MikroTik

omberli

Thanks for good info!!
-O

omberli

Hi, Hope you don't mind a rather non-tech question... I'm about to set up a point-to-point link over approx. 6-800 meter (free sight). Have done this many times before with older Mikrotik hardware, but have a problem to figure out the difference between two different Mikrotik products. Don't find bo...

omberli

I configured a 951 unit as a Home AP from the QuickSet menu in Winbox. WAN-port (1) is connected to a fiber modem, and the LAN ports (as a switch) support local units. All seems fine, except watching net-TV. Have found that I need to enable IGMP to make this work. Have downloaded the needed add-on a...

omberli

A short update. I changed the firewall rules according to the previous post, and accessing the winbox from external sites now works. The access to mstsc to 3 different internal addresses also works ok. When looking at a default firewall setup, I notice that there are no "new" state in the ...

omberli

Thanks for your response!! Seems like I need to update my router config skills quite a bit... ;-) Have tried to implement your suggestions. Does this seems better? (will not be able to test before doing the changes at customer's site next week... -Olaf /ip firewall filter add action=accept chain=inp...

omberli

Thanks for your response! Had to set up the router in a hurry, and found an old unit on the shelf... Will upgrade the OS as soon as I get physical access to the router. The fiber company say that their unit is in bridge mode (double checked), and I got a fixed, public IP, a gateway IP, a netmask and...

omberli

Long time since I did Mikrotik configuration, and setting up a router/firewall is now a bit challenging. I have a 951 unit set up as a router between a fiber WAN and a LAN with PC's, printers and 3 "servers" that should be reached from the WAN side by using MSTSC (Microsoft Terminal Servic...

omberli

Some time ago I installed an outdoor point to multipoint solution for a customer. There was a need to distribute Internet access to 3 buildings. Used SXT SQ Lite in the 5GHz band. Angle between the clients (seen from AP is approx 90 - 120 degress. Distance from AP to clients, around 50 meters. Syste...

omberli

Thanks for your responses. I'll work my way through the comments and see if I'm able to get this thing working.... Just a few comments.... anav: (1) The Attack-IPs address list was created in an attempt to block intruder attempts to my mail server. Happened quite often. It worked well on a previous ...

omberli

Thanks for comments! Sorry about confusing description. There are two completely different and separate networks. Old network has the x.x.x.240 public IP address, a RB433 routerboard and the CloudKey on the LAN side of the 433 board (Ether2). This setup works well, but the network will be closed / d...

omberli

Hi. I have a Ubiquiti CloudKey running behind a Mikrotik firewall. Works well. Firewall is set to forward tcp ports 8080, 8443 and 8880, as well as udp 3478 to the CloudKey's local ip (192.168.1.49) Need to move the CloudKey to my local LAN, where I also have a Mikrotik Router. Have tried to set up ...

omberli

Additional info: The SXT sq units are configured as bridges (AP bridge and Station bridge)
All units are in the same IP-range (192.168.200.x/24)
-Olaf-

omberli

I have set up a short wireless link (30m) with two SXT sq units - one as AP, the other as client. Both have fixed IP addresses. The AP is connected to an Internet router with DHCP server. At the SXT client end, there is a switch and a camera controller (NVR). There is, however, a problem for the NVR...

omberli

r00t.. Thanks for explaining. I don't know anything about interference or available frequencies unil I get on-site. Will give nstreme a try then. In my test setup I got speeds of around 80-90 Mbit/s when connecting to an external speed test site through the mentioned link and a 100Mbit fiber access....

omberli

anav...
Probably nothing wrong with the Cube setup. Don't know it....
My reason for using the SXT sq is that I have several of them avilable after un-installing a few "last mile" systems recently.
-Olaf-

omberli

Thanks. Have set ut two SXT sq units and tested the protocols. Speed and ping seems to be almost the same for 802.11, nstreme and nv2. On nstreme I got some disconnects with the log message: lost connection, not polled for too long. Not sure why (have not worked with nstreme before). Seems like sett...

omberli

I'm about to set up a short (50m) point to point link using two 5GHz SXT sq units. Have done this before, but mainly over long distances (1-6 km) using the nv2 protocol. It works quite well. Not sure,however, if the nv2 protocol will give the best performance for this short distance, or if 802.11 ma...

omberli

What seems strange to me is that the dstnat rules on my home router should stop the communication to the external server. Had the understanding that the dstnat worked only on inbound traffic. In my previous post, in the "home-fw" script under /ip firewall nat, the rules that made the probl...

