![Community banner](https://lemmy.world/pictrs/image/c567c60a-f06b-432d-b691-d89228fd61db.png)
-
RouterOS v7.15.3 Release Notes
mikrotik.com MikroTikMikroTik makes networking hardware and software, which is used in nearly all countries of the world. Our mission is to make existing Internet technologies faster, more powerful and affordable to wider range of users.
What's new in 7.15.3 (2024-Jul-24 13:36):
*) lte - fixed possible crash when enabling/disabling config-less modem interface; *) lte - fixed R11e-LTE no traffic flow when modem with older firmware version is used; *) routerboard - improved Etherboot stability for CRS320-8P-8B-4S+ device ("/system routerboard upgrade" required); *) ssh - fixed unsupported user SSH public key import (introduced in v7.15);
-
Tethering not working (any more)
hello, I have a same setup for (at least) 3 years now: Mikrotik hAP ac lite <USB> Android Mi A2 and then I enable USB tethering on the phone. For some reason now on phone USB tethering is disabled (grayed out).
Additional notes and what I tried:
- USB cable is good, if I connect to PC “tethering” is enabled
- during previous working time and now I lend MT to I friend and he updated it to v7
- before that I also made a backup of my setup
- FWs I tried (nothing works)
- v6
- v7
- v7 beta
- On phone a see that last update was in 2021 and there is no other updates
- also phone was completely restarted/formated
Any ideas what else I could try or how can I debug
-
v7.15 Released
Changelog
Before an upgrade:
- Remember to make backup/export files before an upgrade and save them on another storage device;
- Make sure the device will not lose power during upgrade process;
- Device has enough free storage space for all RouterOS packages to be downloaded.
What's new in 7.15 (2024-May-29 15:44):
!) system - added support for AMPERE (R) and ARM64 CHR installations (new ARM64 CHR image available); !) system - added support for AMPERE (R) hardware (new ARM64 ISO file, new ARM64 extra-nics.npk package); *) bgp - added initial vpnv6 support; *) bgp - correctly synchronize input.accept-nlri address list; *) bgp - fixed prefix count when BGP sessions run with multiple AFIs; *) bgp - fixed selecting local.default-address from wrong VRF; *) bgp - use IPv6 as default address-family for IPv6 sessions; *) bgp-vpn - use VRF interface as gateway for leaked connected routes; *) branding - added option to hide default configuration prompt; *) branding - added option to hide or replace default caps-mode-script; *) bridge - added error message if MLAG peer-port is configured with "mlag-id"; *) bridge - added MLAG peer-port events to logs; *) bridge - added MVRP support; *) bridge - do not allow multiple bonds with same "mlag-id"; *) bridge - improved protocol-mode STP, RSTP and MSTP stability; *) bridge - rename monitor property "path-cost" to "actual-path-cost"; *) bridge - reworked dynamic VLAN creation; *) bridge - use default "edge=auto" for dynamically bridged interfaces (PPP, VPLS, WDS); *) certificate - added support for different ACME servers for ssl-certificate (CLI only); *) certificate - added support for importing pbes2 encrypted private keys with aes128; *) certificate - added trusted parameter for certificate import; *) certificate - allow replacing certificate with internal import; *) certificate - delete certificate related files automatically from storage after import; *) certificate - improved RSA key signature processing speed; *) chr - allow to "generate-new-id" only while CHR is running on level "free" license; *) chr - fixed bogus messages printed out while booting up the system (introduced in v7.14); *) chr - fixed Xen and Vultr missing ethernet (introduced in v7.14); *) console - added "byte-array" option to ":convert" command; *) console - added "proplist" parameter to interactive commands; *) console - added "rows" property for sniffer quick mode; *) console - added "sanitize-names" property under "/console/settings" menu (option for replacing reserved characters with underscores for files, disabled by default); *) console - added "type" parameter to ":resolve" command; *) console - added "use-script-permissions" option when running scripts from CLI; *) console - added hotkey "F8" to print entire multiline input; *) console - added link from "/iot/lora" to "/lora"; *) console - added log for script execution failures; *) console - added multi-line print in "/file" menu; *) console - added option to get "about" value (dynamically created text field by RouterOS services like CAPsMAN); *) console - added option to read and change file line endings in full-screen editor; *) console - added warning log for modified filenames due to reserved characters; *) console - covert spaces, CR, LF in ":convert to=url" command; *) console - do not convert string to array in ":deserialize" command; *) console - fixed ":onerror" behavior when "do" block is missing; *) console - fixed "export where" functionality in certain menus; *) console - fixed console prompt when entering hot lock mode with "F7"; *) console - fixed DHCP server "authoritative=no" configuration export; *) console - fixed do/while implementation not working with variables (introduced in v7.14); *) console - fixed filtering by "dhcp" flag in "/ip/arp" menu; *) console - fixed multiple typos in help; *) console - improved stability; *) console - optimized configuration export to prevent startup of processes without any configuration; *) console - remove unnecessary serial ports for Alpine CPUs; *) console - show system note before serial login if enabled; *) console - use user permissions when running scripts from WinBox and WebFig; *) container - do not allow negative number for "ram-high" setting; *) defconf - do not override default DHCP server lease time; *) defconf - fixed 5ghz-ax channel width for L11, L22 devices; *) defconf - fixed unknown topics in log messages; *) defconf - minor configuration script updates; *) dhcpv4-relay - added VRF support; *) discovery - added LLDP MAC/PHY Configuration/Status TLV support; *) discovery - added LLDP Maximum Frame Size TLV support; *) discovery - added LLDP Port Description TLV support; *) discovery - advertise only physical interface name for LLDP PortID TLV; *) discovery - always send LLDP MED Power TLV if MED was received; *) discovery - fixed high CPU utilization when "tx-only" mode is set; *) discovery - optimized LLDP information update; *) disk - added option to auto configure media sharing; *) disk - added support for formatting exfat file-system; *) disk - improved support for file systems with non-ascii characters in file names; *) disk - improved support for formatting ext4 file-system; *) disk - improved system stability when adding partition with no parent; *) disk - improved system stability; *) disk - the "scan" command will now detect and include USB drives that were previously ejected; *) dns - added support for "adlist"; *) dns - added VRF support; *) dns - improved system stability when caching entries; *) eap - improved eap-peap, eap-mschap2 client authentication (dot1x/wireless/ipsec); *) ethernet - fixed default names for CRS310-8G+2S+ device (introduced in v7.14); *) ethernet - fixed interface disable for CRS326-4C+20G+2Q; *) ethernet - fixed management port disable/enable on CCR2004-1G-12S+2XS, CCR2004-1G-2XS-PCIe, CCR2216, CCR2116 devices; *) ethernet - improved port speed downshift functionality for CRS326-4C+20G+2Q; *) fetch - added "idle-timeout" parameter; *) fetch - changed topic "info" to "error" for permission denied logs; *) fetch - fixed slow throughput due to "raw" logging which occurred even when not listening to the topic (introduced in v7.13); *) file - allow adding and renaming files and directories; *) file - avoid refreshing whole file system during file modification; *) file - improved external storage detection; *) health - added "cpu-temperature" for IPQ50xx devices; *) health - added log for fan state changes on CRS3xx, CRS5xx, CCR2xxx, CCR1016r2, CCR1036r2 devices; *) health - fixed fan behavior for CRS310-1G-5S-4S+ (introduced in v7.14); *) health - fixed rogue voltage on CRS510-8XS-2XQ-IN; *) install - cdrom and hdd install images contain additional packages that can be interactively selected; *) ipv6 - properly initialize default ND "interface=all" entry; *) leds - fixed LEDs for L22 device; *) lora - removed LoRa WinBox and console functionality duplication (moved to IoT package since v7.11); *) lte - added "at-chat" support for DELL T99W175 (PID: 0x05c6 VID: 0x90d5); *) lte - added support for concatenated AT commands in "modem-init" string; *) lte - added support to set "modem-init" string for "dialer-less" modems; *) lte - apply the same configuration for Microsoft branded EM12-G modem (Surface Mobile Broadband) as for Quectel EM12-G; *) lte - do not show persistent interfaces for multi-apn slave interfaces; *) lte - dropped support for R11e-LTE-US FOTA firmware update; *) lte - fixed R11e-LTE-US modem dial-up; *) lte - fixed situation where link is not restored after Quectel MBIM modem firmware update; *) lte - improved FG621-EA modem APN authentication; *) lte - make interface persistent (unused interface configs can be removed, allow to export and examine current configuration without the device present); *) lte - removed 2 APN restriction for RG520F-EU modem; *) lte - use the correct network interface for multi-interface LTE modems; *) media - added support for DLNA; *) metarouter - removed support; *) modem - send APN authentication for BG77 modem also if ppp-client interface created manually; *) netinstall - improved stability; *) netinstall-cli - fixed incorrect server address assignment (introduced in v7.14); *) ovpn - fixed import ovpn config when remote port is missing; *) ovpn - fixed minor typo in error message; *) poe-out - added LLDP power management support for devices with single PoE-out port; *) poe-out - fixed powering devices if input voltage is lower than 12V for hEX PoE (introduced in v7.9); *) poe-out - improved firmware upgrade stability for AF/AT controlled boards; *) poe-out - moved "PoE LLDP" property from "/interface/ethernet/poe" to "/ip/neighbor/discovery-settings" and enable it by default; *) ppp - added "enable-ipv6-accounting" option under PPP AAA menu (CLI only); *) ppp - added log when disconnecting a client due to "WISPr-Session-Terminate-Time" RADIUS attribute; *) ppp - allow underscores in domain names; *) ppp - enabled monitoring of registration state, RSRP, RSRQ, SINR, PCI, CellID