MikroTik

Kaldek

I would like to try again, but maybe only initially upgrade my RB5009 Capsman and leave CAPs on 7.16.2?

I had all my cAp ax units on 7.17rc1 and upgraded the RB5009 to 7.17rc1. The only issue I had was the change in IPv6 settings I mentioned in an earlier post.

Kaldek

ROS 7.17 silently disables "Accept Router Advertisements" in IPv6 settings. This caused IPv6 to no longer be able to route to the Internet for my ISP. I am not sure why it does this. The closest release note item is this one which might be related? *) ipv6 - added IPv6 settings related to ...

Kaldek

It looks like the problem is only for Intel AX devices like (ax200/ax210 wifi cards) The Intel AX adapters are hot garbage. Last week I literally had a laptop with an AX200 card sitting next to one with a Realtek 8852CE. The Realtek was connecting to my cAP ax in the next room at 1201 Mbs (max rate...

Kaldek

Confirmed IPv6 pools and SLAAC is working again in 7.16beta7.

Kaldek

Just did a test with mDNS on two different vLANs, and it does not work with Netflix. It works with Chrome, Youtube, Viaplay, Etc. Any idea why this does not work with Netflix? I have multiple devices which support Chromecast, but Netflix refuses to cast to most of them regardless of whether they're...

Kaldek

It may sound weird, but DHCPv6 does not have ability to add default route. The option in RouterOS to do so is MikroTik's non-standard hack, it simply uses link-local address of DHCPv6 server as gateway. Which works only when DHCPv6 server is the same machine (uses same link-local address) as gatewa...

Kaldek

The O-flags means that you can use DHCPv6-client to get other information such as which DNS-resolvers to use. But if the M-flag is set then the Mikrotik is misbehaving because set M-flag means that the client is expected to use its DHCPv6-client to request which IPv6 it should use and gateway to ro...

Kaldek

You mean the ISP router waits for RA from your Mikrotik? Another thing to lookup/verify is if your ISP actually sends you a public nexthop to be used as gateway for your Mikrotik or if they rely on linklocal address instead (which lately seems to have become a thing among ISP's)? No, what happens w...

Kaldek

Ergo, IPv6 is way borked in 7.16beta4. I have to pull back from this statement until I do further testing. My ISP also changed the way they issue default routes for IPv6 and so I now I don't know if the core issue was 7.16beta4 or the ISP change. This particular ISP now requires that IPv6 DHCP and ...

Kaldek

After the upgrade I only had a global address showing for my Bridge - not my VLANs also. I copied the Bridge global address and changed the interface to my first VLAN interface and changed the global address in the 8 bits I have to work with in the /56 I am provided from 00 to 10 (for example for V...

Kaldek

Now I have to manually create the ipv6 addresses using the Bridge dynamic assignment as a guide, copying the address and changing the prefix slightly for each VLAN. Then the pool kicks in and routes and the rest get created dynamically. I'm not sure what you mean, can you explain this in more detai...

Kaldek

Anyone else unable to get interface assigned IPv6 addresses from pools in 7.16 (running beta4 now, no change)? Mine just says "couldn't add new IPv6 address already have such address (6)". Here's the base config which has been working for ages. This gets a prefix, then assigns the outside ...

Kaldek

I am assuming that the mDNS feature requires that the Firewall allows inbound on all the relevant interfaces for udp port 5353 for IP packets addressed even if addressed to 224.0.0.251 ?

Kaldek

No. It took longer for AX, because we switched from mikrotik in-house driver package (15 years old) to new chip manufacturer driver. Now all new hardware standard will come quickly.

In that case mate, I would really, really like a cAP ax with 6ghz support. Really really.

Kaldek

Folks I get the defense of Mikrotik here and the discussion around certificates. The work still has to be done; whomever is responsible for developing the adlist functionality should always assume the worst, and design to that.

Kaldek

It should not be an issue, because almost all websites are now https and all updates (Microsoft, MikroTik) are digitally signed so you cannot setup a website hosting trojaned ROS images. "Should not be an issue" isn't good enough. Supply Chain attacks are a real thing, and I don't know wh...

Kaldek

I'm loving the adlist function, but the security of sources is a real potential problem. Whether Mikrotik does it or it's done by yourself, every entry in an adlist should be validated to direct to 0.0.0.0 A question for Normis - is the adlist just loaded as a regular hosts file? I am concerned that...

Kaldek

Your best option here is to replace your core switch to one with multiple 2.5Gbs ports and an SFP+ port, and uplink it to the RB5009 using SFP+ (10Gbs). Then, use the RB5009's 2.5Gbs port to connect to the fibre ONT. Realistically for Mikrotik that switch would be the new CRS326 but it aint cheap. h...

Kaldek

The question you're actually asking here (without necessarily knowing it) is about calculating available WiFi airtime. There are only so many microseconds in a second, and each device on the network (which includes the AP) cannot transmit at the same time. So, each time anything is transmitting, it'...

Kaldek

Given the amount of yelling Mikrotik users have been doing about the previous lack of 802.11r, check out this stat from the recent Wireless LAN Professionals conference in Prague. This is from a Cisco employee directly: Of 8.7 million known SSIDS on Meraki gear, only 1.45% have enabled 802.11r. Scre...

