MikroTik

infabo

*) device-mode - do not allow changing CPU frequency if "routerboard" is not allowed by device mode (introduced in v7.17); Really? Why? I can't upgrade one of my routers now because I have to arrange a visit to a data centre just to power the router off to enable the now disabled feature?...

infabo

I completely agree with you.

infabo

If you ask me, it would have been preferable to enhance the flagging mechanism rather than restricting previously available features by default. But now it is here to stay I guess.

infabo

please specify "bad performance of the network". Local networking or towards internet?

infabo

What's new in 7.17.2 (2025-Feb-06 11:10):

*) device-mode - do not allow changing CPU frequency if "routerboard" is not allowed by device mode (introduced in v7.17);

infabo

Let’s go through the device-mode changes one by one. The following features are now turned off by default: - traffic-gen: I don’t think most small business MikroTik professionals need traffic generation tools often. But there might be some use-cases in (automated) big deployments. - repartition: Whe...

infabo

Sure you can downgrade to certain versions.

infabo

I still use x.org - not wayland. So it is maybe not related to wayland especially. Rather a x.org thing when Winbox uses this x.org compatibility layer.
Oh, X11 scaling is scary... :-) Is this on i3wm by the way?

Yes, i3wm.

infabo

I still use x.org - not wayland. So it is maybe not related to wayland especially. Rather a x.org thing when Winbox uses this x.org compatibility layer.

infabo

@TenaciousD this is how it looks at my system as well. Since first public Winbox 4 beta. I even mentioned this early in the topic, but all was said was to wipe off dust off my screen. Glad to see someone else reporting this with evidence screenshot. I think this needs platform specific Qt rendering ...

infabo

BrianHiggins, I understand that this solution may not work for you, and that's completely fine. If you're encountering an issue, I’d recommend reaching out to MikroTik support to discuss it with them directly. If you’d prefer not to see alternative suggestions, you might consider avoiding public dis...

infabo

I've looked over to the CCR1072 topic. Could be hardware faulty. Best is to contact your distributor in such cases. Distributor usually has shorter response time usually. Or did you buy the ccr from Mikrotik directly?

infabo

your ISP maybe filters ICMP replies. your firewall filter does not have any drop rules on input chain i assume right?

/ip/firewall/filter/export

infabo

It would be very helpful if MikroTik consistently documented the minimum RouterOS version required for each feature. While this information is sometimes included, it is often missing. Having it in all cases would make it much easier to understand compatibility.

infabo

what is puzzling is that hAP ac2 is still sold and probably produced.

That is what I am saying: it may be still produced with this 16MB chips. No matter how many successors exist.

infabo

MikroTik Support thanked me for reaching out and for the report. They mentioned that they had reproduced the issue and were looking forward to fixing it in future RouterOS versions.

infabo

I share the same concern. The limited 16MB flash storage has been known for years, yet no new hardware revision of e.g. hap ac2 with more memory has been released. Furthermore, other devices like the 5G R16 are being launched with the 16MB chips, which is quite puzzling.

infabo

OP did not say from which ROS version updated from. Not saying by which method (builtin update, upload npks, netinstall). Not config export. Basically it is guessing at a high level what may have gone wrong.

infabo

I prefer not to go into detail regarding my observations and the test cases I used to reproduce this issue, as I believe it could be security-sensitive. Additionally, it is unclear whether this bug is limited to CPU frequency adjustments or if it represents a broader flaw affecting other device-mode...

infabo

I would recommend reaching out to MikroTik support for guidance. They might be willing to assist with troubleshooting. Enabling "lte,debug" logging could also provide more insights, but it’s important to know what to look for. Alternatively, the issue could be hardware-related, such as a l...

infabo

@tdabasinskas this is a bug IMHO. I have experienced this bug as well. I did came up with some test cases and reported them all to Mikrotik support this week. SUP-177436 Depending on your action sequence there is a high chance that rebooting (/system/reboot) reverts cpu-frequency back to "auto&...

infabo

Wondering. ROS should contain a cleanup command or something alike. And upgrade procedure should check for available space before even doing an attempt and cleanup junk when needed by itself. Instead it cancels with "not enough space" message. From 7.17.0 to 7.17.1 I lost another about 70k...

infabo

There quite a few things that need to be passed from cap to its capsman.

infabo

"traffic processing on CAP" means what it says: no traffic forwarding to CAPsMAN server.
The info-message was changed by 7.17.

