MikroTik

yottabit

Will you install completly different generations of Ruckus, to be on pair with your MT complaints? If you are ready to buy new Ruckus-everything, go scrap your old MT stuff and go wifiwave ax full-force too? My point was that if I'm going to have to buy new MikroTik APs to get better performance, I...

yottabit

I'm getting very close to selling all my MikroTik APs and going to Ruckus for wireless. I'll still use MikroTik for routing, though. MikroTik wireless is flexible, but just not performant. And this wifiwave2 business is looking to be the last nail in the coffin for me. I've been waiting for years, a...

yottabit

The station-bridge mode works together with the AP mode, there is no need for a new type of AP mode. The WifiWave2 station-bridge is only compatible with WifiWave2 APs. Audience configuration won't be automatically converted in this case. That's a bummer on two fronts. 1. I don't see why the upgrad...

yottabit

How long are my 10+ months old hAP ax2s going to be stored in a drawer, because ROS 7 still does not support repeater mode? Tonnes of new features, but still not fully on parity with ROS 6. I have been waiting for this too, so that I can use the Audience with wifiwave2 and wireless mesh. It looks l...

yottabit

My post has nothing to do with connecting. Using a short hostname resolving directly to the internal IP shows pings in the client on the same LAN. Using a fqdn resolving to the external IP does not show pings in the client on the same LAN. Due to the hairpin NAT rules I have installed, both the shor...

yottabit

This is an odd one. If I add my server LAN IP to the app, the app reports the ping and users online. But if I use my FQDN which is hairpin-nat'd, the ping stats do not report; yet, I can still connect to the server just fine this way. Here are the rules I used for hairpin NAT: /ip/firewall/nat add a...

yottabit

6.5 years since original post. 2 years since they said "shortly" in my ticket. We need a reference for what "shortly" means in this case? Software dev cycles? Human lifespan? Galactic time scale?

yottabit

Most of my ssh hosts won't even accept rsa keys anymore. So I have to maintain ed25519 for them, and a separate rsa key just for the RouterOS hosts. It's very annoying.

yottabit

There is a typo in the first post. The client should use address 192.168.66.2/24, not 192.168.66.3/24, in order to match the peer definition in the RouterOS. After fixing this, it works perfectly. Unfortunately it seems there are no default logs to give any kind of errors or warnings on RouterOS, wh...

yottabit

Done, SUP-67007.
did they offer a timeline?

No. They didn't commit to v6 at all, and just said "shortly" for v7. That was on 2021-12-28. No updates since.

yottabit

Sorry to say, this helped the situation but did not completely fix it. It seems the problem was triggered again whenever the user roamed between APs. In the end, we had to turn on the Wi-Fi feature for their crappy AT&T U-verse gateway modem/router, and used a unique SSID so only the iPhones wou...

yottabit

IPIP+IPSec tunnels are still broken if the default keepalive is left enabled. If you unset the keepalive, the tunnels come right up.

I am using ROS 7.1.1 on one end and ROS 6.49.2 on the other end.

I saw this reported in the beta and it is still not fixed.

yottabit

Done, SUP-67007.

yottabit

6.49.1 here and still no support for ed25519 keys. As I can no longer use sha-1 RSA keys, I would like to use the currently most secure format and not manage so many different keys just because a vendor refuses to update security to the best practices. Can we get ed25519 support in v6 please?? Edit:...

yottabit

I forgot to report back. I went back to the internal resolver on 6.48.4 about 10 days ago and it has been working fine for me now.

yottabit

Couldn't help but notice DNS resolver fixes in the 6.48.4 release.

I haven't reverted back to the internal resolver yet, but I will soon and report back.

yottabit

FYI, I have solved this problem on a different network and router (hap ac3) by doing the same thing: using DHCP to push Google Honest DNS directly to the clients instead of using the RouterOS resolver.

There is definitely something wrong with the Router OS DNS resolver.

yottabit

Why you have the nice idea to short DNS query timeout from 2 seconds to 0,2 seconds? (and default max-concurrent-queries from 100 to 1000 and max-concurrent-tcp-sessions from 20 to 200?) Aha, thanks for noticing that. I made these changes in an attempt to figure out the problem. The changes are not...

yottabit

I'm using Audience and I'm investigating why initial page load seems to be so slow. It seems that the RouterOS DNS server is slow and/or missing queries. Relevant config snippets: /system routerboard print routerboard: yes board-name: Audience model: RBD25G-5HPacQD2HPnD serial-number: BB0C0B6B7926 f...

yottabit

I have a puzzling problem. I'm using a recursive route for WAN failover, and on a second RB I am using Netwatch to ping this recursive route so that a specific port can be disabled when the primary WAN fails, and enabled when the primary WAN recovers. Topology: <WAN1>--<ether1|rb1|ether2>--<ether1|r...

yottabit

Audience and Chateau both only use the beta version of the operating system which has problems at the moment. No, the Audience runs 6.x and has been quite reliable for me. I have configured 17 of them, largest installation using 3 of them plus 2 wAP ac as extra CAPs and 1 wAP in station-bridge mode...

yottabit

I have searched high and low, trying to figure out why an AT&T user using Wi-Fi Calling can no longer hear the remote party approximately 2-3 minutes after answering a call. (It seems to happen most often in the inbound direction, e.g., answering the call while using Wi-Fi Calling.) I am unsure ...

yottabit

I have the first router and first AP configured. I'm going to add the second AP later tonight and then do some testing. So far I've kept everything in repeater mode for ease-of-setup. I'm worried that switching to wds-slave may interfere with future WPS pairing of new APs, should they need that. I d...

yottabit

You are sure you did not do backup the station configuration and restore in another device to make a clone? This would create devices with identical MAC addresses.

