MikroTik

mkx

not only does the ping drop, but the connection is also interrupted

Which connection? The wireless link? Winbox management connection?

mkx

Looking at ping responses is mostly useless. If link is fully utilized, then those pings will get queued and seemingly dropped ... in reality they will likely get around but with round trip delay larger than 1s (which is usual timeout value), responses will be ignored by ping application. Try to run...

mkx

New beta 7.18 for christmas? I wish Not likely. So far, beta only came out after previous version was released as stable. 7.17 is still Release Candidate and folks @MT are running out of time ... it's almost Christmas eve, Latvia is at UTC+2 which means it's 3:30 PM and almost end of office time.

mkx

@HeptaZ, did you read through excellent Using RouterOS to VLAN your network tutorial?

Because most of discussion in this thread is about VLANs and they are explained pretty well in the tutorial I linked above.

mkx

There are things to be set-up on gmail side, check their article: https://support.google.com/a/answer/2520500?hl=en

Then it could be TLS support mismatch. AFAIK ROS supports up to TLS 1.2 and some sites already require minimum of TLS 1.3 (not sure if gmail does).

mkx

Check setting of property configuration.distance . Here's description: distance () Maximum link distance in kilometers, needs to be set for long-range outdoor links. The value should reflect the distance to the AP or station that is furthest from the device. Unconfigured value allows usage of 2 km l...

mkx

If there's a chain of accessibility (i.e. you can access R1 but cant access R2 directly, while R1 can access R2), then you can use CLI (ssh, MAC telnet, normal telnet) if any of these is allowed on R2. ROS includes clients for all mentioned protocols. The only issue is with MAC telnet, ancient versi...

mkx

Mikrotik app for Android shows the following value of dtim-period setting:

It might be artifact (by Tik app) for not having property set at all ... in which case default value (1) would be used.

When in doubt, always use CLI to verify ... and report a bug in UI to MT to get it fixed.

mkx

Setting of band property on new wifi actually only limits the newest generation of wifi technology but allows all the older. So by setting band=2ghz-n one is allowing B, G and N, but not AX. When constructing AP for really old devices, one has to be extra careful with security settings: B-only devic...

mkx

I'm trying to configure my rb951 to access Internet from ISP router but after setting the static IP ( 192.168.100.100/24) and checking routes and when I try to ping google.com Does your ISP support DHCP as means of obtaining IP config for clients? If it does, then use it, it's usually less error-pr...

mkx

I’m sure I listened to a MuM talk once that forwarding a packet to black hole takes less CPU than dropping? If there's a very effective way of doing it. Otherwise I doubt it. But whatever one does, packets definitely have to be silently dropped (as opposed to rejecting them with ICMP port unavailab...

mkx

Had same issues, changed DTIM values to 3 for 5GHz (it was 10 by default), the same was proposed upper in the thread, 2 days - no disconnects so far. A random thread from quite some time ago ... which concluded that DTIM interval longer than around 3 can (and will) cause problems with certain stati...

mkx

But it seems the CRS304 can FastTrack at 1700 which would be acceptable for a 2.5G WAN. Not in my book. I'm paying monthly fee to ISP and I certainly want to have hardware which can use all of what I'm paying for. Otherwise I can save a few euros (every month) and live with slightly slower WAN link...

mkx

Don't know how far 2.4ghz interference can go for USB3. The test computer is around 2/3 meters away from the next AP. The big problem is interference between locally connected interfaces (i.e. hAP ax3 with flakey USB3 stick plugged in and 2.4GHz radio ... USB3 activity will interfere with Rx path o...

mkx

I'm here with @chechito wondering why TF? CRS520 comes with list price of almost 2200$ and power consumption exceeding 120W. So one doesn't really save much by not adding a small server to the network, a high-end raspberry pi would dance around CRS520 when it comes to server functions (stock samba v...

mkx

... so I don't see how the hEX could have any influence on the problem Some interference in form of timing jitter affecting TCP window scaling? Experience with official test results says that figure listed under "Ethernet test results -> Routing -> 25 ip filter rules -> 512 bytes [packet size]...

mkx

CPU in hAP ax3 can shuffle around 2.5Gbps (look at test results for bridging) and that's pretty lean on CPU (no packet processing, only passing between two ethernet interfaces). With SMB there's plenty of processing involved. And USB in SoC IPQ-6010 is 3.0, so max 5Gbps (including overhead) possible...

mkx

What you showed looks like a really old product for legacy customers. 40G and very slow at routing. CRS devices are switches (remember this fact by heart!) ... and many can route at wirespeed if properly configured for L3HW offload (with certain limitations which are device class dependent). If any...

mkx

When port is used as stand-alone, then switch-chip passes frames to CPU (via cpu-facing bridge port) as they are ... then CPU does VLAN header manipulations (via VLAN interfaces attached to such stand alone port). So in this case no L2HW offload. It's rather similar when bridge is used ... and L2HW ...

mkx

One can get a 2x 25G card for 135 euro. Add processing power, necessary to route at 25+ Gbps and price tag is easily around 1000€ ... and you've got a mere 2-port router. And I'm pretty sure that such price tag is outside of MT users' comfort zone. So my guess is that we won't be seeing full 10Gbps...

mkx

What do I need to consider for the additional units? The problem is that one wireless station can only be connected to one bridge at a time. This problem kicks in when e.g. you need a chain of APs like this: ethernet -> AP1 <- wireless1 -> AP2 <- wireless2 -> AP3 <- wireless3 -> AP4 (etc) Let's say...

mkx

@sindy if I understood correctly, there should be two "entities" capable of switching, the switch chip and the switching functional block in the cpu? In the context of bridge nyszeries explanation forget about switch chip (the real, piece of hardware). In this context, there's only switch...

mkx

Because we use existing device from several brand on our client, we need follow their default VID for their management. If it's only management, then you can bridge all 3 VLANs. I'll assume you have ether5 off-bridge and have something like this: /interface/vlan add interface=ether5 vlan-id=98 name...

