MikroTik

Sorry for my english.
My radio wireless is LHG 5 and ISP radio is QRT 5. The connection is PTMP, there is 3 other clients connected to that QRT 5. There is a weird problem that happens every few moment and it's so annoying for me. every few moment( 2 minute - 10 minute) I get a complete disconnection for 3-4 second and it's so annoying because it interrupts every kind of task (Voice Call, Online Game, University online course, live stream or video, Streaming by myself). I called ISP many times to solve this problem, they did everything they can to solve it but they couldn't succeed. Also we checked everything together (Me and ISP support) but we couldn't understand what is the reason of this problem. The 3 other client are industries and they get closed after 15 PM, so after that time I'm the only user who uses the internet and other 3 client device stay as idle mode (They just stay online and don't use any internet). So ISP asked me to research about it. They are ready to set any configuration I say to solve this problem because they have no idea what's the reason of this. Thus I decided to ask you for help, I can provide any detail you want to solve this problem.

Bump!

The engine in my car don't work. Here's a picture of my seat. please help...

A more friendly advice: post the export of both configurations (hAP lite and LHG5), and you'll likely get some instruction on what and where to sniff while testing to help identify the problem.

Before starting, install the latest long-term version (6.47.9 at the moment of writing this) on both devices - debugging this kind of issue on a beta version is a waste of time. I'm not sure, though, whether a downgrade from 7.x to 6.x is possible without loss of configuration, you may have to configure the routers from scratch.

These are the settings of my LHG5.

Instead of posting 150 screenshots which show 5 % of the configuration, please use the [New Terminal] button to open a command line window, type /export hide-sensitive file=current-config in that window and press Enter. A file named current-config.rsc will appear in the file list; download it, and if you eventually have a public IP address, substitute it in the file following the hint in my automatic signature. Then either attach the file here as an attachment to the post, or copy-paste the contents into the body of the post between [code] and [/code] tags.

I don't have permission for that.

In such case, ask the ISP for that, as it is apparently their device.

Just as a blind shot until you can arrange that, press [Interfaces], and in the "Interface List" window that opens, press the [Detect Internet] button just above the table on the (Interface) tab. Post the screenshot of the window that opens.

I can't have access straightly to wireless device, so I have to disable Internet first. I wonder that can I have access to my LHG 5 through my hAP Lite with online internet?

It is hard to say as I don't know the complete setup. The LHG5 may be working in bridge mode an have no IP address, or there may be a management IP address assigned by the ISP. When you connect your PC to the hAP lite, you can see only the hAP lite in the neighbour list in Winbox because the hAP lite acts as a router and thus the LAN and WAN are not the same L2 segment, so the discovery protocols cannot traverse between LAN and WAN.

If the LHG5 has an IP address, and if there are no firewall rules (on the hAP lite or on the LHG5 itself) that would prevent access to that address from your PC, you should be able to connect to the LHG5 even when the hAP lite is connected to it by telling Winbox to connect to that IP address rather than to the MAC address of the LHG5.

To find out, on LHG5, go IP->Addresses and post the window that pops up (if the IP address is a public one, hide it in the picture).

Then, go IP->Routes and post that window.

Next, go IP->Firewall and post that window when the tab (Filter Rules) is chosen.

And post the text export of your hAP lite, I suppose that device is your own one so you can do the export on it?

BTW, you've excused for your English, but I can understand what you write just fine. Do you have any issue with what I write?

I totally understand what you write. I excused because I may make some grammar mistakes because I'm not native English. So I want you to don't take these seriously.
I can also give you AnyDesk address to check everything needed.

You may want to remove the script part from the configuration export (edit the post, remove the file and re-post it without the /system script and all the lines following it) and change your password to the DynDNS service. It didn't come to my mind you could have something like that in operation. I'll continue regarding the original topic later.

Which password should I change? I already removed Scripts line in this config file.

There is the local noippass "xxxxx" line in the script; if someone has downloaded the original file, they can update your DynDNS now, until you change the password on the DynDNS web selfcare page and then update it accordingly in your script.

To the original topic: given how the two Mikrotik devices are configured, I doubt the ISP network allows the customers to access the LHG5 using its IP address. The PPPoE connection from your hAP lite is terminated on some of their central routers and there is probably a firewall rule or a missing route to prevent customers from accessing the subnets the ISP uses to manage their delivery network. And you cannot configure an IP address from that subnet on ether1 of the hAP lite because the subnet is really small so you could get in conflict with some other customer (since there are 4 customers in total, there's a single free address in that /29).