Then I see continous traffic between the CAP and the CAPsMAN on port 5246.

Where or how did you measure/see this? What kind of traffic?

infabo

Color change is one thing, it was there in Winbox3 already. But an improvement would be to have some kind of diff/change view collecting all the pending changes so one knows what to expect when "OK" button is clicked.

infabo

@optio Seems like you already had reduced free disk space on 7.16 already. I too have container+wifi-qcom-ac installed and about 200kb free on 7.17.1 (was 270kb on 7.17.0). see https://forum.mikrotik.com/viewtopic.php?t=213941#p1119443 Unless you have stored some files/graphs on your flash, you can ...

infabo

Not sure what all the fuss is about ... Look for post in this thread with "RouterOS 7.17 BugProve Testing" as title. It's still there for everyone to see. Like I said, I (or MikroTik) would not have deleted it. It was a volunteer mod. To be correct, it was merged into this thread, not del...

infabo

No syn flood warning. I only saw a handshake timeout for WireGuard and a "VPN terminating" message for the L2TP connection in the log. I enabled debug logging for the IPsec and L2TP topics, but nothing appeared—there were no changes or additional debug output (watched the situation for at ...

infabo

I'm not sure, but since the upgrade to 7.17.1, neither my L2TP (IPsec) VPN nor my WireGuard tunnel to ProtonVPN are connecting. I hope this isn't directly related.

infabo

It is time for 7.17.1.

infabo

Remember how the authentication of winbox and MAC access was changed, to improve security, but the new method remains undocumented.

The question is: was the method before the "new method" documented?

infabo

there is an option to disable fractional scaling for winbox, you will then have to use winbox built-in zoom to make it bigger, but there will be no scaling issues due to Windows problems

That sounds like a solution. I would appreciate having this option to observe how it behaves.

infabo

teslasystems, this is what I call nitpicking above. If you use the screen at normal resolution, you can't see it. This is why yourself had to make insane zoom for the video, just to show it. I did not mention it before because I did not want to be the one who is nitpicking. But I have to give tesla...

infabo

Voluntarism works very well in a market economy. However, as Normis already mentioned, MikroTik does not take active countermeasures. Can you name another manufacturer that has voluntarily published both its bootloader code and comprehensive documentation for its devices? Just one example will suffi...

infabo

As a first measure or attempt, I would Netinstall the affected cap ac (with "keep-configuration" flag).

infabo

Not publishing bootloader specs is effectively the same thing as locking out You could go to the EU Parliament and propose a law requiring all manufacturers to make their devices fully accessible for open-source operating systems, including the publication of specifications and all relevant documen...

infabo

Why is device-mode even being discussed in this 7.18beta topic? As far as I can see, there hasn’t been a single changelog item related to device-mode in 7.18. It would make more sense to discuss this in the 7.17 thread or in a dedicated topic. A separate, well-focused discussion with significant att...

infabo

Between "Filter Rules" and "NAT" there is a different spacing compared to the other tabs.

2025-01-29_14-51.png

It also appears on other windows. Seems randomly.

2025-01-29_14-54.png

infabo

*) Table: Change to a custom font that has same-width numbers I don't know exactly how to say but I think tables are better to scan now. *) Performance optimization: Try fixing line glitches when using fractional OS app scaling Not performance, but a bug-fix for me. I do not have any random "d...

infabo

Just got Samsung s25 ultra and it doesnt want to roam(Older s23 roamed just fine), i get this in log. @Glavni_5GHz association rejected, FTE indicated that STA uses RSNXE, but RSNXE was not included. Is this related to 7.18 or something else i never saw such message? This message already existed be...

infabo

It would be beneficial to all to report these issues to Mikrotik support - instead on whining here. This is a community topic. Of course there will be comments like "I dont have this issue" just because this is not a Mikrotik support thread. It is a open discussion.

infabo

I think the difference is: wifi-qcom has driver support for VLANs built-in - and wifi-qcom-ac not. Thus the need to do it on the CAP bridge instead.

infabo

I can confirm. I also hit the cache size limit with very few entries. The cause in my case was a static "CNAME localhost" record. I got rid by using "A 127.0.0.1" instead. Still a bug IMHO. But i can live with the alternative.

