- Public - talk.mikrotik.com.au

RBwAPG-5HacT2HnD losing 5GHz radio?
by Damien Gardner Jnr 22 Dec '23

22 Dec '23

HI all, Kinda pulling my hair out with this one.. Hoping someone has a suggestion. I have a RBwAPG-5HacT2HnD, love this thing. But yesterday morning we started getting weird outage alerts from monitoring at home, with some devices being offline. (The main kicker was the cubby lol) When I got home from work I went looking, and finally tracked it down to wlan2 being missing.. A reboot brought it back.. But 10 mins later it was gone again. Rebooted it a few more times, then added remote syslog, and went to bed. Got up this morning, and remote syslog really wasn't any use at all (I assume there's some specific prefix I should have been punting to remote syslog to catch the device going away), and now reboots aren't helping, it has to be a physical power removal and re-application.. Thankfully I have a spare (Got one on ebay at the start of the year, and had meant to set it up at the back of the house), so have just finished copying the config to it, but would love to get this one working properly again.. Was hoping it was just mini-PCIe cards or something, but alas no. Has anyone had the 5GHz radio go away on these? And fixed it? It's 4 1/2 years old, so I'm pretty sure it's out of warranty period 🤣 Thanks, DG -- Damien Gardner Jnr VK2TDG. Dip EE. GradIEAust rendrag(a)rendrag.net - http://www.rendrag.net/ -- We rode on the winds of the rising storm, We ran to the sounds of thunder. We danced among the lightning bolts, and tore the world asunder

4 3

Proscend PS180-T VDSL SFP Modem EOL
by Tim Sandy 12 Dec '23

12 Dec '23

I'm quite sad to have just discovered that the PS180-T is now EOL, does anyone know of a similar product out there? I've got them at quite a few sites and would really love to avoid running an external modem in bridge mode. Cheers, Tim

6 7

ROS6->ROS7 and BGP
by Tim Warnock 17 Nov '23

17 Nov '23

Hey Guys, I ran an experiment to upgrade a ROS6 box to ROS7 to see what it looks like and found at least the following things: 1 - route "check" tracking doesn't seem to work? 2 - no-exports set on routes towards EBGP peers are interpreted rather than forwarded - so you can't signal to EBGP peers to no-export your routes from outside of their ASN anymore. 3 - it appears that the route policy conversion bugs out if one of the entries is disabled so you have to be prepared to fix any entries that are missing. 4 - you can no longer set the ASN of a route being advertised. (would need to update RPKI information) 5 - non-synchronous network statements are gone, so you can't easily send scrub communities via BGP anymore (because a legit route now has to exist in table). 1,2 and 3 feels like bugs, the rest I'm not sure why the functionality was removed. Anyone successfully spoken to MikroTik about what their thought process was with the changes? (I opened a ticket for 2 and it was ignored.) Thanks Tim

3 2

Puzzled why forwarding no work
by Karl Auer 07 Nov '23

07 Nov '23

Some may recall I now have a Wireguard VPN between a Starlink-connected site and another site. The other site has a static IP address, the Starlink site does not. Inevitably, someone now wants to connect from outside to a server in TCP/85 in the Starlink site. No problem, thinks I. They can connect to the static IP and I will ship their connection over the VPN to the other network. Just dstnat plus srcnat. In the following, xxx is the static IP address, and 192.168.103.184 is the address they want to reach in the Starlink-connected network. /ip filter nat add chain=dstnat action=dst-nat \ dst-address=xxx dst-port=85 protocol=tcp \ to-addresses=192.168.103.184 to-ports=85 \ in-interface=e1-uplink log=yes log-prefix="A" add chain=srcnat action=masquerade \ ???? out-interface=wg0 log=yes log-prefix="B" I can't figure out what I should put in the srcnat rule that will limit it so it only src-nats packets coming from the public internet. The obvious one, filtering on "in-interface=e1-uplink", isn't possible with srcnat. What am I missing? Or do I have to add "accept" rules for all the networks I don't want NATted by wg0? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

5 10

Sanity Check on Route Filters
by Christopher Hawker 06 Nov '23

06 Nov '23

Hey all, Just looking to get a sanity check done on a route filter. If an AS is receiving routes from an IX route server, will this allow routes from the RS to be received? I'm confident it will, however just looking for validation before we test it. /routing filter rule add chain=AS64496-V4-IN disabled=no rule="if ( bgp-input-remote-as 64496) { set bgp-local-pref 200; accept }" Regards, Christopher Hawker

2 2

40G QSFP+ Card Support on Mikrotik ROS x86
by Christopher Hawker 30 Oct '23

30 Oct '23

Hi All, I'm currently trying to source a dual-port QSFP+ card that is supported on ROS x86 (bare-metal). Are there any cards that people know of that are supported? We are trying to avoid the overhead of virtualisation that comes along with running CHR on a hypervisor. Thanks, Christopher H.

