ec9659d0cb
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Major documentation cleanup after VLAN migration completion: - Archive 12 VLAN project docs to archive/vlan-migration/ - Archive 5 done WIP docs (VLAN proposals, AI stack, Fossorial, DNS backup) - Create standing reference docs 08-DNS-ARCHITECTURE and 09-TAILSCALE-VPN - Renumber docs to clean 01-09 sequence with merged CHANGELOG - Update all active docs from stale 192.168.31.x to current VLAN 10 IPs - Fix CSS1 (.10.9→.10.3) and ZX1 (.10.7→.10.4) IPs in hardware inventory - Clean 06-VLAN-DEVICE-ASSIGNMENT: remove migration columns/sections, fix VLAN 25 subnet Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
202 lines
4.9 KiB
Markdown
202 lines
4.9 KiB
Markdown
# WiFi and CAPsMAN Configuration
|
|
|
|
**Last Updated:** 2026-02-02
|
|
**Purpose:** Document WiFi network settings, CAPsMAN configuration, and device compatibility requirements
|
|
|
|
---
|
|
|
|
## Network Overview
|
|
|
|
| SSID | Band | Purpose | Password |
|
|
|------|------|---------|----------|
|
|
| XTRM | 5GHz | Primary network (fast devices) | `M0stW4nt3d@home` |
|
|
| XTRM2 | 2.4GHz | IoT/Legacy devices | `M0stW4nt3d@IoT` |
|
|
|
|
---
|
|
|
|
## XTRM (5GHz) - wifi1
|
|
|
|
**Target:** Modern devices (phones, laptops, tablets)
|
|
|
|
| Setting | Value |
|
|
|---------|-------|
|
|
| SSID | XTRM |
|
|
| Band | 5GHz |
|
|
| Mode | 802.11ax (WiFi 6) |
|
|
| Channel | Auto (DFS enabled) |
|
|
| Width | 80MHz |
|
|
| Security | WPA2-PSK + WPA3-PSK |
|
|
| Cipher | CCMP (AES) |
|
|
| 802.11r (FT) | Enabled |
|
|
| Password | `M0stW4nt3d@home` |
|
|
|
|
---
|
|
|
|
## XTRM2 (2.4GHz) - wifi2
|
|
|
|
**Target:** IoT devices, legacy devices, smartwatches
|
|
|
|
### CRITICAL COMPATIBILITY REQUIREMENTS
|
|
|
|
Some devices (Tuya JMWZG1 gateway, Amazfit TREX3, iPad 2) require legacy settings:
|
|
|
|
| Setting | Value | Reason |
|
|
|---------|-------|--------|
|
|
| SSID | XTRM2 | |
|
|
| Band | 2.4GHz | IoT compatibility |
|
|
| Mode | **802.11g** | Legacy device support |
|
|
| Channel | **1 (2412 MHz)** | Most compatible |
|
|
| Width | **20MHz** | Required for old devices |
|
|
| Security | **WPA-PSK + WPA2-PSK** | WPA needed for legacy |
|
|
| Cipher | **TKIP + CCMP** | TKIP required for old devices |
|
|
| 802.11r (FT) | **Disabled** | Causes issues with IoT |
|
|
| Password | `M0stW4nt3d@IoT` | |
|
|
|
|
### Devices Requiring WPA + TKIP
|
|
|
|
| Device | MAC Address | Model | Notes |
|
|
|--------|-------------|-------|-------|
|
|
| Roborock S7 Vacuum | B0:4A:39:3F:9A:14 | S7 | Requires WPA+TKIP |
|
|
| Amazfit TREX3 | TBD | Smartwatch | Requires WPA+TKIP |
|
|
| Tuya Smart Gateway | 38:1F:8D:04:6F:E4 | JMWZG1 | Requires WPA+TKIP |
|
|
| iPad 2 | TBD | A1395/A1396 | Legacy device |
|
|
|
|
### RouterOS Commands for XTRM2
|
|
|
|
```routeros
|
|
# Working configuration for legacy devices
|
|
/interface wifi set wifi2 \
|
|
channel.frequency=2412 \
|
|
channel.band=2ghz-g \
|
|
channel.width=20mhz \
|
|
security.authentication-types=wpa-psk,wpa2-psk \
|
|
security.encryption=tkip,ccmp \
|
|
security.ft=no \
|
|
security.ft-over-ds=no \
|
|
security.passphrase="M0stW4nt3d@IoT"
|
|
```
|
|
|
|
### Fallback (Maximum Compatibility)
|