Yep, I'm well aware of that problem.

yottabit

I have received the first half of the devices, including 17 Audience. I am considering changing the default wlan3 from repeater mode to wds-slave. This has the added benefit of allowing the extension nodes to associate with different nodes as conditions change, a self-healing configuration. The down...

yottabit

Same. I'm using Chrome and selecting Paste from the Chrome menu doesn't work. It works fine in the webpage fields of webfig of course, but just not in the Webfig Terminal.

yottabit

This is indoors, household application. In some cases Audience will be used and the 4-chain 5 GHz radio will be used for the backhaul with a different SSID to keep regular stations off. In other cases, due to slower Internet speed, the additional speed provided by Audience having the extra radio is ...

yottabit

Years ago, when Station-Bridge + Virtual AP mode ("repeater mode") came out in RouterOS, I performed some speed tests using that mode compared to WDS-Slave mode, which essentially is the same solution for wireless backhaul + AP, sharing the same radio. In my tests, the repeater mode was a ...

yottabit

Hey everyone, Many years ago I wrote a 2-step QoS script to help home users manage their limited upload bandwidth. I've recently discovered that I somehow completely missed my intention to prioritize the TCP 3-way handshake and ACKs, so I've just refactored the ruleset and improved it. I posted it t...

yottabit

I expected ingress traffic, perhaps not quite this much, but fair enough. I wouldn't have expected it to be so steady. What I don't understand fully is the amount of egress traffic... All I'm supposed to be sending is the SYN/ACK response in the 3-way handshake, and then nothing else. Even if we wer...

yottabit

I converted AP masterbedroom from repeater-like configuration to WDS. Problem solved. Doesn't make any sense, but at least I don't have the problem anymore. I have not heard anything back from MikroTik support. Luckily, on this AP I don't need the higher throughput that repeater mode tends to provid...

yottabit

I was doing some data pushes to Google and Amazon overnight, and noticed a steady amount of ingress and egress, before and after the transfers, that was unexpected: https://i.imgur.com/FJgLdoF.png Digging further, I could see a high Rx & Tx rate with Torch running on my WAN interface: https://i....

yottabit

Here's my network topology: rb1 (hap ac2, router, no wifi) <--eth--> rb2 (hap ac, wifi ap only) <--wifi--> masterbedroom (hap ac, wifi ap only) And here is the utter junk I keep getting with my Pixel 3 Android 10 phone trying to roam from rb2 to masterbedroom (notice you don't see any log entries fr...

yottabit

Here's my network topology: rb1 (hap ac2, router, no wifi) <--eth--> rb2 (hap ac, wifi ap only) <--wifi--> masterbedroom (hap ac, wifi ap only) And here is the utter junk I keep getting with my Pixel 3 Android 10 phone trying to roam from rb2 to masterbedroom (notice you don't see any log entries fr...

yottabit

... when roaming from ap to ap it drops net, its connected to wifi but says Internet may not be avaiable, you need to turn Wifi on off several times or just wait 5+ mins and it starts working. I have been having this exact problem with a Google Pixel 3 on Android 10. I think the problem started wit...

yottabit

That didn't help. I also turned on RSTP to see if that would help, and it didn't.

I haven't had time to correlate the logs yet to see if the routers actually show anything obvious during this behavior.

Sent from my Pixel 3 using Tapatalk

yottabit

no, you have to manually pair the third audience to another audience of your own choosing Ok, good to know. But that doesn't conform to the typical definition of a "mesh" network. Years ago, I started using the station-bridge mode, with station roaming, because it greatly outperformed WDS...

yottabit

My problem isn't that Android hops between them. My problem is that after Android has made the decision to jump to the other radio, its Internet reachability test fails (presuming the RB is blocking the frames as it still believes the same MAC is reachable on another interface), and so Android disco...

yottabit

I'm still having this problem. Updated to latest ROS. Android 10 shows flapping the Wi-Fi with a dim Wi-Fi icon. Going to Wi-Fi settings shows connected/no Internet, and then it starts again. It seems like the switch FIB is blocking when it sees a MAC quickly switch from one AP to another. My extens...

yottabit

Actually you can pair an audience to any of the already paired audiences Hi @normis! Can you tell us if the Audience default config is using Station-Bridge mode or Dynamic WDS Mesh? If you configure a 3rd Audience to connect to the 2nd Audience via WDS/CAPs, will the 3rd Audience connect to both th...

yottabit

Ah, didn't realized untracked traffic wasn't the same as !fasttracked traffic. ;-) In this case, untracked simply means it's a new flow that hasn't been added to the conntrack state table yet, or a flow that isn't able to be tracked. I wonder if anyone has a way to sniff the TTL on a RB? It doesn't ...

yottabit

That diagram is super helpful. I still am confused about the untracked traffic though. Why would I have so much if fasttrack is disabled? Also, I think I figured out why the postrouting chain wasn't catching as much traffic as I expected. I was largely testing one direction but the rule was for the ...

yottabit

In which chain does the TTL decrement happen? Pre, fwd, or post? Also, I found it odd that when setting up a mangle rule to change TTL, that I had matches on both forward and postrouting chains. I had passthrough disabled on both of them. I have fasttrack and fast path both disabled. Why is my singl...

yottabit

Also, in the release notes, security now depends on dhcp. Maybe having DHCP package disabled is causing the problem. You should remove all of those extra packages that you have disabled.

Sent from my Pixel 3 using Tapatalk

yottabit

I'm having the same problem with hap ac (RB962). It bricked itself during the upgrade to 6.44.1, and now I cannot use netinstall to recover. I get the same error, "board supports versions from 0.0". Edit: disregard. Turns out that after you select the device in the upper-left pane, the pac...

yottabit

are you advertising the tunnel endpoint IPs via OSPF?!
check something like "redistribute connected routes" etc.