omberli

Hi. Thanks for responding. Have attached the firewall export (fwexp). BUT - I have discovered that I most likely have created the problem in my home router (also a Mikrotik)... I will soon move the Unifi controller from the external site and into my home LAN (which also has an official IP). To prepa...

omberli

The problem is for WAN users (outside) to reach the Unifi controller on the LAN side.

omberli

Hi. I'm setting up a simple Ethernet router (public WAN IP) to get access to a Unici Cloud Key on the LAN side. Using an old RB433 board with Ether1 as the WAN and Ether2 as the LAN interface. Have configured a number of MT routers previously, but this one refuses to give me access throuh the router...

omberli

Tried to set up a "Hairpin rule" in my router, but couldn't make it work. Follower instructions at https://yaleman.org/2014/10/23/hairpin-nat-on-mikrotik-v6-19/ but something went wrong, and all Internet access was lost. Had to restore the old firewall rules from a .rsc file. Is there a sc...

omberli

Thanks for the feedback! Seems like I need to set up a hairpin rule in my Mikrotik. Seeml logical. Looked around for a dns server that could run on a win10 machine in he LAN, but hairpin is probably easier. Strange thing is that this has been working well at another location with an old ZyWall route...

omberli

I've set up a RB951 as a router for our small office. Have a fixed, official IP-address. Several units are connected to the LAN and wifi ports on the 951 (that also works as a DHCP server for the LAN). In our LAN we have a mailserver running, and have set up firewall rules to forward ports (25, 487,...

omberli

Thanks again for the feedback. Yes, the server is a public SMTP server. It is handligng emails for just a handful of people - providing web and imap email as well as schedule to users both in the LAN and "on the road". The reason for running it ourselves is that we've been selling the mail...

omberli

Thanks, mutluit.
Fail2ban looks like an interesting tool. From what I'm able to see on the Wiki, this is running on a "Unix-like OS". My mailserver is running on a Windows box.....

-Olaf-

omberli

Thanks again for feedback and suggestions. Seems llike I've not been very accurate in my explanations.... (if I understand the firewall scripts mentioned above correctly). The problem is unwanted traffic from the outside (WAN) into my mailserver. Attempts to get access may look like: 00:09:05 0008F9...

omberli

Update:
I tried to add ranges of IP-addresses to the address list and found that if I entered ranges that were possible to convert to a subnet, then Mikrotik automatically did the conversion and added the correct netmask. Great !!
-Olaf-

omberli

Hi Anav. Thanks for your response. I'm running a mail server in my LAN, and have forwarded the needed ports for the outside to reach my server. I experience, however, that there is a lot of attempts to "break into" the server. The server is obviously refusing this access unless the "o...

omberli

I'm setting up a firewall (RB951) where I want to use address lists to reduce the number of rules. Some of the addresses I want to block are actually ranges of addresses - not entire subnets. Is this possible in RouterOS? If it is - how? Will it work to just enter the start and end address in the li...

omberli

Thanks again!
Yes, agree that checking another device. Have several units on the shelf . 951G 2HnD, 951UI 2HnD and even hAP ac lite. Will give it a try and report back.
As you say - if same thing happens with one of these, it's getting more interesting....

omberli

Browsed through the log and could not see any reboots. In addition, the AP does not "go away", but output seems to drop to a very low level. The monitoring I've used shows a normal signal of approx. -40dBm. This drops to around -70dBm when the problem shows up. I'll switch to another power...

omberli

Have installed a RB 951-2n in a customer's home. The unit is configured as a bridge with all ports in the bridge. Static IP. Everything seems fine, and customer connects their iPhones and an iPad without problems. After a couple of minutes, the signal from the AP drops significantly, and connection ...

omberli

nichky: Here is the export. Have changed the keys and ssid in the export file. # feb/24/2019 22:43:41 by RouterOS 6.42.6 # software id = R5WC-9DBR # # model = 951G-2HnD # serial number = 4F43041E5438 /interface wireless security-profiles set [ find default=yes ] authentication-types="" eap...

omberli

Thanks for all the info and suggestions.... Some further results / observations: - Changed wifi channel to 2412. Still same result: Virtual net with WPA shows up, and main net with WPA/WPA2 does not show up and can't be reached on the Mac - Customer's Mac is a 10+ year old iMac (21.5") - Runnin...