|
|
|
If devices still can't connect, use WPA-only with TKIP-only:
|
|
|
|
```routeros
|
|
/interface wifi set wifi2 \
|
|
security.authentication-types=wpa-psk \
|
|
security.encryption=tkip
|
|
```
|
|
|
|
---
|
|
|
|
## CAPsMAN Configuration
|
|
|
|
### Manager (HAP ax³ - 192.168.10.1)
|
|
|
|
| Setting | Value |
|
|
|---------|-------|
|
|
| Enabled | Yes |
|
|
| Interfaces | bridge, vlan10-mgmt |
|
|
| Certificate | Auto-generated |
|
|
|
|
### CAP Device (CAP XL ac - 192.168.10.2)
|
|
|
|
| Setting | Value |
|
|
|---------|-------|
|
|
| caps-man-addresses | 192.168.10.1 |
|
|
| certificate | request |
|
|
| SSH Port | 2222 |
|
|
|
|
### CAP Interfaces
|
|
|
|
| Interface | Radio | Band | SSID | Status |
|
|
|-----------|-------|------|------|--------|
|
|
| cap-wifi1 | wifi1 | 2.4GHz | XTRM2 | Working |
|
|
| cap-wifi2 | wifi2 | 5GHz | XTRM | Channel issues (disabled) |
|
|
|
|
### CAP Access List Rule
|
|
|
|
CAP clients bypass VLAN assignment (go to VLAN 10):
|
|
|
|
```routeros
|
|
/interface wifi access-list add \
|
|
interface=cap-wifi1 \
|
|
action=accept \
|
|
comment="CAP clients - no VLAN" \
|
|
place-before=0
|
|
```
|
|
|
|
---
|
|
|
|
## WiFi Access List (VLAN Assignment)
|
|
|
|
Devices are assigned to VLANs based on MAC address:
|
|
|
|
| VLAN | Purpose | Example Devices |
|
|
|------|---------|-----------------||
|
|
| 20 | Trusted | MacBooks, iPhones, Samsung phones |
|
|
| 25 | Kids | Kids devices |
|
|
| 30 | IoT | Smart home devices, Chromecast, Bosch appliances |
|
|
| 40 | Catch-All | Unknown devices (default) |
|
|
|
|
### Current Access List
|
|
|
|
```routeros
|
|
/interface wifi access-list print
|
|
```
|
|
|
|
---
|
|
|
|
## Troubleshooting
|
|
|
|
### Device can see XTRM2 but can't connect
|
|
|
|
1. Check security settings - device may need WPA (not WPA2)
|
|
2. Check cipher - device may need TKIP (not CCMP/AES)
|
|
3. Try 802.11g mode instead of 802.11n
|
|
4. Use channel 1, 6, or 11
|
|
|
|
### Device connects but disconnects immediately
|
|
|
|
1. Check if 802.11r (Fast Transition) is disabled
|
|
2. Check VLAN assignment - CAP clients need special rule
|
|
3. Check channel width - use 20MHz for stability
|
|
|
|
### CAP not connecting to CAPsMAN
|
|
|
|
1. Check certificate - remove old cert and re-request
|
|
2. Check firewall - ports 5246-5247 UDP must be open
|
|
3. Check interface binding - CAPsMAN must listen on correct interface
|
|
|
|
---
|
|
|
|
## Backup Files
|
|
|
|
| File | Location | Purpose |
|
|
|------|----------|---------|
|
|
| wifi-backup-working.rsc | Router files | WiFi config export |
|
|
| config-backup-working.backup | Router files | Full system backup |
|
|
|
|
---
|
|
|
|
## Quick Reference
|
|
|
|
### Show WiFi status
|
|
```routeros
|
|
/interface wifi print
|
|
/interface wifi monitor wifi2 once
|
|
/interface wifi registration-table print
|
|
```
|
|
|
|
### Show security settings
|
|
```routeros
|
|
/interface wifi security print detail
|
|
:put [/interface wifi get wifi2 security.authentication-types]
|
|
:put [/interface wifi get wifi2 security.encryption]
|
|
```
|
|
|
|
### Check CAPsMAN
|
|
```routeros
|
|
/interface wifi capsman print
|
|
/interface wifi capsman remote-cap print
|
|
```
|