MikroTik

CTassisF

*) quicksest - only show LTE mode for devices without other wireless interfaces;

Small typo.

CTassisF

I'm also having problems with USB stick disappearing on RB5009. I use the USB stick as storage for my containers, and after 3~4 days of uptime the usb1-part1 disk disappears from /file and garbage is shown in /disk. The weird part is that all containers continue to work, but after a while this seem...

CTassisF

I'm also having problems with USB stick disappearing on RB5009. I use the USB stick as storage for my containers, and after 3~4 days of uptime the usb1-part1 disk disappears from /file and garbage is shown in /disk. The weird part is that all containers continue to work, but after a while this seems...

CTassisF

I was able to make this work with custom routing tables (and even VRFs) using the following configuration: /ip firewall mangle add action=jump chain=prerouting comment="prerouting LAN" connection-mark=no-mark connection-state=new dst-address-list=!private dst-address-type=!local in-interfa...

CTassisF

ROS 7.14 very nice. Now firewall for VPRN traffic to VRF on CPE mikrotik routers just completely and silently ignored . DNAT to VRF also don`t work. Well done. 1- v7.14 is still in beta 2- I'm having a similar problem with static routes in VRFs: https://forum.mikrotik.com/viewtopic.php?t=202612&...

CTassisF

I just noticed that the syntax gateway=example-interface@example-vrf in /ip(v6)/route/add dst-address=0.0.0.0/0 gateway=example-interface@example-vrf routing-table=example-vrf (together with /ip/vrf/add interfaces=example-interface name=example-vrf ) is not working properly since v7.14beta6 : - /ip(...

CTassisF

Did /tool/graphing/resource stop recording container memory usage? Or has there actually been some serious reduction in memory usage on ARM64 devices? I'm seeing a lot more free memory in both my RB5009 and hAP ax3. Both run containers, and no settings have been changed. RB5009.png hAP ax3.png

CTassisF

After updating to v7.14beta3, I noticed that my hAP ac3 is reverting vlan-mode settings in /interface/ethernet/switch/port to vlan-mode=disabled instead of the vlan-mode=fallback that was set before. This is happening on every reboot, even after setting to vlan-mode=fallback again.

CTassisF

I'm also interested to learn what exactly is controlled by the "ram-high" parameter. SUP-136073 I never got a proper answer to that question, but after experimenting a bit I think the correct answer is: "ram-high" limits the total RAM usage of all containers (not considering the...

CTassisF

Upgraded to 7.13beta3 and noticed that if I reboot my CAPsMAN (RB5009), all the wireless interfaces of my CAPs (hAP ax3 and hAP ac3) will show as “busy” and not work.

Rebooting the CAPs after rebooting the CAPsMAN solves the issue.

SUP-135728

CTassisF

In v7.13beta2, NAT PMP logs are too verbose: Screenshot 2023-11-21 at 12.56.27.png I hope this changes before the stable release. I also noticed that the comments of dynamically-generated NAT PMP firewall rules are mentioning the external (WAN) IPv4 address while UPnP comments show the internal (LAN...

CTassisF

Upgraded my RB5009 (CAPsMAN), hAP ax3 (CAP) and hAP ac3 (CAP) from 7.12rc5 to 7.13beta1 using the "check for updates" and everything went fine . RB5009 had wifiwave2 package before, now it only has routeros (since WiFi menu + CAPsMAN feature is now bundled). hAP ax3 had wifiwave2 package b...

CTassisF

Since updating to 7.12beta9 I'm having issues with my hAP a c 3 that works as WifiWave2 CAP. After a few hours of uptime, some of the devices connected to hAP a c 3 stopped having internet connectivity. This issue does not happen to devices connected to my hAP a x 3 that is CAP to the same CAPsMAN. ...

CTassisF

What is layer-dir in /container/config?

Edit: Looks like it's persistent storage for container layers to be reused (in case different containers share some/all layers).

CTassisF

According to documentation , "this will soft limit RAM usage - if a RAM usage goes over the high boundary, the processes of the cgroup are throttled and put under heavy reclaim pressure". Here's my question: If I set ram-high=512.0MiB , will it mean that containers' processes will be throt...

CTassisF

After updating to 7.11beta5 , all containers are showing 0.0.0.0 as their own IP in /etc/hosts . For example, here's my AdGuard container: [cesar-ro@RB5009] > /container/print 0 name="4736436b-e3cc-4f12-a794-7f128e0a26cf" tag="adguard/adguardhome:latest" os="linux" arch...