So it may be possible to use mac-telnet to access the LHG5 from the hAP lite, using the same credentials you use for Winbox access ([Tools]->[Telnet]->(o) Mac Telnet and enter the MAC address of the LHG5).

It should also be possible to make ether1 of the hAP lite a member port of the LAN bridge, attach pppoe-out1 to the bridge interface rather than to ether1, and use bridge filter rules to allow only pppoe, pppoe-discovery, and mac-winbox frames to leave through ether1, in order to prevent messing with the rest of the ISP network, but it's quite a complex task which may not be worth it.

They could also assign a secondary IP address to the LGH5, from another subnet, and you would assign another IP address from that subnet to ether1 of your hAP lite.

No matter how you eventually get there while the hAP lite is connected, the thing is that I'd like to see the log of the wireless subsystem while the outages happen, but as your account on the LHG5 doesn't have enough permissions to export the configuration, I doubt you could change the logging settings.

As your initial screenshots show that you ping the MAC address of the AP from the LHG5 itself, it should not be a cabling issue, except if a powering one. Do you know how long is the Ethernet cable from the PoE injector to the LHG5, and what is the voltage of the power supply used to feed it?

If I were your ISP, and if the log of the wireless subsystem shows nothing at either end (the AP and your LHG5), I would use another LHG5. First to replace yours, and if it doesn't help, to do wireless sniffing while you ping the AP from the LHG5 and the outages happen. I'd first be sniffing at the AP side, looking whether all the ping requests arrive over the air, and if they do, then at your end, to see whether the responses come over the air.

I will change my DynDNS service password to make it secure ASAP. I can make temporary LAN connection by disabling interface "pppoeout-out1" and then adding ether1 port to LAN_Bridge. I also tried MAC-telnet and it worked, but as it connected through terminal, I didn't like it XD. For now, it's not a big deal so we can skip solving this problem. Back to original topic, the only situation that I don't get timeout and the problem gets solve, is by disabling other clients on ISP radio device. So they suggest me to buy one more radio and make a PTP connection, but it cost a lot of price, I believe the problem is solvable so it's not worth to pay that much money for that, however, it's an option. about cable and voltage, the cable length is 25 meter and voltage is 220-240, but as I said the problem is not related to cable or device it self. They say they already send a ticket to Mikrotik support team with needed config files, and they already did every suggestion that support team suggested but those didn't work.

the only situation that I don't get timeout and the problem gets solve, is by disabling other clients on ISP radio device. So they suggest me to buy one more radio and make a PTP connection, but it cost a lot of price, I believe the problem is solvable so it's not worth to pay that much money for that, however, it's an option.

That's the issue of the price of one's time. In some countries, the price of LHG5 equals to one hour of technician's work, in others it may equal to one month of technician's work.

But more important is that running another radio in parallel to an existing one is in a better case a useless occupation of an extra radio channel, and in a worse case it is an extra interference source if no unused channels are available in the air.

about cable and voltage, the cable length is 25 meter and voltage is 220-240

The voltage you gave is the AC one at the wall outlet, but there's an adaptor which makes 24 or alike DC from it, and this is what I was interested in.
But if you use the adaptor that came bundled with the LHG5, it should be fine with just 25 meters of Ethernet cable, unless the cable is very bad. And as you say that disabling the other clients cures the problem, it's definitely not related.

They say they already send a ticket to Mikrotik support team with needed config files, and they already did every suggestion that support team suggested but those didn't work.

Have you/they tried to change the MAC address of your LHG 5?

I don't know whether they really need to use NV2 given that there are only four clients on the sector - the issue may be specific to NV2 and not exist in 802.11 mode. Have they tried to switch all the clients and the AP to 802.11?

The price is about 1 month of my brother income, So it's a lot. The cable is high quality one with few layer inside. They already have connected me to another radio but problem still exist, we also tested both protocol, 802.11 and nv2, on both of ISP radios, but it didn't change anything. The solution that is mentioned before, also worked on the new destination radio(Disabling other clients). About changing MAC, they(ISP) said that they already had this problem with one of their customers and problem fixed by changing connection into PTP, So it means even changing MAC may not solve the problem. I wonder that if it related to Mikrotik devices, and the bad news is the Mikrotik is only brand which is accepted by my country ISPs.