mkx

Also 50 cm can be too close. This. Depending on channel selected, but ... As I mentioned, I've got single Audience, so the 4x4 radio is used in AP mode as well ... and my tablet, which currently resides around 3m away (and 1.5m below) with LOS, shows signal strength of -35dBm. Which is on the highe...

mkx

IMO it would be smart to ask MNO if they can give a public IP address and how much would that cost. I know a few MNOs who provide public IP addresses to those asking for one at small cost (or no cost at all).

mkx

BTH function is done exactly for such cases.

mkx

Some MNOs run firewall blocking certain types of traffic (typically with low destination port numbers because these are often used by servers). And some do CGNAT in a senseless manner. When those two worlds collide, anything can happen. Basically wireless broadband is mostly not fit for anything els...

mkx

Using CAPsMAN to provision audiences' "public radios" (i.e. the ones serving normal client devices) gives opportunity of better client mobility ... APs, participating in client mobility, have to be controlled by single entity (e.g. CAPsMAN) for all the mobility features (802.11 r/k/v) to w...

mkx

hAP ac2 can run v7 pretty fine. But : its 16MB flash is tiny and it's very likely it'll get full (and then all sorts of funny things start to happen). Base routeros v7 uses around 13MB of it, any wireless (legacy or new wifi) another 2MB or slightly more ... so not much free for config and/or additi...

mkx

Generally it doesn't matter which way you do it if you configure wifi manually. In this case the only difference is if one uses multiple VLANs with single SSID, such scenario can't be implemented with bridge handling all VLAN tagging. If you use CAPsMAN and VLANs, then it takes lots of fussing (and ...

mkx

How does profile output look like while pings are timing out?

mkx

CAPsMAN doesn't configure backhaul ... which in usual AP installation is ethernet while in mesh it's the 4x4 radio (I guess it's called wlan2 when running wireless drivers, it's wifi2 when running wifi-qcom-ac drivers). Further more, radios loose their setup if they loose connectivity towards CAPsMA...

mkx

The second rule hints at use of hairpin NAT because in-interface=bridge to-addresses=192.168.88.244 ... default config has 192.168.88.0/24 on LAN and bridge is the interface used by roouter to talk to LAN. And if that's how you need it, then you need the masquerade rule which obfuscates actual src-a...

mkx

It's the last rule (masquerade) which messes src-address. In principle it's not needed unless you require "hairpin NAT" ... in which case thrte's no way around it.

Unless you create separate IP subnet fot the server.

mkx

Don't think so.
Not on RB5009 with 8 ether ports
Then they should have called it the RB5008 LOL
Then use port 8, use your imagination, drink some moose milk!!!

5009 is indeed an odd number for a router ... specially because it's even

mkx

Verify on Mikrotik that NTP client is properly synchronized. Without that, NTP server won't allow further clients to synchronize to it. ROS NTP server doesn't use own RTC as time source (among other reasons because MT hardware doesn't have RTC).

mkx

Move DHCP client from ether1 to "JJMarketing Wireless Bridge". Also remove comment on DHCP client as your device doesn't have WAN interface. Two other minor things: remove bridge with name bridge1 ... it's not used at all setting names of items to settings with spaces in them makes config ...

mkx

As I wrote: provide us with actual configuration and we'll proceed from there.

mkx

You've set 192.168.10.1/24 to one interface and 192.168.10.2/24 to the other interface. Every normal device will assume these two addresses are in same subnet and hence directly accessible without explicitly using router. And bridge is here to pass traffic from ether1 to ether2 (with appropriate VLA...

mkx

I have some problems with my MikroTik Routers. I plan to upgrade all MKT devices from version 6.46.6 to 7.16.1. I think that MT would recommend you to use ROS built-in updater (under /system/packages/update). As already mentioned, there will be a few steps: while running 6.46.6, upgrade it to lates...

mkx

Basically your list of tasks performed seems about right for an AP/switch combo ... which then needs another device acting as router / DHCP server / etc in same ethernet network. Can you post current configuration? Open terminal window (from GUI) or connect to device using SSH. Then execute command ...

mkx

I have no closet solution. There are devices with better form factor (and WAF) than RB5009 when it comes to placing/mounting anywhere else than inside rack. To be absolutely clear: I'm not saying that there's no place for wireless routers any more ... my main point being that RB5009 / L009 form fac...

mkx

I have tried doing a netinstall as follows: 1. Press and hold reset button 2. Insert power cable. 3. Wait for flashing act light, continue to wait for On act light, continue to wait act light off. then release reset button. [snip] Running wireshark on the used ethernet I can see the routerboard sen...

mkx

IMO the big problem with powerfull wireless routers is the fact that with increasing "mainstream" wifi frequencies (5GHz now, 6GHz coming) it's necessary to deploy multiple APs on the same area where with 2.4GHz APs it was enough to have single AP. And those multiple APs have to be positio...

mkx

About 160MHz channel width, that's for APs capable of using it. First one which can is wAP AX (and it works just fine 8) ). Actually ... audience was first 8) : 2 L radio-mac=2C:C8:1B:77:DE:EA tx-chains=0,1,2,3 rx-chains=0,1,2,3 bands=5ghz-a:20mhz,5ghz-n:20mhz,20/40mhz,5ghz-ac:20mhz,20/40mhz, 20/40...

mkx

To the topic: so basically your core switch doesn't respond to every ping sent at, regardless of where it was sent from. So it might be something about core switch IP configuration (or it might actually be overloaded ... run CPU profiler and see if that might be the case). CPU total is about 16-24 ...

mkx

Is it normal that the first interface has the same mac as the bridge? This is default behaviour if you don't set bridge MAC manually (bridge assumes MAC address of first member port). To the topic: so basically your core switch doesn't respond to every ping sent at, regardless of where it was sent ...

mkx

Can you provide some basic real world examples on when I need L3 access to the bridge from the CPU?