CTassisF

My hAP ax3 with 10 WifiWave2 interfaces (open, owe, wpa2, wpa3) is quite stable in 7.11beta2. [cesar@hAP-ax3] > /system/resource/print uptime: 1w1d32m18s version: 7.11beta2 (development) build-time: Jun/21/2023 11:39:58 factory-software: 7.5 free-memory: 591.3MiB total-memory: 928.0MiB cpu: ARM64 cp...

CTassisF

Is it possible to have WifiWave2 CAPsMAN Open AP with OWE transition mode? security.owe-transition-interface expects an interface, so I guess it is not possible to have this as a provisioned configuration profile?

Thanks

CTassisF

These images continue to work fine with my MikroTik devices (RB5009 (arm64) and hAP ac³ (arm)).

By the way, I recently updated the instructions above to reflect the new images available in Docker Hub.

Please let me know if you're still having issues with ctassisf/ripe-atlas-alpine.

CTassisF

Still cant download dockers/containers... "error response getting manifests: 404" This has nothing to do with the new authentication feature that was implemented in v7.8. Basically Docker changed how images are created and stored and MikroTik will have to update its container implementati...

CTassisF

Even after lots of fixes for certificates, still can't use IKEv2 EAP VPN tunnel to NordVPN servers . IIRC this has been happening since v7.7 betas. 20:01:45 info fetch: file "root.der" downloaded 20:02:45 system,info ipsec modecfg nordvpn added by cesar 20:03:40 system,info ipsec peer nord...

CTassisF

I have the same problem with my own build, all newly pushed to docker hub are the same error. if you pull from other linux os and upload to routeros, it works. Same behavior here: not working on RouterOS, but on macOS with Docker it works fine. I've opened a ticket (SUP-105409) but it was closed by...

CTassisF

Thank you! Fixed. Thanks! It is now fixed for mikrotik.com . But as @Larsa mentioned, there seems to be another issue with www.mikrotik.com . $ host -t A mikrotik.com mikrotik.com has address 159.148.172.205 $ host -t A www.mikrotik.com www.mikrotik.com has address 159.147.172.205 It seems that som...

CTassisF

Looks like mikrotik.com is broken for some clients. According to SSL Labs and Internet.nl the certificate chain is incomplete. Example using curl on Debian 11: $ curl --version curl 7.74.0 (x86_64-pc-linux-gnu) libcurl/7.74.0 OpenSSL/1.1.1n zlib/1.2.11 brotli/1.0.9 libidn2/2.3.0 libpsl/0.21.0 (+libi...

CTassisF

Since updating to 7.8beta2 I'm having issues importing remote container image zabbix/zabbix-proxy-sqlite3:alpine-6.0-latest on my RB5009 (arm64). It was working fine on 7.7rc5 . 16:43:05 container,info,debug importing remote image: zabbix/zabbix-proxy-sqlite3, tag: alpine-6.0-latest 16:43:05 system,...

CTassisF

I did not found on Winbox ou CLI the VRF attribute to l2tp-ether, eoip, ipip, gre.

https://help.mikrotik.com/docs/pages/vi ... edfeatures

CTassisF

The key type in the public key file is "ssh-ed25519" so I'm wondering if RouterOS is expecting something different. RouterOS added ed25519 support for *key exchange*. This can be set using KexAlgorithms option in OpenSSH. The key you can generate using ssh-keygen and you use to log in is ...

CTassisF

I'm not sure if this is related to any of the DNS issues reported above, but in 7.7rc4 I started getting intermittent "resolving error" while importing container images. If I try again it will eventually work. 05:06:53 container,info,debug importing remote image: zabbix/zabbix-proxy-sqlite...

CTassisF

what are you trying to achieve? I have a RB5009UG as my home router. I connect to the Internet via PPPoE and get my IPv6 block (/64) via DHCPv6-PD. I use NAT only for IPv4. All of this happens in the main VRF. I also have a Wireguard tunnel and I forward some traffic through this tunnel using a dif...

CTassisF

Hello @ggs331,

Did you manage to get this working?

I'm following the "Leaking routes between VRFs" instructions but it's not working for me, it never shows any neighbors.

CTassisF

My Samsung Galaxy S22 5G with Snapdragon 8 Gen 1 can't connect to my hAP ac3 running 7.7beta8 with WifiWave2 + WPA3 unless I set sae-pwe=hunting-and-pecking.