for BG77 modem; *) ppp - fixed "Framed-IPv6-Pool" usage when received from RADIUS; *) ppp - fixed "on-down" script running even when tunnel was not up; *) profiler - added "neighbor-discovery" task; *) ptp - added PTP support for CCR2116 device; *) qos-hw - added "offline" tx-manager (CLI only); *) qos-hw - added "profile" and "map" support for CPU port; *) qos-hw - added congestion avoidance support for 98DX8xxx, 98DX4xxx, 98DX325x switch chips (CLI only); *) qos-hw - added ECN marking support for compatible switches; *) qos-hw - added per-queue traffic shapers (CLI only); *) qos-hw - added Priority Flow Control for compatible switches (CLI only); *) qos-hw - added support for QoS profile assignment via ACL rules; *) qos-hw - added WRED support for compatible switches; *) qos-hw - fixed port "print stats/usage" when using "from" property; *) qos-hw - replaced buffer with bytes in QoS monitor; *) queue - improved system stability (introduced in v7.6); *) quickset - only show LTE mode for devices without other wireless interfaces; *) radius - added "require-message-auth" option that requires "Message-Authenticator" in received Access-Accept/Challenge/Reject messages; *) radius - include "Message-Authenticator" in any RADIUS communication messages besides accounting for all services; *) route - do not allow routes with empty "dst-address"; *) route - do not redistribute loopback address as connected route; *) route - fixed bgp-vpn prefix import with the same route distinguisher (RD); *) route - improved system stability; *) route - rework of route attributes; *) route - show route-distinguisher (RD) in route print; *) route-filter - allow setting different AFI gateways; *) route-filter - fixed ext community list matcher; *) sfp - added "100M-baseFX" link mode support for compatible devices; *) sfp - added "sfp-ignore-rx-los" setting; *) sfp - fixed "sfp-tx-fault" state indication for CRS510; *) sfp - fixed link establishment with 100Mbps optical modules (requires "/interface ethernet reset" or adding "100M-baseFX" modes for advertise or speed properties); *) sfp - fixed missing Tx traffic at 10Gbps rate on CCR2004-16G-2S+ in rare cases; *) sfp - ignore SFP RX LOS signal for modules with bad EEPROM; *) sfp - improved "sfp-tx-power" value monitoring in certain cases; *) sfp - improved auto-negotiation linking for some MikroTik cables and modules; *) sfp - improved system stability for CR2004-1G-2XS-PCIe (introduced in v7.14); *) sfp - improved system stability with some GPON modules for CCR2004 and CCR2116 devices; *) smb - added logs for share connection requests; *) smb - do not allow setting empty "comment" or "domain" properties; *) sms - added option to select SMS storage; *) sms - added SMS PDU to SMS inbox "print detail"; *) sms - added workaround for modems which do not notify regarding new SMS arrival (missing URC); *) sms - improved SMS handling; *) sms - removed SMS for SMIPS; *) sms - use "gsm" logging topic for serial modem SMS logs; *) snmp - added missing PoE-out status codes to MIKROTIK-MIB; *) snmp - added new "mtxrOpticalVendorSerial" OID to MIKROTIK-MIB; *) socks - attempt to parse domain name as IP before resolving; *) ssh - added support for user Ed25519 private keys; *) ssh - export host Ed25519 public key; *) ssh - fixed bogus output; *) ssh - fixed permissions to run ".auto.rsc" scripts; *) ssh - require "policy" user policy when adding public key; *) sstp - added SNI support; *) sstp - disconnect clients when server is disabled; *) storage - improved configuration storing process on first system boot after configuration reset; *) switch - added support for multiple ingress and egress port mirroring on 98DXxxxx switches; *) switch - added support for RSPAN mirroring on 98DXxxxx switches; *) switch - fixed L3HW and QoS monitor during switch reset; *) system - added resource values (Product name, File name and File version) for Windows executable files; *) system - general work on optimizing the size of RouterOS packages; *) system - show "cpu-frequency" for Alpine CPUs; *) system - skip configuration upgrade from RouterOS v6 on configuration reset; *) system - updated office address in RouterOS license; *) system - updated online manual links from "wiki" to the help documentation; *) timezone - updated timezone information from "tzdata2024a" release; *) traffic-flow - detect IPv4 source address if not set; *) traffic-flow - improved system stability; *) userman - added "require-message-auth" option that requires "Message-Authenticator" in received Access-Request messages; *) userman - include "Message-Authenticator" in any RADIUS communication messages besides accounting for all services; *) vlan - added MVRP (applicant) configuration option; *) vlan - ensure that VLAN MTU remains unchanged when adjustments are made to the parent interface MTU, only modifications to the L2MTU might impact VLAN MTU; *) vlan - fixed MTU reset on bridge after reboot; *) vlan - limit "vlan-id" range from 1-4095 to 1-4094; *) vrf - fixed VRF interfaces being moved to main table after reboot (introduced in v7.14); *) webfig - allow pasting with ctrl+v into terminal; *) webfig - fixed column preferences for ordered tables; *) webfig - show inherited properties for wifi interfaces; *) wifi - added "reselect-interval" support; *) wifi - changed interface default to "disabled=yes"; *) wifi - do not report disabled state for CAPsMAN managed interface; *) wifi - fixed configuration export for "disabled" property; *) wifi - improve channel selection after radar detection events; *) wifi - improve regulatory compliance for L11, L22 devices; *) wifi - improved interface initialization reliability on DFS channels; *) wifi - improved stability of DFS check in the 5GHz-A band; *) wifi - improved system stability when provisioning CAPs in certain cases; *) wifi - rename "available-channels" parameter to "channel-priorities" and include desirability rating for each channel; *) wifi - report current CAPsMAN address and identity on CAP; *) wifi - show inherited properties with "print" command (replaces "actual-configuration") and added "print config" for showing only configured values; *) wifi-qcom - added configuration.distance setting to enable operation over multi-kilometer distances; *) wifi-qcom - updated driver; *) winbox - added "Download" and "Flush" buttons under "System/Certificates/CRL" menu; *) winbox - added "Flat Snoop" button under "WiFi" menu; *) winbox - added "FT Preserve VLAN ID" setting under "WiFi/Configuration/FT" menu; *) winbox - added "Request logout" button under "System/Users/Active Users" menu; *) winbox - added "Trusted" checkbox under "System/Certificates/Import" menu; *) winbox - added drop down menu for "User" property when importing SSH key under "System/User/SSH Keys" and "System/User/SSH Private Keys" menus; *) winbox - added invalid flag under "IP/DHCP Relay" menu; *) winbox - added key type and key length column for user SSH keys; *) winbox - added missing SFP monitoring properties under "Interface/SFP" menu; *) winbox - added passphrase option for SSH host key export; *) winbox - added passphrase option for SSH host key import; *) winbox - allow specifying size and rtmpfs size with M, G units under "System/Disks" menu; *) winbox - allow to specify "M" or "G" postfix for download, upload or total limits under "User Manager/Limitations" menu; *) winbox - do not show "Host Key Size" when using ed25519 key under "IP/SSH" menu; *) winbox - fixed the issue where the skin file fails to appear in the user group menu after creation; *) winbox - renamed "Channel" column to "Current Channel" under "Wifi" menu; *) winbox - show "Valid Servers" and "Unknown Servers" column by default under "IP/DHCP Server/Alerts" menu; *) winbox - show inherited properties for wifi interfaces; *) winbox - show SIM settings for SXTR device under "Interfaces/LTE/Modem" menu; *) winbox - updated icons for certain menus; *) winbox - use correct values for "Jump Target" property under "IPv6/Firewall/Filter Rules" menu; *) wireguard - added option to mark peer as responder only; *) wireguard - added peer "name" field and display it in logs; *) wireguard - do not attempt to connect to peer without specified endpoint-address; *) wireguard - fixed "auto" argument usage for "private-key" and "preshared-key" settings; *) wireguard - fixed performance issues showing QR code; *) wireless - perform shorter channel availability check for 5600-5650MHz if regulatory domain permits it; *) x86 - fixed ixgbe Tx hang by disabling TSO; *) x86 - fixed VLAN tagged packet transmit for ice driver; *) x86 - ice driver update to v1.13.7; *) x86 - improved stability for RTL8125 driver; *) x86 - ixgbe driver update to 5.19.9; *) x86/chr - improved panic saving (increased minimal RAM requirements to 256MB);
-
CCR2004-1G-2XS-PCIe as Firewall in colocation
I have just ordered a CCR2004-1G-2XS-PCIe to be used as the firewall of a single server (and its IPMI) that's going to end up in a data center for colocation. I would appreciate a sanity check and perhaps some hints as I haven't had any prior experience with mikrotik and, of course, no experience at all with such a wild thing as a computer in a computer over pcie.
My plan is to manage the router over ssh over the internet with certificates and then open the api / web-configurator / perhaps windows-thinyg only on localhost. Moreover, I was planning to use it as an ssh proxy for managing the server as well as accessing the server IPMI.
I intend to use the pcie-connection for the communication between the server and the router and just connect the IPMI and either physical port.
I have a (hopefully compatible) RJ45 1.25 G transceiver. Since the transceiver is a potential point of failure and loosing IPMI is worse than loosing the only online connection, I guess it makes more sense to connect to the data center via the RJ45-port and the server IPMI via the transceiver. (The data center connection is gigabit copper.) Makes sense? Or is there something about the RJ45-port that should be considered?
I plan to manually forward ports to the server as needed. I do not intend to use the router as some sort of reverse proxy, the server will deal with that.
Moreover, I want to do a site2site wireguard vpn-connection to my homelab to also enable me to manage the router and server without the ssh-jump.
Are there any obstacles I am overlooking or is this plan sound? Is there something more to consider or does anyone have any further suggestions or a better idea?
