in the different ranges: https://help.mikrotik.com/docs/display/ROS/Switch+Chip+Features https://wiki.mikrotik.com/wiki/Manual:CRS1xx/2xx_series_switches#Summary https://wiki.mikrotik.com/wiki/Manual:CRS3xx_series_switches#Features https://wiki.mikrotik.c...

Signal level is not great, might be better choosing a higher frequency channel.

Also not clear which routeros version you are running, some versions are more stable than others, and there have been quite a lot of fixes listed in the changelogs.

Regards
Nick

You may be able to do it using the proxy:

https://wiki.mikrotik.com/wiki/Manual:IP/Proxy

Vigor 130 are still good.

Also worth looking at refurb HG612 from ebay, they just work :)

https://wiki.mikrotik.com/wiki/Manual:I ... cteristics

Looks like the wifi password might be too short ?

We have a lot of posts to moderate, and we are mostly volunteers, so it can take a little time.

regards
Nick

You can add the IP into an address list with a timeout, and then use the address list to mark the packets

You can use Traffic flow perhaps:
https://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow

or accounting:
https://wiki.mikrotik.com/wiki/Manual:IP/Accounting

For static dhcp leases, you can go into IP -> DHCP Server -> Leases and select an assigned lease and click Make static. Once you have done that you can even change the IP, eg if you want all static to be in a certain range. You can also use the address list feature on a lease to add this IP into an ...

If you are not changing the port then you don't need to specify to-ports.

Have you added a firewall rule in the forward chain to allow traffic from outside to get to the internal IP on that port ?

Did you make sure that you added the new wlan interfaces into the bridge where the DHCP server is ?

I haven't looked yet, but I'm guessing you could turn off the default authenticate on the station bridge interface in C and add a connect list entry for the mac address of B

Hope that helps
Nick

If your data is on local forwarding then it is going across the bridges on the LAN between the CAP and your main router, so check the bridge config on both, could be related to STP settings, also make sure bridges have an admin-mac set. Well i "played" as well with my caps configuration an...

Bear in mind that current SXT and LHG models are limited to 100Mbps ethernet port.

See https://mikrotik.com/products/group/lte ... abit%22]#! for a list of LTE with Gigabit

Hope that helps
Nick

You should create a pppoe client on the ethernet connected to the modem. MTU should probably be 1492, but if that fails try 1480. If you open up the pppoe interface in winbox and click the status tab, you will see the status. If you are using the default mikrotik config, you will also need to add th...

I use a mangle rule to mark the connections, and then use the mark to avoid fasttrack /ip firewall mangle add action=mark-connection chain=prerouting comment="no fasttrack list" connection-mark=no-mark \ connection-state=new new-connection-mark=nofastrack passthrough=no src-address-list=no...

You need to route the traffic. so on RB1 set the IP on eth1 to be 50.50.50.1/24 PC is on 50.50.50.2 Now on RB1 set IP on eth4 to be 50.50.60.1/24 Now on RB2 set IP on its eth1 to be 50.50.60.2/24 Make its default route 50.50.60.1 Now on PC you can get to 50.50.60.2 (assuming PC has default route via...

You are testing on the device itself ?

You need to test from devices connected beyond the switches, eg iperf between PCs, the CRS does not have enough CPU to run btest.

regards
Nick

The simplest method to setup LTE is actually to use quickset. (normally I don't like quickset)

I would suggest you reset back to the default config, by going to System -> Reset Configuration..

Then once it has rebooted, use the quickset page to set up as LTE CPE

Hope that helps
Nick

Make sure that you have disabled power saving on the Intel Wifi card.

Regards
Nick

Did you try using arp monitoring with active-backup mode ?

https://wiki.mikrotik.com/wiki/Manual:I ... Monitoring

mii monitoring only monitors physical interfaces.

Yes you can use the mAP2nD for that

1) make a bridge
2) put all 3 ports in the bridge

You can use them as separate interfaces, but some have shared bandwidth to the CPU.

Use the Torch tool on your LAN interface, it will show what is being used

I found the original post here:

https://networkengineering.meta.stackex ... krotik-tag

Not sure why the poster is posting it, but of course paid support is available from distributors such as ourselves

Regards
Nick

Yes it is weatherproof, and ideal for this distance.

I tested the meshing a couple of days ago. 1) power up the 1st Audience which you will use as the main AP 2) press the wps-sync button briefly, the light on the front starts flashing green 3) power up the next Audience device whilst holding the wps-sync button, keep holding until the light on the fr...