I thought this was fixed since v7.6 [stable], it is mentioned in the changelog, but still seems to be broken.

SUP-99820

CTassisF

What this quote was for? Removed

Thanks! Changing this config fixed the issue with iPhone + iOS 16 + WPA3.

CTassisF

Anyone seeing issues with WPA3 and iOS 16 (released today)? After upgrading iPhone 12 to iOS 16.0 it was unable to connect to wpa2-psk,wpa3-psk networks I have on my hAP ac3 running RouterOS 7.6beta6 with WifiWave2 package. Before the upgrade (iOS 15.6) it was connecting fine. After changing the int...

CTassisF

And, as I said before, it is working great on my RB5009UG+S+ using the configuration I shown.
it's a usb flash drive??
src=/disk1/

Yes. USB flash drive formatted as ext4.

CTassisF

this post https://forum.mikrotik.com/viewtopic.php?p=955911#p955095 previously done as you suggested, result does not change. I guess this was a workaround for when it was not possible to create folders/directories inside container mounts. It was a restriction on RouterOS containers that was fixed ...

CTassisF

Why are you creating duplicated, nested mounts for /opt/adguardhome/work and for /opt/adguardhome/work/data ? This might be your problem. Create just one mount for /opt/adguardhome/conf and another one for /opt/adguardhome/work and it should work. It is working here for me using this configuration: ...

CTassisF

This issue was fixed some time ago in 7.5beta4 so I guess it won't happen from now on. So when can I expect the fix to kick in? I did a couple of reboots after installing 7.5 (if not for other things to bring routerboot version up) and the message is shown every time ... my feelingnis that this fix...

CTassisF

Is this really so hard to fix? There is an option to retrieve the script being used at startup, I believe ? You should be able to see specifically what the error is about since the exact location has been mentioned ? It is probably the router trying to load the default configuration for /interface ...

CTassisF

Upgraded RB5009 and hAP ac3 from 7.5rc2 to 7.6beta4. No issues so far.

Containers, USB flash drive as external disk, WifiWave2... Everything working as expected.

CTassisF

remote-image=zabbix/zabbix-proxy-sqlite3:alpine-6.0-latest imported on mine 5009 without any problems. Sorry, my mistake. I was trying to pull remote-image=zabbix-proxy-sqlite3:alpine-6.0-latest instead of the correct remote-image= zabbix/ zabbix-proxy-sqlite3:alpine-6.0-latest . That is why it was...

CTassisF

Are you sure you provided the URL for the router's architecture? Yes. I tried on a RB5009 and this zabbix/zabbix-proxy-sqlite3:alpine-6.0-latest tag has linux/arm64 in it: https://hub.docker.com/layers/zabbix-proxy-sqlite3/zabbix/zabbix-proxy-sqlite3/alpine-6.0-latest/images/sha256-44a5cdd64302b2a0...

CTassisF

I'm seeing an error when trying to add a container using this remote image: zabbix-proxy-sqlite3:alpine-6.0-latest Logs: 23:25:41 container,info,debug importing remote image: zabbix-proxy-sqlite3, tag: alpine-6.0-latest 23:25:41 system,info item added by cesar 23:25:43 container,info,debug error res...

CTassisF

i think i got where it goes wrong. As a workaround currently you can after adding container start it, stop it and start again. Mounts should appear. we will try to fix this in next releases

Thanks for the workaround, seems to be working as expected.

CTassisF

i just tried locally - your veth configuration is invalid - you are missing bitmask to address, set address to 172.31.0.1/24 Thanks! Default route is working now that veth is configured correctly, but mounts are still broken. [cesar@MikroTik] > /interface/veth/print Flags: X - disabled; R - running...

CTassisF

I'm running RouterOS 7.5beta4 on my hAP ac³ and: 1- mounts still doesn't work for me; 2- I noticed that a default route is not being added to my container, even though gateway is defined in interface/veth . [cesar@MikroTik] > /interface/veth/export # jul/27/2022 13:49:44 by RouterOS 7.5beta4 /interf...

CTassisF

/container/mounts/ seems to be broken: you create a new mount but it does not show in /file/print or via FTP; not sure what happens to the data the container tries to write to those mounted paths.

Is this known? Will it be fixed in the next RC? Should I generate a supout.rif file and send a report?