Kaldek

If we were to wind back a bit regarding tagging/vlan and go back to documented basics

At this point, you should move this part of the discussion to the WiFi channel. On topic for 7.12rc1 though, was your problem resolved by using the guidance from the post by Ftoms in MT support?

Kaldek

I don't really get all this tagged/untagged discussion. The 802.11 frame header has no place for a VLAN ID, so, technically, wifi interfaces are never tagged. It's more about what happens on the access point once packets from clients come in from the radio, and yeah the way it's described is a bit ...

Kaldek

Not exactly the same as with vlan-id set to 1. wifiwave2 datapath propertiy vlan-id can be unset (as per your example) ... and in that case VLAN tagging is not done by wifiwave2 driver at all (the same as with legacy wlan driver setting of vlan-mode=no-tag). So yes. in this case bridge port implici...

Kaldek

So, wifi interfaces should in fact be among the tagged ports for the respective bridge VLAN, when VLAN filtering is enabled on the bridge. Except if the VLAN of the datapth is the same as the bridge's PVID, right? Because that's how mine behaves. Screenshot 2023-10-19 103340.png Screenshot 2023-10-...

Kaldek

#2. BRIDGE/VLAN interface "TAGGED" ports are expected to carry vlan traffic, and should not be applied to an access port weather its physical or wireless( unless your expecting a client to be using tagged vlan traffic ), there are 2x entries in bridge->vlan entries tagged, and untagged, t...

Kaldek

HERE IS A VIDEO SHOWING THE ISSUE https://www.youtube.com/watch?v=PLI-1Qm1Lp4 My view is that you need to first define the datapath for the primary wifi interfaces on the cAP ax. This is the conversation I had earlier in this thread about my own issues with dynamic bridge port and vlan behaviour on...

Kaldek

These wifi wave2's capsmans is not yet as fully functional as the legacy CAPsMAN, and I'm just pointing out where this vlan/datapath/ tagging function needs to be fixed.. My example I'm using is not in the production environment. I have 10 new cAP AX's on the shelf, and waiting to install once this...

Kaldek

Just trialed 7.12rc to try and get WAVE2-Capsman-Controller ( on a RB5009 ) to properly set VLAN datapath on a cap unit ( in my case a cAP ax ) set as a cap with the manager set to capsman. .. Anyhow the crux of the 7.12rc1 issue is that the allocated VLAN for each wireless-radio is being put into ...

Kaldek

Yes, you´re right, you have to configure the "Datapath" on the CAP itself in the Wifiwave2 menu. I guess this makes sense, when viewed (on the cAP) from the perspective of the CLI rather than the GUI: /interface wifiwave2 datapath add bridge=bridge name="Local Bridge" /interface...

Kaldek

I've found that some intel AX cards get weird preference for 2.4ghz. I really need to capture the 802.11k and 802.11v data and see if there is anything in there which is confusing clients. Thanks a lot for confirming this Kaldek. Same behavior here. Kind regards! Have a play with the adapter option...

Kaldek

Yes, you´re right, you have to configure the "Datapath" on the CAP itself in the Wifiwave2 menu. But this ist the way like MT mentioned it has to be. It was the answer even in one of my support tickets from the MT-support (SUP-115988) I totally agree that you have to configure much more l...

Kaldek

Did anyone testing 7.12rc1in a wifiwave2 device (hAP-ax3 in my case) notice some kind of stickiness to 2,4GHz frecuency? Previously roaming to 5GHz works flawlesly in 7.11, but now it seems some devices are kind of lazy to roam, even when they are quite close to the AP (2m away, literaly), unless y...

Kaldek

They are added dynamically to the bridge Can I ask you for an export of your Datapath settings for the wifi1 and wifi2 interfaces? There's something you're doing which makes the dynamic assignment work, and there's something I'm doing which is stopping it from working. Update: The only way I can ge...

Kaldek

@Kaldek, I moved all my Cap AX to be managed by CapsMAN a few weeks ago and have no issues. Running 7.11.2 right now and all interfaces, both main and slaves are added to bridge and correct VLAN, even if there is a bug that add PVID 1 right now, fixed in 7.12, everything works great and I LOVE that...

Kaldek

P.S. I don't suppose if you know whether wifi1 and wifi2 should also be dynamically added to the bridge or if it only applies to slave interfaces? I tested it just now and it only seems to apply to the slaves. That is, I need to manually add wifi1 and wifi2 to the bridge with PVID 1. They are added...

Kaldek

OK, turning off slaves static seems to fix it. Thanks for the assist; this has been a real pain for the last 6 months or so. I can only assume that the fact my setup worked even though the PVID of the slave WiFi interface bridge ports was set to "1" rather than 10 (the VLAN id that I use),...

Kaldek

I don´t know what you mean with "slaves static", but to enable the dynamic add of virtual wifi interfaces to the bridge it´s nessesary to enable the "Slaves Datapath" in the CAP menu on the CAP itself. This is the trick, without this setting nothing happens in the bridge or the ...

Kaldek

Does it also add the interface to the VLANs tab in the bridge as tagged? My VLANs for WiFi work fine regardless of the PVID setting on the port but they don't work at all unless the WiFi interface is added to the VLAN as "tagged". This happens automatically on legacy CAPsMAN. Yes, it does...