infabo

When you are familiar with developer tools: check network tab for failing requests (4x or 5x status). I am curious. But it seems more likely that the login html document is already the source of issue. So you have a modified/customized login HTML markup somehow? Branding package or the like?

infabo

@zajDee Please clear your Browser's cache. This is the old login design. 7.17 webfig got a design overhaul.

infabo

I have just found a device mode bug. I was able to set routerboard "cpu-frequency" from "auto" to "768MHz". Then I wanted to undo it by "/undo". It did not undo unfortunately (even though it shows "R" as like it has undone the action - but has not). ...

infabo

viewtopic.php?p=1110235&hilit=ovpn#p1110235

It is added automatically. I removed that server (even though it is disabled) on my devices after upgrade to 7.17. It is just noise in config export otherwise.

infabo

It seems you've accidentally pasted your comment twice. That said, desktop application development (such as Winbox) and web development (like the Webfig redesign) are entirely separate disciplines from software development for embedded devices (such as those running RouterOS on MikroTik hardware). T...

infabo

Bugs are not documented 😉

infabo

Just two days ago, I suggested in the 7.18 topic that release features could be announced better. Now, two days later, there’s a great changelog video for 7.17. That must be a coincidence - you can’t make a video like that so quickly! RouterOS 7.17 changelog as a YT video: https://www.youtube.com/wa...

infabo

We dont even know what is wrong. Whats the output of

/interface/lte/monitor lte1 once

Consider downgrading to ROS 7.17 before doing factory reset. This is BETA.

infabo

Do you see errors in the log?

infabo

My Chateau LTE has been having some stability issues and seeing the improvements in this Beta release, i thought I'd upgrade. this went fine, then i noticed there was a modem firmware upgrade available, i did this also. now i cant connect to 3/4G. I noticed just now that my routerboard fw is still ...

infabo

We occasionally notice bugfixes for wifi-qcom-ac in the changelog, which is highly appreciated. However, it would be quite interesting to know if dynamic VLAN assignment is planned for implementation - be it even in the distant future. Do you mean VLAN assignment via RADIUS or Access list? datapath...

infabo

We occasionally notice bugfixes for wifi-qcom-ac in the changelog, which is highly appreciated. However, it would be quite interesting to know if dynamic VLAN assignment is planned for implementation - be it even in the distant future.

infabo

- ad unicast timeout: have you double checked the passphrase? Make sure there are no whitespace or special characters (e.g. because of copy+paste) anywhere at start/end of input fields. - ad dhcp lease timeout: looks like tp-link device wants to bridge the network. This may not work out properly as ...

infabo

I see messages like these:

2025-01-22_14-57.png

Already reported that postive signal issue for registration table in ROS 7.16 via SUP-170583. Now I see these numbers in 7.17 in logs again.

infabo

I understand it’s mentioned in the changelog, and yes, it’s still in beta. Similarly, the file share feature had its place in the changelog, but it wasn’t entirely clear what it was about until I saw a screenshot. Even stable channel releases often don’t provide much more detail than what’s written ...

infabo

yes, pe1chl is correct. check for updates command will read the package list from the server. you can install packages directly from the server now. no need to download them and upload them by hand. the list needs to be refreshed after reboot. That's a great new feature! I would love to see such fu...

infabo

Well yes OF COURSE "file share" function will open up 443 HTTPS from anywhere, it creates a public website with https on your router, which anyone can visit. This function is to create public download links for files, like this: https://hcf087skgys.routingthecloud.net/s/7DPKi3nJTFhJq3b Yo...

infabo

How this works? Has someone tried already?

*)  cloud - added file-share feature;

infabo

Maybe analogously to ipv4 fasttrack?

infabo

This release adds a lot of improvements. Mikrotik, very strong!

infabo

Why is manual steering configuration?

