MikroTik

2frogs

Actually in a flat bridged network like yours, the interface-list has no barring as you are not using firewall rules. The firewall is being bypassed by the bridge. That is why you prescieve no difference between the two. If you set both up has routers, with all interfaces belonging to the bridge, yo...

2frogs

Your IP addresses for the router are set incorrectly. Should be:

ip address/ 
add address=10.1.21.1/24 interface=vlan21_guest network=10.1.21.0
add address=192.168.1.1/24 interface=ether1 network=192.168.1.0

2frogs

You need to add the route tables: /routing table add disabled=no name=Route1Name fib add disabled=no name=Route2Name fib The router will use the main table, by default so you will want set route preference and failover accordingly. corrected! corrected correction! ;) I forgot the FIB was not defaul...

2frogs

You need to add the route tables:

/routing table
add name=Route1Name
add name=Route2Name

The router will use the main table, by default so you will want set route preference and failover accordingly.

2frogs

You have to either disable the drop not from lan firewall rule for input or fix the interface list member for lan to include bridge. The problem is when you use quickset to change to bridge mode, the interface list members get changed from bridge to the individual interfaces. But since the interface...

2frogs

From the third paragraph of original post. my problem is that the port 8080 which runs a web service at my home server, is not accessible through the public ip of CHR. I cannot access the web UI from that public IP. The CHR is the used as Wiregaurd server, the Home Server is acting as Wiregaurd clie...

2frogs

The user is trying to reach the server with the Public IP of the CHR through Wiregaurd tunnel. Again, this is the whole purpose of the CHR, to allow remote access using the Public IP of the CHR. I am having to do the same, since only CGNAT services of T-Mobile 5G, T-Mobile LTE and Starlink are avail...

2frogs

The purpose of the CHR is to provide Public IP for the server behind CGNAT by way of a Wiregaurd tunnel. This needs NAT...

2frogs

You need to add your dst-nat rule back for the server/8080 and correct your last filter rule. The comment on it is correct (drop all not dst-nated), but the rule is missing the function.

2frogs

Anav missed that to use IP Firewall on Bridge Ports, you need:

/interface bridge settings set use-ip-firewall=yes

But this comes at a cost, CPU usage.

Edit: Should have mentioned that I have no issues with my HexS connecting to my Starlink 2nd Gen ethernet adapter.

2frogs

Install a plug or hardwire to A/C power and 12/2 dc wire for the amperage and distance.

2frogs

https://mikrotik.com/product/mtp250_53v47_od

https://mikrotik.com/product/mtp250_26v94_od

2frogs

You need to set admin-mac for the bridge. The default setting of auto-mac=yes, will set the mac-address of the bridge to the mac-address of a bridge port interface first to populate after reboot. This makes the bridge mac-address some what random. Setting the admin-mac makes it's mac-address static.

2frogs

https://mikrotik.com/product/wireless_wire_dish These come pre-paired from the factor with a unique SSID and password. There is an included label with each device that notes it's role of Master or Slave and the password. The individual devices are the same LHG-60G that you can purchase individually ...

2frogs

From the Wiki:

get <id> <param>=<value>
Would translate to:
get number=0 value-name=dns-server

2frogs

From your provided R1 export: /interface bridge port add bridge=bridge1 interface=ether1 add bridge=bridge1 interface=wlan1 Add an IP address for ether1 from the 192.168.1.0/24 of your other Router and remove ether1 bridge port entry. You will also need a route on your other Router for 192.168.119.0...

2frogs

You have R1 setup as a bridge. Your clients behind R2 are getting DHCP from R1 by chance. And with gateway of other Router, your clients are going out it directly.

2frogs

No, order one wAP 60G AP (this will be your Main AP in your attached pic.) Order one Wireless Wire kits to reconfigure as your two clients. Or, in place of the Wireless Wire kit, you can order two wAP 60G . The wAP 60G is the same devices as is in the Wireless Wire kit, but just one. I include this ...

2frogs

You can use the ones from the kit or non-AP versions (as stations) to connect to the AP version. No need to spend extra on those.

2frogs

You will need to purchase the AP version.
https://mikrotik.com/product/wap_60g_ap

The kits only have a level 3 license that only allow for them to be stations or an AP for a single station. The AP versions have a level 4 license.
https://wiki.mikrotik.com/wiki/Manual:License

2frogs

Quickset Bridge Mode is broken. It removes Bridge from inteface-list=LAN and adds each of the individual Interfaces to this list. That is an incorrect configuration because the individual Interfaces are slaved to the Bridge in Bridge Mode.

I have reported this behavior to support to no avail.

2frogs

FTP requires 2 ports. The command ports which is usually ports 21 and a data port. For active mode, the data port is usually port 20. For passive mode, the port is a random port (you can usually set a range inverter settings.) You will need to also forward the data port(s) depending on mode type used.

2frogs

Do you know about the auto import feature?
https://wiki.mikrotik.com/wiki/Manual:C ... tic_Import

2frogs

/ip dhcp-server lease remove [find where dynamic=no]

You can both print and export to file.