Yes, that was it! I had redistribute-connected=yes. The manual isn't clear on why this would break in my situation. Can you explain why it caused the ipip tunnel to flap?

yottabit

Hi Everyone, I'm running 6.44, and now attempting to turn on OSPF for route distribution between two routers. Pretty simple setup: rb01: ether1: DHCP WAN bridge1: 172.16.42.0/24, 172.16.43.0/30, 172.27.0.0/24 The 172.16.43.0 is being used for an IP-IP tunnel to rb02 via WAN Static routes are in plac...

yottabit

While this is true for listening services, you should not have any of those exposed to the WAN side of your router, or you'll be a victim of the next Mikrotik vulnerability. Hey great point. I do expose SSH with public-key-only authentication for remote management in case tunnels go down. So this s...

yottabit

You make a good point about reboots creating zombie TCP connections on the nodes, but you are wrong about the DoS mitigation. Setting nf_conntrack_tcp_loose to 0 (not the default) stops false SYN-ACK and ACK packets before they hit the “listen” state lock, thereby allowing conntrack to scale much hi...

yottabit

MT has two different Passive modes; an older one for up to 100 Mbps links used spare pairs, iirc. For the newer version supporting 1 Gbps, all pairs are used for transmission, so the power is coupled, though I don't know how or on which pairs exactly. Be sure you're not relying on the old spec. Even...

yottabit

What is the default setting for nf_conntrack_loose? It should be 0 (disabled) for better scaling against TCP DoS attacks. Had it been 0 or 1 before being exposed? Or is it new to the MT kernel branch?

Sent from my Pixel 3 using Tapatalk

yottabit

Yep, Chromecast requires station-to-station and/or station-to-node forwarding in order to receive and transmit control messages. You do not need UPnP enabled.

Sent from my Pixel 3 using Tapatalk

yottabit

Symbol: ` in WLAN SSID brake all wlan interfaces. Or even not a symbol, but a virtual WLAN. When I create a virtual WLAN and reboot hap ac^2, I don't see all interfaces and export doesn't work in the console. Is this new? 802.11 spec specifies SSID can be up to 32 bytes. It does NOT require alpha-n...

yottabit

yottabit - To which IP address does your router resolve upgrade.mikrotik.com (:put [:resolve upgrade.mikrotik.com])? Upgrade should work on this router without any problems. There might be some proxy server between your router and upgrade server causing this. [yottabit@rb1] > /ip dns print servers:...

yottabit

All of my MIPS devices (5x hAP ac, 2x RB951) upgraded automatically last night by script. My one ARM device (hAP ac2) did not upgrade, logging that there were no updates available. I tried to update it this morning from /system packages, and it still reports no updates are available. It's still on 6...

yottabit

If your AP is Mikrotik, set your client device wireless mode to station-bridge. Disable its DHCP. Use any port except ether1 for the wired device. Personally in this config, I like to wipe the client device to no defaults, login with winbox by mac address, create bridge, add all ports to bridge, cre...

yottabit

Guest mode won't work for this use. Typical Chromecast use sends commands from the phone, tablet, or computer, and the Chromecast fetches the content itself. The controlling device doesn't send content directly. But in screen/tab-casting mode, the controlling device is transcoding the media into a v...

yottabit

Bridge the VLANs, but then there may be no point using VLANs. Or you'll need to write a rule that can forward mDNS traffic as this is the protocol Chromecast uses for advertisement and control. Chromecast is not really intended to work outside of a simple LAN environment. An alternative is to enable...

yottabit

Alright, here's what I ended up doing, in case anyone else would be interested in the same thing without using queues. Unfortunately I couldn't get the mangle rules to work when trying to 2-step connection-mark and packet-mark. Maybe I will revisit again at a later time. So far the RB962 (hAP ac) CP...

yottabit

Thanks for your reply. Turns out I did not fully disable Fast Path, doh. Now that it is off, I have created a Mangle that marks the connection based on the dst-address-list, and a Mangle that marks the packet from the connection. The next issue is that I am attempting to make this more efficient on ...

yottabit

So this test is a pretty simple setup. Single RB962 (hAP ac) serving the whole network. Running 6.43.4. I am attempting to account for the network usage of a Chromecast. I created a firewall rule that matches the Chromecast's MAC address and adds that IP address to an address list. /ip firewall filt...

yottabit

When using the preshared key feature of IPIP tunnels to dynamically create the IPSec policy, I am glad that we can using an FQDN for the remote-address parameter. But the local-address parameter is still configured as an IP address. Does this matter? I was under the impression that if the local and ...

yottabit

Just a cautionary tale for all of you out there. When the 'detnet' and dynamic interface lists were implemented a while back, I just removed them from the default configs because I didn't trust them yet, and didn't want to bother with the hassle of something trying to automate what I typically didn'...

yottabit

So it's completely awesome that the preshared key option was added to IPIP setup, which automatically creates all of the tedious IPSec configuration parameters. But... how does this work (and it does work*) without 500 (IKE) and 4500 (IPSec NAT) open on the firewall? i.e., everything is configured e...

yottabit

Sure, the Wi-Fi performance is worse, and by design. Apart from the initial issues that they have fixed, it specifically has lower EIRP and fewer chains. I actually don't use the Wi-Fi on my hAP ac2. I have it enabled for worst-case management connections only; but I feed multiple RB962 (hAP ac) int...

yottabit

It does not "overheat," in that I have not noticed any performance problems when the router is "hot." As others have said, the heat may contribute to premature failure of the device, but that is conjecture at this point. Mine is serving a 150M/150M Internet connection with period...

yottabit

I upgraded to the hAP ac^2 for the faster CPU over the hAP ac, because my QoS rules were hitting the CPU limit. So I'm using the CPU quite a lot, and have been running this for months in an ambient temperature of 29 C without direct airflow. It feels hot, but it must have been designed for a high op...

yottabit

You can sign up for email notifications from Mikrotik. I also follow Mikrotik's Twitter account and a non-Mikrotik Twitter account for release notices. There's a subscription field at the bottom of the downloads page: https://mikrotik.com/download Twitters: @mikrotik_com, @mikrotik_build Sent from m...

yottabit

I've scoured documentation on the Wiki and in the forum, and constructed a quick tutorial on how to set up ingress PCQ for managing low-rate or quota-limited Internet connections. I've tested the burst and throttling successfully, but I do have a couple remaining questions about the ring buffer beha...

yottabit

Why not create a connect list rule that disallows the TV from the 2 GHz radio? Then it will not have a choice but to use the 5 GHz. I have found that all of the ChromeOS-based devices in my home (not just computers...) jump around a lot when there are multiple 5 GHz APs available with the same SSID,...

yottabit

I wonder if RouterOS offloads WPA in any way to the SoC, or whether it's done completely in software. I suspect the latter, so I'm hopeful we can get the upgrade, as long as it isn't driver-blocked by the older kernel used by RouterOS.

