Hey all!
Hoping someone can give me some assistance with my Mikrotik SXTsq Lite5. I've successfully flashed it with ARDEN and can access the initial configuration page on 192.168.1.1 (where you setup a password and your callsign). After entering my details, the node reboots, tells me a 10.x IP and then I'm never able to access it again under that IP.
When I run a packet capture, I see it's doing a DHCP request out the Ethernet port, and when I connect it to a network with a DHCP server, I see it successfully negotiates an IP, but I can't ping or log into it. The node is alive though, since it successfully negotiates ARP.
What I think is happening, is the initial configuration is setting the Ethernet port as a WAN port and then restricting access because it considers the port 'unsafe.' Unfortunately this device only has a single Ethernet port, and it doesn't seem to broadcast a WiFi SSID in this initial configuration so I'm never able to access it.
Is there a way to tell the initial configuration that the Ethernet port should be considered part of the 'LAN'?
73,
Hoping someone can give me some assistance with my Mikrotik SXTsq Lite5. I've successfully flashed it with ARDEN and can access the initial configuration page on 192.168.1.1 (where you setup a password and your callsign). After entering my details, the node reboots, tells me a 10.x IP and then I'm never able to access it again under that IP.
When I run a packet capture, I see it's doing a DHCP request out the Ethernet port, and when I connect it to a network with a DHCP server, I see it successfully negotiates an IP, but I can't ping or log into it. The node is alive though, since it successfully negotiates ARP.
What I think is happening, is the initial configuration is setting the Ethernet port as a WAN port and then restricting access because it considers the port 'unsafe.' Unfortunately this device only has a single Ethernet port, and it doesn't seem to broadcast a WiFi SSID in this initial configuration so I'm never able to access it.
Is there a way to tell the initial configuration that the Ethernet port should be considered part of the 'LAN'?
73,
I've just flashed two SXTsq Lite5 this morning, without any problems.
After you've entered your callsign and password, you must change back your ethernet connection from the fixed IP address to "automatic" (DHCP). Once the AREDN software is completely started, you shold be able to access it.
Assuming you use a windows PC, you can check the ip of the antenna using ipconfig in the command window. And sometimes it helps to either run ipconfig /release and ipconfig /renew to refresh your computer's ip settings, or simply disconnect the LAN cable for a moment and plug it back in..
Hope this helps :-)
Best 73s,
Kurt HB9XCL
How are you trying to access the SXT ?
" I connect it to a network with a DHCP server,"
The SXT is a DHCP server. If you plug the SXT into a workstation,
it will give the workstation an IP address on the LAN of the SXT.
"it considers the port 'unsafe.' "
Is 'it' the SXT? or is 'it' your workstation? or ?
Or does your workstation think the SXT is 'unsafe'.
I am not familiar with anything thinking anything is 'unsafe'.
Please elaborate further.
I think "the initial configuration" of a single port AREDN device is
73, Chuck
After completing the initial configuration, I plug my computer directly into the PoE injector on the sxt and confirm I get Ethernet link. I then wait, but I never receive a DHCP IP. If I instead plug the sxt into my LAN, I can see it requests a DHCP IP and the router happily assigns it one. I can confirm the device is in fact the sxt because the MAC address meatches.
>The SXT is a DHCP server. If you plug the SXT into a workstation,
>it will give the workstation an IP address on the LAN of the SXT.
This was my expection, but it doesn't seem to hand out IPs
>Is 'it' the SXT? or is 'it' your workstation? or ?
The SXT. When plugged into my LAN, I am not able to ping the IP it pulls, nor is there any response to an NMAP scan against it, hence my assumption that it has firewalled the port
I use a length of ethernet cable with a RJ-45 connector at each end between the POE and the SXT.
I power up my computer and issue an ifconfig command:
gelmce@nc8q-acer:~$ ifconfig
enp2s0f0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether dc:0e:a1:0b:b6:0d txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 16
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 152 bytes 14496 (14.4 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 152 bytes 14496 (14.4 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
wlp3s0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 08:11:96:d6:26:e8 txqueuelen 1000 (Ethernet)
RX packets 559 bytes 115868 (115.8 KB)
RX errors 0 dropped 9 overruns 0 frame 0
TX packets 356 bytes 53927 (53.9 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
gelmce@nc8q-acer:~$
I plug the male RJ-45 end of the Mikrotik POE into my computer.