-
RouterOS v7.14.0 Stable Released
Release 7.14 2024-02-29
What's new in 7.14 (2024-Feb-29 09:10):
!) rose-storage - moved SMB service to the RouterOS bundle; !) smb - removed legacy SMB service (replaced with newer and faster ROSE SMB service, compatible with SMB 2.1, SMB 3.0 and SMB 3.1.1); *) 6to4 - make "ipsec-secret" sensitive parameter; *) api - improved REST API stability when processing invalid requests; *) api - properly return SNMP OIDs when requested; *) arm - improved system stability when using microSD on RB1100Dx4; *) arp - added ARP status; *) bgp - allow to leak routes between local VRFs; *) bridge - added MLAG support for MSTP bridges; *) bridge - avoid per-VLAN host flushing on HW offloaded bridge; *) bridge - fixed auto "path-cost" for bonding interfaces (introduced in v7.13); *) bridge - fixed MLAG connection after peer-link flap (introduced in v7.13); *) bridge - fixed packet forwarding after changing HW offloaded bridge interface settings in certain cases (introduced in v7.13); *) bridge - improved bridge VLAN configuration validation; *) bridge - improved configuration speed on large VLAN setups; *) bridge - improved protocol-mode MSTP functionality; *) bridge - improved protocol-mode STP and RSTP functionality; *) bridge - make "point-to-point=yes" default value for non-wireless bridge ports; *) bridge - removed "mst-config-digest" from MSTI menu; *) bridge - try to set wireless bridge ports as edge ports automatically; *) bth - added simple "Back To Home Users" manager under IP/Cloud menu; *) calea - improved system stability when adding bridge rule without "calea" package installed; *) certificate - improved certificate validation performance; *) console - added ":tolf" and ":tocrlf" commands for converting line break to/from LF or CRLF; *) console - added "show-at-cli-login" option to display a note before telnet login; *) console - added missing "where" clause for "/ipv6/firewall/filter" table print command; *) console - do not accept negative or too large values for ":delay" command; *) console - do not allow to use out-of-range values for time type fields; *) console - fix configuration export when user does not have a "sniff" policy; *) console - fixed delayed output from ":grep" command in certain cases; *) console - fixed incorrect behavior of ":onerror" command in certain cases; *) console - hint on reset command help that ".rsc file" is required for "run-after-reset" parameter; *) console - improved editor functionality in full screen mode; *) console - improved stability when using autocomplete with "export"; *) console - increased maximum file content length that can be managed through command line to 60 KB; *) console - updated copyright notice; *) container - improved VETH interface management responsiveness and reliability; *) container - restrict "/container/shell" menu for users without "write" permissions; *) defconf - added log about configuration reset due to pressed reset button; *) defconf - fixed Audience scanning-for-wps-ap timeout; *) defconf - fixed configuration script on KNOT devices if "ppp-out" interface is removed; *) defconf - fixed firewall rule for IPv6 UDP traceroute; *) defconf - fixed wifi configuration if interface MAC address is changed; *) defconf - improved wifi interface detection after upgrade; *) defconf - increased LTE interface wait time; *) defconf - updated health settings on configuration revert; *) defconf - use "fq_codel" queue as default interface queue for wired ports on LTE devices; *) dhcpv6-client - install dynamic IPv6 blackhole routes in corresponding routing-table; *) dhcpv6-client - updated error logging when multiple prefixes received on renew; *) disk - added exFAT and NTFS mount/read/write support; *) disk - added global disk "settings" menu; *) disk - fixed changing settings on some GPT formatted disks; *) disk - properly unmount disk when it is disconnected; *) dns - do not add new entries to cache if "cache-size" is reached; *) dns - fixed domain name lookup resolving for internal services; *) ethernet - fixed issue with default interface names for CRS310-8G+2S+ in rare cases; *) ethernet - improved cable-test reliability for hAP ax3 PoE out port; *) ethernet - resolved minor memory leak while processing packets; *) fetch - added "head" option for "http-method"; *) fetch - added "patch" option for "http-method"; *) fetch - allow specifying link-local address in FTP mode; *) fetch - allow to use certificate and check-certificate parameters only in HTTPS mode; *) fetch - do not require "content-length" for HTTP (introduced in v7.13); *) fetch - fixed DNS resolving when domain has only AAAA entries (introduced in v7.13); *) fetch - fixed fetch execution when unexpected data is received in HTTP payload; *) fetch - fixed fetch when using "src-path" with HTTP/HTTPS modes (introduced in v7.13); *) fetch - fixed fetch when using "src-path" with SFTP mode (introduced in v7.13); *) fetch - fixed incorrect "src-path" error message when "upload=yes"; *) fetch - fixed IPv4 address logging (introduced in v7.13); *) fetch - improved fetch stability in SFTP mode; *) fetch - improved file download stability with HTTP/HTTPS modes; *) fetch - less verbose logging; *) fetch - print all "Set-Cookies" headers in response; *) fetch - treat any 2xx HTTP return code as success (introduced in v7.13); *) filesystem - improved filesystem integrity for several RB3011 units with automatic firmware upgrade; *) firewall - added "creation-time" parameter for IPv6 address list entries; *) firewall - fixed underlying CAPsMAN tunnel reusing packet marks of encapsulated packets; *) firewall - fixed underlying VXLAN/EoIP tunnel reusing packet marks of encapsulated packets; *) firewall - increased default "udp-timeout" value from 10s to 30s; *) health - added limited manual control over fans for CCR1016r2, CCR1036r2 devices; *) health - changed default "fan-min-speed-percent" from 0% to 12%; *) health - improved fan control on CRS3xx and CCR1016-12S-1S+r2; *) health - show voltage when powering KNOT R through Micro-USB; *) health - updated health properties for CCR1016r2, CCR1036r2 devices; *) iot - added bluetooth whitelist wildcard asterisk support; *) iot - added LoRa CUPs protocol support; *) iot - fixed modbus partial frame reception issue; *) iot - improved LoRa LNS; *) iot - improved modbus Tx/Rx switching behaviour; *) iot - improvements to GPIO behavior on boot; *) iot - improvements to LoRa CUPS; *) iot - removed bluetooth whitelist maximum entry limit of 8; *) ipv6 - made "valid" and "lifetime" parameters dynamic for SLAAC IPv6 addresses; *) isis - show passive interface active levels; *) l3hw - fixed IPv6 host offloading in certain cases; *) l3hw - fixed neighbor offloading after link flap; *) l3hw - preserve offloading for VLANs when bridge ports are down; *) leds - added "dark-mode" functionality for hAP ax3 and Chateau ax series devices; *) leds - do not show LTE connection state/mode using RGB power LED from configless LTE modems; *) leds - fixed "type=on" LED behaviour after reboot; *) leds - fixed default LTE LED configuration for wAPR-2nD; *) leds - fixed modem LED indication for SXT LTE 3-7; *) leds - fixed wireless type of LED triggers for routers using WiFi package; *) lte - added "at-chat" support for Sierra Wireless EM9293 5G modem; *) lte - added AT channel support for Quectel EM120K-GL modem; *) lte - added redial timer when the MBIM modem fails to register or does not receive APN activation notification; *) lte - don't duplicate primary band in 5G SA mode for chateau 5G; *) lte - fixed "use-peer-dns" setting for EC200A modem; *) lte - fixed an issue for EC200A modem that IPv6 address could be added as IPv4 address; *) lte - fixed APN authentication for FG621-EA modem; *) lte - fixed MBIM interface enabling for Quectel EC25 modem (introduced in v7.13); *) lte - fixed Simcom modem support in 0x9000; 0x9002, 0x9002; 0x901a and 0x901b USB compositions; *) lte - fixed Simcom modem support in 0x9001 USB composition; *) lte - fixed support for config-less modem detection (introduced in v7.13); *) lte - fixed USB mode switch and initialization race condition for configless USB modems; *) lte - improved FG621-EA modem firmware upgrade; *) lte - improved modem recovery after failed IPv4 configuration; *) lte - improved support for "ACER" and "MSFT" branded EM12-G modems; *) lte - optimized "at-chat" response reading; *) lte - refactored AT command control for AT modems; *) modem - fixed SMS removal (introduced in v7.13); *) modem - improved stability when performing modem FOTA upgrade; *) mpls - fixed VPN fragmentation when forwarding IP traffic; *) netinstall-cli - check package and device architecture before formatting; *) ovpn - added support for pushing routes; *) ovpn - improved "push-routes" option handling when large amount of routes is specified; *) ovpn - improved key-renegotiation process; *) ovpn - improved OVPN configuration file import process; *) ovpn - improved system stability when using HW encryption on ARM64 devices (introduced in v7.13); *) ovpn - limit the maximum length for "push-routes" up to 1400 characters; *) package - added "size" property; *) package - reduced "wireless" package size for ARM, ARM64, MIPSBE, MMIPS devices; *) package - reduced package size for SMIPS; *) poe-out - driver optimization for AF/AT controlled boards; *) poe-out - fixed "power-cycle" for CRS354-48P-4S+2Q+ device (introduced in v7.13); *) poe-out - improved 802.3at classification and measurement accuracy; *) poe-out - improved cable test for hAP ac3 and hAP ax3 devices; *) poe-out - improved PoE out reliability on routers with a single PoE out interface; *) port - fixed support for USB/serial adapters (introduced in v7.13); *) port - removed bogus serial port on RB750Gr3, RB760iGS and RBM11G devices; *) ppp - added support for "WISPr-Session-Terminate-Time" RADIUS attribute; *) ppp - log an error when IPv6 DHCP pool is exhausted; *) ptp - added "aes67" and "smpte" profiles; *) ptp - added configurable "domain" and "priority2" parameters; *) ptp - added support for Management message forwarding in BC; *) ptp - fixed "default" and "g8275.1" profiles go into "slave" instead of "uncalibrated" state; *) ptp - fixed default values for "802.1as" profile; *) ptp - fixed flags in Announce message; *) ptp - fixed potential error in packet exchange; *) ptp - make clock go into grandmaster state if slave port goes down; *) qos-hw - fixed "tx-queue7-packet" counter; *) route - fixed gateways of locally imported vpnv4 routes; *) route - improved route print "count-only" process speed; *) route - improved stability on route table lookup; *) route-filter - added option to set "isis-ext-metric"; *) route-filter - fixed AS path matchers when input and output chains are used; *) routerboard - added "reset-button" support for RBwAPR-2nD device; *) sfp - added support for modules requiring single byte I2C read transactions; *) sfp - fixed corrupted Tx traffic at 10Gbps rate on CCR2004-16G-2S+ in rare cases; *) sfp - fixed corrupted Tx traffic at 10Gbps rate on RB4011 in rare cases; *) sfp - improve high-power SFP