MikroTik

Just wondering ... how does that VPN work then without internet connectivity ?

Check this recent thread with exact the same environment.
It was about a Python environment.

viewtopic.php?t=213024

It is even advisable to make a separate slave interface with settings only for those devices and make sure it's properly shielded from the rest of your network (firewall, vlan, ... whatever you like, as long as it is done).

Or a very recent change of default setting.

Doubtful IMHO.
There is a confirmed bug with container startup crashing the whole system.
That needs to be fixed or it will be a very eventful release.

If you are testing from PC1 wireless to PC2, you are not really passing Hex. It stays on that switch. What sort of switch is it ? Simple test since both ether4 and ether5 are on the same bridge: remove that switch from the mix. remove/disable bridge2 (to be sure HW offloading is fully active on the ...

Thank you for this diagram.

Where is the iperf server ?

Also, you did not mention in your initial post you have THREE WAN connections to ISP ?
Which device is using which WAN connection ?

Ether5/LAN2 is not being used for the moment ?

(moved post with config into this thread since you replied in another thread, from 2023) Please also add drawing how you test your iperf setup. From which device to which port on Hex, which port from Hex to which other device. Same with wireless AP, what port is it being connected to ? Quick comment...

Already several times it has been hinted to show your config although the info you provide, does not seem to indicate an issue with the wired part. Even if you add a non-MT AP into the mix, it is still a wired device for your Hex. However ...if from wired to wired you "only" get around 820...

Couple of quick comments
Disable detect internet. Really.
Adjust lease time of dhcp server. 10 minutes is really too short. 30m is default, I use 1hr or even 4hr.
Set in APN use default route.

For routing performance rule of thumb is 512 byte packets, 25 filter rules.
That should give you a rough idea about real-life performance.

If it works after you disconnect and reconnect the client and it works with your Mac, there is nothing wrong with the router, I would think.
It's your Windoooos client playing tricks on you

What wifi card is in that box ?
What version of Windows ?

How does it help? There will be still only 1Gb ports on Chateau.

Apologies, my response was directed to OP with RB5009.

Or put a 2.5Gb / 10Gb switch in the mix ?

Even with bonding you will never saturate 2 links if only 1 stream is passing.

I think with quickset you should be able to change those things.
And most likely two subnets using the same IP range will indeed be the problem.

(mod edit: post split from article to keep discussion separate. If needed/useful, can be merged again later) My take on things: 1- what is the question ? 2- what is the question ? 3- Tagged ports are indeed filtering based on VLAN ids. 4- Your base problem here might be that you are not aware a brid...

Already checked with support ?

High level
Q1: create VPN and using firewall rules and VPN interface in forward chain restrict access to only 1 destination device (allow to one dest, drop all the rest coming from that interface).

Q2: similar approach.

What VPN are you planning to add ?

With legacy wireless adding capsman layer makes things indeed more complex. Not that much with wave2 drivers (95% is exactly the same) but you are correct that for 1 AP it's not worth the extra effort. A small drawing with your intended setup adding how VLANs should flow might help. And of course co...

Most likely switch ACL rules.

Check this thread for more background info.
viewtopic.php?t=203589

Now plug in your laptop into ether9, change ipv4 settings to 192.168.65.2 and you should be in!!!

Don't think so.
Not on RB5009 with 8 ether ports

I could track it down and note that it has an issue related to datapath and vlan setup. In short, it only work when provision vlan is the same as mgmt vlan. Cap AX and wAP AX are identical as far as vlan setup is concerned. Only major difference is the swapping of radios, wifi1 and wifi2. Best to c...

Known issue. They are working on it.

You did use ether1 to connect your RB ?
Sometimes it helps to put a dumb switch in between.

Touché

I use IsHosting.
CHR VPS for 5 EUR /month with fixed ip4.
I am using it as wireguard gateway only for now.

Isn't that the purpose of Q-in-Q ?
https://help.mikrotik.com/docs/spaces/R ... LAN-Q-in-Q

Check Bridge STP priority as well if STP/RSTP/MSTP is used.
Core switch should have lowest priority.

