Community discussions

MikroTik App
 
User avatar
Lurch74
just joined
Topic Author
Posts: 4
Joined: Wed Oct 26, 2022 1:11 am

cAP Lite ethernet port access

Mon Oct 31, 2022 5:16 am

Hi all,

I have one of these in my lounge to enable good coverage for my WiFi rear speakers (Yamaha WX-021). My main AP is i the attic, intermittent drop-outs observed.
I currently have it working using a different IP range from my main network. Ethernet = 192.168.1..., WiFi = 192.168.88....
The only way I have got this working at the moment is when the ethernet port is designated WAN, which then enables the internal firewall. As the cAP Lite is behind a firewall already, I don't need this ability. Can I simply remove all the firewall rules?
Or leave them as is, and add a firewall rule to allow port 80 or 8291 access?

I am learning my way through the RouterOS system, but it is a very steep learning curve :-)

Cheers,
Lurch
 
mkx
Forum Guru
Forum Guru
Posts: 8970
Joined: Thu Mar 03, 2016 10:23 pm

Re: cAP Lite ethernet port access

Mon Oct 31, 2022 7:18 pm

The main AP, which brand is it? If it's Mikrotik as well, then you can create a transparent wireless bridge. If it's another brand, then you'll have to either keep NAT on cAP lite or add static route on main router/AP ... the later would be better if it's possible.
 
User avatar
Lurch74
just joined
Topic Author
Posts: 4
Joined: Wed Oct 26, 2022 1:11 am

Re: cAP Lite ethernet port access

Tue Nov 01, 2022 8:12 am

Hi Metod,

My main AP is a Grandstream, so not compatible in a Mikrotik way.😀
I forgot to mention that I have assigned a static address to the Ethernet connection, sorry about that.

I can get to the internal config webpage is I select my phone to change WiFi AP.
However I would prefer to use my computer for this instead.
Just can't see a way forward 🫤

PS:
Also, my Router is going to be changed out for a MikroTik hEX RB750Gr3. Am in the process of setting this up to use in NZ.
cAP Lite is connected to an unmanaged 8-way switch in my lounge, so all IP addresses on this are 192.168.1.xxx.
I suppose I could change that to be permanently on 192.168.88.xxx, once the hEX is in place.
 
mkx
Forum Guru
Forum Guru
Posts: 8970
Joined: Thu Mar 03, 2016 10:23 pm

Re: cAP Lite ethernet port access

Tue Nov 01, 2022 6:25 pm

Hmm ... it just struck me: you're connecting cAP to main router using ethernet cable? If that's so, then there's no problem ... you just have to "convert" your cAP lite to a simple AP. I don't think there's a QuickSet profile for that (sadly it's still missing after years users demanded it), but it's not too complicated to do it manually:

  1. Go to download.mikrotik.com and download winbox ... it's a windows executable, but runs fine in wine under linux or macos
  2. using any management method (CLI, winbox or webfig) connect to cAP lite and reset its configuration ... mark to not save any settings or backup
  3. after device reboots, you'll have to connect your computer to device with ethernet cable and use winbox to connect again ... when winbox discovers your cAP lite, click on MAC address
  4. set up admin password
  5. create new bridge under interfaces, add ether1 and wlan1 as member ports
  6. configure DHCP client to run off bridge interface
  7. configure wireless ... set the same wireless properties as your main AP uses. Probably that will include WPA2-PSK mode, set the same SSID and same PSK, also set disable-pmkid=yes. You can change band to 2ghz-g/n, backward compatibility with 802.11b is nowdays rarely needed but does cost some performance if enabled.
  8. reboot device to make sure the new config is applied
  9. connect cAP lite to main router using ethernet cable
  10. verify that cAP acts as AP and that it properly forwards data towards LAN and router. Also verify that you can connect to management UI (you can use winbox discovery to find out cAP's IP address or look at DHCP server's lease list)
 
User avatar
Lurch74
just joined
Topic Author
Posts: 4
Joined: Wed Oct 26, 2022 1:11 am

Re: cAP Lite ethernet port access

Tue Nov 01, 2022 6:45 pm

Hi Metod,

Most of those steps I understand and have gone through.
I think it is step 6 that I didn't think of. 👍
That a bridge is also an interface.

My (mistakenly or otherwise) problem is that the Ethernet port is designated WAN. My understanding is that no unrequested traffic can enter through here. I tried to somehow change this to LAN but not successful.

My first thought was to create a separate network (IP range) for my stereo and some other things, but certainly not essential.

I'll have a look tonight, it's only 05:45 here now
 
mkx
Forum Guru
Forum Guru
Posts: 8970
Joined: Thu Mar 03, 2016 10:23 pm

Re: cAP Lite ethernet port access

Tue Nov 01, 2022 7:09 pm

If you decide to go with separate network, then it'd be wise to do it on main router anyway ... keep using cAP as simple AP. How to do it depends on the rest of network ... having unmanaged switch there doesn't exactly help.
You can confine wifi network to wireless side of cAP ... then cAP will have to route between ether port and wireless ... whether it has to do NAT or not again depends on configuration of main router.
Whatever you decide to do ... first make a plan and start to reconfigure things later. A clear network chart is essential corner stone.

Regarding ether1 port: it really depends on configuration. Some of preset configs (not sure about cAP lite since it's only got single ether port) indeed configure it as WAN port. In those configs, however, it's used as stand-alone interface, not as bridge port. In configuration I outlined in my previous post ether1 is not treated in any special way, it's simply bridge member, just like wireless. Since there's no firewall configured, nothing will block any traffic in any direction - which makes thusly configured device very vulnerable to any hacking attempts. As always one assumes LAN is villain-free :wink:

Yup, NZ is in totally opposite daylight phase than Europe :-)
 
User avatar
Lurch74
just joined
Topic Author
Posts: 4
Joined: Wed Oct 26, 2022 1:11 am

Re: cAP Lite ethernet port access

Wed Nov 02, 2022 9:38 am

I appreciate your input. It is working for now, but want to clear it up for easier access.

The unmanaged switch is not a problem as only Xbox and Blu-ray player on there, so to separate them from main network is preferable.

I understand what you are getting at, a plan definitely will be made to proceed, and prepare config etc to suit.

As stated earlier, I'm learning, some great tutorials out there.
I can see the advantage of configuring the main router for isolating the networks.

Most of my family is in Netherland, so yeah I'm well aware of the time difference.
We're ahead of everybody, timewise 🤣🤣

Who is online

Users browsing this forum: Xelmep and 36 guests