I issue another ifconfig command:
gelmce@nc8q-acer:~$ ifconfig
enp2s0f0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.255.255.206 netmask 255.255.255.248 broadcast 10.255.255.207
inet6 fe80::4da1:68aa:8169:226a prefixlen 64 scopeid 0x20<link>
ether dc:0e:a1:0b:b6:0d txqueuelen 1000 (Ethernet)
RX packets 54 bytes 10655 (10.6 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 84 bytes 10141 (10.1 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 16
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 212 bytes 19804 (19.8 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 212 bytes 19804 (19.8 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
wlp3s0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 08:11:96:d6:26:e8 txqueuelen 1000 (Ethernet)
RX packets 559 bytes 115868 (115.8 KB)
RX errors 0 dropped 9 overruns 0 frame 0
TX packets 356 bytes 53927 (53.9 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
gelmce@nc8q-acer:~$
I issue a 'ping' command:
gelmce@nc8q-acer:~$ ping -c 1 10.255.255.206
PING 10.255.255.206 (10.255.255.206) 56(84) bytes of data.
64 bytes from 10.255.255.206: icmp_seq=1 ttl=64 time=0.032 ms
--- 10.255.255.206 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.032/0.032/0.032/0.000 ms
gelmce@nc8q-acer:~$
I issue a nmap command:
gelmce@nc8q-acer:~$ nmap 10.255.255.206
Starting Nmap 7.80 ( https://nmap.org ) at 2026-06-01 18:05 EDT
Nmap scan report for nc8q-acer.local.mesh (10.255.255.206)
Host is up (0.00013s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds
gelmce@nc8q-acer:~$
That's weird. An AREDN node should NOT request an IP on the LAN port - it should be acting as a DHCP server.
aredn-4.26.1.0-ath79-mikrotik-mikrotik_routerboard-sxt-5nd-initramfs-kernel.bin
?
Here is the URL that has instructions for installing AREDN firmware on mikrotik devices:
https://docs.arednmesh.org/en/latest/arednGettingStarted/installing_firm...
I am not finding the word 'netboot' in those instructions.
Please share the URL where 'netboot' is contained in the instructions you are following.
73, Chuck
your SXT returns as a client requesting an IP address,
instead of as a DHCP server issuing 10./ IP addresses.
What IP address is the SXT getting from your home DHCP server?
What ports are open on the SXT's LAN IP address?
What ports are closed?
If the load was successful, the SXT should be on channel 145(?) at 10 MHz bandwidth.
Do you have a working 5 GHz AREDN node to test and see if the radio is active?
I have some SXTs on the bench.
I'll try an install usingthe factory then sysupgrade procedure.
it took about 5 minutes before the device was accessible.
5 minutes is much much less than never.
:-|
73, Chuck
> your SXT returns as a client requesting an IP address,
> instead of as a DHCP server issuing 10./ IP addresses.
After installing the sysupgrade image I get to the initial configuration screen, much the same as the one you have in your screenshot. I can configure settings like my callsign, and password, then it reboots.
> What IP address is the SXT getting from your home DHCP server?
> What ports are open on the SXT's LAN IP address?
> What ports are closed?
It pulls the dhcp IP 10.13.37.142 (my LAN subnet is 10.13.37.0/24). No ports are open according to the nmap scan.
> If the load was successful, the SXT should be on channel 145(?) at 10 MHz bandwidth.
> Do you have a working 5 GHz AREDN node to test and see if the radio is active?
I don't have any other ARDEN nodes, however, I do have a Mikrotik LHG5 which is compatible with 5 and 10MHz channels (I use it on HamWAN). When I run a scan on 5725MHz (10MHz bandwidth) I don't see any SSIDs, but perhaps ARDEN doesn't broadcast an SSID.
Couple of screenshots of the process, after that second screenshot it never comes back on 10.185.96.22
The ethernet port will be a LAN DHCP client.
If you plug the AREDN device and your workstation into the same (home) router, they will share
that LAN and the AREDN device should be accessible using the ports above.
You will need a VLAN router to pull out the LAN access ports on the SXT.
A hAP-ac2, hAP-ac3, Gl-iNet AR750, or a deprecated hAP-ac-lite will grant LAN access ports to a home computer.
Your SXT could then be DtD connected to a DtD port on the programmed VLAN switch.
I have a couple 8 port VLAN routers that I have configured.
However I am now using an old 3-Com 48 port VLAN router (alas, it is 100MB).
73, Chuck
If I plug it into my laptop and run tcpdump, I see what looks like it could be traffic from the Mikrotik, though the MAC address doesn't seem to match what's on the Mikrotik sticker
What VLANs is it configured for? I can configure a trunk port on a Mikrotik router
Is there any way to change this behavior? I'd prefer to have the 'LAN' interface untagged, but I can't see any way of setting that in the GUI
1. plug sXT into my laptop on an untagged port, flash firmware according to the instructions
2. connect to sXT on 192.168.1.1 and complete initial configuration
3. connect the sXT to a VLAN switch (or a trunk port on the laptop) that accepts tagged VLAN 2
4. I found it necessary to configure a static IP on my laptop - I didn't receive a dhcp address from the xST
5. Access the GUI and configure the LAN interface
Thanks for all the support in this thread! Wouldn't have got here without the trail of breadcrumbs to follow.