Kaldek

Yeah, does this do what I think it does??? Yes it does: [attachment=0]Screenshot_20231007-004343.png[/attachment 💪😁 Does it also add the interface to the VLANs tab in the bridge as tagged? My VLANs for WiFi work fine regardless of the PVID setting on the port but they don't work at all unless the W...

Kaldek

wifiwave2 - use CAPsMAN's "datapath.vlan-id" on CAP for bridge port "pvid"; << Thank you!

Yeah, does this do what I think it does???

Kaldek

wifiwave2 - automatically add wifi interfaces to appropriate bridge VLAN when wireless clients with new VLAN IDs connect; Is this the fix for WiFi slave interfaces adding themselves to the appropriate VLAN? I didn't see this happen when I updated my APs and my RB5009 (CAPsMAN Wifiwave2) to 7.11. On...

Kaldek

What hardware? What was your config?

Pretty broad statement without more info.

Kaldek

PLEASE Mikrotik staff that reads this thread ... reconsider the inline comments on the webfig and also the 'centering of everything'

I like the inline comments in WebFig. It's saving me a lot of time scrolling. I ask that Mikrotik don't change this back.

Kaldek

802.11r and 802.11k are now available in the WiFiWave2 package, with 802.11k enabled by default and 802.11r disabled by default. This is a good thing, because unless you're using EAP for authentication there's little benefit to using 802.11r. One could argue the lack of 802.11v is a negative but I w...

Kaldek

For what it's worth, I seem to have gotten some WiFi stability by disabling all of my access list rules in WiFi. I had noticed that in 7.8, some of my ACLs just did not apply, when those same rules (for a specific MAC address) worked on CAPsMANv1. When I upgraded to 7.9 and had the issue with not be...

Kaldek

Hah, interesting. Thank you so much, it solved my issue . It seems quite interesting to me that all ROS until 7.8 worked seamlessly with /interface/bridge/vlan/add bridge=bridge tagged=bridge untagged=ether5,wifi2-host vlan-ids=8 . However, from ROS 7.9 I have to have wlan interface as tagged, not ...

Kaldek

So theoretically, I should have bridge (with PVID7 - my default PVID is not 1 but 7) and over that vlan8 with VLAN ID: 8 - like in updated config in attachment, right? I've checked your updated config. Your WiFi interfaces on VLAN 8 need to be tagged as well. No, I don't recall exactly why that is,...

Kaldek

Looking at your configuration it looks like you have VLANs 7 and 8 in use. However, you also have two bridges. I don't know why this ever worked for you, but that's not the correct configuration. You should only have one bridge, with VLANs 7 and 8 added to that bridge. Do you want an implicit VLAN 1...

Kaldek

Nope, even disabling WPA3-PSK and Disable PMKID did not help - wlan devices unable to connect and obtain IP from DHCP (using vlans). Still the same issue...

Message me directly and I'll see if I can help you. I have VLANs with 7.9 and 7.10beta5 working.

Kaldek

ok, make that 4 of us, both of my Hap AX3 completely drop wireless clients after around 24 hours. They continue to advertise the SSIDs but no new registrations occur. I'm using CAPsMAN server on one AX3, the other AX3 is a client. Both stop registrations. As a test I rebooted the remote 'client' AX...

Kaldek

Anybody know if the DHCP server on 7.9 stable is borking stuff like Google Nest Doorbell DHCP requests?

I've confirmed that DHCP is working for all my devices on 7.9 stable. This includes the Google Nest Doorbell.

Kaldek

Anybody know if the DHCP server on 7.9 stable is borking stuff like Google Nest Doorbell DHCP requests?

Kaldek

Being a person that uses the webfig much more than winbox Why? Genuinely curious as to why anyone would use WebFig over Winbox if they have the option to use Winbox. It's way off topic for this thread of course, but I can't stand Winbox. The windowed and tabular format for sub-config items drives m...

Kaldek

*) wifiwave2 - automatically add a VLAN-tagged interface to the appropriate bridge VLAN; Does this apply only if both the CAP and the CAPsMAN device are running 7.9? I've got two cAP ax units running 7.9rc5 and my RB5009 is running 7.8 still due to the DHCP issues introduced in 7.9rcX, so I left it...

Kaldek

I have a working SFTP upload script for my RouterOS devices which uploads backups to an SFTP server. However, I had to stuff about on my SFTP server because the /tool fetch command using SFTP only supports HMAC-MD5 and HMAC-SHA1. I've raised a support ticket for this (in March) and just had my first...

Kaldek

CAPsMANv2 no longer has its own top level menu and it's just under Wireless. To set up a CAPs Manager you go Wireless->Remote CAP->CAPsMAN.

After that you really need to read the help page on WiFi Wave2, and also keep up to date on the 7.9rc release notes.

Kaldek

Looks like the DHCP options sequencing issue that broke Google Nest Doorbells has been reintroduced in 7.9. Please resolve! Confirmed this is indeed broken. DHCP failing for a multitude of devices in my environment with the "DHCP offering lease without success" log messages. It's happenin...

Kaldek

The only current way to get vlan and dynamic interfaces working on caps with capsman 2 is to disable vlan filtering on cap bridge. Then it will work. That's a short statement with a lot potential ramifications. For example, the PVID setting applied to ports in the bridge has no effect unless Bridge...