See here for more info:
https://help.mikrotik.com/docs/spaces/R ... ionprocess

I have to search for it (again) but there was someone a couple of years ago who made a really nifty script which would do all the collecting and processing and send out info via mail per period you could specify yourself. Used it for SXT LTE6 setup in South of France to track data usage for vacation...

That sounds like a genuine bug.
Definitely something to report.

And ... good analysis !!

What's the idea behind "subsettings" part of config ? To apply it to Jasmine Home ? Doesn't work that way. You apply through provisioning a master config (and if needed slave config) to a radio. All info for that config needs to be in that master config (either directly, either via sub-sec...

The Mikrotik V6 firmware still has a traffic accounting menu, meaning the Mikrotik V7 firmware has been renamed to Kid Control.

That's what I said, didn't I ?

Can kid control monitor client device IP address traffic

Yes.

We've all been there

Some formatting issue on the CAP Name or some naming convention which has not been documented or ... ??

I am seeing the same with all my APs under capsman (7.16.2: AX Lite, wAP AX and AX2).
Also in Winbox GUI it shows.

If it bothers you, make ticket to support so they can investigate root cause.

It has been renamed to IP / Kid Control.

Problem is similar with AX Lite. 64bit processor, 32-bit OS. Main reason they gave is that the device does not have enough memory to justify use of 64-bit. Using 64-bit means larger memory usage of OS itself (64-bit instead of 32-bit pointers) which is then wasted on that device. As far as running R...

While perhaps the older ac chipset cannot directly handle VLAN in hardware... It is a nice try, but the UBNT accesspoints I use at work use the same QCA9984 chip as is used in older MikroTik AC hardware, but it fully supports VLAN assignment per client... and I don't think that would be a software ...

You're not the first and surely will not be the last.

Obviously you need to move that rule to the top of NAT rules ...
And make sure connection track table is empty or reset MT device (or wait).

Maybe this ?

/ip firewall nat
add action=src-nat chain=srcnat dst-address=10.0.1.0/24 out-interface=ether1 to-addresses=10.0.2.1

Reverse for the other side.

CRS = switch. It has routing capabilities but not much. You're most likely looking for CCR then. And then prices go up up up. E.g. CCR2004-16G-2S+ 16 Gb ethernet ports, 2SFP+ cages, PLENTY of power. No Wifi. No passive cooling. There is even a version with 12x SFP+ cages and 2x 25G SFP cages. Does t...

Even better to not allow anything from WAN except VPN and established,related,etc.
Oh wait ... that's done by default firewall rules ...

You're correct, I missed that line.

It has been a while since I played with it but AFAIK default hotspot should have some firewall rules to prevent access between clients. Right before that rule which blocks access, you should add a rule to allow access to that specific printer. To be 100% sure, make sure it has a fixed IP lease so yo...

Have a look at this Help page:
https://help.mikrotik.com/docs/spaces/R ... h+examples

So you have a VPN tunnel between Mikrotik A and Mikrotik B ? Which one ? Answers based on not seeing your config: What interface list is that VPN tunnel in ? I assume nothing. 2 short options: explicitly allow traffic via firewall coming from that tunnel on both Mikrotik devices or add VPN interface...

Going through brick, glass and roof and still getting 216Mb is not too shabby, if you ask me ...

Only thing I found annoying is for some reason mode is changed after every reboot from station bridge to station...

That shouldn't happen.
Which ROS version ?

MikroTik isn't really in 2.5G yet. Yes there are some devices with a single 2.5G port and an SFP that can do 2.5G, but what you really would want is a device like the 5009 but with several 2.5G (UTP) ports. And probably some switches too. And then for the router probably with wireless as well. They...

If understand correctly, I need to configure each AP as a static VLAN device. Will the config hold long term? Meaning, if there will be update, will it crash? Yes. Yes. Normally not :lol: (depends on how MT will proceed with memory requirements for ROS7 and wifi-qcom-ac package because on those AC-...

I read that for the router RB5009UG+S+i you can't use a direct attached copper spf+ cable. I can't find any documentation. I wish to connect this to a mikrotic CRS317-1G-16S+RM switch which can use DAC. Can someone shed some light on what cable I should use? Brad And where did you read that ? Mikro...