/ip dhcp-server lease export file=dhcp-static

2frogs

You need HairPin NAT.
https://help.mikrotik.com/docs/display/ ... HairpinNAT

2frogs

You need a route to your ISP(s) without routing marks. You can use distance to make one primary and other backup. Something like:

/ip route
add check-gateway=ping distance=1 gateway=192.168.1.1
add check-gateway=ping distance=2 gateway=192.168.2.1

2frogs

If you are using the default firewall configuration, that should be all you need. Just be sure to disable the SIP helper. You can find it under IP>Firewall>Service Ports.

2frogs

You can't forward the same port to multiple IPs. I believe you are mistaken on the requirements. You should only need outgoing connections to those ports for the phones to establish a connection to hosted service. Only an self-hosted pbx would require forwarded ports.

2frogs

I would suggest looking on the QNAP/ Control Panel -> Security and be sure your local IP is not being blocked.

2frogs

You are missing a src-nat for the ZeroTier network. It should look like your first rule with the src-address=192.168.193.0/24 and to-address=192.168.0.2. Or you can put a route to 192.168.193.0/24 on the remote Mikrotik pointing to 192.168.0.2.

2frogs

You need to add a delay after fetch so the file can be written.

:delay 60s

2frogs

/system note set note="I closed the vulnerability with a firewall. Please update RouterOS. \ You can say thanks on the WebMoney Z399578297824 or BTC 14qiYkk3nUgsdqQawi\ MLC1bUGDZWHowix1" You should consider your device compromised and use netinstall to reset config and update to the lates...

2frogs

/ip dns static add address=192.168.88.200 regexp=".*\\.router\\.test\$"

This works for me.

2frogs

<html> <head> <meta http-equiv="refresh" content="0; url=http://"YOUR_ROUTER_IP/DNS"/login?username=T-$(mac-esc)&dst=http://www.google.com" /> </head> </html> Put this in your login.html, change the 0 after content to whatever seconds and update the YOUR_ROUTER_IP/...

2frogs

You shouldn't disable that rule, when disabled it allows access from internet. You should add the vpn to LAN list or add an accept rule for the vpn.

2frogs

You have used the incorrect dst-nat for local access. You have used in-interface-list=wan and local traffic does not reach the wan interface. You options to fix it by adding a static dns entry pointing towards your server, but this only works if you are using a local dns. If you have a static public...

2frogs

This is most likely the issue.

add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN

You need to add your vpn to the LAN interface list or add an accept rule above it for for vpn.

2frogs

The wAP AC doesn't look bad when wall mounted and provides excellent coverage. With brick walls, I would plan on 3 per floor just to insure 5ghz coverage.

https://mikrotik.com/product/RBwAPG-5HacT2HnD

2frogs

https://wiki.mikrotik.com/wiki/Manual:IP/DNS

2frogs

You can configure CAPsMAN on your router and set each wAP in CAPsMAN mode using the reset button. https://wiki.mikrotik.com/wiki/Manual:Reset Or use NetInstall to install a new default configuration. https://wiki.mikrotik.com/wiki/Manual:Netinstall Otherwise, you will have to connect to the wifi of ...

2frogs

Use netinstall to upload a current ROS Version and check the option to "Apply default config". If purchased from Amazon there is a chance that this device has had a alternate default config installed. This is best practice when not purchasing from a unreputable supplier. https://wiki.mikro...

2frogs

NetInstall 6.49 with "Apply default config" checked. For some time now, the default bridge name has been name=bridge and yours is name=bridge1. I believe the default config has been altered and is causing the Quickset scripts to error and stop.

2frogs

Have you tried moving the WAN to a different ethernet port? I moved a port flapping gaming console to a different LAN port and it stopped flapping.

2frogs

You have to put password="1234/$", needs the "".

2frogs

Quickset should only be used with a device in it's original state or to make additional changes as long as only Quickset was used. It relies on a simple set of scripts to make changes to the original configuration and adding any settings outside of Quickset will have unexpected results. This would i...

2frogs

How is it useless? I provided an alternate firewall rule that blocks all forwarded from a single IP that is not in the the address list. This would include any forwarded DNS requests.

So folks just live to be arrogant and rude I suppose...

2frogs

/ip firewall address-list add address=www.islonline.es list=WebsPermitidas /ip firewall filter add action=drop chain=forward comment="Bloqueo salida internet" log=yes log-prefix=Bloqueo protocol=tcp src-address=10.45.9.105 dst-address-list=!WebsPermitidas You will need to use the router f...

2frogs

You are routing to 192.168.88.0/24, but that filter rule is for traffic destined to 192.168.2.0/24. So which one are you trying to reach?

2frogs

Do you still have the default filter rules on MK2? The last one for chain=forward is to drop every thing not dst-nat, so you would need to disable it or add an accept above it for the other network. /ip firewall filter add chain=forward src-address=192.168.1.0/24 action=accept If you are still havin...

2frogs

On MK1, it is a simple route: /ip route add distance=1 dst-address=192.168.88.0/24 gateway=192.168.1.154 On MK2, you will need to exclude 192.168.1.0/24 from the default src-nat rule (using dst-address=!192.168.1.0/24 or address list) or disable the scr-nat rule on MK2 and let MK1 handle all for bot...