CTassisF

moving from one ap to the other

The changelog says "roaming (802.11r) between local AP interfaces", so I guess it only works for interfaces in the same AP (like roaming from 2.4GHz to 5GHz).

CTassisF

Any progress on your configuration? Yes! I was able to make it work. Apparently to make it work you have to do both mark-connection and mark-routing: /ipv6 firewall mangle add action=jump chain=prerouting comment=prerouting-vpn dst-address-list=vpn jump-target=prerouting-vpn add action=mark-connect...

CTassisF

Upgraded my hAP ac3 from 7.3beta33 to beta34 and now it is boot looping. Will try netinstall.

Edit: successfully recovered using 7.3beta33 netinstall on Windows.

CTassisF

There seems to be a memory leak somewhere in v7.2rc7:

weekly.gif

monthly.gif

CTassisF

Every time I reboot my router this happens to all graphs (CPU, Memory, Interfaces, Queues): daily.gif This has been happening since v7.2rc4. I guess it might be related to my timezone because it's UTC-3 and the graph seems to be missing exactly 3h of data for every reboot. /system clock set time-zon...

CTassisF

I was about to ask why the container package is missing but then I noticed the changelog was updated.

Screen Shot 2022-03-23 at 11.12.44.png

CTassisF

WTF Mikrotik!! Erase the routing tables (/routing/table), leaving me with setting about 50 different routing-marks all who are all over the place!!!!! I also lost the single custom routing table I had after upgrading from rc3 to rc4 🤡 At least in my case it was easy to fix, but it took me a while t...

CTassisF

Has not worked since 6.43, what did you upgrade from?

IIRC it was working on rc3 (the version I was using before rc4).

CTassisF

pppoe-client is not being detected as WAN or INTERNET after upgrading to rc4. [cesar@MikroTik] > /interface/pppoe-client/print detail Flags: X - disabled, I - invalid; R - running 0 R name="pppoe-client" max-mtu=1492 max-mru=1492 mrru=disabled interface=ether3 user="xxx@xxx" pass...

CTassisF

(hAP ac^3 running 7.2rc1) I have properly working IPv4 and IPv6 networks. IPv4 is NATed, IPv6 /64 prefix comes from WAN (PPPoE) via DHCPv6 PD and it is then Router Advertised to my LAN. I wan't to route some of the outgoing traffic via a WireGuard VPN using NAT. To do that I've: - created a new rout...

CTassisF

Version 7.1 1638367647 was briefly released under the "testing" branch, but then this release was rolled back.

CTassisF

but how to point zerotier local conf ro it in the mikrotik router? You don't have to change local.conf to be able to run your own controllers. When you create a network in a controller, the network ID already contains the ZeroTier address of controller[1]. That way your peers can find the controlle...

CTassisF

v7.1rc5 broke /interface/wifiwave2/channel usage in wifiwave2 interfaces: [cesar@MikroTik] > /interface/wifiwave2/channel/add name=foobar band=2ghz-n [cesar@MikroTik] > /interface/wifiwave2/channel/export # oct/27/2021 09:22:16 by RouterOS 7.1rc5 # # model = RBD53iG-5HacD2HnD /interface wifiwave2 ch...

CTassisF

So, after all, if you take the time to contact support, make sure you provide a full repro and clear description of what you'd expect vs. what you get. I really thought it was the intended behavior, even though it did not make sense. That is why I didn't ever report this issue to them. I'm glad the...

CTassisF

*) dhcpv6-server - fixed "address-pool" default value;

I will finally be able to restore my full export.rsc without having to split it in two parts because of the historically missing address-pool default value.

CTassisF

How to explore and get files from container mounts now that they are stored as "container store" and not as directories/files as before?

CTassisF

Now that RouterOS v7.1rc3 supports running containers, I took the time to create a Docker image to run RIPE Atlas Software Probe on my MikroTik router. The image is based on the official code provided by RIPE NCC , with a few tweaks to make it run under Alpine Linux. Alpine is based on musl , not gl...

CTassisF

ZeroTier uses Salsa20 to encrypt and Poly1305 to authenticate packets. As far as I know these are (very fast but) software-only algorithms and can't be offloaded to the hardware for acceleration. Since version 1.6.0 ZT has new AES-GMAC-SIV encryption mode, which is supported in hardware accelerated...