Management of said device (used as switch) from network connected to one of bridged ports.

Routing between single off-bridge port (WAN) and bridged ports (LAN).

Etc.

mkx

Bridge has a few personalities, neatly explained in this tutorial: https://forum.mikrotik.com/viewtopic.php?t=173692 One of personalities is interface allowing CPU to communicate with L2 network joined together by bridge (the switch-like personality). If CPU is to communicate on L3 with devices memb...

mkx

The DE FACTO guide on setting up VLAN for ROS https://forum.mikrotik.com/viewtopic.php?t=143620 Configuration, based on linked tutorial, will work fine ... but sloooowly because CRS1xx can't offload bridge config to switch chip. Instead one has to configure things directly on switch chip: https://h...

mkx

It's possible to set pref-src property on static routes, e.g. /ip/route add dst-address=0.0.0.0/0 gateway=172.16.1.1 pref-src=172.16.1.30 Then router uses this address when making new connection using that particular route. But I don't know if the same selection applies if destination is in same IP ...

mkx

... restore config from export (not backup!).

Or, better yet, start from default config and apply minimum changes required. It's possible that flakey config allowed exploit to succeed.

mkx

Whatever datapath settings from capsman config are enforced on CAP side. E.g. bridge name ...

How to split traffic? Most straight forward using VLANs (if not using wifi-qcom-ac driver on CAP) or some L2 tunneling (e.g. EoIP) if VLANs absolutely aren't possible.

mkx

Some devices try to identify the network to set appropriate firewall setup (e.g. home/work/public) ... e.g. winfows does that. And among other information gateway's MAC address is taken into account. And I guess some (paranoid) devices might require re-entering pass phrase simply to make owner aware...

mkx

... when using the previous generation access point, I only need to configure a profile in CAPsMAN that goes to each datapath. As I wrote: with new CAPsMAN there is no capsman-forwarding any more. Wireless interfaces, even though provisioned by CAPsMAN, are attached locally to CAP's bridge and loca...

mkx

Can you please point me where are the defaults firewall rules?

Open terminal and execute

/system/default-configuration/print

(as user with admin privileges)

mkx

wifi-qcom is an extra package. Dont install it. No drivers - no radio. I think the point is that WiFi module costs money that could have been spent elsewhere (better CPU, 2 Gbps eth1-CPU link etc) or just excluded to make the price less. Commodity hardware, used as heart of MT devices, often alread...

mkx

New wifi CAPsMAN doesn't offer capsman forwarding. Which means that without VLANs CAP is joining normal LAN. And traffic then normally doesn't hit CAPsMAN. When it comes to DHCP ... when DHCP client (WiFi station in your case) sends out DHCP Discovery , every DHCP server in same L2 broadcast domain ...

mkx

Seems that connect-priority 0/1 improved the situation. Devices now do switch to 5ghz, but it does not seem due to actual steering, but because they eventually take that decision themselves. WiFi standards (802.11 anything ) don't standardize handovers (at decision of network entity), they standard...

mkx

Does this problem still exist in Ros 7? This problem never existed for me, neither in v6 nor in v7. I cannot delete PVID on the bridge interface. You can't delete PVID ... but if you set bridge CPU-facing port with frame-types=admit-only-vlan-tagged , then PVID setting will become irrelevant. After...

mkx

It shows who has everything to say in your household.

As if it's not the same in your household

We are speaking about WAF here, not about HAlF

mkx

Set aside the whining, I don't see a difference between hexs and L009: I don't have either hEX S nor L009 ... so only guessing: it could be that L009 doesn't allow PoE out if it's powered via PoE in ... while hEX S did? The fact is that PoE 802.3 comes with some stringent spcifications (which MT mo...

mkx

What are my options to achieve 20gbps speeds ? I thought 802.3ad would give this with layer3+4 hashing, but even with multiple-streams (iperf3 -P) I get capped at 10gbps. I noticed that iperf3 is using same port for all streams, so I guess that can explain it. IMO you should stick to 802.3ad ... wi...

mkx

Generally I'd say that your current firewall is .... inadequate. IMO default rules are much better than yours. So I guess you have very good reasons for ditching default and implementing .... what you have now. However, it does seem weird if DDoS attack would cause your router to drop ethernet link....

mkx

My other Linux server that is 2x2.5G bonded on Linux side and is connected to Layer3 TP-link switch. I didn't have to do any config changes on switch to make this bond work. There are some bond modes, available in linux, which don't require switch to know there's bond involved ... but it works well...

mkx

I can't see anything weird...

One line above the message about loosing DHCP lease it mentions link down on ether8-WAN ... so you'll have to investigate why link between your router and ISP device drops. There are plenty of possible reasons for that ...

mkx

... but randomly appears
Code: Select all
dhcp-client on ether8-WAN lost IP address 89.XXX.XX.18 - lease stopped locally

Can you show us log lines immediately preceding the quoted message (a few tens of seconds of history should do it) ... in general anything related to ether8-WAN port or DHCP.

mkx

I bought this thing. It has 25G interfaces to be a typical bridge, but there is no way to transfer even 10G in bridge mode. Is this some kind of joke? You bought router which happens to have 2x 25Gbps ports (and some others). Official test results tell that thing can route at speeds between 5Gbps a...

mkx

So nothing to be done on Linux itself ? Of course there is, bonds have to be configured on both sides of logical link. And bond mode (e.g. 802.3ad) has to match (Tx hash strategy can be different on both ends). I guess you didn't get feedback on linux-side config because that is largely of scope of...

mkx

Let's assume they are working on it.