2frogs

Your dst-nat rule is what is limiting you to outside connections only. Local traffic does not come in on WAN, so you can not use in-interface or in-interface-list. Instead, use dst-address with either external ip address (static address) or ddns (dynamic address). You can also set dst-address-type=l...

2frogs

I would suggest performing a netinstall on this device. https://wiki.mikrotik.com/wiki/Manual:Netinstall Be sure to check the box "Apply default config", especially if it was purchased from Amazon or the similar. If still does not work, try connecting it to your tplink and see if it works ...

2frogs

/ip firewall filter add action=drop chain=forward comment="no internet midnight to 5" src-address=!192.168.1.46 time=23h57m-5h,sun,mon,tue,wed,thu,fri,sat As nje431 stated, this rule drops ALL forwards except from 192.168.1.46 when active. This would include all others from LAN and all fr...

2frogs

I believe I stated exactly why he should order a replacement! Not all damage is immediately apparent and to suggest all is fine is absolute folly.

2frogs

I am going to suggest you get a replacement ordered. Even though all may seem fine, you could start having intermittent issues with the router that are unexplainable and cause great grief in trying to diagnose. I would also suggest adding a inline surge protector to your WAN line to help from happen...

2frogs

block all incoming forwards You have to allow for returning connections, if you block all incoming connections you are also blocking your wanted connections. Below is the default firewall rules and other necessary settings for it to work. You will see the section for Forward that allows Established...

2frogs

You need to disable fast-track found in IP>Firewall>Filter or at least exclude your guest-lan from it.

2frogs

The reason your configuration on the cAP is not working, is due to the src-nat rule. It is using out-interface-list=WAN and the only interface-list=WAN is ether1. In your case, the bridge interface will be your WAN and the guestbridge will be your LAN. But I would not changing the interface-list to ...

2frogs

Try using netinstall. You may also try a different power supply.

https://wiki.mikrotik.com/wiki/Manual:Netinstall

2frogs

3 Jan/02/197000:01:08 memory system.error. critical. unknown. unknown. unknown error while running customized default configuration script: interrupted This indicates the default script was replaced with a custom script. Perform a netinstall and select "Apply default config" to revert thi...

2frogs

Here is a detailed how to:

https://www.premitel.uk/consultancy/exp ... thout-nat/

2frogs

You should perform a netinstall on this device. Simply resetting the device may not be enough to remove any bad code.

2frogs

You might also try netinstall with a different power supply for the hAP lite. It may not be providing the proper power needed for boot up.

2frogs

Since you have made changes outside of the Quick Set screen, do not use it any longer for making changes. It relies on fairly simple scripts to make it's changes and can't account for what you do outside of it's scripting.

2frogs

It works in my testing. Can you post full export?

2frogs

You should do a netinstall. A simple reset may not remove all compromising components.

2frogs

/ip firewall filter add action=accept chain=forward comment="ENABLE LAN to WAN" in-interface=\ bridge out-interface-list=WAN add action=drop chain=forward comment="Drop All Else" These 2 firewall rules are causing both issues. I suggest using this one and it will also replace th...

2frogs

If you decide to keep it, you should do a netinstall just to be sure there are no bad things left on it.

2frogs

/ip firewall nat add chain=dstnat dst-address=192.168.88.1 src-address=!192.168.88.5 in-interface=bridge dst-port=53 protocol=tcp action=dst-nat to-address=192.168.88.5 add chain=dstnat dst-address=192.168.88.1 src-address=!192.168.88.1 in-interface=bridge dst-port=53 protocol=udp action=dst-nat to...

2frogs

The reason the NAT rules do not work when in the same subnet, is because the clients communicate directly with one another. For the router to do the NAT, that traffic has to passthrough it's CPU. This does not happen even when clients are connected to the router, but on bridged interfaces. If this w...

2frogs

It is better to have your PiHole on a different subnet, this way you can use dst-nat to do the fail over. You will not have to wait for your dhcp-lease on each device to renew before the fail over works. /ip route add dst-address=192.168.188.2 gateway=bridge /ip dhcp-server network add address=192.1...

2frogs

Did you update the client to the same version? The server and client have to be the same version.

2frogs

When testing for the ports to be open, are you testing from a device on the WAN side or the server on LAN? Your NAT rule only allows from the WAN. I see no error with your NAT rules. As far Filter rules, the default state (without rules) is to accept. Your original configuration was not block the NA...

2frogs

You should do a netinstall instead of just a reset. There sometimes is weirdness that can't be fixed with a reset or upgrade/downgrade.

2frogs

Since you want to use the wireless to connect to remote networks, you will want to use mode=station. Create a dhcp-client for the wlan also. If you have need to remember the connections, you can use the wireless connect-list. You will also either add another src-nat rule for wlan or change first one...