Sent from my Pixel XL using Tapatalk

yottabit

OK cool, so what you wrote indicates that it always extends higher first, and then lower. Indeed, that does change where I think I should put my base channel. For particularly difficult environments, it would be a nice feature if we could control the direction (i.e., allow it to extend lower first, ...

yottabit

When setting to 80 MHz, you have the C/e notation to pick your base/control channel and extension channels. If I pick 5745 Ceee, it's common sense that the base channel is 5745, and then I would expect the extension channels to grow higher in sequence, e.g., 5745->5765->5785->5805. Likewise, if I ch...

yottabit

Since your upstream speed is so low, you'll be just fine using the hAP ac as a router, even if you implement QoS in the future. If you ever get 100M+ upstream, *and* want QoS, you can buy a more powerful router for that when you need it (e.g., hAP ac2, or whatever its successor may be). Sent from my...

yottabit

Yes, by increasing the antenna gain value, the radio will automatically adapt to proper power levels for the different modulation types, as well as maintain regulatory conformance. Essentially you're "faking" a higher gain antenna, so the radio backs off appropriately to maintain the maxim...

yottabit

Startus: the hAP ac model has superior wireless over the hAP ac2, with higher radio power and 3 antenna chains per radio instead of only 2. But the hAP ac2 has a much more powerful CPU, quad-core ARM v. single-core MIPS. I am using the ac2 for my router as the ac maxes CPU for me with my QoS rules. ...

yottabit

Just don't use the Wi-Fi. I have mine disabled, too, as I use the more powerful hAP ac model for Wi-Fi. The RB3011 is also ARM, but dual-core instead of quad-core, and it costs more. I think the hAP ac2 is still the best fit. But the RB3011 would be adequate, too. Sent from my Pixel XL using Tapatalk

yottabit

Cool, let us know. And be sure WMM is enabled on all Wi-Fi interfaces you're running.

Sent from my Pixel XL using Tapatalk

yottabit

I've had RouterOS default to a 5m lease on DHCP, and this has caused problems with Android and Chromecast devices. Should it? No, but it did.

Increasing the lease time solved that problem.

Sent from my Pixel XL using Tapatalk

yottabit

If you want to keep the config as-is, yes, you'll need a faster router. The hAP ac2 should work nicely for you with its quad-core ARM CPU.

Sent from my Pixel XL using Tapatalk

yottabit

The RB450G has 5xGbE ports and should be able to route with fast-path at over 600 Mbps. If you don't know what PCQ is, I advise you to ask the person that configured your router. If you bought it used, you need to reset to default and start over. https://mikrotik.com/product/RB450G#fndtn-testresults...

yottabit

You have PCQ set to 64/65M. You have a complex set of QoS rules with passthrough=yes on the rules which means the entire list is being processed for each state. I don't think fast-path can work with your QoS rules. You didn't answer to where you tested, using which model of station device, and wheth...

yottabit

Increase group key TTL to 1h and increase DHCP lease to 1h. This nearly always fixes problems I've experienced like you describe.

Sent from my Pixel XL using Tapatalk

yottabit

Google DNS is highly reliable and globally diverse. 8.8.8.8 and 8.8.4.4.

Sent from my Pixel XL using Tapatalk

yottabit

What? The model number is on the label, in Webfig, in Winbox, and in the CLI. Post the output of "/export hide-sensitive" and we can also check to see if you have fastpath enabled, and expensive QoS rules, etc. Also let us know how you're testing the speed, e.g., to which sites, using Wi-F...

yottabit

This is caused by a computer, or other device, on your network sending a flood of requests to Google. They are classifying the requests as a denial of service attempt and blocking you from the rest of their network. I've had this caused once by sending logs to myself via Gmail from an automated syst...

yottabit

I've never met a router I liked that defaulted to 192.168.0.0 or 192.168.1.0! [emoji38]

Sent from my Pixel XL using Tapatalk

yottabit

802.3af/at standard is "active" PoE. It requires negotiation by the devices. Passive PoE is a different, incompatible standard. Mikrotik makes Gigabit Passive PoE injectors you can use if your switch doesn't provide *passive* PoE output. Also, most Mikrotik devices accept PoE input on port...

yottabit

I'm using 6.42.1 on my hAP ac2, and haven't had any problems with DHCP server or client. My ISP is Frontier neé FiOS, and I have about 40 devices on the LAN. I have APs subtended from the router and am not using the router's Wi-Fi.

Sent from my Pixel XL using Tapatalk

yottabit

Check your encryption settings, too.

Use WPA2+AES (only), or WPA+TKIP (only). Don't mix them, if at all possible.

Sent from my Pixel XL using Tapatalk

yottabit

Make sure WMM is set to enabled. This fixes problems with iOS devices on my network, and makes battery life much better on Android devices.

Sent from my Pixel XL using Tapatalk

yottabit

For those that aren't understanding why this method is easier on the CPU, it's because tracking a connection, and then looking it up in the conntrack table is far faster, and far less CPU-intensive, than deep-inspecting values in the individual packets.

Sent from my Pixel XL using Tapatalk

yottabit

Here's my setup, only slightly out-of-date. I have thorough comments added as a teaching aid. This should help.

https://docs.google.com/document/d/1G6o ... p=drivesdk

Edit: link permissions fixed.

Sent from my Pixel XL using Tapatalk

yottabit

Comment #6 is spot on. I use this methodology, what I call 2-step QoS, on a fairly involved tree queue for all egress traffic. I only have to deep inspect the first packet of a new connection, and then rely on the fast conntrack table to apply packet marks for enforcement. Using this method I can ev...

yottabit

The internal antennas in the hAP ac2 are 90-degrees offset. Try aligning your wireless adapter antennas the same way (1 horizontal, 1 vertical, 0/90 degrees; then +45/-45 degrees), and see if this can make further difference.

