Network and firewall

What the collector connects to

Nothing connects to the collector. It needs no open ports and no port forwarding.

Lock down your routers' management services

Allow the API only from the collector, so a leaked password is useless anywhere else. On every router (with the collector at 10.0.0.20):

/ip service set api address=10.0.0.20/32

For API over TLS use api-ssl instead. If your management network is larger, use its subnet. WISPMap's security check flags API services open to everyone.

For SNMP devices, most makes let you restrict SNMP to one address, or to a management VLAN.

Collector offline?

A collector shows offline after 3 minutes without data, and its devices show as unknown, not down: WISPMap can't tell whether they're fine. You also get a Collector offline alert. Check, in order:

1. Is it running? cd wispmap-collector && docker compose ps should show it Up. If not, docker compose up -d.
2. What does it say? docker compose logs --tail 50. Look for the reason on the last lines.
3. Can the machine reach WISPMap? curl -sI https://wispmap.gigahost.co.za should answer HTTP/2 200. If it doesn't, check DNS and the firewall's outbound rules for that machine.
4. Token refused? The log ends with check WISPMAP_TOKEN when WISPMap doesn't accept the token, for example after a new one was issued on the collector's page. Issue a new token there and run the install command again in the same folder: it keeps your router settings.
5. Clock wrong? The log warns when the machine's clock is more than 30 seconds out. Turn on time sync (timedatectl set-ntp true on most systems).

Results aren't lost while the internet link is down: the collector keeps them in a buffer on disk and sends them when it can.

A device shows "API not answering"

Ping works but the RouterOS API doesn't answer. Check that:

• the API service is enabled on the router (/ip service print);
• its address list includes the collector;
• no firewall filter rule on the router drops TCP 8728 from the collector;
• the device's port in WISPMap matches the router's (8728, or 8729 with TLS).

For SNMP devices the same alert says SNMP not answering. With SNMP v2c a wrong community looks exactly like no answer at all, so check the community first, then that the SNMP agent is on and allows the collector's address.

A device shows "API login refused"

The router rejected the collector's user: check that wispmon exists on that router with the same password as in the collector's .env, and that its group has the read, api and test policies. For SNMP v3 devices the alert says SNMP login refused: check the user, the keys and the protocols.