2frogs

/ip firewall mangle
add chain=prerouting action=mark-routing dst-address=138.68.XXX.XXX in-interface=bridge1 new-routing-mark=to_WAN1 passtrough=no

2frogs

dns-none=no (default) means without setting dns-server= the dhcp-server will pass the dynamic dns.

https://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Server

2frogs

Yes:

/resolve www.mikrotik.com server=8.8.8.8

2frogs

Using Fetch command in a schedule should do the trick.

https://wiki.mikrotik.com/wiki/Manual:System/Scheduler
https://wiki.mikrotik.com/wiki/Manual:Tools/Fetch

Code should be as simple as:

/tool Fetch url="provided.unique.url" mode=http

2frogs

There is a shorter command:

:for i from=0 to=12 do={/interface bridge port set $i pvid=101}

2frogs

Maybe you should a netinstall. I had a new hEX S that was in a boot loop from the box. I preformed a netinstall and it has been fine since.

2frogs

Reading your post, it seems you are actually attempting to reach an internal server using the external address. Using an in-interface in this situation will not work. You need to use dst-address=external-ip (best practice with static ip) or dst-type=local dst-address=!router-ip (works with dynamic i...

2frogs

I would test a triple chain NetMetal or RouterBoard with a triple chain wireless card. Treat each chain as a seperate AP as far as mounting is concerned. This way you should only need 4 APs. You will need to get as much physical separation as possible and reduce the power some. You should be able to...

2frogs

Screenshot_20210406-204552_Opera.jpg

Maybe you have a custom skin and have Dude menu blocked. https://myrouter/webfig/#Dude will return you to the Quickset, you have include :Menu_Name. Such as https://myrouter/webfig/#Dude:Network_Maps

2frogs

Is this your full export? I also do not see any of your LAN settings. No bridge_lan or ports connected to it. No DHCP Server.

From what you have posted, you don't have DNS running on your device.

/ip dns
set allow-remote-requests=yes

Or you would see this present.

2frogs

Have you tried using 192.168.3.5:67-69 directly? To other devices on this subnet, the it would seem no different if the NVRs were directly attached (if your firewall is not dropping the traffic).

Maybe a misconfiguration on the Modem/Router. Or it needs a hairpin nat.

2frogs

Looks to me your firewall is doing as it should and your answers should be in your logs.

Hint: prefix=!public

2frogs

Just need to add "where" to the find and you can search using multiple parameters. :if ($bound=1) do={/ip route set [find where dst-address=0.0.0.0/0 routing-mark=ISP2] gateway=$"gateway-address" } Alternatively, you could set comment=ISP2-Default or something unique and use that...

2frogs

In webfig menu area there is a hide-password button to see the password as you typed. Also there is a safe mode button that if on when you change the password, you will have to toggle off/on to make changes permanent.

2frogs

Correction: it was 2018. VER 6.42

https://wiki.mikrotik.com/wiki/Manual:Tools/Netwatch

There is an example in the wiki. Create the script with dont-require-permissions=yes.

2frogs

Fetch may also needs permissions not available to Netwatch. These changes were made in response to the 2019 security issues, I believe.

2frogs

Insure your Dude client is the same version as server. I believe with server ver 6.48.1 and client ver 6.48, it was stuck on getting stuff with no upgrade notice.

2frogs

Netwatch (also DHCP, PPP, etc.) lacks permissions to use global variables.

You can create a script where permissions are not required and then call on that script.

2frogs

If the 9 volt adapter does not have enough amp rating it could cause strange behavior. The device uses max 7 watts with no attachments which is .8 amps at 9 volts. It has 24 watt max total or 2.7 amps at 9 volts.

2frogs

You will have to have port forwarding available on at least one of the modems (No IP is just another DDNS services) or you will have to connect both to third device that has a public IP or the ability to forward ports. There is no magical way of connecting from one network to another directly withou...

2frogs

You are seeing all of those log messages because of this firewall rule: add action=drop chain=forward comment=\ "Drop packets from SMTP spammer address list." log=yes src-address-list=\ "SMTP spammer" The devices you see in the logs have been caught by the SMTP Spammer rules and ...

2frogs

Have you considered powerline adapters?
https://mikrotik.com/product/pl7510gi

2frogs

There is a built in DDNS under IP>Cloud.

If you have an update client running on a device in your network, you can enter your DDNS in IP>Firewall>Address List and it will resolve it to your IP.

2frogs

In testing I have found that creating a virtual station on a wlan with ap bridge works sometimes and not others (I have done ap bridge on mode station many times with out issue.) Maybe a better solution is to just use the wlan as station temporarily. 1. Make export of current config and save it some...

2frogs

If your other MikroTik device has wireless and is in range, you could setup a virtual wireless interface in station mode with a dhcp-client on it. Then use the telnet tools to access the other device.

2frogs

The reason you can't connect to your adsl is because of the /16 (192.168.0.0-192.168.254.254) IP scope you have set. It's IP belong in this range and is being routed out on the bridge instead of your WAN. Looking at your config, I do not see a reason not to use /24 and have a single subnet (192.168....

2frogs

The User Manual from product page: https://help.mikrotik.com/docs/display/UM/mAP+lite Depending on age of the device, the earlier ROS versions may not have had all the safe guards in place or pre-configured differently from a more up to date version. Or possibly had been configured by someone else p...

2frogs

If I understood your requirements, X.X.X.X/32 (example 111.222.112.221/32) is static IP of data center. From: https://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Client bound - 1 - lease is added/changed; 0 - lease is removed So this says when lease is added (new/reboot) or changed to set the gateway for ...