Sent from my Pixel XL using Tapatalk

yottabit

Also remember that DNS operates on both udp/53 and tcp/53, so you need two rules to block them both. I set my router to use OpenDNS kid filter for DNS, then give out my router as the DNS server via DHCP. I then have firewall rules to block my kids from overriding DNS on their own computer, forcing t...

yottabit

I think sometimes given the exceptionally reasonable price of Mikrotik hardware and software, we lose sight of the economy of the whole situation. Even paying for a license upgrade, where can you find a comparable product for anywhere near this price? Coming from the Cisco/Juniper/Arista market, I'd...

yottabit

How to do it?
How to update to 4 level

You buy the license key from Mikrotik and enter the key. There are instructions in the wiki.

Sent from my Pixel XL using Tapatalk

yottabit

You just need to upgrade to an L4 license. I've done the same for the old RB911 5 GHz product.

Sent from my Pixel XL using Tapatalk

yottabit

You could also turn on IP accounting in RouterOS.

Sent from my Pixel XL using Tapatalk

yottabit

Surely there is a way for a Check Box to Be Added on the Check for Updates part of Winbox that Dynamically adds a Permanently Selectable Options "Update the Router Board Firmware" at the same time as the ROS Software is ( Release Candidate or Stable Etc ) updated ( may or may not require ...

yottabit

I do not know whether you have upgraded the routerboard firmware as well (under system->routerboard tab) what do you mean by "upgrading the routerboard"? I installed the rc5 firmware as described by MikroTik using Winbox. Anything else i have to upgrade besides the firmware of the device?...

yottabit

It came with a US power adapter, but I can't recall if it was the US or International SKU. The country selection in the wireless band settings isn't locked, so I'm pretty sure it is the international version.

Sent from my Pixel XL using Tapatalk

yottabit

I'm just starting a new network setup. It's a simple topology: <--ether3> bb01 <ether2--ether1> sw01 <ether2--ether1> sw02 <ether2--ether2> bb02 <ether3--> (to bb01) bridge1 is created on each device, with RSTP enabled. The ports listed above are added to the bridge. I can ping between them. But no ...

yottabit

I just bought mine from EuroDK.com. Even with international shipping, the price is about the same as in the US.

Sent from my Pixel XL using Tapatalk

yottabit

My hAP ac2 is in a room at 27C ambient, with very little airflow. I don't use it for wireless, but it is being used for routing with an involved QoS setup, and The Dude running. I'm having no problems with it. The ARM CPUs are much more advanced than MIPS. You have to expect they will consume more e...

yottabit

Curious as to why DHCP server seems to assign then, moments later deassign...see screen shot. Check the cable and intermediate equipment. I had this when the cable was damaged. Надіслано від мого Redmi Note 4, використовуючи Tapatalk You can set a longer DHCP lease time in the DHCP server settings....

yottabit

Yes, that's expected. The firmware version now matches the ROS version. That change was in 6.41 iirc.

Sent from my Pixel XL using Tapatalk

yottabit

Have you been updating the firmware as well as the software? System, Routerboard, Upgrade May or may not be related, but worth a shot. iirc, some firmware updates include bootloader updates, too. Or it could be the flash NAND wearing out. Are you writing logs to the (internal) flash? Sent from my Pi...

yottabit

The easiest way is to do port mirroring and send all traffic to be captured to selected port where proper hardware could be used to store incoming data.

Yes, port mirroring to an external device (running wire shark) is the proper method. Beat me to it.

Sent from my Pixel XL using Tapatalk

yottabit

Has anyone ever heard of Mikrotik referencing a possible x64 native version of winbox? I only run winbox in Linux, and a very specific distro I'm using right now does not have wine32 support (only wine x64). As such, I cannot fulfill the dependencies required to run winbox. x64 Windows has been arou...

yottabit

Good point. I was put off by that product due to only having 27 dBm EIRP, but I don't actually need the wireless functionality. The testing data shows it is significantly faster processing QoS than the hEX. They're cheap. I guess I'll just buy one and see how it works out. I really, really wish Mikr...

yottabit

Hey everyone, I have a couple dozen stations connected against three hAP ac units. I have all three units logging to a syslog server, which is handy for correlating events when troubleshooting. But sometimes I would just like to visually see which Wi-Fi stations are connected to which AP. Or even ju...

yottabit

Also I think the band you've chosen is uni-2, which in the regulatory domain of United States limits you to 220 mW. Try setting to 5.7 GHz uni-3 band, which is allowed at full 1W. May not apply to your locale, but worth a shot. Some netmetal 5 radios can even support greater powers, 1.3W I think, de...

yottabit

I've upgraded all my Routerboards without any problems.

I suggest doing a backup first of course, in case something goes wrong and you need to revert.

yottabit

Yes, should work just the same. I think all Routerboards with Wi-Fi support this mode since implementation of the "repeater mode" several versions of RouterOS ago.

yottabit

Intel Wi-Fi drivers are *horrendous*. Seriously, I've lost years off my life expectancy because of them. They're slightly better on Linux than Windows, but still awful. I ended up attaching a Routerboard in station bridge mode via Ethernet to my computers with fixed Intel Wi-Fi. Sent from my Pixel X...

yottabit

The hAP ac lite has much lower radio power. Don't look only at antenna gain. The difference in gain between 2.0-2.5 dBi is negligible. Remember dB is a logarithmic scale. Since you only need coverage for a small area, the hAP ac lite would be ideal since its signal will not propagate as far (you can...

yottabit

According to the wiki , if IGMP Snooping is Enabled on the QCA8337 (hAP ac), this should disable the hardware offload feature of the switch. However, RouterOS isn't indicating that this is happening. So which is it? I would like IGMP Snooping enabled, but I don't want to sacrifice hardware offload. ...

yottabit

Hi everybody, today I heavily studied this thread to configure a RBmAP2nD as traveling wlan router. Thanks to all contributors and especially to yottabit for his google doc with the export. With this lines I could adapt it to the RBmAP2nD with only one wireless antenna. Now I've only the problem de...

yottabit

I can always use ether1 to get in if I bjork up the station Wi-Fi parameters. Slightly annoying, but really not that big of a deal, even with my Chromebook. I think the solution to this would be if MikroTik could make the default station scan mode operate in the Background Scan mode like they allow ...