The price is about 1 month of my brother income, So it's a lot.
...
the bad news is the Mikrotik is only brand which is accepted by my country ISPs.

Which seems to be related, other vendors may be prohibitively expensive or embargoed. And they don't support NV2 of course.

They already have connected me to another radio but problem still exist, we also tested both protocol, 802.11 and nv2, on both of ISP radios, but it didn't change anything. The solution that is mentioned before, also worked on the new destination radio(Disabling other clients). About changing MAC, they(ISP) said that they already had this problem with one of their customers and problem fixed by changing connection into PTP, So it means even changing MAC may not solve the problem.

If replacement of the whole device hasn't helped, it seems logical that replacing a MAC address will not help either.

The way you describe it, it sounds as an issue with the wireless protocol where some of the other clients on the same AP is sending when it is not supposed to, interfering with the signal from your LHG5, or the AP not allowing your STA to send for quite a long period of time. This is something that can only be debugged the way I've described before, i.e. using a third radio to passively listen to the wireless traffic and then analysing the captured communication, and it needs an experienced WiFi specialist to find the issue and identify the guilty piece of equipment.

I am afraid no tools capable of analysing NV2 traffic exist outside Mikrotik's lab, so such an analysis can only be done when the whole cell runs 802.11.

What surprises me most is that those other clients (companies) connected to the same AP don't complain, as this issue should affect every client on the same AP, not just a single one. Do they use LHG5 as well? Can the ISP eventually switch them off temporarily in the afternoon one by one (which can be done remotely using the delay command), to possibly identify a single client device that misbehaves?

ISP said even other clients have the problem, but they aren't using like you(They are one shop and three company) so they don't mind this kind of issues. We also tried to switching them off and enabling them one by one, but it doesn't related to specific device, the problem always happen when there is more than one radio connected to ISP radio. Also we've already been using 802.11 protocol for a 2-3 month now. Also devices are different from each other, but ISP radios all are QRT 5.

Bump!

I do not understand because you are taking care of it,
who you do not even have all the permissions to read access and modify the configuration of the devices,
rather than requiring your ISP to take care of it.

This situation is absurd for me and, only for me of course, the hypothesis is that the ISP is nothing more than a guy who, without authorization, gives the connection "without putting much effort"...

I do not understand because you are taking care of it,
who you do not even have all the permissions to read access and modify the configuration of the devices,
rather than requiring your ISP to take care of it.

This situation is absurd for me and, only for me of course, the hypothesis is that the ISP is nothing more than a guy who, without authorization, gives the connection "without putting much effort"...

ISP says because your connection is PTMP, we can't put on risk our security and give permissions to you, there is 3 other clients connected to destination radio. they say if I was PTP, they could give radios permission. ISP already made a ticket with Supout.files attached to it. Support team couldn't solve the problem yet. My situation is something like this:
viewtopic.php?f=7&t=174762&p=855891#p855891

The engine in my car don't work. Here's a picture of my seat. please help...

Without full export (EXPORT, not PHOTOS) of QRT5 and the LHG5 (hoping all LHG5 have same config) can't be done anything.

Very useless "bump"

Change ISP and ask for refund.

P.S.:
What is distance between the other 3 LHG5 and QRT5?
-35 at 2Km...
the right value at that distance is calibrate all between -52 and -60, depend on other users distance.

For 2Km one QRT and one LHG...
No comment...

It's so frustrating to have a such problem. Still looking for a way to fix it. If you have any suggestions, please let me know.

I've heard some people say there is something wrong with RSTP, how RSTP can cause problems in the PtMP network?

You are not cooperative at all, have you read my post LAST YEAR?

Ahhh, sorry, we wayt another YEAR for the no-reply...

Ahhh, sorry, we wayt another YEAR for the no-reply...

You told me that there is no way without full export, also you said that I have to change ISP and ask for a refund. both of these are impossible for me. We did everything we can to fix the problem. It's so frustrating to use the internet with that problem so I had to ask for help again. I'm ready to share any detail that I can see, also I'm ready to give access to my AP through Anydesk or Teamviewer.

So ISP asked me to research about it.
They are ready to set any configuration I say to solve this problem because they have no idea what's the reason of this.
Thus I decided to ask you for help, I can provide any detail you want to solve this problem.

On screenshot you are logged as admin....
Any detail?
Full export...