2frogs

It should have a default SSID MikroTik-######(last six octets of wlan1 MAC) with no password.

2frogs

The default config should be Home AP for this device. This means the ether1 is WAN and wlan1 is LAN. The default firewall rules only allow access to the mAP from LAN. You will have to have someone connect to the wireless of the mAP with a device that you can remote into to be able to reconfigure it....

2frogs

Put this in the script under dhcp-client. It will update only if there is a changed.

:if ($bound=1) do={/ip route set [find dst-address=X.X.X.X/32] gateway=$"gateway-address" }

2frogs

The reason you have configure it the way you have has to do with a limitation of the wireless standards. More specifically it has to do with the way MAC addresses are passed from the client to the connected network. In a normal connection, only the MAC of the connected device is seen by the network....

2frogs

Very straightforward! Use ap-bridge & station-bridge on the pairs.

2frogs

On your Bridge1 configuration you have the address 192.168.177.1 set to interface=ether2, this should be set to the Bridge that port salved to, interface=bridge_192.168.177.0.

Also the other IP's for the other ports also slaved to that bridge will also not work.

2frogs

https://wiki.mikrotik.com/wiki/Log_Pars ... ger_Script

2frogs

I missed the closing ]. I have updated, please try again.

2frogs

Try:

:local since [/tool netw get [find where comment=MAIN CONNECTION] since]

My apologies for my other reply, I was pulled away before I could complete my thought and didn't realize I had submitted it.

2frogs

I agree with erlinden, your rule seems to be working. As a quick sanity check, you can change the to-port to the same as the first one and see if it opens. It would seem to me that there is an issue with the device you are forwarding to. Either you have the wrong port or it's firewall is not open to...

2frogs

Your /interface list members are set incorrectly. You have the individual Interfaces set as members, but the interfaces are slaved to a bridge, so you must use the bridges as the interface. As a result, your firewall filter rules are currently dropping your traffic. You should only need: /interface ...

2frogs

value-name=since

2frogs

Another option is to set your device IP or list of IP's in IP> Service.

2frogs

Did you format the USB disk to Fat32?

2frogs

Export current configuration, then NetInstall current rOS version and Import your configuration. I have seen random weirdness with devices before. I just had to NetInstall a new hAP AC that was in a boot loop straight out of the box.

2frogs

I wouldn't think so since the whole purpose of The Dude is to monitor devices and their state. How would The Dude know the difference between a device that is down that is supposed to up? Or a device no longer connected to your network that no longer needs monitoring?

2frogs

Why not use Group in Advanced Mode.

2frogs

Variables have a 4096 byte limit. Instead of writing from an array, just amend the file. It is similar to amending an array. Here is an example: /file print file=test; :delay 2s; /file set test.txt contents="/ip firewall address-list\n"; :foreach i in=[/ip firewall address-list find where ...

2frogs

Open Winbox, Tools>Move Session Folder. Set to something other than your desktop.

2frogs

Less of a works-as-expected and more of a you-cant-mikrotik... I gave up! 😕

2frogs

You was in the wrong menu. Lists can only be added or removed, but members can be disable. Sometimes the flow between Winbox and CLI can be seeming backwards...

interface list member set [find list=POE] disabled=yes

2frogs

You can narrow the scope for the local variable to help mitigate the issue: global main do={ #populate dict with values based on given name if ($1="bob") do={ local dict ({}) set ($dict->"name") "bob" set ($dict->"address") "maple st." set ($dict->&q...

2frogs

I would use the Groove in CPE mode and the hAP in WISP AP mode. First reset the Groove to factory default. Then insure the mode on Quickset is set to CPE. You should be able to use the Quickset to connect to an AP, browse the Internet and update the Groove when connected directly to it. Next, reset ...

2frogs

Are you getting a blank space in your $dnsIp by chance? As expected: :local dnsIp "172.0.0.1"; :put "length=$[:len $dnsIp]"; :put "v alue=$dnsIp"; :put "type=$[:typeof $dnsIp]"; :set $dnsIp [:toip $dnsIp]; :put "v alue=$dnsIp"; :put "type=$[type...

2frogs

Have you tried with:

/ip ssh
set forwarding-enabled=no

2frogs

:for i from=1 to=50 do={/ip firewall address-list add list="user_$i" address="172.16.1.$(($i*5)-4)-172.16.1.$($i*5)"}

2frogs

I have discovered there is a flaw in the script that the Quickset uses to change to WISP AP. It leaves intact and active the default firewall rules, including the Drop Input not from the Interface-List LAN. It also removes the Bridge Interface from this list and only adds the individual Interfaces (...

2frogs

Disable the firewall rules before changing to WISP AP. The Quickset is broken, when you make the change it removes the bridge from interface-list=LAN and this causes the firewall filter input rules to drop IP traffic to the router. If you use Winbox, you can connect to the device using the MAC inste...

2frogs

Anav, you need to read up on antenna radiation patterns. Antennas radiate their power in lobes, even omni antennas. The more directional the antenna, the more the lobes are concentrated in one direction and typically there are more lobes. Back lobes are what you need to pay attention to. They radiat...