omberli

Thanks.
Good to know

omberli

I'm setting up a new (out of the box) SXTsq-5HPnD. It had router OS version 6.40.4 and firmware version 3.41. There is no suggestion to upgrade the firmware. After upgrading routerOS to 6.42.6 the information in (Winbox) System/Routerboard suggests upgrading to firmware 6.42.6. It seems like the fir...

omberli

After reading the Netinstall info it seems like it is not a tool to use in the current situation. The SXT unit is connected in a remote WAN, and a complete reinstall could make it very hard to reach it and configure it. Tried again to upgrade by putting a .npk file into the files and do a reboot. Th...

omberli

Have a SXT 5HPnD that seems to have stability issues. This showed up some time ago, after upgrading routerOS from 6.42.6 to 6.43.4. To sort out if it is the RouterOS version, I have tried to downgrade to 6.42.6, but it doesn't seem to work. Have done it many times before on other hardware, by upload...

omberli

Have done an export of the configuration and replaced some characters in the WPA/WPA2 keys. The AP is currently running with the normal wlan interface as well as a virtual ap. Normally the WPA/WPA2 key is applied to the main interface. When this is done, the Mac can't see the ssid. The Mac can see t...

omberli

Have a RB411GL access point running nv2 in the 5GHz band, with 2 clients connecting to it. It is set to 5GHz/A with a 20MHz channel width, and so are the clients. No problems for a very long time. Then added a third client and set it to 5GHz/A/N and 20/40 Ce. After this one of the initial client sta...

omberli

After some more investigations, it seems like the encryption on the access point and on the Mac is the problem. What I found is: 1. The (quite old) Mac seems to have only WPA encryption. 2. If running the AP without any encryption, the Mac connects fine 3. If running the AP with just WPA encryption,...

omberli

After some more investigations, it seems like the encryption on the access point and on the Mac may be the problem. What I found is: 1. The (rather old) Mac seems to have only WPA encryption. 2. If running the AP without any encryption, the Mac connects fine 3. If running the AP with just WPA encryp...

omberli

Have a customer who has been running a Mac - connected to wifi on a RB951. Has worked well for a long time. When trying to connect to his wlan recently he couldn't see his wlan, but detected a couple of near-by networks. I did a lot of checking and found that I could log on from my windows PC, from ...

omberli

Thanks!
Downoaded and will be installed soon.

omberli

Thanks.
I didn't see it because I didn't scroll past the long term entries.
-O

omberli

Have several Mikrotik units - indoor and outdoor that have been running without problems for a long time. After upgrading from Router OS 6.42.6 to 6.43.8 several problems are showing up. These include radar detection issues on some outdoor units and group key issues on indoor units. Tried to go back...

omberli

After some more investigation, it seems like the radar detection is the problem. Have tried an older version, 6.42.11, and it performs the same way. Going back to 6.42.9, however doesn't seem to have this problem. Probably because the AP is allowed to select a non-radar frequency??? I've seen severa...

omberli

I have a network with approx 30 Mikrotik units and am in the process of upgrading OS and firmware to latest version (from 6.42.6 to 6.43,8). After upgrading a 922UAGS-5HPacD and a 911G-5HPacD that provides a 6km link using the nv2 prodocol, the units don't connect anymore. I "think" this h...

omberli

Thanks for clarifying! Is it possible - in Winbox - to create and maintain these interface lists. I can see them defined in the default config script, but prefer to make configurations in a graphical interface.. ... Also found the lists in Winbox. Sorry for not checking well before posting.. :-( Any...

omberli

Thanks for the response! Only the LAN interface was enabled. Tried to change it to "All", but then only ether1 showed up in the list (from my LAN connection). Is this correct? However - this made the router show up in Winbox Neighbors on the WAN side. Additional note: It seems like Mikroti...

omberli

On two different occations I've experienced that Mikrotik units connected to a WAN network (with Ether1) does not show when refreshing the Neighbors list in Winbox. If I enter the unit's IP-address, I'm able to connect to it and manage it. Units are hAP ac lite and 951-2n. Both have RouterOS 6.43.7....

omberli

Have an AccessPoint and two clients, running nv2 in the 5GHz band (5GHz-A). One of the clients has started to get frequent disconnections, and the log shows "synchronization timeout". After the disconnect, the client re-connects. The problems started about a week ago. Previously it has bee...

omberli

Thanks! Have ordered a cAP ac that will run The Dude. It also seems like it will run on a x86 hardware. Does this mean that it could run on a PC (without Windows OS)? Is the CD image on the download page actually something that could be installed on a "clean" PC or perhaps on a virtual mac...

omberli

Thanks!
Yes, I'm aware of the risks related to using a web-based tool.
Have blocked all access to port 80 from the outside and also allowed the www service from addresses within the LAN. Hope this will be ok.