module initialization; *) sfp - improved combo-sfp handling for CRS328-4C-20S-4S+; *) sfp - improved link establishment for RB4011 devices; *) smb - added option to specify SMB service mode as "auto"; *) sms - fixed SMS inbox for FG621-EA modem (introduced in v7.13); *) sms - fixed SMS sending from WinBox and WebFig (introduced in v7.13); *) sms - improved system stability when working with SMS; *) sms - increased SMS read timeout; *) snmp - added "bgpLocalAs" and "bgpIdentifier" OID reporting; *) snmp - fixed "bgpPeerFsmEstablishedTime" OID reporting; *) snmp - hide "MikroTik" in LLDP MIB when branding with hide SNMP option is used; *) snmp - updated timeout log; *) ssh - improved SSH performance on ARM, MIPS, MMIPS, SMIPS and TILE devices; *) ssh - refactored SSH service internal processes; *) sstp - added support for "aes256-gcm-sha384" encryption; *) sstp - improved system stability for PPC devices; *) supout - added PTP section; *) switch - fixed Ethernet disable/enable for CRS310-8G+2S+ devices; *) switch - fixed reserved multicast receive on Atheros-8327, QCA8337 switches for R/STP bridge; *) switch - improved 100G interface stability for 98DX4310 and 98DX8525 switches; *) switch - minimise potential packet overflows on CRS354; *) system - changed build time format according to ISO standard; *) system - expose "lo" and "vrf" interfaces; *) system - fixed "cpu-frequency" for CRS3xx ARM devices; *) system - improved memory allocation for ARM64 devices; *) system - improved RAM allocation for L009UiGS-RM; *) system - improved system stability when processing packets in FastPath (introduced in v7.13); *) system - properly assign destination port for HTTP/S connections initiated by the router (introduced in v7.13); *) system - properly close HTTP/S connections initiated by the router; *) system - provide more precise "total-memory" value for ARM devices; *) system - provide more precise "total-memory" value under "System/Resources" menu for L009 and hAP ax lite routers; *) tftp - improved invalid request processing; *) timezone - updated timezone information from "tzdata2023d" release; *) tr069 - don't duplicate cellular info in "X_MIKROTIK_5G" nodes when connected in NR SA mode; *) tr069 - fixed bandwidth test; *) tr069-client - show 5G signal info in X_MIKROTIK_5G nodes only for 5G NSA bands; *) traffic-flow - use 64bit counters for v9 and IPFIX flows; *) traffic-generator - improved system stability when receiving bogus traffic; *) usb - show "Supermicro CDC" adapter as Ethernet interface; *) vlan - fixed non-running VLAN interface after failed MTU change; *) vrf - prevent VRF interface name collision with interface lists; *) vxlan - fixed underlying tunnel reusing routing marks of encapsulated packets; *) webfig - fixed routing table filter under "IP/Routes" menu; *) webfig - fixed setting the user's password; *) webfig - fixed showing WireGuard peers; *) webfig - improved stability when adding new entries under "IP/Routes" menu; *) wifi - added "station-pseudobridge" interface mode; *) wifi - fixed issue with setting country profile (introduced in v7.13.1); *) wifi - improved handling of CAP connections in dual CAPsMAN scenario; *) wifi - increased value for SAE retransmit period to 3s to improve WPA3 compatibility with IoT client devices; *) wifi - use "Latvia" as the default value for "country" property; *) wifi - use correct CAP identity for interface name provisioning after it has been changed by remote-cap/set-identity; *) wifi-qcom - enable display of regulatory information on L11,L22 devices; *) wifi-qcom - fixed new connections, when maximum supported number of MAC addresses behind connected station-bridges is reached; *) wifi-qcom - improve system stability for L11, L22 devices; *) wifi-qcom - improved memory allocating process; *) wifi-qcom - improved regulatory compliance for L11, L22 devices; *) wifi-qcom - improved system stability when using FastPath (introduced in v7.13); *) winbox - added "accept-protocol-version" parameter to the L2TP server settings; *) winbox - added "mode-button" and "switch" menus for L41G-2axD&FG621-EA; *) winbox - added "Name" parameter under "Tools/Netwatch" menu; *) winbox - added "page-refresh" setting to the Graphing settings; *) winbox - added "Port Cost Mode" setting under "Bridge" menu; *) winbox - added "VRF" parameter under "Tools/Ping" menu; *) winbox - added "x25519" argument for "DH Group" parameter under "IP/IPsec/Profiles" menu; *) winbox - added missing "Protocol" arguments under "IPv6/Firewall" menu; *) winbox - added missing monitoring properties under "WireGuard/Peers" menu; *) winbox - added Preboot Etherboot settings to the System/RouterBOARD/Settings menu; *) winbox - do not show USB settings for CRS devices that does not need it; *) winbox - fixed "Bridge Cost" range under "Interfaces/VPLS" menu; *) winbox - fixed "Password" button under "Quick Set" menu; *) winbox - improved connection speed and reliability; *) winbox - improved route table automatic refresh process for static routes; *) winbox - improved status values under "System/PTP" menu; *) winbox - improved system stability with large packets; *) winbox - include "te-tunnel" parameter in VPLS interface monitor; *) winbox - properly validate "passthrough-subnet-size" in the LTE APN settings; *) winbox - remove "Root Bridge ID" property under "Bridge/MSTIs" menu; *) winbox - removed "sfp all" option from combo port settings; *) winbox - renamed "Wireless Table" menu to "Wifi"; *) winbox - show "routing-table" column under IP/Route menu by default; *) winbox - show all columns under "Routing/PIM SM/Static RP" menu by default; *) wireguard - do not allow to use multiple WireGuard interfaces on the same "listen-port"; *) wireguard - optimised and improved WireGuard service logging; *) x86 - fixed VLAN tagged packet transmit for igb (introduced in v7.12);
-
Bridge port sometimes doesn't show on DHCP leases. Why?
I noticed that occasionally the Bridge Port doesn't show up under Webfig > IP > DHCP Server > Leases. If I ping the IP from either the router or from a device on the same network, it repopulates the Bridge Port.
For 192.168.88.248, it looks something like this:
Then when I ping it, it'll correctly show
ether5
. Why is the behavior like this? Is there something that I can change (a timeout maybe?) so it always populates this column? -
v7.13.1 Stable Released
mikrotik.com MikroTikMikroTik makes networking hardware and software, which is used in nearly all countries of the world. Our mission is to make existing Internet technologies faster, more powerful and affordable to wider range of users.
Notice - Starting from RouterOS version 7.13, significant changes have been made to the RouterOS wireless packages. This is done due to a new product development which will require more disk space for hardware drivers so we had to split it in order to maintain old products alongside the new ones. More wireless packages are yet to come.
-
When upgrading by using "check-for-updates", all versions earlier than 7.12 will display 7.12 as the latest available version. Upgrade from v7.12 to v7.13 or later versions must be done through 7.12 in order to convert wireless packages automatically. Fresh installation with Netinstall or manual package installation works in the same manner as always.
-
Drivers for older wireless and 60GHz interfaces, as well as the wireless management system CAPsMAN, are now part of a separate "wireless" package instead of being a part of the bundle package. This package can be uninstalled if not needed.
-
The existing "wifiwave2" package has been divided into distinct packages: "wifi-qcom" and "wifi-qcom-ac", and the necessary utilities for WiFi management are now included in the RouterOS bundle. RouterOS and "wifi-qcom-ac" packages alongside each other now fit into 16MB flash memory.
What's new in 7.13.1 (2024-Jan-05 15:51):
*) bridge - fixed auto "path-cost" for bonding interfaces (introduced in v7.13); *) console - updated copyright notice; *) dns - fixed domain name lookup resolving for internal services; *) fetch - do not require "content-length" for HTTP (introduced in v7.13); *) fetch - fixed DNS resolving when domain has only AAAA entries (introduced in v7.13); *) fetch - fixed fetch when using "src-path" with HTTP/HTTPS modes (introduced in v7.13); *) fetch - fixed IPv4 address logging (introduced in v7.13); *) fetch - improved file download stability with HTTP/HTTPS modes; *) leds - do not show LTE connection state/mode using RGB power LED from configless LTE modems (introduced in v7.13); *) leds - fixed wireless type of LED triggers for routers using WiFi package (introduced in v7.13); *) lte - fixed support for config-less modem detection (introduced in v7.13); *) lte - fixed USB mode switch and initialization race condition for configless USB modems; *) modem - fixed SMS removal (introduced in v7.13); *) port - fixed support for USB/serial adapters (introduced in v7.13); *) switch - improved 100G interface stability for 98DX4310 and 98DX8525 switches; *) switch - minimise potential packet overflows on CRS354; *) system - improved system stability when processing packets in FastPath (introduced in v7.13); *) timezone - updated timezone information from "tzdata2023d" release; *) tr069 - fixed bandwidth test; *) wifi - use "Latvia" as default value for "country" property; *) winbox - renamed "Wireless Table" menu to "Wifi";
-
-
Securing my network even more
My home network is firewalled and reasonably secure (all permanent devices and IOT devices have MAC addresses tracked and registered) but I’d like to improve it even more:
-
Home devices (servers, printers, laptops, etc) with registered MAC addresses which can’t be accessed from my registered IOT devices or from unregistered guest devices.
-
QOS rules for all guest devices.
Using a HEX to run the network with unifi AP hardware.
-
-
v7.13.0 Released - Significant changes to wireless packages
mikrotik.com MikroTikMikroTik makes networking hardware and software, which is used in nearly all countries of the world. Our mission is to make existing Internet technologies faster, more powerful and affordable to wider range of users.
Release 7.13 2023-12-15
Notice - Starting from RouterOS version 7.13, significant changes have been made to the RouterOS wireless packages. This is done due to a new product developemnt which will require more disk space for hardware drivers so we had to split it in order to maintain old products alongside the new ones. More wireless packages are yet to come.
-
When upgrading by using "check-for-updates", all versions earlier than 7.12 will display 7.12 as the latest available version. Upgrade from v7.12 to v7.13 or later versions must be done through 7.12 in order to convert wireless packages automatically. Fresh installation with Netinstall or manual package installation works in the same manner as always.
-
Drivers for older wireless and 60GHz interfaces, as well as the wireless management system CAPsMAN, are now part of a separate "wireless" package instead of being a part of the bundle package. This package can be uninstalled if not needed.