Antenna gain on a Disc should be set to 21, you are running far too much power for a short link.

I could add antenna gain in the interface setting, do you think it is a good idea?

Nick, any practical example of rule ? i.e. : 192.168.1.0/24 (ether4) will use 10.20.30.1/29 on ether1 192.168.2.0/24 (ether5) will use 10.20.30.2/29 on ether1 and so on... Still masquerade rule needed ? Thank you Try /ip firewall nat add chain=srcnat place-before=1 src-address=192.168.1.0/24 action...

Put the /29 IPs on the interface and then use a srcnat rule for each subnet to srcnat to the IP address you wish to use.

Regards
Nick

If you show us your config it would help.

use /export and then we can see what is wrong.

Also provide the output of /ip route print

Regards
Nick

My confusion was not so much over price as to why this model exists at all and what are the usage cases. I guess here in the UK if you're lucky enough to get near the maximum VDSL2 speed (80Mbps), then it would be useful as the most as I could get out of my little hAP mini (which I'm using for teac...

Try putting your router on latest v6 Stable or Testing release before upgrading to the v7 beta

Labtest beta? I tried the link on the first page. http://mt.lv/v7

The interface will be marked down when there are no clients connected.

Can you tell which band your phone is using ?

Which bands do you have selected on the SXT ?

We have a 60m wireless wire link here with one end in a window, and the other outside which works fine.

However it may not work depending on the type of glass.

Regards
Nick

The dual PSU version has r2 at the end of the model number on the product sticker.

They have only recently started shipping the revised model with dual PSU.

Regards
Nick

You can also use RADIUS to do this:

See
https://wiki.mikrotik.com/wiki/Manual:I ... US_Support

and

https://wiki.mikrotik.com/wiki/Manual:R ... Attributes

Regards
Nick

The 3011 only takes passive PoE between 10 and 30V, but your switch is an 802.3af PoE switch, so won't power it.

You can use a PoE converter to do this, https://mikrotik.com/product/rbgpoe_con_hp

Hope that helps
Nick

We have stock:
https://linitx.com/product/mikrotik-pai ... 10d)/14558

and they are still also available to order more from Mikrotik.

regards
Nick

On each device you should have the ethernet and the wlan in a bridge

You should have a dhcp-client on the bridge

On the wireless set one end as Bridge, and the other as station bridge, then they will just be a transparent layer 2 bridge.

Hope that helps
Nick

If you just make sure that the in interface on those 2 rules is set to be your WAN interface then only traffic coming in on the WAN will be affected by them, without that the rules will intercept the traffic on all interfaces.

Regards
Nick

Looks like you are NATing all port 80 and 443 traffic to an internal IP

add action=dst-nat chain=dstnat dst-port=80 protocol=tcp to-addresses=192.168.50.7 to-ports=80

Try setting an in interface on these rules.

Regards
Nick

You may need to check any filtering settings on the switch.

It sounds like the switch is filtering all packets in 01:80:c2:00 rather than just the range which is supposed to be excluded.

Only this part should be filtered 01-80-C2-00-00-00 to 01-80-C2-00-00-0F

Regards
Nick

What does this mean ?

*) wireless - improved antenna gain setting for devices with built in antennas;

It would be nice if it knew the antenna gain of the device, just tested on a 4011 with wireless, and nothing obvious in winbox.

Firstly, no need to set to-ports in the nat rule, only use this if you are changing the to-port

Secondly, the filter rule needs to use the IP of the internal device, eg after the NAT has happened.

Hope that helps
Nick

If services were available from the LAN, then an infected PC on the LAN could exploit the router from the LAN side.

1) don't specify the to-port=80, you don't need to if the port is the same.

2) check that you have an ip filter forward chain rule which allows the traffic to port 80 on 10.0.0.101

3) check that the device 10.0.0.101 has a default route back to the routerboard.

Turn off neighbour discovery on the CPE interface, or use a bridge filter to control the MNDP packets.

When the router boots it uses the active partition, if that fails then it tries the next partition. That is all it does.

It sounds like you have the wireless mode set to Bridge.

It needs to be AP Bridge.

Hope that helps
Nick

Ceee means 1 control channel plus 3 extension channels so a total of 80MHz, in fact your status screen shows 80MHz When you btest you should not btest on the devices, the CPU will max out, you should btest between other devices connected to both ends. Also the signals are much too high, which will n...

Make sure you have set the logging to disk and try again

Is there anything in the logs ?