Kaldek

Looks like the DHCP options sequencing issue that broke Google Nest Doorbells has been reintroduced in 7.9. Please resolve!

Kaldek

I have a couple of cAP ax units arriving in a few weeks so I wanted to prep my network for the Wifiwave2 package with CAPsMANv2. It's pretty straightforward but requires some extra work, particularly if you have multiple SSIDs and those SSIDs are on VLANs other than VLAN 1. In the example below we h...

Kaldek

cAP is not really intended as the "only router in your house", but sure, you can use it for that.
But normally I would suggest hAP in such a case. cAP is more for large networks and CAPsMAN.

And large houses. Don't make me feel bad for having 4 x cAP ac!

Kaldek

For which use case would you prefer 4x4 MIMO APs, then ? If I was completely stuck with only one access point, and I had a 2Gbs+ Internet link, and many wireless clients, then I'd want 4x4. As it is, one AP has never been able to cover my entire house. With 3 teenage boys who all need streaming thr...

Kaldek

My only beef with the size of the unit is that it's very large (228mm) for only a 2x2 MIMO. Unifi fit 4x4 MIMO into a smaller footprint (197mm). If "long range" is intended then the direct comparison would be the Unifi U6 LR which is 220mm across but it's 4x4 MIMO. So yes, I think this is ...

Kaldek

Just deploy IGMP Proxy correctly: https://help.mikrotik.com/docs/display/ROS/IGMP+Proxy Darknate is correct but let me add context. mDNS as a standard is not meant to be reflected or repeated. Avahi is an implementation of the zeroconf standard that added mDNS reflection as a practical solution for...

Kaldek

I am just some SOHO guy, but when I had customised rates enabled my WiFi performance was terrible. It would randomly drop speeds to 30Kbs on the 5Ghz channel.

Went back to default rates, and the problems are gone.

Kaldek

That makes a lot of sense. I'm going to give it a go and see what happens tonight when I'm home. Thank you for the info!!!

Yeah no problem mate, curious how you decide to go. Mikrotik forums can be a lot like the old XKCD comic "Wisdom of the Ancients" https://xkcd.com/979/

Kaldek

For my second reply, let's talk about Provisioning rules and Configurations. You can absolutely use provisioning rules to do everything dynamically. If you do this, what you end up with is unique configurations for each radio MAC so that each radio chooses the channel you want it to, and it's enable...

Kaldek

Hi mate, I think you're trying to fit a square peg in a round hole here. You can absolutely have one SSID on both frequences and other SSIDs on only one frequency each, but the way you're trying to go about it looks off. First of all, Mikrotik has no AP-side band steering. It's a marketing term anyw...

Kaldek

Confirmed I am seeing the same problem on RouterOS 7.7. Pcap files have the VLAN tag, streamed TZSP packets do not. Mirrored the two side by side and I even have the File Pcap and what Wireshark saw both available in PCAP format.

Kaldek

Folks I'm going to call this one resolved. The solution was to not alter the default rates, either in CAPsMAN or if configuring the APs directly.

Kaldek

I have now moved all APs back to being under CAPsMAN management. No issues detected in the following 24 hours.

I'm going to call this one soon with a "solved" status about this being related to the custom rates.

Kaldek

Another update, 8 days since the last post.

No detected issues during this time.

Kaldek

The latest update is that this issue appears to have become rare . It's happened a couple of times but only for brief periods. I can only surmise at this point that there is something which is affected by the rates settings but not tied to it? I can only leave it as-is and keep updating this thread ...

Kaldek

Small update - the issue is still occurring but at the moment it is less often, and only seems to last for a few seconds. So few in fact that if I reach for my laptop which is wired via Ethernet I don't even have time to run some ethernet-level tests before the issue goes away again.

Kaldek

Yeah, I read that one. It doesn't say that the client is added to a ban list though, and regardless of RSSI even if it moves back into range.

Kaldek

If you get out of range (signal drops < -86dBm, that is in the -120..-86 range) for a bigger time than the "signal-out-of-range" in the allow rule, you get kicked out, for at least the duration of the signal-out-of-range time in the deny rule. Here 10 sec. Interesting. I did not know the ...

Kaldek

I've just noticed that even with the basic rates set back to "default" it's kept the old config with the specified rates. Very weird. I'm now resetting the WLAN configuration for the interfaces and creating them again. There are many other problems possible, linked to the first SSID data t...

Kaldek

Well, bad news. The issue occurred again. I do have some more interesting facts however: During the incident, any devices connected to the secondary/slave SSID had no performance issues (200+Mbs) During the incident, the affected device stayed connected and reported 400/400 Tx/Rx speeds with an RSSI...

Kaldek

It's been just over a day and I've not had any performance issues.

I'm going to let this bed in for a few days to a week, to see if it was indeed an alteration of the basic rates settings.

Kaldek

1. Because the environment is not fully clear field without disturbances and short range connections. Not being able to correctly receive the beacon (at basic rate) will give connection drops. With multicast and beacon transmitted there is no CRC check, no ACK, and no retransmit, as is with unicast...

Kaldek

Just one remark: extension channel XX or XXXX is giving you what channel? It is undefined with XX and XXXX. So it can be different with every interface restart, or every CAPsMAN channel reselection (which I hope is set to OFF) This is a bit of a throwback to when I didn't know "what was best&q...