You know what they say: assumption is mother of all f**ups. So let's not assume anything ... not with Mikrotik

mkx

As long as TLS 1.2 is still considered secure and ROS supports secure ciphers, I couldn't care less. Everything else is compliance BS. It's is not just about security, TLS 1.3 have more optimal handshake, less round trips. True. But when it comes to managing your router/switch/AP, how many hundreds...

mkx

... if for whatever reasons you applied an excessive voltage to ether1 I would expect It to fry, not the other ports.

If this happened, then this is quite a problem ... because netinstall works only ether1.

mkx

I don't understand why mikrotik doesn't have some kind of roadmap...

Wait ... Mikrotik has a roadmap?

I'd love to buy an Audience ax or two as long as it's as good as current Audience (I simply love it).

mkx

There have been previous reports on this forum about CCRs with similar symptoms. All have been resolved by replacing capacitors in PSU and/or main board, which showed signs of failing (bulged ends). When doing it, make sure that replacement capacitors match capacity of original ones (too big differe...

mkx

Are ether1 and wlan2 members of same bridge? Broadcast packets are in principle not routed, only switched/bridged.

And possible misconception: if only traffic flowing is broadcast, then it'll only affect Tx counters not Rx (only port connecting to broadcast source(s) will show Rx activity).

mkx

Bridge is only necessary if one wants to switch between bridge member ports. If device is used as pure router (strictly routing between ports), then bridge is not needed (and if it's used then one has to take extra steps to block L2 communication between different ports).

mkx

Post textual export of configuration of your RB960PGS. I suspect that the problem is in routing indeed. Either you have to add routes to different remote locations on main router or you have to configure SRC-NAT on each of remote location routers. Personally I'd go for first option as it allows you ...

mkx

just use your own dns, set up a cname to the ugly domain name and problem solved. Is not. Even if your own DNS server can reply with CNAME record, clients still won't be able to resolve the serial.sn.mynetname.net ... the only way around it is to actually update A record on your DNS server whenever...

mkx

It should match http://youtube.com but not a lot more.

AFAIK not even protocol (http), only host name, e.g. youtube.com ...

mkx

As I already wrote: if those domain names are not sent from client towards server in plain text, then L7 matcher won't be able to match them. You can verify if this is indeed a problem by doing a wireshark recording (on client machine would be fine) and check initial few packets, sent from client to...

mkx

I have mentioned about this problem in 2019, fife years passed and still the same. CRS326 is unusable at all. Do you actually have problems with CRS326 or is only the stats which are worrying you? And an idea: screenshot shows really low port speeds (10Mbps, 100Mbps) for ports with most link downs....

mkx

Only on the bridge, as that's what the IP stack is linked to. The Ethernet interfaces are just member ports of the bridge in this setup. ... which also means that access to other networks (including internet) can be controlled in this way. But: communication between devices on same IP subnet (even ...

mkx

Almost definitely the two rules you showed are not full firewall config. Or is it? Regarding L7: almost everything now days works over encrypted communications (httpS) and almost every server/client combination supports TLS v1.3. In TLS v1.3 also SNI is encrypted, hence L7 regex rule in ROS can not ...

mkx

Unfortunately, one drawback of my setup is that my location data is random. At one point websites think I'm in southern California, and then a day or two later I'm supposedly outside Chicago. AFAIK this has nothing to do with your actual physical location, it's got to do with some GeoIP databases ....

mkx

My experience with Gmail and IMAP is that when there are many messages in inbox (several thousand which in my case translates into a couple of gigabytes of space consumed), then sync rate plummets. IMO nothing to do with router.

mkx

Drawback: you probably can not use MAC access (I'm not even sure you can do that using Wine, never used it myself). It's possible to use winbox over MAC using wine (just tried winbox 3.35 x64 in linux). For CLI over MAC I guess there's no real option now, MT doesn't provide MAC telnet client for wi...

mkx

Can you set one of ISP router ports as trunk port? Routers, provided by Telekom Slovenije, have option to set each port as either "data", "IPTV" or "both" ... the later being trunk mode. This way you'll get IPTV already (natively) VLAN tagged (and internet probably unta...

mkx

Just seeing lots of devices on the interface with torch that should not be there at all, nothing to do with IPTV multicast. If IPTV of Makedonski Telekom is anything similar to same thing of Telekom Slovenije, then VLAN for IPTV is switched for many IPTV customers ... and you will be able to see so...

mkx

... translating it to new CAPsMAN and wave2 will most likely be the next challenge once I've established a working VALN setup. So one step at a time... :) Well ... support for VLANs in wifi-qcom-ac package is next to none (while wireless has pretty good support), so if you're struggling with VLANs ...

mkx

Normally "AP" are strictly AP's. All Mikrotik's APs (all are running ROS) are "wireless router" in parlance of many other vendors. Mikrotik doesn't have any "AP only" device at the moment (and never did so far, can't say anything about future models). However, it's pos...

mkx

OK, post the config of your RB2011. Execute /export file=anynameyouwish from command line (terminal window), fetch resulting file off device, open it with your favourite text editor, redact any sensitive data (such as serial number, WiFi PSK, any other password) and copy-paste it here inside [ quote...

mkx

I'm pretty sure that if you reset your CRS to defaults, it'll come out configured as "dumb switch" even when running ROS. The only item to be done after that is to adjust IP address if you don't like the one used by default. Shouldn't be too hard when using Webfig (just try to avoid Quicks...

mkx

Just edited my previous post ... check addressing, it seems odd.

mkx

The :ffff: notation of IPv4 addresses are not due to router, they are due to web server logging settings (quite usual if web server supports both IPv4 and IPv6). You're saying that communication across sebnets works using NAT? So where is the PC you're using to manage vacuum? And where's vacuum? Qui...

mkx

The text from product page you quoted was there before L3HW became available on CCR2216. It seems that L3HW got broken in latest stable ROS (7.16.2) ... it's likely it runs out of routes memory. And when using device "with several full tables", this likely gets triggered much faster than w...

mkx

Apart from VLAN stuff (@anav already gave you some good advice) ... are you intending to use hAP ac lite as AP as well? If not, then you better remove wireless package and install wifi-qcom-ac on Audience, its wireless will really take off and fly. You'll have to use the new CAPsMAN (available under...

mkx

My concern with this workaround is that when you append this null character to the filename, it's going to change the length and might confuse some PXE clients ("pxelinux.0" has lenght "10", but with null added it's going to be 11 (hex 1A) and I assume some clients might not lik...

mkx

Guess who will be buying a tplink the first sale I see on their wifi7 products.......