Cabling nightmare ?

We are the biggest UK distributor for MikroTik and we have stock:

https://linitx.com/product/mikrotik-rou ... hape/15370

Hope that helps
Nick

I have problem with my CRS125 and ethernet throughput. I can reach roughly 50mbit/s to my WAN port. I'm having NAT in WAN, I have enabled fasttrack and changed WAN port queue type to ethernet-default. CPU load is about 30-40% and still I can't reach even close of my Internet connection speed (250mb...

I would suggest that you look at the perfomance test results for this device:

https://mikrotik.com/product/CRS112-8G- ... estresults

This is not a fast router, it is mainly a switch, so you don't really have the right device for a 1Gig internet feed.

Nick

You could use a variation on port knocking but using icmp and various packet sizes.

Then the client can use the ping command with size set to execute the knock

Hope that helps
Nick

Looks like you have it set on channel 3, and only g, what did you set it to on the capsman ?

You should make sure you are using non-overlapping channels, and the correct 802.11 protocols, such as g/n

Nick

Modem isn't configured yet normally means the SIM is not in place correctly.

Are you using the correct sim size ?

i am currently facing a situation where the device needs to be reset but the rains and winds are too strong to climb the tower and the client has his entire production machines cutoff from the server as the PTP link is down.

And you can't just mac-telnet in ?

Did you make sure the interface was removed from capsman ?

The only time it should be doing it by IP is if you specify the IP of the capsman when setting up the cap.

You don't seem to have a discovery interface selected, probably because you are trying a layer3 connection. I use: /interface wireless cap set discovery-interfaces=bridge1 enabled=yes interfaces=wlan1 In your case it is probably bridge-local, and remove the capsman IP, then it will use L2 to find th...

Please remember that you should stick with bugfix channel for production routers.

Yes it is in the additional packages download.

For production systems you should use the bugfix branch, which is currently on 6.40.8

Bugfix includes any security fixes.

Nick

It is best if you export the whole config so that we can see it.

I am guessing it is related to NAT rules.

Nick

Currently only available in PtP and needs a minimum antenna gain of 30dBi, which the WAP60 does not have.

Ofcom have recently consulted on 60GHz PtMP usage and micro cells, (lower antenna gain requirements) but they have not yet issued any actions/changes.

Nick

I don't know about radius on windows, but on freeradius we send a radius reply containing:

MikroTik-Group=full

which maps onto the user group on the Router.

Hope that helps
Nick

Just add the fallback route with a greater distance into this L2TPVPN table.

Then when the l2tp interface is down the first route won't be used.

Hope that helps
Nick

You can add /32s into the DHCP network settings so that you can override settings for individual IPs

It is only available when there are only 2 interfaces in the bridge, no more, no less.

Did you make sure that you set an admin-mac on the bridge ?

They haven't shipped any M33G yet.

We have them on backorder, but Mikrotik are currently saying no availability until end of Dec, so we hope to see them in January

Nick

Did you add a default route ? Maybe if you show us an export of your /ipv6 that will help

Have you added your routerboard as a NAS on the freeradius server ?

I have been testing a 180-T but it seems to resync every 10-12 hours.

It does sync at a high speed on my line, and latency is low when it is working, but drops twice a day.

Has anyone else seen this sort of instability ?

Nick

You can use https://wiki.mikrotik.com/wiki/Manual:IP/Accounting to do the accounting

See https://wiki.mikrotik.com/wiki/Manual:R ... Remote_AAA for RADIUS

You can set a default user group for all logins, maybe read only, and then override that in the radius response.

eg set MikroTik-Group = full

Hope that helps
Nick

The 2.4GHz interface is only really meant for management.

The level 3 licence means that only one client can connect, you have to use Bridge mode, not AP Bridge.

Also the antenna gain on the 2.4GHz is only 1.5 dBi which will not provide much range.

Nick

From memory you need to get it to 3.30 first

The route selected is first decided based on the smallest subnet mask which matches.

Only if 2 identical routes are available is the metric used.

Nick

Yes you can use an RJ01 to do this.

:) Yes thats the one, you can see above that it has chosen a mac address of one of the interfaces assigned to the bridge. If you take the mac address it is currently using, which starts 6C and make it start 6E instead then you will have set a special private admin mac which will be unique and won't ...

I'm guessing that you have put the dhcp-client on the bridge on the APs. The DHCP client will use the mac address of the bridge. If you have not set an admin mac on the bridge then the bridge will pick a mac from the interfaces in the bridge, and that can change. So the answer is, set an admin mac o...