Kaldek

You're misreading it. It's "-86 or worse for more than ten seconds" (-120 to -86) not "-86 or better".

Kaldek

Are all your AP's the cAP AC units? I had similar random 5Ghz drop-outs using very similar CAPsMan deployment for a restaurant. I believe the cAP AC was faulty / flaky -- 5Ghz was not stable. They are, but I also replaced one with an RB4011 (in CAPsMAN, so its radio config was identical) and it sti...

Kaldek

The venue I'm struggling with is a busy bar and ""fix 5Ghz stability on AC" resonates with me. What appears to happen is that 5GHz stops working (took me a while to twig) and devices are falling back to the very heavily congested 2.4GHz band. In my case the clients don't leave the 5G...

Kaldek

Righto, I might be onto something here. Yesterday before the issue occurred again I had re-entered the cusom rates on all APs. I have now set all APs to the default rates, so let's see how stable this is. The one remaining additional edit is access lists which boot hosts off an AP if the signal is -...

Kaldek

Hold on chum, just because I haven't specifically stated that, doesn't mean I didn't do it. This radio environment has channels carefully selected so that there are either no other radios on the same channel, or those radios have a seen signal of lower than -92dB.

Kaldek

Well, scratch my good news. I had yet another dropout, even on the direct config. Once again, the same behaviour: Only happens on the Master SSID, not the Slave SSID (Virtual interface) Lasts for a minute or two and them comes back I've done so many different things which haven't worked. So frustrat...

Kaldek

Well folks this issue came back, and hard. No changes were made aside from my RB5009 losing power recently and all the network gear rebooting. All of the cAP ac units are powered by the RB5009 (it's the PoE model). I have disabled CAPsMAN and gone back to individual AP configs to see if this resolve...

Kaldek

cAP ax is coming, as is CAPsMAN support for ax. I know this because I asked on the Mikrotik YouTube channel and Mikrotik said the cAP ax are in testing now.

Kaldek

I guess that for working WiFi roaming (read: 803.11 r/k/v) in Mikrotik network, one will have to use CAPsMAN even if network infrastructure consists of only 2 APs. 802.11 r/k/v are protocols that should be deeply understood before being concerned about the lack of them. 802.11r only really benefits...

Kaldek

Out of interest, are you running v7.x on the cAP acs?

Yeah, my cAP ac units are nearly always ahead of my router but everything has been running 7.X. All devices are on 7.6 (stable) now.

Kaldek

All APs and my router are now running ROS 7.6 stable for 4 days. So far, I have not seen this issue return. I don't know if it was 7.6 that fixed the issue or the rate settings.

Kaldek

This is the correct setting from Ron Touw guidance: /caps-man rates add basic= 12Mbps comment=12Mbs+ name=2Ghz-rate supported=12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps Check the setting for 5Ghz rate or try to disable them and use the standard rates. I had a good 24 hours where the issue didn't occ...

Kaldek

There might be something wrong with your rates: /caps-man rates add basic=18Mbps,24Mbps,36Mbps,48Mbps,54Mbps comment=18Mbs+ name=5ghz-rate supported=24Mbps,36Mbps,48Mbps,54Mbps You miss 18Mbps in your supported rate. And check your basic rate settings. Might be the best to switch them off see how i...

Kaldek

UPDATE: This issue appears resolved. Please scroll down to the posts from late December 2022 Hi folks, I have four cAP ac units all managed via CAPsMAN with two SSIDs, one for the regular network and one for IoT devices. It has been this way for a couple of years with no issues whatsoever. However,...

Kaldek

*) wireless - fixed incorrectly applied ingress priority to non-wireless packets; Can someone please explain what symptoms this fixed? I've had some seriously messed up WiFi performance lately (down to 12Kbs even though the MCS rate is 400Mbs) for one of my SSIDs on one of my cAP ac units. 7.6beta8...

Kaldek

This is easy. 1. Put your Chromecasts in a different VLAN 2. Set the Firewall so that your computers can connect to the Chromecast VLAN, but not in reverse 3. Also set the Firewall so that the Chromecast VLAN can reach the Internet (set up DHCP, all that stuff) 3. Install Avahi daemon on a Raspberry...

Kaldek

Yep, I've tried Netinstall, I can't see Device after resetting, I've tried several times... In Windows I can see that Network Adapter shows - "Unidentified Network" and "Cable is disconnected" I recommend watching my video on YouTube about how Netinstall works so that you're doi...

Kaldek

What's new in 7.4beta5 (2022-Jun-27 10:39): *) dhcpv4-server - placed option 53 as the first one in the packet; FYI this is necessary for Google Nest Doorbell (Battery) to work, as ROS 7.3.x changed the DHCP options order and the Google doorbell refuses DHCP offers if option 53 isn't first. Alterna...

Kaldek

Hi mate, I just saw your post. The answer to this is two things. First, you will need to make sure that you have a Firewall rule that allows inbound packets to the router from the Internet interface, but also from the VPN source IP address. That will allow DNS to the router. Note that in my example ...

Kaldek

So MS upgrade 10 to 11. MT is in the wrong. Just.... Really. Use linux for all I care.

You should not default to a position of "MS is wrong, because MS" rather than considering that non-RFC compliant use of UDP and IP is the real problem.