2frogs

Redirect to your page first and have the login on it (or a link to a separate login page.) This way both android and ios devices will see your advertisements.

2frogs

Your firewall is dropping the traffic. 172.16.0.0/24 is included in the address-list=not_from_intrrnet and is being dropped.

2frogs

Please post your full config. Use “/export hide-sensitive file=myexport” and this will create a myexport.src file you can download and edit with your favorite txt editor. The use of ether2 with slaves is outdated, so you may need to change your IPs to be on your “bridge”. Or you need to consider upd...

2frogs

Long range on Mikrotik marketing is usually referring to multiple km with high gain antennas and not covering a back yard.

The wAP AC has 3 chains on 5ghz compared to 2 chains of the netmetal. And the wAP is the same enclosure as the wireless wire (wAPG-60adkit), so it will be just fine outdoors.

2frogs

PS. The netmetal is what I would get for outdoor and probably with an antenna that has a 180 sector such that I dont get leakage into the house area. This is why you should not be giving product advice! A netmetal with sector is such bad advice for a home user. By the way, the best value Outdoor pr...

2frogs

Testing with the built in tools should not be used a true measure of performance as it uses the cpu for both the test and connectivity.

Only use iperf (or similar) between 2 capable PCs as a true measure of performance. Connect the 2 PCs directly and test first to see what they are capable of.

2frogs

Using dstnat is correct for changing the destination no matter if it is incoming or outgoing! I would suggest changing the ip scope of the pi-hole to outside your lan ip scope. This way you can see individual devises on your pi-hole instead of the router. Add something like 172.16.0.1/24 to the same...

2frogs

Use in-interface or out-interface to use interface name.

You have to define the interface list if you want to use in-interface-list or out-interface-list.

/interface list
add name=WAN

/interface list member
add list=WAN interface=wan

2frogs

Use export instead of print:

/interface wireless export

You should now see if tx-chain=0 or tx-chain=1. It should be tx-chain=0,1. You can change it using:

/interface wireless set wlan1 tx-chain=0,1

2frogs

It is because you have set an address-pool at either /ip hotspot or /ip hotspot user profile. Change both to address-pool=none. Setting an address-pool was intended to help device that might a static IP set in their setting be a able to still connect to the hotspot. That is no longer a common practi...

2frogs

It was most likely the use of Quickset after you had already made changes. Quickset relies on basic scripts to make the changes and if you make changes outside of Quickset, it has know way allowing for your changes. And there are other instances of Quickset just being broke. If can avoid it using it...

2frogs

https://wiki.mikrotik.com/wiki/Manual:Console

2frogs

[tab] button is your best friend in RouterOS.

/[tab] - will show you directory and available commands for that directory

/int[tab] > /interface - auto completes

/interface set [tab] - will show all variables

2frogs

I don’t see a dhcp client.

/ip dhcp-client add interface=lte

The only other odd thing is a blank interface-list-member.

2frogs

/export hide-sensitive file=myconfig

Download myconfig.rsc from Files and edit with your favorite txt editor. Post content.

2frogs

In Quickset it is the very top drop down box, you want “CPE”, but I highly recommend NOT using Quickset as it has a bad habit of breaking things. Just Don’t! I only provided it as one of the places this change could be made... Issue this command in terminal: /interface wireless set wlan1 mode=statio...

2frogs

Auto correct victim.... or poor typing skills....

“ I didn’t say they should.”

2frogs

I didn’t say they should! It could be done in a poor attempt to redirect to their own server. Or a Mom/Pop shop that just doesn’t know any better.

The fact the OP stated this was ongoing from before his Mikrotik router implies to me it is the ISP.

2frogs

I believe both of the previous responses was either backwards or missed the mark, so I am going to give my 2 cents. When you are connecting to a time server, you do so on port 123. This is no different from http on port 80 and https on port 443. The return port is what will be random. Your device wi...

2frogs

If the modem is in bridge mode, your will need to add an IP address to the interface that it is connected to on the Mikrotik in the range that the modem is in. For example; If your Modem has an IP of 192.168.1.1 and connected to ether1, you would add 192.168.1.2/24 to ether1. /ip address add address...

2frogs

If you plug into the modem directly with your PC or connect to its wireless, do you get an IP from it? Are you able to browse the Internet or ping Internet IPs? If you are having to set an IP in the range of your modem to ping it/ access its web interface, then it is most likely in bridge mode. This...

2frogs

The wAP AC is an excellent outdoor AP.
https://mikrotik.com/product/RBwAPG-5HacT2HnD

2frogs

If mode=station keeps changing to mode=station-wds then it is being changed on Quickset, /interface/wireless or by a script. A WDS link is still possible if mode=station and mode-wds is not =disabled.

2frogs

1. & 2. look good. 3. action=srcnat is normally used when you have multiple IPs on your WAN interface. Using src-address as an example, you could have 1 internal IP use one external IP while the rest of your internal IPs use another. action=masquerade is the default because it works well with a ...