-Olaf-

omberli

I'm trying to figure out how to set up The Dude in order to simplify my administration of 50+ Mikrotik units. Have downloaded the server (npk) and client software. Client software is installed on a win7 PC and starts ok (I think). On the server side, I uploaded the npk file to my Mikrotik unit (have...

omberli

Solved the problem.
Had messed up groups/users and Webfig profile.

Thanks for the help!

omberli

Thanks for the interesting info about Webfig. Have tried to set up a new skin and have disabled access to several things. Have kept mainly the wireless settings, the logs and system (for upgrading software). Then added a new user and a new (limited) group and assigned the new skin to this user. When...

omberli

Thanks for good suggestions!
Haven't looked into Webfig yet, but will do soon.

If setting up Webfig with new skin on a router - is there a way to export or copy it to another unit - maybe with a (slightly) different configuration?''

omberli

Have just installed a hAP lite at a customer's site (a small fitness center). Customer asked to get access to the unit in order to change the WPA2 key when needed (they are offering wifi access their members). I'm hesitant to give them full admin access. Looked at the user setting, but didn't find a...

omberli

Is it possible to set up a Mikrotik unit, like RB951 or RB433, as a bridge and have it act as a firewall? Have tried to find some simple description (using Winbox) here, but it seems quite complex or hard to understand. My scenario is this: I'm sharing a 100Mbit fiber Internet connection among some ...

omberli

Thanks!

Good that this was only a test setup (and I didn' check the OS version).
All other Mikrotiks in my system are on OS 6.42 or higher.
Changing all passwords now...
-O-

omberli

Thanks for the info. Did an export from the router and have included it below. Seems like some strange stuff in there - things I've never entered, like the /ip socks access Also, at the end of the config - the /system scheduler. There was also a file on the router - 7wmp0b4swouv - that I have no kno...

omberli

I'm setting up a RB951-2n as a router with Ether1 as the WAN port and each of the other Ethernet ports as separate LANS (i.e. Ether2 is 192.168.2.0/24, Ether3 is 192.168.3.0/24 and so on). Separate DHCP servers are defined for each ethernet port. Have configured NAT and set up standard firewall rule...

omberli

I'm setting up a customer's wifi system with one or two access points. They want to change the wifi password once every month, They want to do this by running a batch file or a simple script - maybe enter the new password as a parameter. Is this possible in RouterOS (maybe with winbox?)

oberli

omberli

Thanks. Problem solved after changing the policies and setting the right login info for our mailserver. Another thing related to this..: If monitoring 25-30 access points / clients in this way (running the script on one of them) - how will this affect the performance of the monitoring unit? Is it a ...

omberli

Trying to set up a simple system to monitor my network (approx 30 Mikrotik APs and clients). Found an article at https://mikrotik.com/testdocs/ros/2.9/tools/netwatch.php that describes how to use Netwatch to do this. Set up Netwatch for a couple of units, and it reports correctly if the unit is up o...

omberli

I had a similar experience when upgrading to 6.42.3. Most of my approx. 30 units came online and worked as expected, but 3 units didn't respond to winbox. (All other services, like telnet etc. are disabled.). Two of these device turned up in Winbox after approx 2 hours, while the third showed up aft...

omberli

short update:
After more than 6 hours after the software upgrade, the Sextant mentioned above, suddenly became accessible from winbox.
Don't know why it waited so long after the software upgrade. Did a routerboard firmware upgrade afterwards, and it worked normally.