Kaldek

My RB5009 routinely gets stuck on reboot, and I get this error:

upgrade status: failed, failed to download file 'routeros-arm-7.2.3.npk', no such file

Hi mate, how are you getting that error in the pre-boot environment - USB-to-serial cable?

Kaldek

Well, safe to say I disagree with the responses. Having to re-code something that "just works": I disagree with this because for many people it doesn't "just work", hence the existence of this thread. "It's only meant to be directly connected": That is the position Mikr...

Kaldek

use of UDP broadcasts for file transfer is a bad idea. Putting this back on Microsoft for what could be a security improvement to their network stack is not justified as it's not backed by any data. You allow and traffic and it is still being blocked by the firewall, that is very shitty Microsoft s...

Kaldek

So this is a Windows defect, not a Mikrotik one.. No, and saying things like that just lets poor code off the hook. I've provided empirical evidence here that the use of UDP broadcasts for file transfer is a bad idea. Putting this back on Microsoft for what could be a security improvement to their ...

Kaldek

Personally, I've had hit/miss for NetInstall based on the NetInstall version in Windows.. Different version, .4 instead of .5 worked vs failed, on the same host. I did think that might be an issue so I tried a range of versions, even going back to 6.48. On the fully patched Windows 11 systems I hav...

Kaldek

Here's the YouTube video showing the details of how Netinstall works, with a Windows 11 host failing, and a Windows 10 host succeeding:
https://youtu.be/-mOGD1-Uv2Y

Kaldek

I'm not even trying anymore with windows.
I have a dinosaur-old Dell laptop (2008) with Linux.
Works first time right each and every time.

I get that, but I'm trying to focus on the use of broadcast packets as a means of file transfer. For lab and home users,there needs to be a better option.

Kaldek

I just did netinstall yesterday on win11 I had to disable firewall completly and also disable any other adapter like wifi even they where not connected, then it worked fine. I have done the same, and yet with no offer packet exiting the network stack (even though Process Monitor stated the packet w...

Kaldek

In addition to the first post, this whole problem just causes a massive amount of confusion because Mikrotik's troubleshooting notes for Netinstall all focus on the BOOTP/TFTP stage of Netinstall. If that stage works but the second package transfer stage fails, all troubleshooting guidance keeps poi...

Kaldek

Hi folks, I have posted this on Reddit under /r/Mikrotik but I'm also posting it here with slightly different language. However I will say that I am seriously miffed at Mikrotik for the way that Netinstall actually works and why it's broken on Windows 11. Put simply, the package transfer mechanism i...

Kaldek

My RB5009 running 7.3.1 and firmware 7.2.3 refused to boot after upgrading to 7.4Beta4. Only a netinstall back to 7.3.1 resurrected it. No supout - it never booted. I also struggled for about 3 hours just to get Netinstall working. Only Neinstall 7.2.3 seemed to work for me - I had to run Wireshark ...

Kaldek

I seem to have fixed this, but I am not sure exactly what the fix was. However, it does seem related to netboot, in that the link is stuck in a weird state which was stopping the boot process from completing in the firmware. One of the following things fixed the issue: - Upgrading the firmware to 7....

Kaldek

Hi folks, so I upgraded in 2021 to an RB5009 for 2.5Gb/s support from my PC to my server which is on 10Gb/s. Ergo, my PC is on ether1 and the server is on sfp-sfpplus1 (10Gb/s via DAC) Whenever I upgrade RouterOS, the RB5009 fails to complete the boot process if my PC is connected to ether1. It sits...

Kaldek

Interesting behaviour. I have an RB5009 running 7.1 connected to a CRS328 running 7.1 (although it also worked when running 6.48) connected via a Mikrotik DA0001. It's never had a connectivity issue, so I wonder what's different for you folks? UPDATE: I checked mine in more detail and there's no fla...

Kaldek

I just purchased an RB5009 to replace my RB4011. Initially skeptical about the rack mount kit but it is ingenious. You either use it as-is (for centre mount in a 19" rack), or snap the ears off and punch out the centre plates for mounting up to four units in 1RU, leaving the shorter rack ears. ...

Kaldek

The changes in 7.1rc5 introduced an issue that causes a certificate to not be signed if the user does not explicitly specify the digest algorithm. This will be addressed in the next release. For now, a workaround is to always specify the desired digest algorithm (the default is SHA256). I can confi...

Kaldek

Fresh RB5009 with 7.1RC5 SW and FW. Repartition doesn't work. Am i wrong ?? regards.... OK. ARM64 seems not supporting this... Same issue here - fresh RB5009 upgraded to 7.1rc5 as soon as I had it connected to the Internet. Where did the statement about ARM64 not supporting partitions come from?

Kaldek

Hey does anyone know if 7.1beta6 includes the FragAttack mitigations?

Kaldek

Stable v7.1 Roadmap Currently, the showstopper for stabilizing v7 is /routing . in particular, routing protocols and filters. Once the routing stuff is done, we will go into the stabilization phase and aim for v7 release candidates. That's interesting. I've never used any of the /routing packages s...

Kaldek

I've reported the posts by Avevna and rextended for breaking forum rules. Honestly you two, being dismissive of a vulnerability that affects practically every WiFi device in use globally without reading about or understanding the vulnerability is poor form. It's very difficult for most people to emp...