2frogs

First, thank you for your help. Here is the configuration # jan/02/1970 04:56:35 by RouterOS 6.46.5 # software id = YCEF-KZ52 # # model = RB941-2nD # serial number = D1130BA3F321 /interface bridge add admin-mac=C4:AD:34:C9:6E:47 auto-mac=no comment=defconf name=bridge /interface wireless set [ find...

2frogs

https://mikrotik.com/product/RB750UPr2 The RB750UPr2 is only rated to 30v. It includes a 24v power supply. https://mikrotik.com/product/RB960PGS The RB960PGS (HEX POE) is rated to 57v and includes a 24v power supply. It is passive power, so it will supply what ever you input to it. All Mikrotik POE ...

2frogs

An alternate would be to use something like:

/interface bridge host print

It won't get you the address, but it will get you mac-address and interface it is on. You could then combine this with data from the /ip dhcp-server lease of your router.

2frogs

Since all your ethernet port are slaved to the bridge, only the bridge will show as the interface. You can change the script to: { :local ethlist; :local buffer; :local fileName "address-list"; :foreach i1 in=[/interface find running=yes] do={:set $ethlist [/interface get $i1 value-name=na...

2frogs

:foreach i in=[/interface bridge port find where bridge="bro"] do={/interface bridge port set $i pvid=10}

2frogs

:foreach i in=[/ip fire add find where list=name address~".net"] do={:if ([/ping [/ip fire add get $i value-name=address] interval=1s count=5]>0) do={/ ip fire add set $i timeout=30d}}

2frogs

@bpwl This is a Ubiquiti issue. The clients routers are not getting DHCP from the Ubiquiti CPE. I use Mikrotiks at all my towers, using DHCP to hand the IP to the Ubiquiti radios. The radio is configured to then hand out an IP to the customers router . @jakkwb You might try changing lease time to 86...

2frogs

@anav 1. Not sure what you mean!?!? (leave on tcp,upd :53) 2. I believe this would be best, so if there is an issue with it you can redirect to somewhere else. (see 9.) 3. This would be more personal preference. I only use vlan for my Guest network. 4. 192.168.254.1 is pi-Hole in this example: /ip d...

2frogs

This is a strange way of handing out multiple IPs. It is usually considered to be a big No-No to make multiple connections to the same device. You normally have to configure manually for the additional IPs. You might contact your ISP to be sure you have done this correctly.

2frogs

It has it's drawbacks as well! When forwarding, the Pi-hole only sees the Router as a client, so the per client/group blocking won't work. Devices on my network only get 1.1.1.1 & 1.0.0.1, so if I was to disable both sets of NAT rules the devices would still have functioning DNS. I originally ha...

2frogs

Your firewall rules need a lot of work! chain=input is for traffic going to the router it's self (Webfig, Winbox, Ping, DNS, etc.) chain=forward is for any traffic being forwarded by the router (from one interface to another.) All the rules you added mostly belonged to the chain=forward since it was...

2frogs

Not sure if is proper way of handling DNS, but I left Cloudflare as DNS under DHCP-Server>Network and use NAT to redirect to my Pi-hole instance. My Pi-hole has the router set as it's DNS so that I could use Static DNS and the router had Cloudflare set for it's DNS. I have some that I don't want goi...

2frogs

I am going to ask the more obvious! Are you using the default firewall? And did you add ETH3-WAN2 to WAN Interface List?

2frogs

Looks like you are not getting an IP Address on LTE. On your Quick Set page it is empty. And when you pinged 8.8.8.8, which you don’t need DNS to ping IP, it returned “ no route to host”.

2frogs

dstnat: in :pppoe-out1 out:(unknown 0), proto TCP (SYN), 110.54.222.111:49667->101.58.69.xx:3389, len48

You have log=yes (checked), this is the log showing a connection. This is not an error message. Was the client unable to connect to the router?

2frogs

Using Mikrotik Winbox instead of Webfig is the best option. You should be able to connect to the device using the MAC Address to configure your device. It is also best practice to reset the device without default configuration and configure it manually than trying to rely on the basic scripts in the...

2frogs

For the Hotspot to work correctly, it requires internet access so that any html queries can be redirected to the Hotspot login.html landing page. Instead of trying to redirect with firewall, it would be easier to edit the login.html to: <head> <meta http-equiv="refresh" content="5; UR...

2frogs

This is what I use with success; <head> <meta http-equiv="refresh" content="0; URL=https://www.yoururl.com/" /> </head> <body> <p>If you are not redirected in five seconds, <a href="https://www.yoururl.com/">click here</a>.</p> </body> Just replace the html code with th...

2frogs

Try increasing DHCP lease-timeout=1d . I know Apple things have issues with the short default lease time.

Edit: just re-read your last post where you changed it, but it might not have been long enough.

2frogs

I have seen lots of explanations of why, most are centered around temporary network issues or bad client devices/drivers. The best solution is to disable the 1:1 NAT by setting the dhcp-pool=none. The 1:1 NAT was introduced to allow devices that had a static IP Address configured to be able to conne...

2frogs

/ip firewall filter
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related

You will need to disable fasttrack as it will break mangle rules.