Every version of rb5009 has SFP+ port but there is NO version of RB5009 with wifi.
Basic chip used on that platform doesn't support wifi.

It is what it is.

Now you are changing requirements... you said you needed replacement.
RB2011 doesn't have any 2.5Gb ports.

There are no routers with at least 2x 2.5Gb ports AND wifi, not even when considering using 1 SFP+ as 2.5Gb port.
You need 2 devices then.

You mean RB5009 WITH Wifi ? I hope that version never comes...

Drop-in replacement for 2011 is L009, there is version with or without wifi.
And it's fanless.

OK, what's the trick for adding my country - the United States? I tried editing the example wifi /interface wifi configuration section. I tried United States and it doesn't like the space. I tried 'United States' and it doesn't like the '. I tried UnitedStates (no space) and it says no such country...

Therefore as Halvoetn suggested check/disable DHCP client on hAP. The DHCP client has to be enabled for the WAN port otherwise no internet connection. I've not had chance to dig deeper into this but I will. I never said to disable ALL DHCP client. Just the unneeded one(s). Look, it doesn't take 5 m...

If I look at the BSSID of the wifi channel I am currently connected to with my laptop, it's the MAC address of the CAPSMAN wifi interface on the controller. Not the MAC address of the AP radio. If you set those interfaces to create enabled, you should be able to set that MAC the same as it was befor...

Using AX material, there is little to nothing to be done on the caps. So yes, capsman does make it easy. About wifi-qcom-ac, normally this was NOT foreseen but MT made it available for AC HW capable using that driver. They didn't have to. But they did. It does come with some quirks, yes. But you sti...

The DE FACTO guide on setting up VLAN for ROS

viewtopic.php?t=143620

Oh yes.
RB5009Pr

Should be 802.3 af/at compliant.

I think my grip is forum is beating up OP, when Mikrotik's log message is shitty — these "executing script from XXX failed" should identify what script is at issue... I get what you mean but when multiple persons ask you to see config and you persist on not showing it, what sensible perso...

I was already thinking that as well but I don't have a cAP AX lying around here.
Although given wAP AX and cAP AX are both 802.3af/at devices, I am going to (carefully) assume it's just that forced on setting which should make it work.

OP can easily test it.

Help pages:

https://help.mikrotik.com/docs/spaces/R ... 59120/WiFi

Log files do show something is running, no ?
And that part is defined ... in your config.

The negotiation part does not fly when connected to L009.
But it works when you "skip that part", hence forced on.

With "auto on" it gives an error message (on my setup it does).

Just tried with wAP AX (which is even further down in power requirements but normally also 802.3af/at only): it will power on using L009 but you have to set POE on ether8 to forced on. Not auto on.

Which is why we need at least some info on what script is running and how.

Otherwise we are all simply guessing.

Why 2 bridges on RB5009 ?
Why 2 bridges on Netmetal ?

There is most likely your problem.

Could someone help me?
If needed I can paste here the entire configuration

You know what to do then ... both sides, please.

who has marded this post solved?

You did.
I "unsolved" it.

And still you are not responding to our request to provide necessary info ...
Screenshots usually don't help.

Possibly BSSID has changed even though your SSID is the same.

PS great contribution here from mkx related to this topic:
viewtopic.php?t=210898

And no encryption cyphers selected ?

Can you export wifi part of config ? (leave out passwd etc).
It will show there.

What security settings are you using ?
Quite a bit of IoT devices (and that includes quite a bit of SMART TVs) only accept WPA2 and nothing else.

what is this file.? i have private data that i don't want to publish please tell me what this error is related some bug and error in script that system sched wants to run? or some one from outside wants to inject a script in my os? Some comments ... 1- this is a USER forum. Users helping other user...

In most cases, 1 bridge is all you need. If you are planning on having those AX devices connect to a legacy capsman controller (previous generation), that will NOT work. Are you ? It might be better to follow erlinden's advice and provide a schematic representation of your network also clarifying wh...

I dont know how PM here works.

It doesn't.

Check user manual for reset sequence.
Watching led sequence is more important then counting seconds

Worse case: netinstall.