You can use mac-telnet, or use winbox and click the mac address.

https://github.com/haakonnessjoen/MAC-Telnet

Nick

Can you post an example config for this ?

If they are already in your address list then don't match them again on the L7 matcher !

You need to use a Virtual Wireless interface for each extra SSID

See
https://wiki.mikrotik.com/wiki/Manual:I ... #VirtualAP

Nick

I have seen this happen where the DHCP server is on a bridge, and the admin-mac has not been set on the bridge.

It is always good practice to set an admin-mac

Nick.

You can use Bridge mode on an SXT lite5 which allows 1 client to connect.

Its very hard to work out what is happening when you hide the IPs with XX.XX.XX.XX

Normally to avoid the need for hairpin NAT you use internal static dns to point at the internal IPs instead.

The modem needs to be able to reply to an IP which is not in its subnet. If you can add a static route on the modem for 192.168.1.0/24 via 192.168.0.1 then this will work. Otherwise add a srcnat masquerade rule on the mikrotik for dst address 192.168.0.2 Then the modem will see traffic from 192.168....

The input chain is for traffic to the router.

To restrict traffic going through the router to the client you should use the forward chain.

Nick

there is an rj45 on the back or just use winbox to a mac address if you are plugged into one of the ethernets

Power level is managed using the antenna gain setting on wireless settings of the AP, and the region setting in capsman.

Yes you can set the parent on each device.

We have new stock arriving in approx 8 days

https://linitx.com/product/mikrotik-rou ... -psu/14584

Nick

The thing about having 1M+ routes in the table has been search time for me, less about convergence and loading. This is where Cisco and other platforms have killed it over Mikrotik for me - if I want to look up the current active route entry for 8.8.8.8 (for example). the search time on a 1036 with...

We have PoE injectors in stock:

https://linitx.com/product/mikrotik-rou ... ctor/12350

You need to work on the problem, by breaking it down into separate parts. eg you mention a PtP link using SXTs, is this reliable can you ping end to end, what are the settings on it etc Then once you have proved the wireless link is ok, can you then ping from the RB across to the other router ? Then...

To make a PtP link like this you would be better off using a pair of SXTs, usually the SXT lite5

Nick

WPA has a minimum of 8 characters.

what channel width are you using ?

what modulation rates are the clients connected at ?

Have you checked that the links are not causing interference to each other ?

MikroTik's ordering system says 9th September for the next batch.

Hope that helps

Nick

Add an access-list rule which rejects when the signal is too low.

Have a look at our article :
https://blog.linitx.com/howto-improved- ... t-roaming/

Nick

Have you check that the device on 192.168.0.100 has a default route of 192.168.0.1 ?

Also have you checked that your NAT rule has an out interface specified ?

I tried another test .... removed the BT homehub out of the equation and just went ppoe direct from the hAP lite, similar results via ethernet or wifi :( If you see the same speeds on ethernet you must have a config issue. Have you checked the ethernet status to see if it has negotiated correctly ?...

Well firstly the hAP AC lite only has 10/100 ports. If you are using the default config, you have probably connected from ether1 on the hap ? If so you will be NATing. Looking at tested speeds http://routerboard.com/RB952Ui-5ac2nD you should be getting close to the limit of the 10/100 ethernet - nor...

Assuming no config: (you can get to this by going to System - Reset-Configuration and selecting no default config) Go to interfaces -> ethernet, and set the master port on each of ether2-ether5 to ether1 Go to Bridge add a bridge Go to Bridge -> Ports add ether1 and wlan1 into the bridge Go to wirel...

If you use Capsman on your 2011 you can then set the wireless interfaces on the other routers to be CAP, and they will be managed by the 2011.

http://wiki.mikrotik.com/wiki/Manual:CAPsMAN

Use one pppoe-client and route the additional IP to it.
You will need to manually assign it on the client RouterBoard.

Nick

Most RouterBOARD devices will turn back on after a minute or so.

I've just shutdown a 951ui to test this, and it hasn't restarted after 10 mins

Which models do this ?

Nick

Check in system packages

You should be using wireless-fp or wireless-cm2 if you are running capsman.

If it is showing that wireless is there then remove it.

Then you should be able to upgrade.