So ISP asked me to research about it.
They are ready to set any configuration I say to solve this problem because they have no idea what's the reason of this.
Thus I decided to ask you for help, I can provide any detail you want to solve this problem.

On screenshot you are logged as admin....
Any detail?
Full export...

Those are my router's screenshots not AP, why I don't have to share my details when I can?

Ask the ISP to share the config of AP and CPE, on forum, so everyone can see if are problems.

If you do this already last year, probably the problem is gone already one year ago...

Ask the ISP to share the config of AP and CPE, on forum, so everyone can see if are problems.

If you do this already last year, probably the problem is gone already one year ago...

The ISP doesn't do that. It has already shared those with Mikrotik support and they couldn't solve it. I wonder if there is a way to get extended logs.

Log can be helpful for some problem, like 1% of the problems...

Log can be helpful for some problem, like 1% of the problems...

What am I supposed to do then?

You have more choice:
1) Still post uselessly in this forum (of course I'm sorry, and I understand you)
2) Ask the ISP to share the config of AP and CPE, on forum, so everyone can see if are problems
3) Ask the ISP to pay a consultant that go directly on-site and reveal what are the problems
4) Change ISP, for example Starlink,
and for sure you have also other options.

4) Change ISP, for example Starlink

Starlink? In Iran? Not really likely in this decade...

I've heard some people say there is something wrong with RSTP, how RSTP can cause problems in the PtMP network?

RSTP (or any other flavor of STP) blocks forwarding of traffic on interfaces that just came online for a while, until a time during which an STP BPDU should arrive expires, to prevent L2 loops. So theoretically, if the wireless interface was going down briefly now and then, following each such event the forwarding would be interrupted for some time. But this time should be several times longer than 3-4 seconds, and you should see the wireless interface to be going down and up again even if the actual issue is at the "base station" at the ISP side.

Is there any security activated on the link? Did you manage to monitor the link using another wireless device while it was running in 802.11 mode as I've suggested last year?

Finally, they gave me the Write access to my AP. I'm still unable to make Supout.rif
Thanks to the topic below, I just changed RSTP to STP and everything seems solved.
viewtopic.php?f=7&t=175574
I still have a few problems and need help with those.
1. I get some weird ping spikes.
2. I want to have access to my AP without turning my WAN port into LAN port on my Router.

Finally, they gave me the Write access to my AP. I'm still unable to make Supout.rif
Thanks to the topic below, I just changed RSTP to STP and everything seems solved.
viewtopic.php?f=7&t=175574
I still have a few problems and need help with those.
1. I get some weird ping spikes.
2. I want to have access to my AP without turning my WAN port into LAN port on my Router.

The second problem got solved by ISP specialist, but first problem still exist, I get weird and illogical latency spikes every few minutes.

Again, picture without explanation is useless.


Now I'm doing it too so you understand what it means:
The solution to the problem is obvious, it's in the image, you can not see that???

Again, picture without explanation is useless.


Now I'm doing it too so you understand what it means:
The solution to the problem is obvious, it's in the image, you can not see that???

What do you need?

For example, if the CPE have 192.168.3.1, what have you ARP pinged?, and the IP 192.168.2.1 what is?
Just for example.....

For example, if the CPE have 192.168.3.1, what have you ARP pinged?, and the IP 192.168.2.1 what is?
Just for example.....

The ping in Winbox, is ISP's AP MAC Address, the 192.168.2.1 is my home router which my PC has connected to it through LAN cable, and 95.80.184.185 is ISP's DNS address. Also the ping from my router to my CPE is <1 as well.

Ok, at this point, if the CPE can ping the AP consistently at 1ms, the problem is the rest of the provider's network ...

Ok, at this point, if the CPE can ping the AP consistently at 1ms, the problem is the rest of the provider's network ...

Do you have any suggestions for testing? Like what things should we try on the ISP network or AP?

For me, if all this is true, it is better that the ISP hires some consultants to fix its internal network...
I don't think it's the user's business, also because you can do very little ...

Do you have any suggestions for testing? Like what things should we try on the ISP network or AP?

I agree with @rextended that it's the ISP who should solve this, however if you try /tool traceroute x.x.x.x rather than plain :ping x.x.x.x, it should show you at which network hop the jitter begins.

I recently went through this because the ISP wouldn't answer DHCP renew requests and was set for 5 minute leases..

After the lease expired, a discover was sent and that was answered immediately.

The problem was that because the IP was dropped and then re-issued the masquerade rules would drop all the sessions.