Ssh / ftp / smb / ... you can even mail them to yourself.
Plenty of options.

Depending on needs for further routing, vlan, discovery, romon, ... EOIP might be better since it will create a virtual interface for which you can do exactly the same as any ethernet interface.
But IPIP should do as well if you only need IP-related functions.

Pay attention to which public key you place where and make sure each peer has a unique address.

If that doesn't help, indeed post config for review.
All peers.

A bit too much for my liking.

At least using Wireguard I know you can selectively specify which subnet should go over VPN and which not.
I suppose OpenVPN can do the same ?

Personal preference is WG, though

It's more resource friendly and faster and less chatter to keep the connection.

DuckDNS should be able to do it.
I already used it in the past just for that.

Plenty of script examples available

It depends.

Maybe you need to clarify in a lot more detail what you are planning to do ?
A logical workaround would be to use VPN on only those devices, then you control what comes via that VPN and what not.

With the arrival of vendor drivers for wave2, that option went away.

Wireless legacy drivers were completely made in house, so much more control over what could be done.

It's not a good idea to actively block clients using access list.
Some clients might avoid such an AP completely.

Unless that's your aim, then I wonder why you keep using the same SSID for that frequency ?

Oh
My
God
....

It shows who has everything to say in your household.

You can have both capsman versions on the same controller.
You can not have seamless roaming between both controllers.

It is what it is.

Check your routes.

And then the router will ... route.

Should be default there if you have ROS 7.13 or higher, under wifi menu.

Uh ??

What ROS version ?
There was a change in ROS 7.14 where "no country" results in "Latvia".

Already contacted support about it ?

They don't read all posts here since this is a user forum.

You shouldn't even set datapath at all on CAPs side.

There are some limitations when using wifi-qcom-ac driver, mainly VLANs can not be dynamically asigned. 802.11ac chipsets do not support this type of VLAN tagging , but they can be configured as VLAN access ports in bridge settings. = you shouldn't use vlan-id in datapath on AC device. Adding: use ...

... My home lab network is relatively simple: hAP ax2, two Windows Server 2022 domain controllers, couple of dev servers and my workstation. Simple ?? :shock: Check for DHCP client on that device. Or sniff the network using wireshark to see which devices are sending out request for DHCP leases (and...

How long did it take for wap AX to come out ?

Let's assume they are working on it.

RB5009 even has a 3th powering option on the side.

Also, POE version of RB5009 can be powered using POE on ALL 8 ether ports.

Do you have any informations that RB5009UPr+S+IN can be tricky when using 2.5Gbit port for ISP and transfer goes above 1Gbit and also SPF+ i utilized to connect to CRS326-24G-2S+RM SPF+, I have read that there are some problems that router can make lags or some kind of problems?. Not that I am awar...

Yes.
Surely your default subnet is not going to be 192.168.88.0/24, is it ?

That's a logical consequence from daisy-chaining those switches one after the other. Only the part which is behind the switch which breaks down, will go down. If it's the first one, everything goes down. If it's the last one, only 24 clients will go down. If it's the RB5009 going down, everything is...

Anyway, I think I'm going to test in my office if it is possible to add the wifiwave2 driver to the AC2s and link them with the L009UiGS-2HaxD with the same driver. I'm not sure if it will work, but we have to try it. It will work. I have several AC devices runing wifi-qcom-ac package without probl...

This is VERY odd indeed ?!

And did you try simply using the mips package as it indicates ?
Because what strikes me as equally odd, is that same QCA9533 CPU is used in mAP Lite and cAP Lite and those ARE mips devices. Not SMIPS.

In that case you have another option but you should thoroughly test it ... hAP AC2 can also make use of wifiwave2 drivers (wifi-qcom-ac) IF you're not doing other things on that device (plain switch, pure AP, nothing more). Problem with AC2 is that it has a quite limited storage and using wifi-qcom-...

I am going to assume all your other access points are using legacy wireless (read: not AX). And there is your problem now. See this Help page: https://help.mikrotik.com/docs/spaces/ROS/pages/1409138/Wireless and this: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi For AX radios capsm...

Yes. And the beauty ? On CRS326 you do not have to do anything except for changing IP address.