No idea. Can you give us a hint?

mkx

What can I do?

By disabling fasttrack, processing gets much more CPU-intensive. Depending on router model used it often means that router is no more capable of routing at high speeds.

mkx

Basic thing is DNS ... and if you want to use domain name globaly, then you need to register your domain and name servers for it globally (through one of domain registrars). Your cloud provider can probably help you with it. This process is not RouterOS specific in any way.

mkx

When running default config, ROS relies on ingress interfaces rather than source or destination address. So when you try to establish connection to any of router's addresses , ROS first determines it's a connection to be handled by router itself ... hence it'll use FW chain=input. And then rules che...

mkx

Is it possible to keep the switch in default Vlan = 1 mode and configure the vlan(10, 20, 30) only to build the network between the cisco ap and mikrotik router. It is possible. If you configure MT with "native VLAN", then VID=1 is used as native VLAN by default. So just don't configure V...

mkx

@anav is saying that RB951U is like 15 years old model and if somebody sold it to you as new, then that business has some seriously old stuff on stock. Never mind that it's not officially declared as EoL, it's old never the less.

You still didn't tell us about ROS version running on your RB.

mkx

It could be other reasons as well ... @OP did not start with too many details, e.g. he did not mention exact model (there are 951U and 951G ... not that it matters in this case). Neither he mentioned ROS version and if it's an old one, it may have some vulnerabilities (fixed in last few years) which...

mkx

Of course it's always possible that router was compromised from LAN side (some computer running malware) so if things happen again, check your LAN clients (or restrict access to router management to a dedicated management port). That would mean a real weak passwd was used or someone in the 'trust' ...

mkx

I noticed that the "Total HDD size" is now reported as 16.0 MiB while I am sure it was like 15.2 MiB before, so that has changed in some recent release. Seeing your post I went to check my hAP ac2 running 7.16.2 ... and my hAP ac2 also shows 16.0MB total flash size. So this flash size inc...

mkx

But just out of curiosity, what router would you recommend? Have a look at hAP ax2 (or hAP ax3). They have decent CPU built in and are not too expensive (wifi is a bonus, if you don't need it, you can completely disable it which reduces ROS footprint). Definitely come with one of best price/perform...

mkx

3l I cannot backup, or change admin group permissions, I get not permitted (9). This item from your symptom list is consistent with several reports of router being compromised (atrackers created another account with full permissions whike permissions of admin account are reduced). The only proper w...

mkx

That's ambient temperature.

mkx

While waiting for a CRS in this form factor: L009 makes a decent switch with 8 ports (ether2-7+sfp) and with out-of-band management port (ether1). Its MSRP is the same as CSS610. Indeed CSS offers one ethernet port and one SFP+ port more ... and both SFP+ ports are 10Gbps (SFP on L009 is 2.5Gbps onl...

mkx

Are you sure that all of your devices actually support use of DHCPv6? Android, for example, doesn't.

mkx

Some recent versions of some browsers use their own DoH ... ignoring system-wide DNS settings. So could it be a browser problem? If thus turns to be the case, then ... it's not a problem, it's a feature ... because it works around whatever limitations any ISP (or home owner) - possibly driven by ma...

mkx

If UTP cable doesn't affect bits passing too much (i.e. if it doesn't drop or invent bits or whole frames), then both link partners should see identical frames. So it shouldn't matter which side of UTP cable captures traffic.

mkx

That's mostly what I had in mind ... plus setting frame-types the same way as it's done for ether1

mkx

Some recent versions of some browsers use their own DoH ... ignoring system-wide DNS settings.

mkx

Your device can not run v6, it's limited to v7. So you'll have to take tutorials with a few grains of salt. And while starting to think about your way forward, upgrade your device to latest v7 (7.16.2 at the time of writing this post) ... I recommend using built-in updater (webfig or winbox or CLI) ...

mkx

While ROS is based on linux kernel, it0s pretty trimmed down to fit tight storage and RAM. So typucally it ships with very few device drivers. And knowing name of device doesn't have anything with driver availability. Having written that: it's highly likely that your gadget is not supported in ROS. ...

mkx

I guess you could.

mkx

You have ether1 on hAP ac2 configured as trunk port. If you want to connect additional cAP ac to ether5 of hAP ac2, then you can simply configure ether5 identically to ether1 ... add it to bridge and set the same VLAN properties.

mkx

Netinstall is your next step.

mkx

The "active address" in that row seems to be assigned to MAC address 00:00:00:00:00:00, so maybe the base issue is not the missing client id, but the (empty) MAC. I can't imagine how could this happen. DHCP server does receive "DHCP discover" and "DHCP request" packets...

mkx

It is more an issue with its routing speed, that may be too slow for your requirements, it should be in the 150-200 Mbit range. And how are you going to do that with only 100Mb ports ??? :lol: There are 2 ethernet interfaces and WiFi being (in theory) faster than 100Mbps. And ethernet ports are (ac...

mkx

"Or" is not an "exclusive or" so you can use "one of two" as well as "two of two" inputs. No, it's "use the one with higher voltage". Only if both supply voltages are almost exactly the same, then device will draw power from both (not necessarily ex...

mkx

Client ID is something DHCP clients supply to server (and not the other way around). When DHCP server decides on which lease to offer, it first checks "Client ID" ... and only if that value was not provided by client, it falls back to using client MAC address (as identifier). Indeed most D...