-
The existing "wifiwave2" package has been divided into distinct packages: "wifi-qcom" and "wifi-qcom-ac", and the necessary utilities for WiFi management are now included in the RouterOS bundle. RouterOS and "wifi-qcom-ac" packages alongside each other now fit into 16MB flash memory.
What's new in 7.13 (2023-Dec-14 09:24):
!) package - convert "wireless" and "wifi" packages automatically, if upgrading from v7.12; !) wifi - split existing "wifiwave2" package into separate packages "wifi-qcom", "wifi-qcom-ac", and include required utilities for WiFi management into bundle; !) wireless - separate "wireless" package from bundle and build as a standalone package; *) bridge - added automatic "path-cost" values depending on interface rate; *) bridge - added bridge interface property "port-cost-mode" with "short" and "long" arguments; *) bridge - fixed bogus VLAN entries from wifi when vlan-filtering is not enabled; *) bridge - improved HW offload enable; *) bridge - improved host flush when removing VLAN on HW offloaded bridge; *) bth - added "VPN Prefer Relay Code" option; *) bth - improved automatic firewall rule generation process; *) certificate - add support for multiple DNS names for Let's Encrypt; *) certificate - added HTTP redirect support for CRL download; *) certificate - added support for certificates with key size 16384; *) certificate - fixed CRL updating; *) certificate - fixed certificate auto renewal via SCEP when certificate contains "subject-alt-name"; *) certificate - improved CRL signature verification and download error messages; *) certificate - improved initial certificate creation using SCEP; *) certificate - use error topic for CRL update failures; *) cloud - improved re-connect speed after network related connection errors; *) console - added ":grep" command; *) console - added ":onerror" command; *) console - added ":serialize" and ":deserialize" commands for converting values to/from JSON; *) console - added "interface" name when printing "interface/pppoe-server" entries; *) console - added "read" command under "file" menu; *) console - added "where" functionality for "export" command; *) console - added flags to "print" command with "value-list"; *) console - added interface helper for "gateway" property under "ip/route" menu; *) console - added unset option for "ssid-regex" and "allow-signal-out-of-range" properties under "interface/wifi/access-list" menu; *) console - clear console history when resetting configuration; *) console - disallow setting existing "name" under "system/script" and "system/scheduler" menus; *) console - fixed "export" boolean arguments when saving output to file using API; *) console - fixed "interface/ethernet/switch/port-isolation" export; *) console - fixed "on-event" argument highlighting under "system/scheduler" menu; *) console - fixed graphic distortions in WinBox; *) console - fixed issue where API incorrectly asks for missing arguments; *) console - fixed printing to file using API; *) console - ignore negative values for ":delay" command; *) console - improved flag printing in certain menus; *) console - improved stability when running "tool/ping" from API; *) console - removed "route-cache" setting from "ip/settings" menu; *) console - replace reserved characters in file and script names with underscores; *) console - resolve "wifiwave2" directory to "wifi"; *) console - show "l2vpn-link" address family under "routing/route" menu; *) console - use more compact login screen for empty branding; *) defconf - expire password when reverting configuration; *) defconf - fixed bogus wifi password on certain Audience devices; *) defconf - fixed configuration for Audience with "wifi-qcom-ac" package; *) defconf - fixed wireless band and channel-width selection (introduced in v7.12); *) defconf - hide default configuration for users without "sensitive" policy; *) defconf - improved wifi interface detection after upgrade; *) defconf - updated configuration with new "wifi" directory; *) defconf - use "WISP Bridge" default configuration mode for RBGrooveGA-52HPacn device; *) defconf - use "fan-min-speed-percent=25" for CRS354-48P-4S+2Q+ device; *) defconf - use device factory preset credentials when using CAPs mode; *) defconf - use one SSID and enable FT when using "wifi" packages; *) disk - fixed hang on reboot when network file systems mounted; *) ethernet - improved packet CPU core classifier for Alpine CPUs for non IPv4/IPv6 traffic; *) ethernet - improved system stability for L009 and hAP ax lite devices; *) fetch - added "http-auth-scheme" parameter, allows to select HTTP basic or digest authentication; *) fetch - added "http-content-encoding" setting; *) fetch - added raw logging; *) fetch - allow to receive HTTP response headers; *) fetch - require "ftp" user policy; *) firewall - added "nat-pmp" support; *) firewall - added new IPv6 filter arguments "icmp-err-src-routing-header" and "icmp-headers-too-long" for "reject-with" setting; *) firewall - do not mark all IPv6 GRE packets as invalid; *) firewall - fixed IPv6 address-list timeout; *) firewall - fixed altered address-list when upgrading from RouterOS v6; *) firewall - fixed connections being tracked when tracking is disabled; *) firewall - removed "prohibited" and "unreachable" IPv4 address-type arguments; *) ftp - improved upload and download speeds; *) health - dynamically add and remove invalid sensors (e.g. sfp-temperature); *) hotspot - fixed incorrect host moving to VLAN 0 when receiving packets through bridge; *) ike2 - fixed ike2 double reply; *) iot - fixed incorrect LoRa ACK packet handling during downlink messaging (introduced in v7.12); *) ipv6 - do not send out IPv6 RA deprecate message for re-used prefix; *) isis - added IS-IS protocol support (CLI only); *) l3hw - fixed routing for IPsec encapsulated packets; *) leds - fixed LED indication in multi-APN setup for Chateau; *) leds - improved LED indication during modem registration state for Chateau; *) log - added "fetch" topic; *) lora - added CUPs protocol support; *) lora - fixed issue with lost LoRa configuration when rebooting the device; *) lte - added RNDIS support for neoway N75-EA modem; *) lte - added support for FOTA firmware upgrade from custom URL for R11eL-FG621-EA; *) lte - disabled IMS service for Chateau 5G on A1 HR network; *) lte - fixed rare cases where Chateau 5G in passthrough mode may stop forwarding packets; *) lte - improved SIM slot status change notification handling for MBIM modems; *) lte - replaced "passthrough-subnet-selection" with "passthrough-subnet-size" setting (CLI only); *) lte - show each CA band in a new line; *) mipsbe - improved system stability when removing USB devices; *) mmips - properly mount and unmount USB devices; *) modem - added option to read SMS using MBIM interface; *) mpls - added "te-tunnel" property for VPLS monitor (CLI only); *) mpls - fixed IPv6 RSVP-TE; *) mpls - improved logging; *) netinstall-cli - added more details to help messages; *) ospf - fixed LSA Type3 advertisement for OSPFv2; *) ospf - fixed missing OSPF interface on L2TP interface reconnect; *) ospf - fixed missing opaque bit in opaque LSA; *) ovpn - improved memory allocation during key-renegotiation; *) ovpn - removed "ping-timer-rem" option from client config file; *) package - added warning log about missing "wireless" or "wifi" package; *) pimsm - improved elected BSR change; *) poe-out - improved firmware upgrade stability for AF/AT controlled boards; *) ppc - fixed RouterOS bootup (introduced in v7.12); *) ppp - added remote-ipv6-prefix to IPv6 firewall address-list if "address-list" property is provided; *) ppp - allow at-chat and info commands in "waiting for packets" state for modems with shared data/info channel; *) ppp - improved IPv6 link-local address uniqueness; *) pppoe-server - fixed connection count limit per license level; *) profiler - improved "disk" and "supout.rif" classifiers; *) qos-hw - added initial congestion avoidance support for 98DX224S, 98DX226S, and 98DX3236 switch chips (CLI only); *) qsfp - added support for QSFP-to-SFP adapters; *) qsfp - fixed supported rates for breakout cables (introduced in v7.12); *) quickset - show DDNS name as VPN address for devices with new style serial number; *) route-filter - improved performance; *) sfp - added "1G-baseT" link mode for modules that supports "2.5G-baseT" mode; *) sfp - allow 2.5G rates only in forced link mode; *) sfp - fixed link establishment with S+DA0001 DAC cables; *) sfp - ignore irrelevant extended compliance code for SFP modules; *) sfp - improved SFP interface handling for 98DX224S, 98DX226S, 98DX3236, 98DX8208, and 98DX8216 switch chips; *) sfp - improved link establishment for SFP copper modules; *) sfp - improved link establishment with certain modules for hEX S device; *) sfp - show 10M and 100M supported rates for RJ45 copper modules; *) ssh - added cipher and hash function acceleration for ARM64 and x86 architectures; *) ssh - fix error that caused large chunks of text not being pasted in their entirety into console; *) supout - added VXLAN FDB section; *) supout - added multiple WiFi sections; *) switch - fixed service VLAN tagged IP multicast packets for 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255 switches; *) system - added "rtrace" debugging tool (CLI only); *) system - improved incoming and outgoing TCP connection performance; *) system - improved internal process communication performance; *) traffic-generator - improved system stability when modifying interfaces; *) usb - added support for RTL8152 USB ethernet on ARM, ARM64 and x86; *) vpls - improved performance when decapsulating data; *) vrf - fixed ICMP reply lookup; *) webfig - allow to display comments in multiline or compact modes; *) webfig - make table headers always visible; *) webfig - use local storage for user preferences; *) wifi - added "flat-snoop" tool for surveying WiFi APs and stations (CLI only); *) wifi - added "radio-mac" variable for "name-format" provisioning setting; *) wifi - added "remove" command in "capsman/remote-cap" menu; *) wifi - after radar detections, avoid selection of channels not permitted by the user; *) wifi - changed CAPsMAN generated certificate common name; *) wifi - create first interface without number when using "name-format" provisioning setting; *) wifi - enable protected interworking ANQP responses; *) wifi - fixed EAP authentication failures when the Session-Timout RADIUS attribute is defined; *) wifi - fixed occasional failures to start on 20/40mhz-eC channels for 2.4GHz 802.11ax interfaces; *) wifi - fixed overridden datapath settings on CAP when unsetting from CAPsMAN; *) wifi - improved CAPsMAN stability during provisioning; *) wifi - make slave APs use datapath bridge settings inherited from master by default; *) wifi - removed "openflow-switch" setting; *) wifi-qcom - added fast-path for received packets; *) winbox - added "Hw. Offload" property under "IP/Firewall/Filter" menu; *) winbox - added "Ping" button under "IP/DHCP Server/Leases" menu; *) winbox - added "Tx bps" and "Rx bps" monitor values under "WiFi/Registration" menu; *) winbox - added "none" argument for "Preshared Key" under "WireGuard/Peers" menu; *) winbox - added icon to entries under "WiFi/Access List" menu; *) winbox - added missing "qos-classifier" argument for "Hw. Caps" under "WiFi/Radios" menu; *) winbox - added missing arguments for "MAC Format" under "Wireless/Security Profiles/RADIUS" menu; *) winbox - allow opening entries under "WiFi/Registration" menu; *) winbox - fixed default "Name Format" property under "WiFi/Provisioning" menu; *) winbox - fixed minor typo under "Routing/BFD" menu; *) winbox - improved connection speed; *) winbox - updated "wireless" and "wifi" menus; *) wireless - fixed "wlan1" default name for RBSXTsqG-5acD and RBLDFG-5acD; *) wireless - fixed snooper information gathering from re-assocation requests; *) wireless - keep configuration after manual package removal;
-
-
RB5009 Passive PoE doesn't support 24V devices
Annoyingly, the RB5009 doesn't have a voltage regulator on its PoE-out ports. So it outputs ~48V, but other Mikrotik devices that support PoE-in only support ranges like 20-34V.