Sure.
That's how it default starts.
You only need to look at the IP address, rest of config default starts as a pure switch (because ... that's what it is !).

Topic locked since the exact same question is already being handled in another thread.

Add-ons: not really or not in the way you may see it. But you can install containers. So if it works in a container, it may work. Not full-fledged docker but usable. Provided you have enough storage, memory, ... My personal view: a router is not my primary target devide to run such things. I also to...

Having just purchased all material for a small shop, bit of router functions and 4 APs which needed to be POE powered. Some printers, some PCs. About 10 connections in total. Give it some spare for near future and I should need 16 ports. I was initially thinking towards RB5009Pr but that would reall...

It seems to be working now, checking from Greece. BTW, free service means "Best effort" SLA... If critical systems depend on connectivity other means should be used for DDNS, usually with a fee.

Correct attitude !

viewtopic.php?t=213191

Threads merged.

Nice job

Sure it's not Gmail capping that connection ?
150Gb is HUUUUGE !

https://support.google.com/a/answer/1071518?hl=en

- In case I do need to verify via SSH, can I use typical tools like PuTTY? I think PuTTY works with OpenSSL and if RouterOS doesn't support that, then I don't know...
All that should work, although been years since I tried PuTTY.

PuTTY works just fine.

First things first ... ROS is so powerful because you can almost do anything with it. And here is the drawback, because you can almost do anything with it, a lot of people get lost. Mesh is there from older legacy wireless HW. It's not applicable anymore to AX HW. Cap is there from older HW with leg...

Check on client peer side if Persistent Keepalive is set (typical: set it to 25s = 00:00:25).

This solved the issue with CAPsMAN provisioning, but now DHCP server don't give IP addresses to devices connected to WiFi trough the CAP devices. External radios or local radios ? What's this ? /ip dhcp-server network add address=0.0.0.0/24 gateway=0.0.0.0 netmask=24 I think that shouldn't be there...

Wouldn't it be sensible then to present your config for review ?

Interesting read: Rules of the Mikrotik Club: 1) You do not use VLAN1 2) You DO NOT use VLAN1 3) You remove default user admin and set a strong password before connecting to the internet. 4) You do not use Quickset. 5) You do not use detect internet. 6)... Now #6 might be added as either: 6) You set...

I have plenty of WG tunnels between MT gear and other stuff (Linux, Windows, Android, ...). It works. It is not impossible nor difficult if you use the correct settings. Having only TX and no RX is normal. Wireguard always tries to send. Only when you see something coming back, then you know it work...

wine doesnt works native implementation will be nice Why not ? It should work. https://pimylifeup.com/raspberry-pi-wine/#:~:text=Installing%20Wine%20on%20to%20your,aren't%20compiled%20for%20ARM. Again: ask support. This is a USER forum. MT staff sometimes frequents this place but not always and cer...

Same problem here.

WIN 11 23H2 22631.4460

After 3th attempt, it succeeded and restarted with new version.

Same problem here.

WIN 11 23H2 22631.4460

Command used looks correct to me (as in: it's the same I have in my notes). But ... you should not forget to ALSO send wireless package. Wireless drivers are not in the base ROS package anymore as of 7.13. So the wireless package (or wifi-qcom or wifi-qcom-ac depending on device) needs to be send as...

Best to ask support but I guess you will have to revert to using Wine.

My personal experience with wireguard between two routers both on same ISP network with 1gig connections was in the 300 range.
Also curious as to what others see.

AX Lite to RB5009: 405/400 Mbps

Something odd going on with partitioning ... [xyz@RB5009] > part [xyz@RB5009] /partitions> activate copy-to find repartition restore-config-from set comment edit print reset save-config-to [xyz@RB5009] /partitions> print Flags: A - ACTIVE; R - RUNNING Columns: NAME, FALLBACK-TO, VERSION, SIZE # NAME...

Post config and specify what you want to do. 1 bridge All interfaces to bridge Possibly dhcp client to bridge or fixed ip. There is not much more to it. For config open terminal export file=anynameyouwish move file to PC redact serial number post contents back here in between [ code] [/ code] quotes...

And you still did not specify what the actual problem is...