mkx

In CLI you can get radio link details by running command /interface wireless registration-table print stats IMO, signal strength of around -60dBm is pretty decent. Ideally signal-to-noise value will be as high as possible (30dB or more) which then should offer good service. One value which does show...

mkx

I don't have any CSS, but I'd expect it to have mirror functionality. However, since those frames break CSS, they might not come out of CSS via mirror port. Which means you'd have to use another managed switch between CSS and one of connected servers and configure mirror port on that switch.

mkx

Connecting USB hub to Mikrotik should work, so you should be able to connect multiple USB devices (mind the power output capability, MT devices usually don't allow much more than standard 500mA, you may have to use powered USB hub). I'm not sure though how many serial ports are supported in ROS ... ...

mkx

AFAIK nv2 and nstreme are supported on all radios which run (now legacy) wireless driver. These protocols are not supported by new wifi driver (wifi-qcom and wifi-qcom-ac), which is required on AX devices (and supported on many AC devices). So in short: nstreme and nv2 work on older Mikrotik wifi de...

mkx

CRS devices are essentially switches ... as in L2 devices. Yes, running ROS on them does add L3 (routing), but without careful configuration those functions will be done by (slow) CPU. But: there's L3HW offload and it might work for you. Further reading: https://help.mikrotik.com/docs/spaces/ROS/pag...

mkx

It would be great if you could post also configuration of the other end (the one you can't get into). While looking at config of "this end", I see a few things: there's some firewall, but with a few errors (like using interface which is "enslaved" to bridge as in- or out-interfac...

mkx

It's encryption of the password. Password is always encrypted. If not set, default encryption is used: ccmp https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-SecurityProperties in here it is said, that it is - A list of ciphers to support for encrypting unicast traffic. Correct: e...

mkx

When checking with CLI: note that setting property to empty string (i.e. "") is not the same as not setting it at all. Ok, and then what happens if it is set to empty string (i.e. "") and what happens if it is not set at all? When this property is not set at all, default (ccmp) ...

mkx

If nothing is set in encryption property (but check in CLI if that's actually the case), then default will apply ... which is "CCMP" (good old AES in WPA2). When checking with CLI: note that setting property to empty string (i.e. "") is not the same as not setting it at all. You ...

mkx

According to SFP diagnostics, it seems that Rx works ... One can not be sure if Tx is fine as well without checking on the other side of fiber, but on your side seems to be fine as well.

mkx

@jfreak53: if you can pinpoint the problem to certain packet contents, then you'd make MT (and humanity) a favour if you could sniff off those frames and send MT the capture file. IMO this is the only way allowing MT to actually fix it. Unless they see those packets and analyze which combination of ...

mkx

By whoever manages cisco ... Or, if it's really ISP (I'm surprised you can see config of your upstream router), let them explain to you how you're supposed to use the /56 they are assigning to you. I suspect that they expect your router to do proxy ARP thingie on WAN port ... which is, IMO, wrong.

mkx

Screenshots are (mostly) useless, you can remove it as well. Open terminal window and execute /export file=aynnameyouwish ... fetch resulting file to your management computer, open it with your favourite text editor, redact any sensitive information (such as serial number, public IP address, wireles...

mkx

How exactly is your SFP port configured? Post outputs of commands /interface/ethernet/export /interface/ethernet/monitor [ find default-name=sfp-sfpplus1 ] once My guess so far: since MT SFP is without "+" (i.e. 1Gbps) and RB5009 SFP port is SFP+ (i.e. 10Gbps), you'll have to disable auto ...

mkx

... MSTP is the most universally compatible one.

I thought RSTP was the most common one?

mkx

Unfortunately, that is what I was doing, and it wasn't working. As in: I disabled wifi interfaces via UI (of any kind) but wifi signal was still being transmitted? Or is it you expected the button magically dissable/enable wifi interfaces without you configuring anything special? Or something compl...

mkx

What I don't understand is how these IoT devices' packets are being heard, received, and repeated by the AP onto the wired network when there is no established wireless connection between the IoT device and the AP. You said that APs are Unifi ... so the question is for Ubiquiti support ... to verif...

mkx

In this case, the configuration no longer takes place on the physical switch but on the virtual switch which is spanned over the physical switch. (At least in the world of HPE/Aruba) Therefore it is also a kind of virtualisation. The only difference is that the switch itself becomes virtual, not th...

mkx

Since packets are broadcast, you'll always see them on hEX, passing in any possible direction ... whether they are getting received somewhere or not. And it's up to anyone's guess as to what's their purpose (and if they would cease to flow if all IoT gadgets would be happy with their connectivity to...

mkx

If you insist that management VLAN resides on VID 1, then it's a). Reason: default config uses VID=1 for all sorts of configuration (e.g. PVID on all ports, including bridge CPU-facing port ). It is possible to get it going as tagged (which is where VLAN interfaces come into play), but it's a tediou...

mkx

something like an entry in the context menu Of which menu? You are surely aware that when device is in sleep mode, it doesn't transmit anything and all caches (e.g. ARP cache, list of DHCP leases, etc.) will forget about it probably long before you'd want to send WoL packet to it, aren't you? Which...

mkx

Since these frames are some kind of broadcasts, you may want to set multicast-enhance=enabled on wifi interface of your AP ... it may or may not help with the problem.

mkx

I can't say about user manager, but usually it should work something like this: set [ find customer=admin username=123456789 password="" ] password="verySecretStuff" Not sure about how to go around 1350 users other than having external script which creates ROS script (with comman...

mkx

Stickers already exist:

They are nice. But let's see what proper W considers as improvement to WAF ... I somehow expect that it's not MT logo stickers no matter what color they are

mkx

Any reason not to upgrade your CRS to ROS version 7.16.2 ?

mkx

Mikrotik supports MLAG. Would that fit at least minimum requirements?