/interface wifi steering
add disabled=no name=steering-lan neighbor-group=dynamic-Home-WiFi-9a91126b rrm=yes wnm=yes
add disabled=no name=steering-guest neighbor-group=dynamic-Guest-WiFi-1c2b9b73 rrm=yes wnm=yes

infabo

This didn’t age well: viewtopic.php?p=966972#p966991

infabo

The new WebFig redesign has quite a few visual issues, especially in Safari. My skin file works fine as far as I see, but I’m scared to click around too much because I’m worried a wrong click might mess up my config.

infabo

It is RouterOS version 7.17 released in the "v7 stable" channel.

infabo

Just a guess, but regarding the triangular routing issue: NA9D, you mentioned having a Layer 3 switch configured with all your VLANs and your 192.x network. Is this switch capable of inter-VLAN routing? If so, it might help eliminate unnecessary hops and improve efficiency, as traffic between the VL...

infabo

Use the ROS built in update functionality. It updates to latest 7.12 first. Then it upgrades to 7.13. After that you can upgrade to 7.17 finally. More info can be found at help.mikrotik.com/docs

infabo

I guess you would never make an inplace upgrade of a MS Server 2019 to 2025 without testing, right? Certainly, there are admins who might attempt such an upgrade directly, but it's always a risk. Even on Windows, untested updates - such as Exchange KBs - can cause significant issues if applied with...

infabo

proceed here: https://mikrotik.com/support

infabo

I can’t even load a web page from a device on the second network.

Sounds more like another issue when not even loading a webpage works which hardware offloading - even when r5009 had it - wouldn't fix either.

infabo

Then please let me know which Amazon platform you're returning it to – maybe I can grab the RB5009 at a good price in the Amazon resale section. One person's loss is another's gain.

infabo

I’m not making excuses for Mikrotik, and I know there are better ways to approach some of these problems in software development. But the issues being discussed here—like kernel image space and hardware offloading, and similar—aren’t something unit tests can handle. These are integration issues that...

infabo

@wuspmikrotik
And yet, it seems that MikroTik is expected to know every possible scenario and real-world setup and perform functional tests to ensure that absolutely no one experiences any problems in their specific environment.

infabo

This is because many people wait for the final release to pull the trigger: "omg!!!!! it broke my xyz". instead of evaluating the testing releases ao Mikrotik can fix release specific issues before final version. I respect that you want to be a MikroTik beta tester, but in a network with ...

infabo

Arggg it seems like there are too many bugs in this version ... Yeah and some random guy here dreamed *THIS* will be a long-term, because it took so long... LOL This is a typical MT point-zero release, 3 steps forward and 5 back... The long-term is as far away as with the v7.0 release. This is beca...

infabo

OP has Chateau Pro AX. I would advise to upgrade to latest ROS for this pretty recent device.

infabo

When on ROS 7.17 and presuming the routerboot has the default boot mode "nand-if-fail-then-ethernet" then you need to do a physical button press to either change the bootmode( to something different) or power cycle while holding the reset button until the device boots into netinstall mode....

infabo

Maybe of help, for Mikrotik developers, here a finding on the "line drawing thickness" thing: - https://stackoverflow.com/questions/57057088/lines-thickness-changes-spontaneously-when-scaling-qgraphicsview - https://stackoverflow.com/questions/9777936/why-do-my-my-line-widths-looks-differe...

infabo

most likely these who is online stats have quite an impact because they often mean database queries.

infabo

We are speaking about RAM issue, not ROM. ROM has been solved roughly in 7.15, what I remember. Thank you for clarifying, Sit75. My earlier post wasn’t intended as a direct response to the RAM issue you mentioned. I’ve been monitoring free memory on RouterOS since version 7.13, and my recent observ...

infabo

Here my update on the "free-memory" topic for those interested and also managing 16MB devices. Before/after of 2 devices I just upgraded. td;dr: free space decreased. [user@router] > /system/resource/print version: 7.16.2 (stable) free-hdd-space: 556.0KiB total-hdd-space: 16.0MiB board-nam...

infabo

The outlines of a unticked checkbox should be visible in dark mode theme. Now there is just a blank space. 2025-01-16_15-57.png And this dropdown-menu icon is so small (even at 100% winbox scale) so it is hardly noticeable and has a very small click area from a perspective of usability and accessibi...

infabo

"Wireless" is fine with 7.17, but "wifi-qcom-ac" is crap, unfortunately. I have had long time open memory leak ticket SUP-147911 for hAP ac^2. This ticket has been closed without solution - but it is bullet proof the leak is related to "wifi-qcom-ac", because "wir...

infabo

I just discovered one bug. On Upgrade the timezone gets unset. It is now UTC instead of Europe/Vienna. "/export" is missing this line which was there in 7.16.2: /system clock set time-zone-name=Europe/Vienna edit: seems like this line from export is added or removed by the Cloud feature. A...