Kaldek

Installed 6.48.1 to test device and first thing I noticed is that this Web UI bug introduced in 6.48 is still present in 6.48.1: - By default /webfig/ URL (default after fresh login) always forwards to "QuickSet / Port Mapping" configuration options. This happens even if Quick Set has bee...

Kaldek

Well that sounds better but I still wonder what is the real power draw - how much it depends on the load etc...can somebody please measure it? Thanks My RB4011 (no WiFi) pulls 8.7 watts when in normal use. As measured from the port health of a CRS328 powering it via PoE for the purpose of doing exa...

Kaldek

You could easily do this. Buy a 24v power supply from element14, something between 1 and 3 amps is heaps of power for an RB3011. Wire the 24v output directly to the RB3011 board and use one of the existing blanking plates for the mains power connector on the back.

Kaldek

Instead of a non-standard kludge I would love to see MikroTik put effort into implementing 802.11d (country ie), .11h (channel utilization), .11k (neighbor reports), .11v (BSS transitions)... Once those are properly implemented should any effort be put into tweaking. Posting late here, but I agree ...

Kaldek

Roaming is a client process and has NOTHING to do with MikroTik and other wifi router suppliers. As this thread was updated in 2019 I'd like to add a little to it here in late 2020. With the 802.11 extensions of 802.11k and 802.11v, roaming decisions may still be client based but the network can in...

Kaldek

Hi folks,

I maintain my own Confluence server. Where can I download your new "ros" language Javascript definition which you have defined which does all the appropriate colour markup in Confluence?
It will help me maintain my documentation in a much more readable fashion.

Kaldek

It's been a few weeks and my switch has maintained low temperatures under 50C in all circumstances. I have permanently fitted the fan to the switch and also ducted the air so that it blows towards the SFP cage. I did not need to remove and re-seat any heatsinks or change thermal paste/glue to achiev...

Kaldek

Holy CARP! I just fitted a 2 watt 40mm 24V fan to the back of my CSS326 and the reported temperatures dropped from 70C down to 38C! Those are *stellar* results. I've already fitted heat sinks to my SFP+ module, so let's see if the additional air flowing over the SFP cage (practically opposite the fa...

Kaldek

Did you read S+RJ10 general guidance? No, as this is a Ubiquiti branded SFP+ module (it was cheaper here in Australia than the Mikrotik unit). However the same problem described for the Mikrotik model as per the general guidance page applies. The product page for the S+RJ10 module now also says it'...

Kaldek

I have a CSS326 (SwOS 2.10) running currently at 85C (!!). I only noticed because my RJ45 SFP+ module started to drop packets and when I went to remove the module it was frikkin' red hot. I moved the Cat6 cable to a spare 1Gb/s port which brought back connectivity but HOLY COW - 85C on the mainboard...

Kaldek

I've fitted a Ubiquiti RJ45 SFP+ module to my CSS326 running SwOS 2.10. This SFP module works but comes up as "multimode fibre" and shows no temperature details.

This is more of an FYI for Mikrotik than a specific complaint.

2020-01-09_17-19-30.png

Kaldek

I will prefer this one Ethernet/SFP+ (Combo Ports) CRS312-4C+8XG-RM

No good for me; I use too many of my 1Gb/s ports. The CRS326 is perfect for my needs.

Kaldek

I have been relying on a CRS125 for about five years but I'm getting to the point where I need a couple of devices to have 10Gb/s connectivity on my LAN. In my example I will have most devices on the network connected to the 1Gb/s ports but my PC and my file server will be connected to the 10Gb/s po...

Kaldek

Well it seems that as usual there's zero information on this and nobody able to assist.

I resorted to mucking about with my network sniffer hosts to stop them ever attempting to obtain an IP address on that interface. It's a hack, but it is what it is.

Kaldek

I have a CRS125-24G-1S with one of the ethernet ports set as a mirror destination that captures traffic from interface 25 (switch1-cpu). Essentially, this captures traffic as it egresses through the router to the Internet (plus it also captures the traffic after it has passed through the CPU and bac...

Kaldek

Any known issues with power consumption using these in a CRS125? The supplied power supply is 12v 2.4 amps I believe. I have a CRS125-24G-1S so there's no WiFi.

Kaldek

I have a CRS125-24G-1S which I just updated to Routerboard firmware 3.41 and then RouterOS 6.41.3. The System-->Routerboard menu is now saying that there is a new firmware version "6.41.3" available. This sounds highly suspicious and incorrect. Can I get someone to confirm if there really ...

Kaldek

ur firmware is Hilink or no-hilink?

I don't know what "hilink" is.

Kaldek

I can confirm this problem was resolved by - wait for it - turning my router off and on again.

Reboots didn't help.
Software upgrades to Release Candidate didn't help.

Turning the router off by pulling the power cord was the solution.

*Shrug*

Kaldek

add action=mark-connection chain=prerouting new-connection-mark=lowttl ttl=less-than:60 Awesome! You can probably optimize this statement by adding connection-state=new as it just needs to mark the connection once at startup. Good point - sometimes I forget that it's marking the connection rather t...

Kaldek

I do some alternate routing marks via pre-routing that don't work well with fast-track and make sure that I only fast-track connections with connection-mark=no-mark and routing-table=main. Maybe you can add another mangle before your other mangle setting a connection mark (and passthrough) and then...