2frogs

Have you set the cable modem to forward the ports to the mikrotik? I see references to a 192.168.1.1 address in a couple of locations that I am assuming is your cable router. If your mikrotik is getting DHCP from 192.168.1.1 and has an 192.168.1.xxx IP, you will have to forward those ports on the ca...

2frogs

add action=accept chain=input dst-port=1723 comment="accept PPTP" protocol=tcp This needs to go either above or below the "defcon: accept ICMP" because the order matters. Also, chain=input is for any thing going to the router itself. And chain=forward is anything being forwarded...

2frogs

2frogs

https://wiki.mikrotik.com/wiki/Manual:License https://wiki.mikrotik.com/wiki/Manual:CHR#Free_licenses In short the x86 version has a 24hr demo (level 0) or a very limited demo (level 1.) The CHR has a free version, limited to 1mpbs/interface. Or 60 day trial mode for any CHR License Levels (P1, P10,...

2frogs

/ip firewall nat add chain=dstnat dst-address=!192.168.88.1 dst-port=80 protocol=tcp dst-address-type=local to-address=192.168.88.253 You can enable the DDNS under IP>Cloud and use the DDNS to access the device. You could also use the DDNS to do the dstnat: /ip firewall address-list add address=you...

2frogs

On the RBMetal, change mode=bridge to mode=ap-bridge, mode=bridge only allows 1 connected client. /interface wireless set [ find default-name=wlan1 ] band=5ghz-a/n channel-width=20/40mhz-Ce \ disabled=no hide-ssid=yes mode=ap-bridge security-profile=profile1 ssid=\ <SSID HERE> wps-mode=disabled

2frogs

One use case would be vdsl2 areas where the 2.4ghz bands are overcrowded and all but unusable. Another would be for wireless internet providers that use 2.4ghz bands to distribute internet, they can provide a router they can set to not interfere with the channel they are using to connect that client.

2frogs

First issue is that the LAN IP address should be on the bridge interface since it is the master and ether2 is slaved to it.

Second, is that your NAT rule has your IP scope on src-address-list instead of src-address. You could define an address-list and use that instead.

2frogs

Usually seeing the same MAC with multiple IPs is caused from having a pool set in the hotspot or from having dhcp lease times set too short. Setting a IP pool in the hotspot will create a 1:1 NAT for devices that have a static IP. And sometimes it will NAT devices that received a IP from the dhcp se...

2frogs

If you plug your computer into the cable that is on ether1, does it get an IP address. If it does, make sure it is not in the same range as your router (ie 192.168.88.0/24). I don't see anything in config that would prevent it from obtaining an IP.

2frogs

On CRS, navigate to IP>Addresses. Or

/ip address remove [find address="192.168.88.1/24"]

The address is most likely a left-over from the default config.

2frogs

Since you have a dhcp-client on bridge, just remove the 192.168.88.1/24 address

2frogs

Change: add action=masquerade chain=srcnat comment=LetsencrypLocal dst-address=192.168.88.254 \ dst-port=180,1443 protocol=tcp to add action=masquerade chain=srcnat comment=Hairpin NAT dst-address=192.168.88.0/24 src-address=192.168.88.0/24 as SOB suggested as it is universal. Do you have any static...

2frogs

And you have flushed dns on your device?
What is doing or not doing?
Can you provide:

/ip firewall nat export

2frogs

Try disabling the fast-track firewall rules.

2frogs

@sebastia

I believe you missed that the server is on ports 180 & 1443. Static DNS entries will not work in this case as it points to ports 80 & 443.

2frogs

Instead of the DNS trick, try correcting your dst-nat rules. If you have a static IP: /ip firewall nat add action=dst-nat chain=dstnat comment=Letsencrypt dst-port=80 dst-address=your.external.ip.address protocol=tcp to-addresses=192.168.88.245 to-ports=180 add action=dst-nat chain=dstnat comment=Le...

2frogs

What you are seeing is normal. The data rate is the combined theoretically possible rate for upload and download. Since the AP and Client can only send or receive and do so to a single device at a time it will half the data rate. And as you noticed, if you connect a second device and try to download...

2frogs

The best way to set it up is to use Winbox to reset without default and configure it manually. Once you have reset the wAP, you will have to connect to it using it MAC Address. Now you can setup a bridge and add ether1 and wlan1 to it. And now configure wlan1 to be a station with the proper SSID and...

2frogs

The Hotspot Trial user is perfect for what you want. You can edit the default login.html to remove the login box and use the trial user link as the "click here" to agree. https://wiki.mikrotik.com/wiki/Manual:Hotspot_Introduction https://wiki.mikrotik.com/wiki/Manual:IP/Hotspot https://wik...

2frogs

So if you put these in terminal they run, but not from the script? /system script run firewall-to-backup /system script run firewall-to-main You could also change from using in/out-interface to interface-list and not have to change the firewall rules at all: /interface list add comment=defconf name=...

2frogs

/tool user-manager user set [find shared-users=unlimited] shared-users=1

2frogs

You mentioned untagging/tagging is why I suggested a bridge. But yes, you can put the IP and DHCP Server directly on vlan1. And you can then remove the bridge port for vlan1 as it is not needed.

Search found 713 matches