infabo

Finally! With important and great changes to "wifi" and many other areas. Keep up the great work!

infabo

That is the beauty and the curse of RouterOS - sky is the limit. But the "sky" here is the administrator @strods I completely agree. But this administrator needs the right tools to troubleshoot and analyze. On a regular Linux system one would just start by using something like ps/htop. Th...

infabo

Alright, that makes sense. I guess I was too naive.

infabo

We agree that they take up more RAM but then eliminate the SMB entry on these devices so that a stable version cannot go into Kernel Panic for functions that the manufacturer itself makes available, do you agree? That is not how it works. But I agree with, Mikrotik could improve memory reporting so...

infabo

Assuming that more than one request comes from each unique IP, implementing rate limits can at least help mitigate the issue. It would require someone with a strong dislike for MikroTik and control over an entire ASN to send, for example, 5000 requests using 5000 unique IPs.

infabo

I backed my most problematic router off from 7.16.2 to 7.15.3 and the BGP problems seem to have stopped. I saw some appear on other routers due to a bouncing session due to faulty BFD, and so I anticipate moving them all to 7.15.3 (BGP cores and reflectors). Thanks for confirming that! I was quite ...

infabo

We have found that some Windows (not WinBox) zoom settings cause it. Only happens at lower resolutions and zoom in windows settings, especially on large screens like external monitors. It's very likelty this is a Windows only issue due to scaling. We will see how to fix it. My screen resolution on ...

infabo

A load balancer like haproxy as a single measure wont improve the situation significantly. Worst case it would introduce all kind of other issues other than HTTP 500 we currently see - if done badly. I have no experience with phpbb itself, but from a quick google research it seems to have a redis ca...

infabo

I believe MikroTik could benefit from professional support or consulting regarding the operation and hosting of a web application. There have already been some suggestions in this regard. The forum is experiencing HTTP 500 errors almost daily. 2025-01-14_11-22.png There is a typo: it should be "...

infabo

Could this be a feature request? I miss the information we had in the old Wireless driver.

I placed this feature request at Mikrotik support last year. Sadly it was declined. Maybe it needs some more people requesting it.

infabo

wifi-qcom-ac is still rock stable in 7.16.2. At least here.

infabo

@teslasystems I have none of such issues with any other software on my device. So it is either a Qt-bug or the result of bad border calculation/settings only visible when doing "non-fractional scaling". I am at 108dpi and may be the cause. As this is not a integer-multiple of 92dpi. But 10...

infabo

@ruijzhan how does your partitioning look like? Better to discuss this further in a dedicated topic or contact Mikrotik support.

infabo

10.1. W (802.3af, radio off, only main chip and LAN working)

This is ridiculous. 10W for nothing.

infabo

This new table view. While I wasn’t a fan of the large padding in the "zebra table" view, I did appreciate the zebra-style itself, as it’s a well-recognized UI pattern. Removing this view entirely, without allowing users to toggle between the "classic table" and "zebra tabl...

infabo

I don't like these "thick borders" every few lines. Is this a rendering bug or on purpose (it looks ugly and distracting)?

winbox-table.png

infabo

I learned the "monkey test lesson" by enabling IGMP-snooping and multicast querier some months ago. It introduced extreme latency on my whole network I could not explain - just to finally determining these 2 bridge settings as the issue.

infabo

WHAT is not true?

normis made it quite clear what was not true. His comment also contains the answer to OPs question: "what happens when CHR 60 days trial is expired!"

infabo

Don't get me wrong, I really appreciate the detailed debugging effort. I am 100% sure it helped to identify and reproduce the issue. Especially it made EdPa look into it. But one remark; these statements were misleading: I just made some test with a hAP ac² running 7.16.2 using the normal bridge (no...

infabo

Tongue in cheek Chaos, of course you guys (real IT and not homeowners) are stuck with dealing with such stupid setups such as below: A use-case for such functionality would be for example when having two uplinks (eg DSL modem/routers) with conflicting IPs, that you cannot control/change their subne...

infabo

I would like to see another RC release before this 7.17 branch receives a stable release.

infabo

For hap ax3 - your device - you need to look at wifi documentation. you have already set country to Germany, so regulatory domain wise your already within allowed limits of your country. To reduce tx-power ("radiation") even more, you need yo increase antenna-gain value. this reduces actua...

infabo

This device should easily handle 600mbit/s or you really mean 600 megabyte per second? anyway, please provide a config export so community can help.

infabo

Script to disable all WIFI Interfaces with the name "AP-1stFloor-*"

According to your commands it is for wireless capsman and not for wifi capsman. so be careful with wording. "wifi" refers to the new /wifi/ menu since ROS 7.13.