BTW, this doesn't seem to have anything to do with topic of this forum section (virtualization) which is running ROS on virtual machines.

mkx

The MIPSBE devices would be great if they added it ... When they first released wifiwave2 package, it's been said that wave2 requires lots of CPU power and lots of RAM. Old hAP ac lacks both (yeah, hAP ac2 with 128MB RAM can run wifi drivers, but barely so ... minimum RAM for wifiwave2 was set at 2...

mkx

I just said anything but some kind of metallic sticker Now who knows what will arrive from Temu...

Definitely post some photos after WAFization of wAP ax ... Ws tend to have similar views on such matters.

mkx

Since your "project" involves some calculations ... just for comparison: when calculating signal coverage of mobile networks using professional RF propagation tools and then comparing it to reality (measured on the field using professional measurement equipment, such as PN scanners and wha...

mkx

yes, it should.

Not really ... wifi-qcom-ac is only available for routers with ARM architecture ... AC devices of other architectures are "doomed" to run legacy wireless driver ... which doesn't support any new functionality (like PPSK) and I believe it never will.

mkx

This is exactly the same on all servers that support LetsEncrypt. It doesn't have to be. On servers which offer more configuration flexibility one can allow only URLs with path names starting with /.well-known/acme-challenge/ and send 404 for the rest ... or 301 redirecting to https ... or tarpit r...

mkx

Ideally there would be 0 dropped packets (because nobody would be trying to anything bad to you). In reality there's always some bots scanning internet for new victims of their deeds. I guess there will be more dropped packets if bots "smell the blood" (there are many reasons for that, one...

mkx

Show us configuration of both devices ... and mention IP address of management PC (running Winbox or web browser) and where it's connected (physically). Without seeing exact configuration it's impossible to tell the reason why it doesn't work the way you wanted it to.

mkx

It’s about wider compatibility: a DHCP client on the physical interface that connects to the modem and a static route to <MODEM-IP>/32 through the said interface applies to both scenarios (ISP with DHCP and ISP with PPP). A static IP in the LAN of the modem applies “cleanly” only to the ISP with PP...

mkx

... and I still wanted several VLANs untagged on the same port (because my WiFi APs are not VLAN aware).

But does this really work for you? Only one VLAN can have bidirectional traffic (single PVID per port).

mkx

In my case, accept (fasttrack counter) is at 2TB and another 2TB for "slow track"... 32MB drop invalid on input and 32MB drop invalid on forward ... and 178MB drop all else (on input ... nothing on forward).

mkx

It does make sense to drop "invalid" packets early, they might match some allow rule down the chain.

mkx

Configure port on router as trunk with all VLANs needed ... here's how to do VLANs in ROS: https://forum.mikrotik.com/viewtopic.php?f=23&t=143620 ... Tutorial may be geared towards switch-like configs, but is usable also for routers (even router-on-a-stick variety). And a suggestion: upgrade you...

mkx

So why bother with a dual IPv4 when you can just have a route that works in either setup? Adding a /32 route doesn't work with peer which uses "normal" /24 addressing ... And, again, doesn't add to security. One has to treat modem as being hostile and adding interface, connecting modem, t...

mkx

I don't think rotating drvices at angle would be a problem by itself. However there are at least two (minor?) issues to think about: wAP60G uses beam forming, so it can direct main lobe in "optimal" direction. But not in any direction, range span is 60° in horizontal direction and only 30°...

mkx

Don't know if this has been discussed already ...

There's such a feature already: port extender. Not many devices are compatible ... and it comes with some serious gotchas. But it's here.

mkx

I didn't manage to get IPv6 addresses not leaking across VLANs when using SLAAC to assign addresses. Did you fix the switch VLAN settings according to @anav's instructions? If port is untagged member of multiple VLANs, then broadcasts of all VLANs will egress through that port (and being untagged o...

mkx

To better understand the process, could you clarify where exactly the packets get tagged in the WireGuard setup? :mrgreen: The smiley you used makes me wonder whether you expect an answer or not. But anyway, here it is: wireguard is IP tunnel so natively it doesn't carry (nor care about) VLAN tags....

mkx

Again (and read my lips:) there's RouterOS version and Routerboot version. Both are distinct.

mkx

RouterOS (as in windows OS) is at 7.16.2. But: RouterBoot (as in BIOS / UEFI) is at 7.16.1. RouterBoot upgrade files are shipped to device along with RouterOS but it's not installed automatically. Hit that "Upgrade" button and reboot device.

mkx

In that case, the Linux kernel is GPL licensed code and as such we should be able to see the sources with modifications from MT ... I don't think that MT linux kernel contains many changes ... apart from some specific device drivers and some patches. I think it's more about missing features. E.g. d...

mkx

The ROS uses Linux kernel underneath anyway and I assume the very same tools underneath as any usual Linux distro ... Here you assume wrong, so nothing you wrote after this point doesn't necessarily reflect reality. ROS indeed runs linux kernel ... but if we can believe MT guys around here (and I d...

mkx

Yes DHCP client sends out broadcast packets when doing DHCP discover and bridge will send these frames out via all member ports. In principle only one DHCP server is necessary per L2 broadcast domain and if there are multiple servers in given L2 broadcast domain (not wrong by itself), it's expected...

mkx

This gbic is working fine with a Ubiquiti Edgerouter X which i'm using right now. ROS is a bit notorious for not supporting properly just any SFP module, thrown at. So the positive experience when using same SFP in different device brand means very little in this case (it only proves that SFP can t...

mkx

Try to check in depth what's going on with SFP+ port and module. ROS is a bit notorious for not supporting just any SFP/SFP+ module properly ...

Also verify as to which physical port corresponds to MAC address, set as bridge MAC address.

mkx

Well, anyway. Logs don't show anything related to hardware issues (link downs or whatever) ... which likely means some L3 problem. In that case you'll have to troubleshoot the issue while problem persists ... like running traceroute (on a LAN PC) towards e.g. 8.8.8.8 and see where things break ... i...

mkx

Errmm ... that's an article from 2014 ?!