yottabit

Here's my config, for reference. Note there is one other change I made that may or may not make a difference. Since I'm using the new 6.41 now, there are these address lists called LAN and WAN that have a special significance. The default srcnat masquerade firewall rule is out-interface=WAN but I ch...

yottabit

Yes, it's perfect for this. I use it in hotels to enable Chromecast on the hotel TV, and on airplanes to share a single Wi-Fi purchase with my family or coworkers. Specific answers: 1. Yes, but the configuration is a bit tricky. First you need to create a Virtual AP on top of the base radio interfac...

yottabit

Would the Wireless Wire product be capable of operating indoors, in a residential construction home? i.e., drywall, wood, no metal structures. What sort of speed could I expect passing through 1 or 2 gypsum drywalls?

yottabit

How did you get RouterOS installed in a bhyve VM? I can't get past the bhyve UEFI shell when trying to boot the ISO to install.

yottabit

Updated my script to reflect the new RouterOS version requirements.

https://docs.google.com/document/d/1gdy ... Fv6aU/edit

yottabit

Feature request: increase log timestamp granularity from whole seconds to milliseconds. Otherwise it can be difficult to correlate events when a dozen or more hit within the same second.

yottabit

Feature request: increase log timestamp granularity from whole seconds to milliseconds. Otherwise it can be difficult to correlate events when a dozen or more hit within the same second.

yottabit

There is the hap, hap lite, hap ac, and hap ac lite. They're all for different models with different SoCs. But the hap lite is the only one that uses smips build. iirc, they won't attempt an upgrade if you upload the wrong architecture. So in your case something went wrong, but hard to say what. Jus...

yottabit

hap lite and hap ac lite are different products.

yottabit

Yes, my config was built using 6.35rc and applies also to the current release of 6.35. You still need to activate the new wireless-rep package per my instructions as it's not the default wireless package yet.

yottabit

There are no typos; this was a copy & paste from a running config export. What model of RouterBoard are you using? If you're not using the exact same model, you will need to make adjustments to the script. And if you have not updated to the new RouterOS v6.35, and enabled the new wireless-rep pa...

yottabit

I'd really appreciate a working config that I can dig through to understand. My other problem is finding a sequence of steps to get from the factory-default RBmAPL-n2D WISP AP configuration to one where the (only) Ethernet interface is on the LAN without losing Winbox connectability. (I can always ...

yottabit

Took me a while to get around to it, but here's the config I'm using successfully for this setup. Feel free to use and modify as-needed!

https://docs.google.com/document/d/1gdy ... YnDcLFv6aU

yottabit

It's still under test and development, with new updates released sometimes multiple times per day. I suggest you enable debug prefix for wireless logging to see more information about disconnects. Upgrade often, too. And when you have the disconnect problem, post in the forum topic for the release c...

yottabit

I haven't had the problem, but I haven't used it on mAP. In order to do simultaneous station + AP you will need wireless-rep package. The earlier wireless packages do not support this operating mode, and when I've tried in the past the station will work but not broadcast any AP when a Virtual AP is ...

yottabit

I´ve tried to upgrade my "hap lite" (smips) from rc21 with wireless-rep to rc25 via winbox: System -> Packages. This doesn´t work with the following error: ERROR: not enough disk space, 7.7MiB is required and only 7.1 MiB is free. Have you tried from a fresh boot (i.e., empty ramdisk)? If...

yottabit

Yes it can. Change wlan1 to station pseudobridge, connect it to a Wi-Fi network by using the scan function. (Remember to setup a security profile if needed for Wi-Fi encryption.) Then setup firewall to src NAT that interface. Create a Virtual AP on the same interface. Ensure both wlan1 and the Virtu...

yottabit

Running rc21 just now on rb962 (hAP ac). I started with a blank config and ended up in a boot loop: Changed wlan1 (2 GHz) to station pseudobridge Scanned Chose a network Clicked connect Appeared to start connecting and then the router rebooted and got stuck in a boot loop. I had to clear the config...

yottabit

No, probably a disadvantage in performance and/or reliability, actually. Specifically this breaks layer-2 since you can't bridge multiple MAC addresses across station mode per 802.11 spec. So you end up using Station Pseudobridge mode which does a sort of NAT for MAC addresses. WDS avoids all that m...

yottabit

Connection to non-Mikrotik and still use one radio for station and AP modes simultaneously.

yottabit

One suggestion for this release if at all possible, or the very next release: file manipulation in Webfig. Per this topic from eight years ago, the only way to move files within RouterOS is by using Winbox or by FTP to locahost. I'm fine with that as I enjoy Winbox and use it very often. However, no...

yottabit

Running rc21 just now on rb962 (hAP ac). I started with a blank config and ended up in a boot loop: Changed wlan1 (2 GHz) to station pseudobridge Scanned Chose a network Clicked connect Appeared to start connecting and then the router rebooted and got stuck in a boot loop. I had to clear the config....

yottabit

Friendly bump to see if anyone has tips for forcing the :resolve command to use an external server?

yottabit

I have a static IP mapping for a host to resolve to an internal IP. However, in my script I want to resolve the public IP by using an external DNS server. Seems simple enough with the ":resolve <host> [server=1.2.3.4]" script command, but it's not working for me. It seems the :resolve comm...

yottabit

I tried that and it didint work, virtual interfaces can be set to station, but they cant scan for networks.. Did you try my second thought? Setting the main physical interface to Station and then adding a Virtual AP on top? I gave away my test RBs recently so I don't have any extras I can use to te...

yottabit

The repeater mode allows you to make a client and an AP both on the same physical interface. You don't need two interfaces. That is the best about this new feature. It seems some of the above posters missed that. Hi Normis, What is required to have this work? Should only Virtual interfaces be used?...

yottabit

wireless-rep means repeater, yes. it also has a new wireless driver and many other new features, so It can't be placed as default yet. I would propose a new wireless package for testing should just be called something such as "wireless-test", and stable wireless packages should be called,...

yottabit

Do we need repeater function? It will be probably easier to configure than wds, maybe it will bring compatibility with other vendor's APs, but do we really need it? I think this is intended to address what is commonly called WISP mode in other vendors' equipment, where the single radio can operate ...

yottabit

IT'S HAPPENING!

http://forum.mikrotik.com/viewtopic.php ... ep#p518473

RouterOS 6.35rc1 has a new wireless-rep package for Station+AP mode!