A solution for wifi capsman would be neat.

infabo

As for the ticket system: there is a default filter to show only open issues in the list. you need to change the filter to "any status".

infabo

Yes, it is possible to login by ssh key.

infabo

I think the only working approach is to use "create-enabled" instead of "create-dynamic" provisioning rules. Then use scheduler on each device to toggle wifi interfaces. Maybe it is also possible to use the scheduler on caps an device to enable/disable specific caps an provisioni...

infabo

Most probably you'll need NAT.

/ip/firewall/nat/add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.254.0/24 action=masquerade

infabo

7.14.x is not known to have any security related issues. See for more info here: https://mikrotik.com/supportsec On the other hand, there are vulnerabilities not mentioned in the "security blog" at all. Instead Mikrotik silently fixed them. e.g. https://www.enricobassetti.it/2023/11/cve-20...

infabo

This discussion is focused on release-specific topics, such as questions about the changelog or issues related to this particular version. For general inquiries, please consider creating a separate topic to ensure they receive the appropriate attention. Wishing you a Merry Christmas!

infabo

No need to worry. "By default, bridge MAC address will be chosen automatically, depending on the bridge port configuration. To avoid unwanted MAC address changes, it is recommended to disable "auto-mac" and manually specifying the MAC address by using "admin-mac"." http...

infabo

yes, looking at wireless specifications. Lower rates operate at higher tx power.

"1MBit/s 26 -100"
https://mikrotik.com/product/cap_ac#:~: ... t/s,%2D100

infabo

I have no idea how clients decide which AP to connect to. I assume they evaluate beacon frames before actually connecting to an AP. The parameters they use to decide where to connect are probably different from device to device. But it is odd that some of your clients prefer AP with very weak signal...

infabo

@andyhenckel Now please create a supout.rif on each Netmetal AX. Send it to support@mikrotik.com. Thank you.

infabo

"address-list-extra-time" works in combination with "address-list" of static dns entries. It has no effect on these dynamic entries you printed. see docs on the topic over here: https://help.mikrotik.com/docs/spaces/R ... 748767/DNS

infabo

/ip service set telnet disabled=yes set ftp disabled=yes set www port=1515 set ssh disabled=yes set api address=154.59.207.138/32 set winbox port=1010 set api-ssl disabled=yes Not only change ports. Restrict access to all enabled services by IP address or network. Since you have not a single firewa...

infabo

the name literally includes the word "home" "The Dude" literally includes the word "dude". But how can a software be a dude? So please be serious: BTH is a product name. It could also be named "Phone to Home" and still be the same service. Wireguard and no re...

infabo

It is up to the individual to use it for business purposes. Some can live with outages. Like many people worldwide can live without electricity for many hours of the day quite fine. So: "Caution 4: While cloud services offer convenience and are free, their service uptime cannot be guaranteed.&q...

infabo

I'd like to suggest a public status page for Mikrotik services. So people don't have to flood forum and support helpdesk with all the same "omg, it is down" reports.

infabo

Indeed, works here again as well. Did not set up a Cloudflare DDNS though.

infabo

No need for +1 comments. You already have the attention by Mikrotik.

We have identified the issue and a fix is coming shortly.

infabo

viewtopic.php?t=213191

infabo

Nameservers are usually rock stable. But I have no idea of the architecture of this cloud service tbh. It is what it is: a convenient feature for home users or personal use. My opinion: don't rely on it for critical access or in commercial environment. It is out of your control.

infabo

Actually a short story. Thanks for letting us know. Now you can mark topic as solved.

infabo

thanks for necroposting. better continue here: viewtopic.php?t=213191

infabo

IMAP or POP? For IMAP there are sync settings. Usually you just need to sync message headers and not the whole message/attachments.

infabo

Well, thats one for the helpdesk, "feature request" inquiry.

infabo

As long as TLS 1.2 is still considered secure and ROS supports secure ciphers, I couldn't care less. Everything else is compliance BS.