Correct observation

Why one bridge instead of one ?

...

If I wrote something wrong someone will correct me.

First line is not correct

Every device runs ROS, so every device can act as a router if that is your question. Not all Mikrotik devices, there are devices running SWOS or SWOS Lite. But the ones that do run ROS, all have a full-featured version of ROS, taking into account some HW restrictions. (e.g. don't load too many addi...

What ROS version are you using ?
I seem to recall there have been some fixes especially for this permission problem.

Two things ... you can perfectly keep using legacy wireless with those cap-ac devices. Al you need to do then is load wireless package on RB5009 (as of ROS 7.13) and you're good to go (just be aware the menu structure will be on another place. Not wifi but wireless/wifi, or something like that) If y...

Works already for quite a while so what is the problem ?

2024-12-09_13-30-08.jpg

Well... If you are using your ax2 as an AP then you should try to enable VLAN filtering on your bridge. Well... yes I did, however I removed it while trying to get the router to become an AP, once it starts doing its thing I will put that config back. VLAN filtering is not likely to be the issue wi...

Good catch !

Netinstall and starting again from default is seldom a wrong approach

Possibly an issue with the mount location ?

On RB5009 there is a confirmed issue with startup of some USB3 stick so I have to be really careful with my containers too after restart/ reboot.

I know.
And that usually means weak admin passwd.

Of course it's always possible that router was compromised from LAN side (some computer running malware) so if things happen again, check your LAN clients (or restrict access to router management to a dedicated management port). That would mean a real weak passwd was used or someone in the 'trust' ...

Well ... and the question is?

That was my first reaction too when I approved that post

OP
post your config as requested, provide a bit more detail on how things fit in the larger picture and we can work from there.

Use 0.0.0.0/0 as allowed addresses.
Everything will go down the tunnel then.

Just a minute.
It all depends on how the uplink is going to be... if LTE you are leaving the device wide open.

Bonding still requires multi stream or you will have zero effect.

Not when used indoors.
Only 1 minute DFS.

What is wrong with 52 or 60 ? You don't HAVE to use 80MHz channels. Sometimes it is even better to go smaller.

Problem with these high ranges is that quite a bit of client devices are not able to use them.
So be careful and check.

Once you are done we can proceed. Do not forget to update modem firmware as well. The device can be used as wifi repeater but I wonder why you use an LTE device for that ? How is it going to repeat the wifi signal ? Through local ethernet or via that LTE ? Maybe best to describe in more detail what ...

Also: scan the environment for each ap separately. You have the tools available in ROS, use them.

Choose a frequency which is not already used by others ( even your own AP if it is close enough) to avoid interference.

Depends on what you want to favor.
You can not ace each and every parameter. Not with the prices these things cost.

Then it may be time to put your config on the table.
Controller and 1 wap AX please.
Make sure to remove all private/public info.
And please post both configs between code quotes.

Errrmm ... you might as well look at the test results posted by Mikrotik then.
That's more or less what they do when conducting those tests.

First wireguard
Then winbox over the wireguard tunnel.

You accept the wireguard traffic.
And then you accept winbox coming via wireguard.

No marking / mangling needed.

Unmanaged switch ? Not for me, thank you.
I wanted a managed switch running ROS on arm

Serious
purely for home lab purposes. To replace old Hex.
And W?BIC.

Why ? Because I Can.

And AI is not able to solve that problem for you ? :o Put a log action on that drop rule and see which MAC addresses are being dropped. Chances are high it's not the one from DELL in your accept rule ... Are you sure there is nothing in between sender and your firewall changing src MAC address ? Are...

But, back to that thread.... It is lively, with an evolution, so it's a little hard to follow what the current/latest instructions and supporting files/apps are. I haven't tried that version Ammo posted there. As indicated, semaja's version works, I'm not touching it. Follow the steps in the first ...

But this is about: RB912UAG-2HPnD, without OUT

https://mikrotik.com/product/RB912UAG-2HPnD

That's still being listed as active.

What if you go back to last know working version( ROS5 ... uh, shivers ...) and then use upgrade path from within the system towards ROS6 and then towards ROS7 ? If there is truly a limit, that upgrade process should stop you. Netinstall most like doesn't. Last resort: ask support. File a ticket and...