Documentation still lacking, and unsure if *all* chipsets, or just a subset, will support this.

yottabit

Great news! Thank you!

yottabit

The RouterOS download page only lists the "hap lite" product under smips architecture, and the new "hap ac lite" product isn't mentioned. Which architecture does it use?

yottabit

Of course. All Routerboards can do this.

yottabit

I wish it were a feature, too. But now that we have the ridiculously cheap hAP lite model, well I just buy two of them and rubberband them together. One in station bridge, and the other in AP NAT routing mode. Better performance anyway, and you could even pick the hAP model for higher-powered (full ...

yottabit

Dst-port from outside, not src-port.

yottabit

Other vendors, such as TP-Link implement simultaneous station + AP mode in Atheros chipset. It is a very useful feature for, e.g., creating small AP cell in a hotel WiFi environment. The Atheros chipset supports it, so it would be nice if Router OS would implement.

yottabit

I just tried again with my new hAP lite, RouterOS v6.27.

Still doesn't work.

akoni@, why do you think this WISP Client mode is supported? The "WISP" QuickSet does not configure for the mode we're trying to implement here in this thread.

yottabit

Connect multiple APs by wire, and configure APs on non-overlapping channels (i.e., 1, 6, 11, in the US) is always best. However, if there is no feasible way to connect by wire, WDS works great. Just keep in mind you'll get half the bandwidth since the radio will split the time between AP mode servin...

yottabit

No matter which channel I select on the NetMetal 5, it always transmits on Ch 36. I think this explains why I could never get a strong signal when running in country-regulatory mode since in the US the UNII-1 band is limited to 50 mW. I was able to get a much better signal when I went to manual-powe...

yottabit

i am use 922UAGS-5HPacT have the same problem. intel 7260AC connet 922UAGS-5HPacT work on a/n/ac mode 54Mbps,but work on a/n mode 270mbps. :? This is not quite the same problem since you're using a non-MT station, but I had to chime in here. The Intel 7260 AC radio is a complete piece of crap. If y...

yottabit

i am use 922UAGS-5HPacT have the same problem. intel 7260AC connet 922UAGS-5HPacT work on a/n/ac mode 54Mbps,but work on a/n mode 270mbps. :? This is not quite the same problem since you're using a non-MT station, but I had to chime in here. The Intel 7260 AC radio is a complete piece of crap. If y...

yottabit

+1 to the .11ac chipset reporting Current Tx Power.

yottabit

for me wireless-fp and new v6.19 gave every mk wireless device much more stability, better throughoutput....so I recommnend it... I'm a bit hesitating in upgrading to 6.19. It wouldn't be the first time that while halfway the upgrading of my entire network some reports surface on this forum still s...

yottabit

uldis, I have upgraded to 6.17 and re-activated wireless-fp.

So far I've had a couple very minor drop-outs but I think I can chalk them up to multi-path interference due to the locations at the times.

I'll keep an eye out for it and send in a supout if I can catch it happening again.

yottabit

Maybe you're using some WiFi client I've never used, but in my experience with mobiles and computers, when the WiFi client jumps from one AP to another AP on the same network and with same SSID, the interface flaps and TCP connections are dropped. I'll play around with this sometime in the next week...

yottabit

MikroTik RouterBoards do operate in the U-NII-1/2/3 bands, but under the ISM rules. I have used all three bands successfully. Keep in mind that US regulatory rules limit power in the different bands. Band 1 is limited to 50 mW, Band 2 is limited to 200 or 250 mW (can't remember which), and Band 3 is...

yottabit

Ok, seamless then.

User wokinit wants seamless handoff, and that is not possible. TCP sessions will be disrupted and the application will have to reestablish.

yottabit

I am using a BaseBox 5 (912UAG-5HPnD) which is basically an RB912. I have a 2.4 GHz radio interface added (R11e-2HPnD), but it's lightly used (only by Chromecast units, really). All other devices are using 5 GHz with U-NII-3 Ce (40 MHz) configuration. The stalling seems to happen only my Android dev...

yottabit

I'd love to, but it's too sporadic and nothing shows in the logs, not even with debug log enabled. So it is what it is, for now.

yottabit

LOL. Can't we all just get along? I really wish they could get a few of these wireless incompatibilities and annoyances worked out.

yottabit

That's all well and good, but it is not transparent handoff like one would expect when using that term. Think 3G/4G handoff. That is not possible with standard 802.11. The decision to switch is the client's, and there is no coordination.

yottabit

Transparent transition between APs is not possible. This is not what WDS Mesh means. And this is not specified in the 802.11 standards. Some vendors (e.g., Cisco) implement this possibility I think using proprietary extensions and wireless controllers, but at great cost. I'm hoping someday the Mikro...

yottabit

I, on the other hand, have had intermittent wireless stalling issues with Android devices when using wireless-fp package with no other changes. Problems stopped when going back to legacy wireless package.

yottabit

I am using a BaseBox 5 and have added in a 2.4 GHz radio interface card. I'm using 5 dBi gain antennas and everything is working great.

1W power for both 5 GHz and 2 GHz in a single enclosure with PoE is attractive.

yottabit

On a semi-related note, I have been having occasional stalling with Android clients when using wireless-fp package. I have reverted back to the legacy wireless package and haven't had an issue since. When the connection stalls with wireless-fp, the client will be unable to access any network resourc...

yottabit

I question whether I should block the whole subnet since 172.16.42.1 is the default gateway and DNS, but I tried anyway to see what would happen. No effect. e # jul/08/2014 00:04:43 by RouterOS 6.15 # software id = 0ZZB-EWWY # /interface bridge add l2mtu=1600 name=bridge1 /interface wireless set [ f...

yottabit

Your reject rule needs to be on the forward chain not the input chain.

Thank you. I made that change but it had no effect.