There is a solution! And I wanted to share it with you guys as my first post :)
48V-to-24V in-line convertor: https://www.aliexpress.com/w/wholesale-poe-Converter-48V-to-24V.html
This will convert the output from the RB5009 to 24V. Tested with PoE-out on RB5009UPr+S+ and PoE-in on CSS106-5G-1S.
The RB5009 is a fantastic device.
-
Large number of RX and TX pauses?
Just wondering if this is normal... or is there something I need to be looking at here? These Rx pauses are the result of roughly 48 hours worth of traffic. The device pictured is the CRS317-1G-16S+, and the switch on the other end is a CRS326-24G-2S+. I'm using brand new FS tranceivers and an fs om4 lc to lc fiber patch. I've swapped the tranceivers for 10gtek ones (also brand new), and it didn't make a difference.
When I look at the CSR326-24G, I see very similar numbers except in the tx pauses column... which I think makes sense. I'm just not sure if there is something I should do? Or, could someone help explain what might be causing it? I'm new to 10gb networking and mikrotik as a whole, so I'm just trying to dial things in.
-
7.12.1 Stable Released
mikrotik.com MikroTikMikroTik makes networking hardware and software, which is used in nearly all countries of the world. Our mission is to make existing Internet technologies faster, more powerful and affordable to wider range of users.
Hasn't been posted yet, so here it is:
What's new in 7.12.1 (2023-Nov-17 13:38):
- defconf - fixed bogus wifi password on certain Audience devices;
- ipv6 - do not send out IPv6 RA deprecate message for re-used prefix;
- ospf - fixed LSA Type3 advertisement for OSPFv2;
- ppc - fixed RouterOS bootup (introduced in v7.12);
- qsfp - fixed supported rates for breakout cables;
- winbox - added missing arguments for "MAC Format" under "Wireless/Security Profiles/RADIUS" menu;
-
How can I set up a wireless bridge without taking down my existing network?
I bought a mAP lite to hook up to my POE security camera (that's DC powered) so I didn't have to run ethernet cable in my attic. I'm configuring the mAP lite with it plugged into my laptop, but I did try it directly connected to my router. I've searched and searched, and I think I've gotten close to how to set it up, but I still need help.
In the web portal I choose the CEP option, join the wifi network, switch to bridge mode, then apply the static IP settings and hit apply. Every time, it changes back to router mode and everything on my network joins the 192.168.88.0/24 network, even though my Mikrotik RB5009UPr+S+in (the POE home lab one) is already set up and running.
I am still using my old TP-link router as an AP until I get around to installing my cAP ax, so I know I need to use the psuedo station option for now.
Any help on getting this set up would be great.
-
Cool YouTube Playlist with MikroTik scripting tutorials
This a colllection of videos that explores a variety of topics around creating scripts for the Mikrotik platform. It includes step-by-step lessions and tutorials showing you how to create your own MikroTik scripts.
The videos presented provide a hands-on, learn-by-example approach rather than being formal-training style presentations. They dip in to various scripting topics as we meet them using real-world scripting examples.
-
Exploiting MikroTik RouterOS Hardware with CVE-2023-30799
vulncheck.com Exploiting MikroTik RouterOS Hardware with CVE-2023-30799 - Blog - VulnCheckVulnCheck develops an exploit that gets a root shell on MikroTik RouterOS.
Up until version 6.49.8 (July 20, 2023), MikroTik RouterOS Long-term was vulnerable to CVE-2023-30799. Remote and authenticated attackers can use the vulnerability to get a root shell on the router.
-
Release 7.11beta7 (2023-Jul-24 14:45)
- certificate - allow to import certificate with DNS name constraint
- certificate - require CRL presence when using "crl-use=yes" setting;
- conntrack - fixed "active-ipv4" property;
- console - added ":convert" command;
- dhcp-server - fixed setting "bootp-lease-time=lease-time";
- ike2 - log "reply ignored" as non-debug log message;
- modem - added initial support for BG77 modem DFOTA firmware update;
- modem - changed Quectel EC25 portmap to expose DM (diag port), DM channel=0, GPS channel=1;
- ovpn - do not try to use the "bridge" setting from PPP/Profile, if the OVPN server is used in IP mode (introduced in v7.10);
- ovpn - improved key renegotiation process;
- ovpn - include "connect-retry 1" and "reneg-sec" parameters into the OVPN configuration export file;
- routerboot - increased etherboot bootp timeout to 40s on MIPSBE and MMIPS devices ("/system routerboard upgrade" required);
- ssh - fixed private key import (introduced in v7.9);
- user - added "sensitive" policy requirement for SSH key and certificate export;
- webfig - fixed gray-out italic font for entries after enable
-
Default Firewall Rules in MikroTik RouterOS
MikroTik RouterOS comes with a default firewall configuration designed to provide basic network security. As a new user, comprehending these default firewall rules is essential to evaluate the initial level of protection for your network. In this technical guide, we will break down the default firewall rules and teach you how to interpret them to ensure your network's security is optimized.
Accessing the Firewall Configuration
To access the firewall configuration in MikroTik RouterOS, follow these steps:
Step 1: Log in to the MikroTik RouterOS Web Interface or connect via the Terminal (SSH or Telnet).
Step 2: Access the firewall settings by entering the following command in the terminal: !
Interpreting Default Firewall Rules
By executing the above command, you will see a list of rules with columns representing essential parameters. Here's how to interpret the default firewall rules:
Column Headers:
- CHAIN: Specifies the traffic direction the rule applies to (input, forward, or output).
- SRC-ADDRESS: Defines the source IP address or IP range the rule affects.
- DST-ADDRESS: Indicates the destination IP address or IP range the rule applies to.
- PROTOCOL: Specifies the protocol (e.g., TCP, UDP) or all for any protocol.
- ACTION: Determines what action the rule takes (accept, drop, reject, etc.).
- COMMENT: Provides a description or comment for the rule (optional).
Default Input Chain Rule
The default rule in the input chain ensures the router itself is protected. It allows established connections (marked as "ESTABLISHED") to be accepted, so responses to outgoing traffic are allowed. It also permits related connections (marked as "RELATED"), enabling protocols like FTP to function correctly. Finally, the rule drops all incoming traffic with an invalid state.
Example Default Input Chain Rule:
0 ;;; defconf: drop all not coming from LAN chain=input action=drop in-interface=!yourLANinterface connection-state=new
Default Forward Chain Rule
The default rule in the forward chain controls traffic traversing between different networks. It accepts established and related connections (similar to the input chain) while blocking any new connections from external sources to the router.
Example Default Forward Chain Rule:
0 ;;; defconf: drop all from WAN not DSTNATed chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=!yourWANinterface
Default Output Chain Rule
The default rule in the output chain allows all outgoing traffic from the router to external destinations.
Example Default Output Chain Rule:
0 ;;; defconf: accept all from LAN chain=output action=accept out-interface=!yourLANinterface
Enhancing Firewall Rules
To enhance your network security, consider adding custom rules. For example, you can create rules to block specific incoming traffic, allow access to specific services, or implement Layer 7 protocol filtering.
Understanding the default firewall rules in MikroTik RouterOS is crucial to assess the initial level of network security. By interpreting the rules provided in the default configuration, you can evaluate and enhance your network's protection as per your specific requirements. Take advantage of custom firewall rules, connection tracking, and Layer 7 protocol filtering to strengthen your network's defenses and ensure a secure and robust network environment.
- github.com GitHub - eworm-de/routeros-scripts: a collection of scripts for MikroTik RouterOS
a collection of scripts for MikroTik RouterOS. Contribute to eworm-de/routeros-scripts development by creating an account on GitHub.
While RouterOS is pretty complete, sometimes a few handy scripts can be useful to configure certain things on your firewall / router. The linked repository holds a number of scripts to manage RouterOS devices or extend their functionality.