That was my point exactly

mkx

With default logging config, ethernet port link-downs are logged. Also PPPoE client outages are logged (and as far as my experience goes, they correlate 100% when there are problems with ethernet port connectivity). With logs you showed (and assuming you didn't filter any events ... either by reconf...

mkx

Even with "plain" file systems (e.g. ext4) it's sometimes necessary to reformat drive (possibly due to lack of support for some type of partition table or some such). But with encrypted drives I'd say it's even more necessary to reformat drive ... it would be logical to me that encryption ...

mkx

Looked at cisco config and I think the problem lies there: interface GigabitEthernet0/1 description ** LAN ** ip address 201.201.201.201 255.255.255.240 no ip redirects no ip unreachables no ip proxy-arp duplex auto speed auto ipv6 address 2001:db8:20a0::1/56 anycast no cdp enable It effectively say...

mkx

IMO the problem is this:

advertising: 1G-baseX
link-partner-advertising:

Note the empty field "link-partner-advertising". Which means that autonegotiation doesn't happen. Try to set port speed to 1Gbps and disable autonegotiation on sfp-sfpplus1 port (under ethernet configuration).

mkx

You actually need to set advertise=yes on addresses on interfaces where there are devices which should use your router as their gateway ... without it, router will not send out RAs and SLAAC then doesn't work. In your opening post, you write "When I try to configure the LAN and define new prefi...

mkx

I just had a quick look at HUB configuration and it seems to me that routing configuration is flawed: /ip address # You probably don't need this: add address=192.168.0.223/24 comment=defconf interface=BR1 network=192.168.0.0 # and you probably don't need this either: add address=192.168.0.223/24 int...

mkx

Is there anything related in logs?

mkx

Can you post configuration from your MT router, at least the /ipv6 part? You can omit firewall part, it probably isn't important in the context of problems you're seeing.

mkx

Can you post the link to tutorial you're referring to? It's quite likely outdated, master port configuration style was abandoned in ROS 6.41 (quite a few years ago) and was replaced by bridge. And before you proceed, I recommend you to upgrade ROS to latest v6 stable (6.49.something), v7 is probably...

mkx

Show us config of switch (text export)..

mkx

At least pist the exact rule which doesn't work for you. And a detail, it might be a hint: firewall rules may be executed before egress interface is known, routing decission is made after most firewall processing is done. Also: screenshot in opening post also hints that ping is originated from route...

mkx

Metarouter is R.I.P. on RouterOS since many moons ago (at least in reality if not officially). It's replaced with container functionality ... but this functionality is not available on all platforms and if one seriously wants to use it (or wants to seriously use it) one better uses a very decent RB ...

mkx

Actualy ax hardware I tested on 7.16.2 on MikroTik have only fixed channels, example 5500 but not 5510 Yup, that's pretty normal on today's mainstream wireless stations (e.g. smart phones) ... they only support standard channel center frequencies. When creating MT-MT point-to-(multi)point link, thi...

mkx

You can't block specific URLs (chosen between different URLs targeting same FQDN host or IP address). Generic reason is that there's no guarantee that whole URL will fit single IP packet. And FW (L7 as well) works with IP packet granularity. So if one uses IP packets with MTU size of 40 bytes, then ...

mkx

In the meantime your devices probably have restarted ...

... or remained in some undefined state if the brief moment without power flowing lasted just the right duration. And in this case one has to reboot device.

mkx

But do think using default 20/40/80Mhz channel width might be cause of at least some of the frequent AX complaints... I don't think that 20/40/80MHz is causing complaints. After all, this kind of channel arrangement is (supposed to be) backwards compatible with devices supporting only narrower chan...

mkx

If considering RB4011 and RB5009 ... then RB4011 is technically inferior in many aspects (slower CPU, uses 2 switch chips and SFP is connected directly to CPU, doesn't have USB port, etc.). Just thought to mention this to contrast higher WAF of RB4011 :wink: Regarding hEX S performance: that rule of...

mkx

about downgrades, there is ZERO logical reason to knowingly downgrade to a version with a known CVE, possibly allowing easy access to the device by a hacker. Zero. Do not try to find it. This is new to me ... that ROS upgrader has built in function to check certain ROS package against database of C...

mkx

You may want to look at output of command /interface/wifi/print and /interface/wifi/security/print (run them in terminal window ... you can start one from WinBox or connect to device using ssh) ... and look for "encryption" property in both outputs. Only then you'll see what is actually co...

mkx

After you uninstall wireless package and install wifi-qcom-ac package - verify that it's actually installed, cAP ac XL has only 16MB storage space which is really tight - (and upgrade routerboard firmware for good measure ... and cold boot device for another good measure), it may be good to reset de...

mkx

I just NEVER see anyone recommend narrowing channel width for AX... which got me questioning physics. My guess: none of the vocal AX supporters considers 2.4GHz band as viable WiFi band any more (everybody is looking at 6GHz now days). I've thought of a reason to go with 20MHz channels (instead of ...

mkx

The problem with communication pausing and/or packets being dropped when there's speed change (most notably from faster to slower, e.g. ingress port is 10Gbps and egress port is 2.5Gbps) is buffering. A switch has only certain amount of buffer and if there's a burst of frames, switch needs to buffer...

mkx

I know AX uses OFDMA to better handle this ... ... so do G and N (and A) ... actually only B uses DSSS with 22MHz-wide channels. So in this respect AX is nothing new. What AX adds is 1024QAM (N stops at 64QAM) so it can reach higher speeds when SINR is great. And reduces subcarrier spacing by facto...

mkx

When doing L2 stuff, it's responsibility of device sending frame (can be originating host, can be router) to find out destination MAC address. And L2 entity (switch) then passes frame to correct port. If sender doesn't know destination MAC address, it can send it to broadcast MAC address. Both when ...

Search found 13486 matches