CTassisF

A question about encryption: what about the hardware acceleration? All models that supports IPsec HW will offload ZT’s encryption? ZeroTier uses Salsa20 to encrypt and Poly1305 to authenticate packets. As far as I know these are (very fast but) software-only algorithms and can't be offloaded to the...

CTassisF

Please add support for ZeroTier Multipath and its various configuration options and policies: https://zerotier.atlassian.net/wiki/spa ... /Multipath

CTassisF

To me this looks more like a partnership between MikroTik and ZeroTier, Inc. https://twitter.com/ZeroTier/status/1432716935024848908 So I guess this is good for both players. And this might "guarantee" this package should not be left unmaintained in the future. But even if that happens (Ro...

CTassisF

Some minor bugs so far: disabled=no disabled=no [cesar@MikroTik] > /zerotier/export verbose /zerotier set zt1 comment="ZeroTier Central controller - https://my.zerotier.com/" disabled=no disabled=no identity="xxx:0:xxx" interfaces=all name=zt1 port=9993 wireless-default queue by ...

CTassisF

v7.1rc2 still doesn't know how to properly bring OWE interfaces up. How they were created: /interface wifiwave2 add configuration.country=Brazil .ssid="Guests" disabled=no mac-address=AA:BB:CC:DD:EE:12 master-interface=wifi1 name=wifi3 security.authentication-types="" add configu...

CTassisF

I will manage my VPNs on my own, don't need and don't want any external service for that. It is possible (and fairly easy) to run your own ZeroTier One controllers and use that to manage your own ZeroTier networks. There's even an open-source web interface (that mimics my.zerotier.com) somewhere on...

CTassisF

ROS v7 seems to have a much better default firewall configuration. Can you post output of /system default-configuration print (make terminal window real wide, long lines get truncated otherwise) for us to compare to contemporary v6 defaults? Apparently there is no change in the firewall between v6....

CTassisF

So far so good on my hAP ac³ with PPPoE, IPv6, WifiWave2, Hotspot, Web Proxy etc. Only issue I have (and I guess this issue has been going on since the first time I've tested 7.1 betas) is that RouterOS does not know the proper way to setup OWE (opportunistic wireless encryption) after a reboot. Bec...

CTassisF

Just upgraded to 6.49beta54 and I can confirm that the DNS cache issue is still present.

I was able to reproduce it using the same POC I provided to support (SUP-51096).

CTassisF

This often happens with things like PiHole where it returns a fake address of 0.0.0.0.

Actually from what I was able to reproduce and report to support it seems to be related to CNAME requests.
CNAME requests appear to be bypassing the cache (memory leak?) and increasing memory usage.

CTassisF

Regarding 6.49beta54:

No fixes for the DNS memory leak introduced in 6.49beta46?

Just asking based on the changelog, haven't tried it yet.

CTassisF

Is anyone having DNS cache issues with 6.49beta46 ? [cesar@MikroTik] > /ip dns cache print Flags: S - static # NAME TYPE DATA TTL 0 www.googleadservice... AAAA :: 0s 1 www.googleadservice... A 0.0.0.0 0s 2 cdn.taboola.com AAAA :: 0s 3 cdn.taboola.com A 0.0.0.0 0s [cesar@MikroTik] > /ip dns static pr...

CTassisF

Both 6.49beta36 and 6.49beta38 are causing kernel failure on my hAP ac^3 RBD53iG-5HacD2HnD.

Ticket: SUP-47971

CTassisF

So does that mean I should remove those particular subnets from the bad_ipv6_address address list? I think you don't have to. But it will make no difference if you remove those rules either. Those rules were removed because they are redundant, they are overlapped by the "defconf: ipv4 compat&q...

CTassisF

*) defconf - removed overlapping IPv6 firewall rules; Does anybody know what those rules were/are? Here's the difference between beta11 and beta22: $ diff -u routeros-arm-6.49beta11.npk/nova/lib/defconf/get-custom-defconf routeros-arm-6.49beta22.npk/nova/lib/defconf/get-custom-defconf --- routeros-...

CTassisF

If you disable watchdog automatic-supout will /export work faster? I guess that might work because the autosupout.rif file won't be generated, but I'm not on v7 right now to be able to test it myself.

CTassisF

Hello.

I have a hAP ac² running both frequencies (2.4 and 5GHz) with the same SSID.

Is station-roaming=enabled recommended in this configuration? Or is it more harmful than helpful?

Thanks in advance.

Search found 81 matches