Find and remove access list duplicates Upload backup to Mikrotik cloud Send backup via e-mail Save configuration to fallback partition Upload backup to server Download packages for CAP upgrade from CAPsMAN Run rolling CAP upgrades from CAPsMAN Renew locally issued certificates Renew certificates and notify on expiration Notify about health state Notify on LTE firmware upgrade Notify on RouterOS update Collect MAC addresses in wireless access list Use wireless network with daily psk Comment DHCP leases with info from access list Create DNS records for DHCP leases Automatically upgrade firmware and reboot Download, import and update firewall address-lists Wait for global functions und modules Send GPS position to server Use WPA2 network with hotspot credentials Create DNS records for IPSec peers Update configuration on IPv6 prefix change Manage IP addresses with bridge status Run other scripts on DHCP lease Manage LEDs dark mode Forward log messages via notification Mode button with multiple presses Manage DNS and DoH servers from netwatch Notify on host up and down Visualize OSPF state via LEDs Manage system update Run scripts on ppp connection Act on received SMS Forward received SMS Play Super Mario theme Chat with your router and send commands via Telegram bot Install LTE firmware upgrade Update GRE configuration with dynamic addresses Update tunnelbroker configuration
The scripts come highly recommended
-
7.11beta5 released
What's new in 7.11beta5 (2023-Jul-17 10:07):
Changes in this release:
*) bridge - added warning when VLAN interface list contains ports that are not bridged; *) bth - added "Back To Home" VPN service for 802.11ax devices with wifiwave2 package; *) console - fixed incorrect date when printing "value-list" with multiple entries; *) console - improved stability when using fullscreen editor; *) container - added IPv6 support for VETH interface; *) container - adjust the ownership of volume mounts that fall outside the container's UID range; *) hotspot - allow number as a first symbol in the Hotspot server DNS name; *) lora - added uplink message filtering option using NetID or JoinEUI; *) qos-hw - keep VLAN priority in packets that are sent from CPU; *) resource - fixed erroneous CPU usage values; *) sfp - reduce CPU load due to SFP interface handling for CCR2116, CCR2216, CCR2004-12S+2XS, CRS312, CRS518 devices (introduced in v7.9) *) webfig - fixed "Connect To" configuration changes for L2TP client; *) wifiwave2 - automatically add wifi interfaces to appropriate bridge VLAN when wireless clients with new VLAN IDs connect; *) wifiwave2 - fixed multicast frame delivery (introduced in v7.11beta2); *) wifiwave2 - fixed registration table statistics (introduced in v7.11beta4);
Other changes since v7.10:
*) api - disallow executing commands without required parameters; *) bfd - fixed "actual-tx-interval" value and added "remote-min-tx" (CLI only); *) bluetooth - added "decode-ad" command for decoding raw Bluetooth payloads (CLI only); *) bluetooth - added "Peripheral devices" section which displays decoded Eddystone TLM and UID, iBeacon and MikroTik Bluetooth payloads; *) bluetooth - added new AD structure type "service-data" for Bluetooth advertisement; *) bridge - added more STP-related logging; *) bridge - fixed MSTP BPDU aging; *) bridge - fixed MSTP synchronization after link down; *) bridge - prevent bridging the VLAN interface created on the same bridge; *) certificate - fixed PEM import; *) certificate - restored RSA with SHA512 support; *) console - added default value for "rndstr" command (16 characters from 0-9a-zA-Z); *) console - fixed incorrect default value of ":return" command (introduced in v7.11beta2); *) console - fixed minor typos; *) console - fixed missing "parent" for script jobs (introduced in v7.9); *) console - fixed missing return value for ping command in certain cases; *) console - fixed printing interval when resizing terminal; *) console - improved flag printing in certain menus; *) console - improved stability and responsiveness; *) console - improved timeout for certain commands and menus; *) console - improved VPLS "cisco-id" argument validation; *) container - added option to use overlayfs layers; *) container - fixed duplicate image name; *) discovery - fixed "lldp-med-net-policy-vlan" (introduced in v7.8); *) dns - improved system stability when processing static DNS entries with specified address-list; *) ethernet - improved interface stability for CRS312 device; *) fetch - improved timeout detection; *) firewall - added warning when PCC divider argument is smaller than remainder; *) firewall - fixed mangle "mark-connection" with "passthrough=yes" rule for TCP RST packets; *) graphing - added paging support; *) health - added more gradual control over fans for CRS3xx, CRS5xx, CCR2xxx devices; *) health - fixed configuration export for "/system/health/settings" menu; *) ike2 - improved system stability when closing phase1; *) ike2 - improved system stability when making configuration changes on active setup; *) ipsec - improved IKE2 rekey process; *) ipsec - properly check ph2 approval validity when using IKE1 exchange mode; *) l3hw - changed minimal supported values for "neigh-discovery-interval" and "neigh-keepalive-interval" properties; *) l3hw - fixed /32 and /128 route offloading after nexthop change; *) l3hw - fixed incorrect source MAC usage for offloaded bonding interface; *) l3hw - improved system responsiveness during partial offloading; *) l3hw - improved system stability during IPv6 route offloading; *) l3hw - improved system stability; *) led - fixed manually configured user LED for RB2011; *) leds - blink red system-led when LTE is not connected to the network on D53 devices; *) leds - fixed system-led color for "GSM EGPRS" RAT on D53 devices; *) lora - added new EUI field; *) lora - moved LoRa service to IoT package; *) lora - properly apply configuration changes when multiple LoRa cards are used; *) lora - updated LoRa firmware for R11e-LR8, R11e-LR9 and R11e-LR2 cards; *) lte - added "at-chat" support for Dell DW5821e-eSIM modem; *) lte - added extended support for Neoway N75 modem; *) lte - fixed Dell DW5221E "at-chat" support; *) lte - fixed NR SINR reporting for Chateau 5G; *) lte - fixed Telit LE910C4 "at-chat" support; *) lte - improved initial interface startup time for SXT LTE 3-7; *) lte - only listen to DHCP packets for LTE passtrough interface in auto mode when looking for the host; *) mpls - improved MPLS TCP performance; *) mqtt - added more MQTT publish configuration options; *) mqtt - added new MQTT subscribe feature; *) netwatch - added "src-address" property; *) netwatch - changed "thr-tcp-conn-time" argument to time interval; *) ovpn - fixed OVPN server peer-id negotiation; *) ovpn - fixed session-timeout when using UDP mode; *) ovpn - properly close OVPN session on the server when client gets disconnected; *) package - treat disabled packages as enabled during upgrade; *) poe - fixed missing PoE configuration section under specific conditions; *) pppoe - fixed PPPoE client trying to establish connection when parent interface is inactive; *) profile - added "container" process classifier; *) profile - properly classify "console" related processes; *) quickset - correctly apply configuration when using "DHCP Server Range" property; *) rose-storage - added "scsi-scan" command (CLI only); *) rose-storage - added disk stats for ramdisks; *) rose-storage - fixed RAID 0 creation; *) rose-storage - limit striped RAID element size to smallest disk size; *) route - added comment for BFD configuration (CLI only); *) route - convert BFD timers from milliseconds to microseconds after upgrade; *) routerboard - fixed "gpio-function" setting on RBM33G ("/system routerboard upgrade" required); *) routerboard - improved RouterBOOT stability for Alpine CPUs ("/system routerboard upgrade" required); *) routerboard - removed unnecessary serial port for netPower16P and hAP ax lite devices ("/system routerboard upgrade" required); *) sfp - improved interface stability for 98DX8208, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98PX1012 based switches; *) sfp - improved optical QSFP interface handling for 98DX8332, 98DX3257, 98DX4310, 98DX8525 switches; *) ssh - fixed user RSA private key import; *) switch - fixed "reset-counters" for "switch-cpu"; *) system - disallow setting a non-existing CPU core number for system IRQ; *) system - increased maximum supported CPU core count to 512 on CHR and x86; *) system - reduced RAM usage for SMIPS devices; *) w60g - improved stability for Cube 60Pro ac and CubeSA 60Pro ac devices; *) webfig - added option to enable wide view in item list; *) webfig - use router time zone for date and time; *) wifiwave2 - added "steering" parameters and menu to set up and monitor AP neighbor groups (CLI only); *) wifiwave2 - added more information on roaming candidates to BSS transition management requests (802.11v) and neighbor report responses (802.11k); *) wifiwave2 - added option to filter frames captured by the sniffer command (CLI only); *) wifiwave2 - changed default behavior for handling duplicate client MAC addresses, added settings for changing it (CLI only); *) wifiwave2 - enabled PMK caching with EAP authentication types; *) wifiwave2 - fixed "reg-info" information for several countries; *) wifiwave2 - fixed "security.sae-max-failure" rate not limiting authentications correctly in some cases; *) wifiwave2 - fixed clearing CAPsMAN Common Name when disabling "lock-to-caps-man"; *) wifiwave2 - fixed interface hangs on IPQ6010-based boards (introduced in v7.9); *) wifiwave2 - improved stability when changing interface settings; *) wifiwave2 - improved stability when receiving malformed WPA3-PSK authentication frames; *) wifiwave2 - make info log less verbose during client roaming (some info moved to wireless,debug log); *) wifiwave2 - rename "reg-info" country argument from "Macedonia" to "North Macedonia"; *) wifiwave2 - use correct status code when rejecting WPA3-PSK re-association; *) winbox - added missing status values for Ethernet and Cable Test; *) winbox - added warning about non-running probe due to "startup-delay"; *) winbox - fixed "Storm Rate" property under "Switch/Port" menu; *) winbox - fixed BGP affinity display; *) winbox - fixed default "Ingress Filtering" value under "Bridge" menu; *) winbox - improved supout.rif progress display; *) winbox - rename "Group Master" property to "Group Authority" under "Interface/VRRP" menu; *) wireguard - fixed peer connection using DNS name on IP change; *) wireless - ignore EAPOL Logoff frames; *) x86 - updated e1000 driver;
-
Wireless
For those of you who have invested in a MikroTik router, have you also incorporated MikroTik wireless devices into your network setup? What has been your experience with MikroTik wireless products? Are they a good choice in terms of performance, range, and reliability? Or would you advise to look for other vendors?
-
Because reasons
What made you choose MikroTik over other networking vendors for your home network setup? Was it performance, affordability, ease of use, or specific features that stood out to you?
-
RB750Gr3 on 1 Gbps fiber
I have a 1 Gbps fiber connection and want to maximize its performance, including IPv6 routing. Considering that IPv6 routing is not accelerated on the MikroTik RB750Gr3, should I still expect it to handle the load effectively, or would it be more suitable to explore other router options?
-
Stable or testing for home use?
When it comes to home routers, do you prefer using the testing or stable firmware versions? Share your experiences, reasons behind your choice, and any noteworthy benefits or challenges you’ve encountered with either option.
-
Default firewall question
Is the default firewall provided by MikroTik sufficient for home users, or should additional firewall configurations be implemented to enhance security? Share your experiences, recommendations, and any noteworthy vulnerabilities you've encountered.
-
Tips and Tricks for Mikrotik?
What’s your most effective MikroTik networking tip or trick that has saved you time or improved your network performance?
-
Be one of the first to try our Back to Home VPN service
Back To Home is a convenience feature, that configures your device for secure VPN access from anywhere in the world to your router and your network, even if your router does not have a public IP address, is behind NAT or Firewall.