Being someone who also had my fingers on a keyboard the first time in 1980 (VIC-20, oldtimers will surely remember it with its 3.5Kb of free RAM) when I was 12... I never played games (ok, not much :lol: ) I'm an auto-didact and I am blessed to learn pretty fast. I learned myself to do so. Same with...

You are aware there is now a native Mac Winbox client ?

Again theoretically... yes but you see what rabbit hole you're going to get into ? What if there is another device with overlapping IP address ? Again: is it only the PC of the USER requiring access ? In that case the issue might be a lot less. Simply (during that session) let all traffic go over VP...

You mean my settings in /interface/wifi/provisioning/export , but instead per AP and Radio MAC defined there? I guess, by setting which frequency you mean, so you don't have any overlapping, which could happen, if AP chooses on its own a frequency from list? Yes. If you let them choose, it might st...

Could be a config issue but I don't think so. These results are a pure consequence from having that ether1 port directly connected to CPU and not to switch chip. Keep in mind: this was a MANAGED SWITCH config so everything VLAN not being HW offloaded to switch, has to pass CPU. Again: I used the EXA...

If I did not make it clear enough that it wasn’t just a hEX refresh issue when I mentioned others having the same (or similar) issues with other routers, I don’t know what to say there…

No, no, you made that very clear

PC with intel AX211, so it supports 160Mhz-wide channels.
About 940-950Mbps using iperf3 to internal iperf container, which are normal values for a 1Gb link.
So the limit is the ethernet port, I guess.

You don't need anything else on RB5009 except for base ROS package, capsman is available and can be used. High level it looks ok with some remarks: You allow channels on 5Ghz which may result in overlaps/interference if you use 160MHz on your APs (e.g. 5180 and 5260, 5500 and 5580). You also let the...

Connecting 2 subnets with the same IP-range is asking for trouble. You WILL get conflicts. I'm not saying it can not be done (you still need to take care of overlapping addresses) but you will probably create a lot of other problems. Changing the home subnet is the best option in my view. One of the...

Biggest problem of these times ... AI making things up and most are unable to determine what's right or wrong and just think is has to be right. It LOOKS right but it is not, as you have seen. There is no proxy-property to be set in ROS7. It looks to me this is coming from ROS6 because The Dude (new...

Can you access the device using webfig (webbrowser) or Winbox ?

Are both 2Ghz and 5GHz radios not transmitting ?
When certain frequencies are being used for 5GHz it can take several minutes before it appears due to radar detection checks (even up to 15 minutes)

Actually, that's 2 separate gigabit ethernet ports. It may seem strange but you will rarely get there. That 2400Mbit/s is the physical data rate. Has little to do with the actual throughput (though higher data rate usually results in higher throughput). Rule of thumb: roughly 50% of data rate is wha...

FWIW ... from PC using wAP AX as AP and Hex Refresh in between towards RB5009 as router with iperf3 container ... I was able to get 900Mbps. Hex wasn't even sweating. But that's with Hex Refresh in managed switch mode (read: VLANs being used) NOT using ether1 as uplink ! In that same config using et...

Are you referring to caps radios becoming visible in capsman or the radios themselves becoming visible to clients ? The former should be rather quick. On my installations it is a matter of seconds after reboot. The latter can take up to 15 minutes if you use DFS frequencies (radar checks needs to be...

So the problem is clearly with Verizon ONT ... Just wondering: What port did you use for uplink to ISP device ? I suppose ether1 ? You are aware ether1 is handled completely different from the 4 other ether ports on that particular version of Hex ? (see block diagram) When you do speedtests maxing o...

Sure, why not ?

So, is something wrong with 7.17RC for RB5009 with Capsman? Or was I just very unlucky for some reason? I don't think it has anything to do with capsman. I had a complete crash on my RB5009 (needed to power cycle to get it back) and had to revert to 7.17b6. After trying to partition that device, it...

Are you saying that the hAP ax2 is more versitile than the hAP ax3? If so, how? Try to fit an AX3 in your backpack. Or simply move it around to another place. Those big ears make it a bit less handy for that. I'd love to hear what netinstalled "using container on AX3" means? Simple. Usb s...