I admit I'm practically useless with Linux ip tables. I'll have to study up. But any other ideas in the meantime are appreciated.

yottabit

Hi Folks, I'm trying to firewall hotspot users from reaching 172.16.42.2-172.16.42.254, but not having luck. What am I missing here? [admin@rb1.domehq] > export compact hide-sensitive # jul/07/2014 15:12:05 by RouterOS 6.15 # software id = 0ZZB-EWWY # /interface bridge add l2mtu=1600 name=bridge1 /i...

yottabit

I have two networks using WDS links between RouterBoards. No problems with them. But when I'm in a foreign environment and I want to join the Wi-Fi network and broadcast my own AP, I apparently cannot do that with RouterOS unless the foreign Wi-Fi is Atheros/Ubnt/TP-Link and I can use WDS. The $25 T...

yottabit

Why do you wish to take board out of case? My tool box goes to t2

Needed to install second radio interface and antenna pigtails.

yottabit

It's a T8 size for anyone curious. No, you probably don't have it laying around, either. Most kits of Torx bits only go down to a T10 if you're lucky. Latvia must have a shortage of slotted or Philips screws.

yottabit

Teeny tiny Torx screws? *sigh*

yottabit

Awesome, that's perfect!!

yottabit

That works! Nice recommendation, thanks!

It's a bit large for indoor use, and having to use the PoE pigtail will be unsightly, but I think it's workable.

Maybe in the future Mikrotik can offer the CA411-711 with an extra hole & grommet for that 4th antenna?

yottabit

Not all manufacturer WDS modes are compatible. You can try to use mode=ap-bridge and create a WDS interface to interconnect with your main AP. Then bridge together Wireless interface with WDS interface. I think I did try your suggestion. When I had the RB set to ap-bridge, using the same channel, S...

yottabit

I was considering buying an RB912 along with the R11e radio card. This optimum configuration would require four antennas, but the only case I see on RouterBoard.com that fits this model with the daughterboard is the CA411-711 and it only has three (3) holes for antennas. How is everyone else doing t...

yottabit

jarda, Unfortunately no luck. If I have the radio in AP Bridge mode, I can add a WDS subinterface but there doesn't seem to be any way to actually configure it for an SSID, channel, or security profile. If I use Client WDS or Slave WDS modes, the wireless debug log complains that the other device is...

yottabit

You can use AP bridge mode and add a WDS link (virtual interface) that connects to another AP. Than add virtual AP for connecting the clients. Routing/bridging is possible as wds link is independent interface to virtual AP from the L2/L3 point of view because they have their own mac addresses and i...

yottabit

Sadly, nothing yet. This is one of a few small features I'm missing in order for RouterOS to be a complete replacement for every type of router & firewall I use. For now, when WISP is needed, I have to resort to crappy, low-powered, cheap TP-Link pocket routers. For Chromecast specifically, I li...

yottabit

Big news! Will soon be able to go to full 1000 mW in the 5 GHz UNII-1 band! http://www.revolutionwifi.net/2014/03/fcc-eases-restrictions-on-5ghz-unii-1.html Hopefully these new rules can be added to the country domain settings for the US in an upcoming RouterOS update. And hopefully most (all?) of t...

yottabit

Alright, I'm giving up. Here's what I've been able to determine: RB can only connect to non-RB WiFi AP when Wireless mode set to "station" or "station bridge" (other modes try to negotiate WDS). When in "station" or "station bridge" mode, the Virtual AP functi...

yottabit

Well I've discovered that the Virtual AP SSID is only advertised/broadcast with the main wlan1 is set to "ap bridge" mode. If I set wlan1 to "station" or "station pseudobridge" it seems Virtual AP is disabled. Is this by design? Is there some way around it? What am I mi...

yottabit

Hi Everyone, I'm trying without any success to turn an RB951-2n into a WISP client that will NAT not only the Ether ports but also as a Wi-Fi AP, too. I'm just doing this as proof-of-concept and to further my knowledge of RouterOS. I've done this with TP-Link products, but I'm really having a proble...

yottabit

Alright so if I change Frequency Mode from regulatory-domain to manual-txpower, I can now get up to 27 dBm output power. Unfortunately when I do that, the CCQ plummets to 20% average and the Mikrotik Bandwidth Test goes from 80 Mbps Rx to 6 Mbps Rx. So I'm going to assume the problem with this model...

yottabit

The RB751G spec is 1000 mW output power (31 dBm). However, running RouterOS 6.7 with Tx Power Mode set to Card Rates and Tx Power set to 30 dBm, the Current Tx Power is only 17 dBm. Running in United States regulatory domain, and 1000 mW is max allowable for 2.4 GHz. [admin@rb1.domehq] > interface w...

yottabit

Well been running v5.26 on both RBs now for two weeks with zero problems. Guess I'm staying in the old release. The killer feature for me on v6 was partitions, really. I probably won't have time to mess with it on v6 again for at least a month. When I do get time, if I feel like it's even worth it, ...

yottabit

Hi RouterOS Wizards, I have a 751G in simple AP mode. Eth1-5 and WiFi are in Bridged mode. The LAN is plugged into Eth1. Plugged into another of the Eth ports is a 911G, with a L4 license upgrade to run in AP mode, too. The problem is when I'm running RouterOS 6.x (tested with 6.1 all the way to 6.5...

yottabit

Nevermind, I just figured it out. But there might be a bug involved here, too? After running a sweeper I noticed my frequency selection never took effect. The lowest channel (#36, 5180 MHz) was always being used, regardless what the RB was configured to use. Turns out, when DFS Mode is set to anythi...

yottabit

The RB911G-5HPnD product page states the radio has a 1000 mW output power (+30 dBm). Couple problems here: * 802.11a/n 5 GHz operation in the United States specifies a maximum power level of 50 mW (+17 dBm), 250 mW (+24 dBm), or 1000 mW (+30 dBm) for different channels ( U-NII 1/2/3 ) in the band, a...

yottabit

Running RB751G on v6.1 with firmware 3.02. Upgrade to v6.2 works, but trying to upgrade attempt to firmware 3.09 causes the RB to hang on reboot. Ethernet activity lights flash but not the Wi-Fi activity light, can't login, and the Ethernet switch doesn't function. Hard power cycling recovers the RB...

Search found 203 matches