Configuration can be done manually, or with our MikroTik VPN companion app (Android, iPhone (coming soon)).
If the VPN server (your home router) has a public IP address, the VPN app will create a direct VPN connection between the phone and the router. However, if the router is not directly reachable from the internet, the connection will be made through the MikroTik relay server. The connection is always end-to-end encrypted, the relay server or any other device does not have access to the encryption keys. In case of going through relay, speed could be limited.
This feature is a convenient option to access your home network or view content available in your home country, from locations, where some content is not available. It is not meant for anonymity, it is for simple one click access to your home network. For more granular security controls, we recommend to manually configure and secure a VPN connection using the advanced RouterOS options.
More configuration https://help.mikrotik.com/docs/display/ROS/Back+To+Home
-
v7.11beta is released!
RouterOS version 7.11beta has been released on the "v7 testing" channel!
Before an upgrade:
- Remember to make backup/export files before an upgrade and save them on another storage device;
- Make sure the device will not lose power during upgrade process;
- Device has enough free storage space for all RouterOS packages to be downloaded.
What's new in 7.11beta4 (2023-Jul-05 13:33):
*) bluetooth - added "decode-ad" command for decoding raw Bluetooth payloads (CLI only); *) bluetooth - added "Peripheral devices" section which displays decoded Eddystone TLM and UID, iBeacon and MikroTik Bluetooth payloads; *) bridge - added warning when VLAN interface list contains ports that are not bridged; *) bridge - prevent bridging the VLAN interface created on the same bridge; *) console - fixed incorrect default value of ":return" command (introduced in v7.11beta2); *) console - improved stability and responsiveness; *) container - fixed duplicate image name; *) dns - improved system stability when processing static DNS entries with specified address-list; *) ipsec - improved IKE2 rekey process; *) ipsec - properly check ph2 approval validity when using IKE1 exchange mode; *) l3hw - changed minimal supported values for "neigh-discovery-interval" and "neigh-keepalive-interval" properties; *) l3hw - fixed /32 and /128 route offloading after nexthop change; *) l3hw - fixed incorrect source MAC usage for offloaded bonding interface; *) l3hw - improved system responsiveness during partial offloading; *) l3hw - improved system stability; *) leds - blink red system-led when LTE is not connected to the network on D53 devices; *) leds - fixed system-led color for "GSM EGPRS" RAT on D53 devices; *) lte - fixed Dell DW5221E "at-chat" support; *) lte - only listen to DHCP packets for LTE passtrough interface in auto mode when looking for the host; *) package - treat disabled packages as enabled during upgrade; *) profile - added "container" process classifier; *) profile - properly classify "console" related processes; *) quickset - correctly apply configuration when using "DHCP Server Range" property; *) rose-storage - added "scsi-scan" command (CLI only); *) route - added comment for BFD configuration (CLI only); *) route - convert BFD timers from milliseconds to microseconds after upgrade; *) sfp - improved optical QSFP interface handling for 98DX8332, 98DX3257, 98DX4310, 98DX8525 switches; *) wifiwave2 - fixed "reg-info" information for several countries; *) wifiwave2 - fixed interface hangs on IPQ6010-based boards (introduced in v7.9); *) wifiwave2 - rename "reg-info" country argument from "Macedonia" to "North Macedonia"; *) winbox - fixed "Storm Rate" property under "Switch/Port" menu; *) winbox - fixed BGP affinity display; *) wireless - ignore EAPOL Logoff frames; *) x86 - updated e1000 driver;
What's new in 7.11beta2 (2023-Jun-21 14:39):
*) api - disallow executing commands without required parameters; *) bfd - fixed "actual-tx-interval" value and added "remote-min-tx" (CLI only); *) bluetooth - added new AD structure type "service-data" for Bluetooth advertisement; *) bridge - added more STP-related logging; *) bridge - fixed MSTP BPDU aging; *) bridge - fixed MSTP synchronization after link down; *) certificate - fixed PEM import; *) certificate - restored RSA with SHA512 support; *) console - added default value for "rndstr" command (16 characters from 0-9a-zA-Z); *) console - fixed minor typos; *) console - fixed missing "parent" for script jobs (introduced in v7.9); *) console - fixed missing return value for ping command in certain cases; *) console - fixed printing interval when resizing terminal; *) console - improved flag printing in certain menus; *) console - improved stability and responsiveness; *) console - improved timeout for certain commands and menus; *) console - improved VPLS "cisco-id" argument validation; *) container - added option to use overlayfs layers; *) discovery - fixed "lldp-med-net-policy-vlan" (introduced in v7.8 ); *) ethernet - improved interface stability for CRS312 device; *) fetch - improved timeout detection; *) firewall - added warning when PCC divider argument is smaller than remainder; *) firewall - fixed mangle "mark-connection" with "passthrough=yes" rule for TCP RST packets; *) graphing - added paging support; *) health - added more gradual control over fans for CRS3xx, CRS5xx, CCR2xxx devices; *) health - fixed configuration export for "/system/health/settings" menu; *) ike2 - improved system stability when closing phase1; *) ike2 - improved system stability when making configuration changes on active setup; *) l3hw - improved system stability during IPv6 route offloading; *) led - fixed manually configured user LED for RB2011; *) lora - added new EUI field; *) lora - moved LoRa service to IoT package; *) lora - properly apply configuration changes when multiple LoRa cards are used; *) lora - updated LoRa firmware for R11e-LR8, R11e-LR9 and R11e-LR2 cards; *) lte - added "at-chat" support for Dell DW5821e-eSIM modem; *) lte - added extended support for Neoway N75 modem; *) lte - fixed NR SINR reporting for Chateau 5G; *) lte - fixed Telit LE910C4 "at-chat" support; *) lte - improved initial interface startup time for SXT LTE 3-7; *) mpls - improved MPLS TCP performance; *) mqtt - added more MQTT publish configuration options; *) mqtt - added new MQTT subscribe feature; *) netwatch - added "src-address" property; *) netwatch - changed "thr-tcp-conn-time" argument to time interval; *) ovpn - fixed OVPN server peer-id negotiation; *) ovpn - fixed session-timeout when using UDP mode; *) ovpn - properly close OVPN session on the server when client gets disconnected; *) poe - fixed missing PoE configuration section under specific conditions; *) pppoe - fixed PPPoE client trying to establish connection when parent interface is inactive; *) rose-storage - added disk stats for ramdisks; *) rose-storage - fixed RAID 0 creation; *) rose-storage - limit striped RAID element size to smallest disk size; *) routerboard - fixed "gpio-function" setting on RBM33G ("/system routerboard upgrade" required); *) routerboard - improved RouterBOOT stability for Alpine CPUs ("/system routerboard upgrade" required); *) routerboard - removed unnecessary serial port for netPower16P and hAP ax lite devices ("/system routerboard upgrade" required); *) sfp - improved interface stability for 98DX8208, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98PX1012 based switches; *) ssh - fixed user RSA private key import; *) switch - fixed "reset-counters" for "switch-cpu"; *) system - disallow setting a non-existing CPU core number for system IRQ; *) system - increased maximum supported CPU core count to 512 on CHR and x86; *) system - reduced RAM usage for SMIPS devices; *) w60g - improved stability for Cube 60Pro ac and CubeSA 60Pro ac devices; *) webfig - added option to enable wide view in item list; *) webfig - use router time zone for date and time; *) wifiwave2 - added "steering" parameters and menu to set up and monitor AP neighbor groups (CLI only); *) wifiwave2 - added more information on roaming candidates to BSS transition management requests (802.11v) and neighbor report responses (802.11k); *) wifiwave2 - added option to filter frames captured by the sniffer command (CLI only); *) wifiwave2 - changed default behavior for handling duplicate client MAC addresses, added settings for changing it (CLI only); *) wifiwave2 - enabled PMK caching with EAP authentication types; *) wifiwave2 - fixed "security.sae-max-failure" rate not limiting authentications correctly in some cases; *) wifiwave2 - fixed clearing CAPsMAN Common Name when disabling "lock-to-caps-man"; *) wifiwave2 - improved stability when changing interface settings; *) wifiwave2 - improved stability when receiving malformed WPA3-PSK authentication frames; *) wifiwave2 - make info log less verbose during client roaming (some info moved to wireless,debug log); *) wifiwave2 - use correct status code when rejecting WPA3-PSK re-association; *) winbox - added missing status values for Ethernet and Cable Test; *) winbox - added warning about non-running probe due to "startup-delay"; *) winbox - fixed default "Ingress Filtering" value under "Bridge" menu; *) winbox - improved supout.rif progress display; *) winbox - rename "Group Master" property to "Group Authority" under "Interface/VRRP" menu; *) wireguard - fixed peer connection using DNS name on IP change;
To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download
If you experience version related issues, then please send supout file from your router to [email protected]. File must be generated while a router is not working as suspected or after some problem has appeared on the device
-
CVE-2023-32154
On 10/05/2023 (May 10th, 2023) MikroTik received information about a new vulnerability, which is assigned the ID CVE-2023-32154. The report stated, that vendor (MikroTik) was contacted in December, but we did not find record of such communication. The original report also says, that vendor was informed in person in an event in Toronto, where MikroTik was not present in any capacity.
What this issue affects: The issue affects devices running MikroTik RouterOS versions v6.xx and v7.xx with enabled IPv6 advertisement receiver functionality. You are only affected if one of the below settings is applied:
ipv6/settings/ set accept-router-advertisements=yes
or
ipv6/settings/set forward=no accept-router-advertisements=yes-if-forwarding-disabled
If the above settings are not set up like in the example, you are not affected. Note that the vulnerable setting combination is not normally found in routers and is rarely used.
What this issue can cause: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability.
Recommended course of action: You can disable IPv6 advertisements, or upgrade to RouterOS 7.9.1, 6.49.8, 6.48.7, 7.10beta8 (all versions already released), and of course newer versions afterwards.
-
7.10.2 is out
7.10.2 is out
*) wifiwave2 - fixed interface hangs on IPQ6010-based boards (introduced in v7.9);
https://mikrotik.com/download/changelogs