Nick

I would suggest you check your facts

1) you can run RouterOS 6.x on an RB850Gx2

2) see http://routerboard.com/RB850Gx2 for performance specs

Look at RB850Gx2, RB1100AHx2 or CCR1009-8G-1S-PC

What happens when you don't have the bridge ? Nick I see a performance diference between ports. My setup is the following SFP=> Wan (down 800Mb/s up 250Mb/s bandwith) eth1 Master of eth2-5 eth6 Master of eth7-10 bridge eth1 & and eth6 Speedtest with a cable from eth1 ==> 780Mb/s down 240Mb/s up ...

You can't do that.

You would need to filter it in the collector

Nick

Hi normis

I'm happy to help with moderation

Nick

You can also add a nat rule to force dns requests to the router even if a client is sending the request to something else:

/ip firewall nat
add action=redirect chain=dstnat comment="redirect dns to router" dst-port=53 in-interface=localbridge protocol=udp

Hope that helps
Nick

Click the down arrow next to the interface

Nick

Use DHCP Client to get the IPv6 prefix:

/ipv6 dhcp-client
add interface=pppoe-isp pool-name=isp request=prefix use-peer-dns=no

Set an IP using the prefix on your local bridge:

/ipv6 address
add disabled=no from-pool=isp interface=localbridge

You can make a bridge and put the pppoe server on that, and then add the vlans into the bridge.

But you would need to create the vlans. I can't think of a way to generically strip the tags at the moment.

That seems more of a switch function, and the CCRs don't have switch chips.

Nick

Just wondering why you are using per customer VLANs ?

The PPPoE encapsulation keeps customers traffic separate anyway.

Nick

If you only need 1Gbit connection you can use this MikroTik SFP module:
https://linitx.com/product/mikrotik-rou ... -ddm/13740

Nick

When they arrive they have the default config with firewall on ethernet and open wireless. So if you want to manage them you need to connect to the wifi, or reset them into CAP mode. To reset into CAP mode, power them up whilst holding the reset button in. The wireless lan lights will flash, and aft...

Better to connect the customers using PPPoE, then you can assign a /32 to them or route a bigger block without wasting IPs.

Make sure you send the datapath via the CAPsMAN, then the ARP entry for the client will remain on the central bridge.

NIck

Try turning auto negotiation on

You should be able to use PCC to mark each connection in turn, and then add multiple dstnat rules, each using a connection mark. The per-connection-classifier keeps each client talking to the same server, but you can choose different methods. Note that this does not test to make sure that the server...

Simplest method is to use eth2 on both routers if you are starting from the default config. Make sure you change the IP on the bridge to be 192.168.88.2/24

eth1 is separate in the default config and you need to change it so that is part of the same switch/bridge if you wish to use it.

Nick

Can't you use Bridge mode on a nearby device and then mac-telnet to it ?

In the UK FTTC delivered over VDSL is no longer supplied with a modem.

Its up to the user to provide their own.

So a MikroTIk with builtin adsl/vdsl modem, or even a simple 1port modem would be great.

Nick

Have you checked the nv2 key ?

You can connect the pppoe into the bridge by using the ppp profile

Set OpenDNS IPs in IP -> DNS servers Use a dstnat chain rule, protocol udp, dst port 53, with action redirect This grabs all dns traffic and forces it via the mikrotik, then you can still use static entries for local machines Use an address list to bypass the redirect, for unfiltered machines, you c...

QoS is only useful when the link is congested.

So I would turn it off !

Stock of 3011UiAS-RM has now arrived:

http://linitx.com/product/mikrotik-rout ... -psu/14584

They have 6.32.2 installed.

I note that the 6.32.3 combined package is not available for download... maybe MikroTik will make this available soon

Nick

But, how to make OSPF to advertise all /32 routes from PPPoE clients to the border and make client's traffic to flow thru the VPLS tunnel ? If you want to concentrate the PPPoE tunnels in a single point you will need VPLS tunnels. If you can have several PPPoE server in the network you can do "...

Use capsman and tunnel all traffic back to one router.

This reduces delays on switch between APs.

Nick

We use PPPoE and RADIUS accounting

http://linitx.com/product/mikrotik-routerboard-3011uiasrm-with-1u-rackmount-case-and-uk-psu/14584 - Interesting LinITX are listing the 3011-RM for start DEC. Might ask them about it if I remember as sometimes the dates on the sites aren't that accurate. The dates we show are confirmed dates from Mi...

You should really stick to 20 Mhz channel width on 2.4

Nick

Yes you can do that.

You assign the IPs on the PPPoE servers using secrets or radius, and then announce the /27 in ospf networks

As each client connects OSPF will announce the /32 which has been assigned.