2 1

Re: [MT-AU Public] Getting out of CAP mode
by Roger Plant 22 Oct '23

22 Oct '23

Sorry if this is a duplicate, It seems to have bounced earlier. Hi, Not sure if this is in the spirit of the exercise, but traditionally a cap had no password and no firewall. If this is still the case, just login (with winbox via mac address if need be) and reset to defaults? Otherwise my only suggestion is: https://help.mikrotik.com/docs/display/ROS/Reset+Button Which I am fairly sure you have looked at more than once... Regards Roger To: MikroTik Public <public(a)talk.mikrotik.com.au> Date sent: Sun, 22 Oct 2023 13:18:03 +1100 Organization: Nullarbor Consulting pty Ltd Subject: [MT-AU Public] Getting out of CAP mode From: Karl Auer via Public <public(a)talk.mikrotik.com.au> Send reply to: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> Copies to: Karl Auer <kauer(a)nullarbor.com.au> [ Double-click this line for list subscription options ] Skip to end for actual question. Otherwise: So. Did I miss something? Is there a special trick for getting out of CAP mode? Is this behaviour possibly even intended? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160 _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au ---------------------------- Roger Plant

1 0

Getting out of CAP mode
by Karl Auer 22 Oct '23

22 Oct '23

Skip to end for actual question. Otherwise: I have a spare/test Mikrotik 951G 2HnD here at home. We've been through many adventures together. I trust it. I think it trusts me. Today I thought: CAPSMAN looks interesting! I took my trusty spare router, did the reset thing and put it into CAP mode. Configured up another router as a manager and it all worked swimmingly. Still have to figure out multiple SSIDs and VLANs, but that is for another day. Tired but happy, and wanting to revert my trusty spare router back to default settings for our next adventure, I pressed the reset pin while plugging in the power, waited the usual few seconds until the ACT light started flashing, and released the pin. The unit remained in CAP mode. Huh. Repeat. Repeat carefully. Repeat even more carefully. Repeat. Repeat. Speak gently to router and repeat. Speak forcefully to router and repeat. Apologise to router and repeat. Sigh. So I read numerous web pages, as one does. It seems a lot of people have difficulty distinguishing flashing LEDs from solid LEDs, distinguishing mode buttons from reset buttons, locating small holes, counting to five, coordinating their limbs etc, but these defects do not apply to me. I have reset this specific router many dozens of times. Possibly hundreds. It has always returned faithfully to a usable default configuration. OK, dragged out NetInstall (Linux version, yay!). It duly sent a new copy of RouterOS7 over to my little friend. Which remained in CAP mode. Kind of expected, so I repeated the process with "-r" to clear the configuration. And finally, finally, my little friend and I fell sobbing into one anothers' arms. So. Did I miss something? Is there a special trick for getting out of CAP mode? Is this behaviour possibly even intended? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

1 0

SPF bounces - oops!
by Mike Everest 19 Oct '23

19 Oct '23

Hi Folks! I spotted a whole bunch of list unsubscribes due to excessive bounces today - due to (mostly gmail) remote servers rejecting posts due to lack of SFP record <d'oh!> FWIW, we *did* have SPF configured for the domain, but overlooked the fact that emails come from '@talk.mikrotik.com' :-} It's now fixed and I re-activated those disabled memberships - there's no search function that let's me find all of the affected subscriptions, so I can't be certain that I fixed all of them - so if I overlooked you, please accept my apology! (but if I overlooked you, I suppose you'd never know that I did - does it keep me 'safe'? ; ) Cheers! Mike.

1 0

Re: [MT-AU Public] Mikrotik and Starlink
by Karl Auer 19 Oct '23

19 Oct '23

On Sun, 2023-10-15 at 14:55 +0000, Andrew Oakeley wrote: > I'd be inclined to set your allowed-address for the peers to > 0.0.0.0/0 On Mon, 2023-10-16 at 09:10 +1100, Roger Plant wrote: > On the Server, You need to add 192.168.16.3 to the allowed > addresses in the Client peer entry. > > On the Client, You need to add 192.168.16.1 (or maybe .16.0/24 if > there will be other peers attached to server in future) to > the allowed addresses in the Server peer entry. I had already tried what Roger suggested, and had added ",192.168.16.0/24" to the allowed-address on each end. It changed the error, but only on the client end, from the error 126 to a timeout. So I just now tried what Andrew suggested, and FMS it then worked; I could ping each Wireguard interface address from its "opposing" address on the link. But WHY?!? Why was it not enough to add just the Wireguard link subnet to each end's allowed-address list? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)nullarbor.com.au) work +61 2 64957435 http://www.nullarbor.com.au mobile +61 428 957160

4 13