-Olaf-

omberli

Had this issue with 3 units so far. Two of them (one RB SXT G-HPnD r2 and one RB SXT 5HPnD) came to live after approx. 4 hours and seems to work normally now. The third, a Sextant, RB711-5HnD is still not accessible, but passes traffic normally. Have tried MAC login and MAC ping from wireless and Et...

omberli

Normis. Can't tell why I have been running the old version. Wasn't aware that there have been issues with the old version, and the units have just worked well..... I have now upgraded almost all my 30 units to the latest software, and also upgraded to the latest firmware. The process has been going ...

omberli

macsrve, Yes, I'm sure that it is not a customer's PC that is causing this.... Config is like this: customer PCs --- router/NAT --- Mikrotik bridge --- another Mikrotik bridge --- Internet Customer's PCs show with a different IP (the one on the NAT router) than the IP of the Mikrotik bridges. -Olaf-

omberli

Have received notes from my ISP that some of my Mikrotik units seems to be infected by Conficker. All the reported IP addresses are Mikrotiks running as wireless clients in bridge mode . Connected to these bridges are Mikrotik routers with different IP-addresses that are NOT reported. All units are ...

omberli

Hi I have a RB433 configured as a station bridge - connecting via nv2 to another 433 ap bridge. Wireless works fine. At random intervals, the Ether1 port (the only one in use) stops responding. Wireless is still ok. All ports (including wlan) on the board are linked together in a bridge, and the bri...

omberli

Sure. That would obviously be a better solution.
However - customer is quite cost sensitive

omberli

Thanks for your response. Makes sense to stick to only one standard :) I've not done a coplete spectral scan, but have used a tool called Network Stumbler. It sees only WLAN systems - not other devices. Only a couple of access points showed up (this is far out in the countryside). Found a channel wi...

omberli

Thanks for the response.
Sure, it seems like the WDS-link is quite sensitive to signal strength.
What seems strange, however, is that 802.11 /bgn seems less stable or more sensitive to high signal levels than 802.11 /bg. Is this correct - in other words - would it be smart to avoid the /n ?

omberli

I'm setting up 2 SXTs to cover the area between 2 buildings approx 60 meters apart. There should also be a link between the buildings. Configured the units as ap bridge and set up dynamic WDS. Mode was 802.11 /bgn. The wds link was established, but disconnected after just a few seconds. Found that s...

omberli

You're probably right.
Both boards with PoE "output" had been in use for some time...

omberli

My understanding is that the RB433 doesn't have PoE output.
What I've seen today is that it obviously did on that particular board.
I also tested on a couple of 433s in my lab. One seemed to have PoE output, the other didn't-
Strange...?

omberli

I have an installation with one RB433 and one RB411 - both powered by "local power" (not PoE). The boards are connected with a CAT5E cable between port 1 on the 433 and the single Ethernet port on the 411. While doing some maintenance on the 411 system I disconnected the local power adapte...

omberli

Thanks for the feedback. rextended: The supplier is heavily into Mikrotik and know it very well. They also recommended UBNT over Mikrotik in this scenario. It was supposed to be more stable in noisy environment. DimitriiP: My concern is what I've also seen on this forum, that Mikrotik may have some ...

omberli

I'm about to set up a wireless (+wired) network for approx 25 small offices where a number of persons / different companies will need Internet access. My first idea was to set up 2 Mikrotik APs (951 or similar) and a WDS connection between them. One AP will actually cover all the rooms, but it seems...

omberli

I've been using Mikrotik for several years without any problems. Longest link is 6km. Very stable in rain, snow and fog. Using it also indoor and like the WDS and virtual AP functions. Also using UBNT in a few installations (Nano Station and Pico station). Also works really well. Only things I'm mis...

omberli

Update. Finally got this BW limitation working! The article at http://wiki.mikrotik.com/wiki/TransparentTrafficShaper#Bridge was very helpful. Didn't have to set up more than a single, simple queue, so the mangle commands were not needed. The main issue, I think, is that I didn't find the "use ...

omberli

Am a bit confused. Had some contact with our Mikrotik distributor. They told me that BW control in a bridge isn't possible. The answer here seems to indicate that it IS possible...? Could someone tell me what to do in order to get BW control in a Mikrotik bridge (Ethernet - Ethernet). If not possibl...

omberli

Thanks. Tried to enable firewall (filter in the Bridge menu?) (Using Router OS 6.5). Set up a rule "forward" and had ether1 as In and ether2 as Out interfaces (testing on a 433 board). Still full bandwidth through the bridge. Am a bit confused about the diffeent interfaces in this config -...

omberli

I'm trying to figure a routerboard (433 or 751) as a bridge that I want to use to limit bandwidth on the Ethernet port(s). I have (by using Winbox) to set one of the Ethernet interfaces to a max bw (Rx/Tx), but still full bandwidth on all ports (All ports are bridged together). Have also tried to cr...

Search found 88 matches