For versatility I would also go for AX2 but ... it has no usb port.

Just netinstalled 5 cap ac ( ros and wifi-qcom-ac) using container on AX3.
First time right on each occurrence.

Sure. Each slave radio needs to be attached to a master and will take over the physical properties but can have separate SSID and security. Each of those slave radios will be an interface on its own and then the VLAN game can be applied again. Just don't overdo it because each virtual SSID will ulti...

Good job !

From those 3, wap AX since it allows for 160MHz channels (if you can use it within your environment. I can

).

It does seem odd wireless package is loaded yet not being used ?

You could try to simply MANUALLY add the wifi interface (in case that interface really needs a long time before it becomes operational after startup). What happens then ?

I think I have seen a similar question recently and if I'm not mistaking, you need to use some sort of address remapping based on port.

Edit: I knew I saw it already before not too long ago

viewtopic.php?p=1108865#p1108865

What model of mikrotik routers do you have in Venezuela and Espana?

It's hidden in the wall of text

AC3 in Venezuela, already present.
Planned to buy AC2 for Spain.

100Mbps over 2.4GHz legacy wireless ? Yeah, one can dream. Make no mistake about my sentiments, however. That mAP is still a fabulous device for its price and flexibility ! I even prefer it over mAP Lite (I do keep that one in my backpack wherever I go). But I get what you mean. Everyone always refe...

For wireguard you only need one public IP, as long as that is present, there is no problem to setup a VPN tunnel which you then can cross from the other side, there are plenty of examples how this should be done, do you have by now also the idea that use of proper interpunction and line breaks is a ...

It is more an issue with its routing speed, that may be too slow for your requirements, it should be in the 150-200 Mbit range.

And how are you going to do that with only 100Mb ports ???

Yes, works just fine !

(IPSEC to Azure, Wireguard, EOIP, , DHCP for about 15 devices, routing, ISP connection of 50/20Mb...)
"only" 19d uptime because I did upgrade of that version, before it was 139d.

2024-12-04_10-22-02.jpg

Can go up to 15 minutes...

Manually is the safest way. Also observe defaults which may be present on the ac2 which may have been different on the older one. Go for the newer settings then. Don't copy MAC addresses for bridge or interfaces. They will be filled in by default. On itself it is not really a big deal, done it plent...

My experience so far is that wifi-qcom-ac is just not worth the trouble, it is way more unstable and there is no significant performance gain so if you don't absolutely need new CAPsMAN just stay with the older wireless package... I disagree. +1 on disagreeing. MAJOR difference in performance betwe...

Super, no issue there then !

As long as the second device gets sufficient power and it can " see" capsman controller network-wise, no problem. What i want to do is: capsman<----wired--->cap1<---wired--->cap2 Or it is daisy-chained (controller wired to cap wired to 2nd cap) in which case there should not be a problem ...

You got a point.
You can check for src_address!=192.168.88.0/27, dst_address=192.168.88.0/27

I doubt that USB-C connector can be used for anything else then powering the device. It's not even mentioned on block diagram (whereas for other devices where I know it works, it clearly is indicated as USB). I even seem to recall Normis (MT staff) mentioned it somewhere (would have to look for it)....

Best to fire ticket to support.
They are the only ones able to tell if and when it can be supported.

Just to check:
did anyone create a ticket to support about this ?
Otherwise chances are high they do not know about it ...

Not an expert either so my personal view. Functionally both are mostly the same. In some edge case (which I can not directly imagine) the second version will catch more so I guess it is the better option. On second option: why use 2 rules for hw-offload or not ? Since I have been looking into this m...

My initial comment to move that one rule to the top was based on the rest not being secure enough already. The only true way to solve this: Use outgoing vpn to some public accessible ip ( either your own or some cloud server) and use that as pivot point to get back in. And then you can close that op...

Whenever you change something in firewall, clear all connections or wait 10 minutes or reboot.

Move this rule as first on input chain

add action=accept chain=input comment=WinBox dst-port=8321 protocol=tcp

Search found 7120 matches