Kaldek

I have a CRS125 with RouterOS 6.34.3 and Firmware 3.24. I purchased a Huawei E8372 as it is on the list of supported devices. When connected, it appears as a USB device, but no LTE interface or Port appears. /system resource usb print # DEVICE VENDOR NAME SPEED 0 1:1 Linux 3.3.5 ehci_hcd RB400 EHCI ...

Kaldek

Is the connection always initiated from the lan side? If you have port forwards and the connection is incoming you may need to use dst-address as the filter on the fast-track. Also, when you change the rule, any current connections will still be fast-tracked until they drop off. The connection is o...

Kaldek

I'd ask mikrotik support directly, attach a supout on the email.

Thanks. I'm currently operating without fasttrack and the CPU hasn't spiked over 50% so far. At least that means I have a workaround.

Kaldek

Looks like...

Which RouterOS and firmware version is the CRS running?

RouterOS 6.34.3 and firmware 3.24.

Kaldek

Have you tried something like /ip firewall filter add action=fasttrack-connection chain=forward connection-state=established,related src-address=!192.168.0.51 /ip firewall mangle add action=change-ttl chain=prerouting dst-port=80 new-ttl=set:64 protocol=tcp src-address=192.168.0.51 Yes I did try th...

Kaldek

I have a CRS125 router/switch combo and need to bypass fasttrack for one particular connection. The problem is that one device in my LAN uses IP TTLs of 32 and the target device is over 32 hops away in Europe (I am in Australia). Here's the relevant code. Note that I placed a dedicated "accept&...

Kaldek

The simplest things are often the cause, eh.

Sorry for making you chase down a complex and incorrect path.

Kaldek

Thanks for clarifying the ports are not slaves of ether1. I've got no further ideas for you based on my own knowledge, so hopefully others will provide the solution!

Kaldek

Hello

i will post you /interface ethernet print when iam at home

and if then my configuration is wrong can you tell me or configured it for me the right way?

thanks in advance

should i post anything else?

Just send that for now, and try the interface queue trick as well, as mentioned above.

Kaldek

Nope, flag S sets also for standalone and master ports if they are part of bridge. Well that would make sense because it makes them the same L2 network. The whole "slave" nomenclature is a Microtik thing anyway, so if/when they flag an interface with "S" would be totally up to t...

Kaldek

There is nothing wrong with bridge. Ports 2-5 are in same L2 network only when configured as master/slave. In this configuration they are are standalone. To make them part of L2 local network they should be in bridge with eth6, as are they in this configuration, which is btw factory default. Nope, ...

Kaldek

Master/Slave just controls interface isolation, and as I understand it link bonding basically just stops spanning tree from going nuts for starters, and then balances traffic as a second function. I would think you just set eth1 as master, with eth2 and all other interfaces as slaves to it, then do ...

Kaldek

What do you mean by "capture vlan 3 and vlan 4"? Do you mean you want to do all the routing on the Microtik router rather than inter-VLAN routing on the Cisco switch? If so: #### Make VLANs 2-4 valid on interface ether2, and tag packets as they exit the interface. /interface vlan add name=...

Kaldek

rmmcann is correct, however if your WAN IP is dynamically assigned, you can change the rule to use the incoming interface rather than the IP address: /ip firewall nat add chain=dstnat action=dst-nat to-addresses=<internal IP address> to-ports=<internal server port> protocol=tcp in-interface=<Your WA...

Kaldek

Your bridge configuration is wrong and is causing your DHCP server to be exposed to the Internet interface where your cable modem lives. You have configured the 100Mb/s switch properly by the look of it, with ether6 as a master and ether7-10 as slaves. What I don't see is you configuring ports 2-5 t...

Kaldek

What Van9018 said is exactly right.

Kaldek

Thanks for the replies! But now I am facing a new issue. What do I need to do to configure the router with an ip address which is accessible trough VLAN10 and the pc connected to eth1? Omega This should work. Binding the VLAN interface to ether1-slave-local should be fine as I'm pretty sure this ju...

Kaldek

Are your LAN interfaces and DSL modem interface sharing the same master interface? They should not be sharing the same master interface or they will have L2 access to the DSL modem. The DSL interface should be a master interface with no slave interfaces. The internal network should have one master i...

Kaldek

Here's a diagram of the above config, so people can understand what I was trying to achieve.

VLAN and routing config - public.png

Kaldek

Well since it took Microtik three days to approve my post, I worked it out in the meantime. If you have multiple master ports it looks like sharing VLAN configuration across/between them may not work because, well, they're isolated from each other. My design resulted in me having two master ports. e...

Kaldek

Nooooo! No bridging!!! Do not bridge those interfaces, it does not need to be done and just causes the CPU to have to deal with everything rather than the switch hardware! The CRS platform uses a dedicated hardware switch with many features. In the case of the CRS125-24G this is a Qualcomm Atheros 8...

Kaldek

I have a CRS125-24g-1s-rm running RouterOS 6.30. I have a problem that needs a solution and none of the CRS manuals are helping. My problem is that I have a separate 8 port switch that provides PoE to all of my access points and also to the WiFi radio on the roof which is my connection to my ISP. In...

Search found 164 matches