Nick

If you add a mangle rule which matches new connections with in interface WAN2 and marks them, you can the use that connection mark to make sure that return packets are routed out of WAN2. eg: /ip firewall mangle add action=mark-connection chain=input comment="Mark new connections on WAN2" ...

As long as you use normal wireless mode (not capsman) you can put both cap2n in AP Bridge mode.

Then build a WDS link between them, but I wouldn't recommend it, performance is not good in my experience

Nick

RFC4638 has only just been implemented in the latest RouterOS Release Candidate. 6.33rc16

Changelog says:
*) pppoe - added support for MTU > 1492 on PPPoE;

Which version are you using ?

Nick

You should set it on the wireless interface before you enable cap.

Nick

And what about the disabled packages? Elaborate... You enable/disable any package except System and routerOS, you need to reboot to do so. Nooooo. Packages must remain enabled i they were enabled before upgrade. Think in 50 CAP's massively upgraded via capscam never more reachables because dhcp pac...

Can you use address lists to add the served IP into an address list and then set a queue for that ?

I don't know why you are using WDS Just put one end in Bridge mode, and the other in station-bridge Put the eth1 and the wlan1 in a bridge on each end, remember to set an admin mac on each bridge to prevent issues. You should see better results. Also check that the ethernet ports are negotiating the...

Try turning autoneg off or on

Distance is only considered after subnet size.

The most specific route is used first, so a /24 will always be used in preference to a /16

Any news on including RFC 4683 support ?

This is already available in the linux pppoe code, so it shouldn't be difficult to add ?

Nick

Excellent - yes our stock arrived today.

http://linitx.com/product/mikrotik-clou ... case/14327

Nick

We have some on order which should be here in 11 days time.

We do aim to hold stock of all MikroTik products, but we do have to wait for them to process and deliver our orders !

http://linitx.com/category/mikrotik-clo ... 4/166,1074

Hope that helps

Nick

On the Wireless Interface disable Default Authentication

Then add an entry in to the wireless access list for each client.

If you assign different address ranges to the 2 sets of equipment then you can use a route rule to lookup in a different routing table, and then have a different default route in that table.

To cope with fallback add a 2nd default route via the other connection with a bigger distance

Nick

You can do that using routes with different distances along with check-gateway enabled.

Nick

You can use the Radius attribute Mikrotik address List to add the assigned IP, which the PPPoE user gets, into an address list on the PPPoE server. This allows you to build queue trees using the address list, or setup firewall rules etc. The IP address which is assigned and then added into the addre...

Please can we have the old theme back !

It is good practice to drop all traffic, and then add rules in to allow good traffic.

The 3 rules you say you have in the forward chain are add chain=forward comment="Accept and forward Established connections" connection-state=established add chain=forward comment="Accept and forward Related connections" connection-state=related add action=drop chain=forward comm...

A normal set of rules in your forward chain might be as follows: /ip firewall filter add chain=forward comment=Established connection-state=established action=accept add chain=forward comment=Related connection-state=related action=accept add chain=forward comment="New from local bridge" c...

if you want to register the onboard wifi interface of the CAPsMAN into the CAPsMAN system you can use the caps-man-addresses=127.0.0.1 in the /interface wireless cap. I tried the caps-man-addresses=127.0.0.1 with registration success in the CAPsMAN but the devices aren´t able to go online via webbr...

You shouldn't bridge WAN and LAN, you should route the IPs

Nick

I think that you need your transportt-address to be the IP on eth3 not your loopback

Nick

Is the printer connected wirelessly ?

If so you may need to allow forwarding on the wireless interface.

Nick

You can't do a coa but you can force a disconnect.

eg

echo "Acct-Session-Id=81e01fb1,User-Name=user1" | radclient -x 10.1.1.2:3799 disconnect radiussecret

The client will then reconnect and get their new radius profile.

Nick

I have an RB2011 running capsman and a cap.

I use local forwarding onto my bridge for that traffic.

Nick.

Hello. I noticed that new SXT AC doesn't show the current TX Power (http://forum.mikrotik.com/viewtopic.php?f=7&t=88071&p=442289&hilit=txpower#p442289). I haven't tried yet Netbox, but it must be the same. That's a "minor" bug but... really we can't adjust the TX-Power! You ca...

We blogged about our SXT AC testing:

http://blog.linitx.com/mikrotiks-sxt-acs/

Hope you like it !

Nick

Search found 523 matches