Differences

This shows you the differences between two versions of the page.

--- lwc:hardware:networking:mikrotik [2026/08/06 20:50] – John Harrison
+++ lwc:hardware:networking:mikrotik [2026/10/17 22:22] (current) – John Harrison
@@ Line 31: / Line 31: @@
 sudo make install
 </code>
+====== Maplite Intranet Reference ======
+===== Overview =====
+Maplite B is the gateway: it joins the upstream wifi as a client, NATs, and runs DHCP. Everything else uses B as gateway and DNS.
+^ Device ^ Address ^ Role ^
+| Main machine | 10.42.0.99 (static) | Gateway 10.42.0.71, DNS 10.42.0.71 |
+| Maplite A | 10.42.0.139 (static) | Gateway and DNS 10.42.0.71 |
+| Maplite B | 10.42.0.71 | Wifi client, NAT, DHCP server, DNS |
+| Maplite C | 10.42.0.72 (static) | Gateway and DNS 10.42.0.71 |
+| DHCP pool | 10.42.0.150 - 10.42.0.199 | Served by B |
+| Free for static units | 10.42.0.73 - 10.42.0.98 | Use these for new maplites |
+Path to the internet: main machine -> A -> powerline -> B -> upstream wifi -> internet.
+===== 1. Adding a wifi network to B =====
+Use an interactive session so the password stays out of shell history:
+<code bash>
+ssh admin@10.42.0.71
+</code>
+Then run these two lines per network. The profile name is only a label: it must be unique and the same in both lines. Increment it (''wifi2'', ''wifi3'', ...) or use a descriptive name (''office'', ''home'').
+<code>
+/interface wireless security-profiles add name=wifi2 mode=dynamic-keys authentication-types=wpa2-psk wpa2-pre-shared-key="PASSWORD"
+/interface wireless connect-list add interface=wlan1 ssid="SSID" security-profile=wifi2 connect=yes
+</code>
+Notes:
+  * The mAP lite is **2.4 GHz only**. Choose the SSID that broadcasts on 2.4.
+  * For an open network use ''mode=none'' and leave out the key.
+  * Reusing an existing profile name fails with "already have such profile".
+  * Put the preferred network first in the connect-list.
+=== View what is saved ===
+<code>
+/interface wireless connect-list print
+/interface wireless security-profiles print proplist=name,mode,authentication-types
+/interface wireless registration-table print
+</code>
+  * The connect-list shows each saved SSID, its profile and the order.
+  * ''proplist='' hides passwords. A plain ''security-profiles print'' prints every stored key in clear text.
+  * The registration table shows which network B is currently joined to.
+  * The ''default'' profile is the factory one and is not used by the uplink.
+=== Remove a network ===
+<code>
+/interface wireless connect-list remove [find ssid="SSID"]
+/interface wireless security-profiles remove [find name=wifi2]
+</code>
+===== 2. Adding another maplite (configured like C) =====
+==== Choose an address ====
+Pick one outside the DHCP pool (.150-.199) and not already in use (.71, .72, .99, .139). Use .73, .74, ... in order.
+==== Plug in and reach the unit ====
+  * Plug it into the chain (powerline or ethernet).
+  * If its DHCP client is on (A's factory config was), it gets a lease from B. Find it on B with ''/ip dhcp-server lease print''.
+  * Otherwise it is at its default address, usually 192.168.88.1. Give your machine a temporary address on that subnet to reach it.
+  * A factory-fresh unit has not been checked on this network, so confirm which of these applies.
+==== Static configuration ====
+Replace ''10.42.0.73'' with the new unit's address. Run it as **one line**: removing the current address can freeze or drop the SSH session, and on a single line RouterOS finishes all the commands before the connection notices.
+<code>
+/ip dhcp-client remove [find]; /ip address remove [find where interface=bridge or interface=wlan1]; /ip address add address=10.42.0.73/24 interface=bridge comment=lan; /ip route add dst-address=0.0.0.0/0 gateway=10.42.0.71 comment=default-gw; /ip dns set servers=10.42.0.71
+</code>
+The same commands work as separate lines, but only if you **paste them all at once**, not type them one by one:
+<code>
+/ip dhcp-client remove [find]
+/ip address remove [find where interface=bridge or interface=wlan1]
+/ip address add address=10.42.0.73/24 interface=bridge comment=lan
+/ip route add dst-address=0.0.0.0/0 gateway=10.42.0.71 comment=default-gw
+/ip dns set servers=10.42.0.71
+</code>
+If you are already connected on the address the unit should keep (for example a DHCP lease you want to make permanent), the session will not drop. Typing the lines one at a time is then fine, but do the ''address add'' before the ''remove'', or skip the remove.
+If you reach the unit on a different address (for example 192.168.88.1), the session drops when the address changes. Reconnect on the new address.
+==== Optional extras ====
+<code>
+/system identity set name=maplite-D
+/user set admin password="NEWPASSWORD"
+/interface wireless cap set enabled=no
+</code>
+  * Name the unit so it is easy to tell apart (all units default to "MikroTik").
+  * Change the default login password.
+  * Turn off the factory CAP mode.
+==== Check it ====
+<code>
+/ping 10.42.0.71 count=3
+/ping google.com count=3
+</code>
+===== 3. Gotchas =====
+  * **Address on a bridge slave:** on C the address is attached to ''wlan1'', which is a bridge port. It works while ''wlan1'' stays in the bridge. If you ever remove it from the bridge, move the address onto ''bridge'' first, in one line.
+  * **Two DHCP servers:** never run B's DHCP server and a "Shared to other computers" connection on the same wire at once. Disable B's first with ''/ip dhcp-server disable lan-dhcp''.
+  * **Shared SSH sessions** (''ControlMaster'') are bound to the source IP and die when the machine's address changes. Remove stale sockets (''rm -f /tmp/mt-<ip>.sock'') before reopening, or you get "ControlSocket already exists".
+  * **If a unit is unreachable:** the only recovery is the reset button on the unit.