infabo

if they dont use any of the common libraries like openssl, then it is maybe quite an effort for Mikrotik. They have to set priorities. Not laziness. We know ROS lacks many features and I guess support for TLS 1.3 is not crucial - now.

infabo

We don't know.

infabo

Because there is no urge for Mikrotik to support it. As long TLS 1.2 is not deprecated/discouraged as 1.0/1.1 - Mikrotik won't move.

infabo

It may be assisted by ChatGPT or just good old copy paste from google results.

infabo

7.16.2

infabo

In summary:
* connect-priority=0/1 seems to be mandatory for Intel based wifi cards

No. I have no such disconnect issues on my Intel AX200 devices (Windows+Linux).

infabo

Typical error. Asking how to solve brainfart instead of describing the problem to solve and get the real solution.
We don't know what OP wants to solve, but i suspect that a classical hashmap is what OP want.

infabo

regarding Fritzbox, have you tried:

"EEE (Energy Efficient Ethernet) in FRITZ!Box deaktivieren"
https://at.avm.de/service/wissensdatenb ... aktivieren

infabo

First time ever my cap ac (running wifi-qcom-ac) locked up yesterday (wifi stopped broadcasting, device not reachable). Needed to power cycle. Log only said "rebooted probably of power loss". What changed in 7.16.2?

infabo

yes, directly to customer support. https://mikrotik.com/support

infabo

It is not a bug. ed25519-sk is just not supported. Only recently the have added ed25519 support.

infabo

i like reading that kind of stories. The tragic hero, IT professional with decades of experience in rocket science IT. First time has to do Mikrotik and fails hard because of that Latvian vodoo. Then visits Mikrotik user forum to vent. The end.

Basically the boilerplate for many topics here.

infabo

I could not identify any request to this specific "CRL update" event until now. There are only TLS requests in the time frame. But I see other packets originating from the router itself toward some "suspicious" destinations (cloudfront,amazonaws,skewed.de, ....) where I dont know...

infabo

Since updating to 7.16.2 these CRL messages are going crazy: [ro@uter] > log/print where message~"CRL" 02:20:05 certificate,debug GENERAL: start CRL update 02:21:05 certificate,debug GENERAL: start CRL update 02:22:05 certificate,debug GENERAL: start CRL update 02:23:05 certificate,debug G...

infabo

Some of you propose hap AX2 for $80-100, but I do not need wifi - I want an even better price for equipment that can handle gigabit internet without major investigations. wifi-qcom is an extra package. Dont install it. No drivers - no radio. It is like saying: "I don't buy a 5 ethernet port ro...

infabo

there is even a curl to Mikrotik fetch converter

https://tikoci.github.io/postman-code-generators/

infabo

Mikrotik must have evidence of effectiveness. Otherwise they would not introduced this change in default configuration.

infabo

HEX refresh is a router. It does not even have Switching results in the Tests tab. So it is not primary intended to be a switch. Yes, it has a switch chip built in (EN7562CT) and can do HW offload. But again: It is a router.

infabo

Please introduce the possibility to disable workspace "auto-save". Why even auto-save is a feature at all? There is a "Save" button in the workspace drop-down list. Is the button there just for the sake of layout needs a button? I use a tiling window manager and I **hate** it whe...

infabo

These results are a pure consequence from having that ether1 port directly connected to CPU and not to switch chip. In case used as a router it would have to pass CPU anyway. An c'mon, with these few ports who would buy such a device as switch? You can buy dumb unmanaged switches in this form facto...

infabo

In that same config using ether1 as uplink, speeds go down drastically (peaking sometimes towards 500-600Mbps but rarely more, average 363 Mbp s). I can't believe. That would make this "refresh" completely use-less for anyone living in 2024. I'd like to quote Viktors from the YT video: ht...

infabo

I hadn't noticed that, but in any case, the Winbox 4b12 version isn't opening and is generating errors, and according to the changelog it should run on macOS BigSur. It's a shame that they discontinued macOS 11, because in some countries a new MacBook isn't that cheap. you can upgrade nearly any ma...

infabo

Look at the results for the 512 kbp packet size and there are basically your real world results. Just depends on your config as to what results you'd see. Thanks for confirming the advice I found earlier - to look at 512B column in the last line. Nowdays, Mikrotik has again created a device that ca...

infabo

"Ethernet test results"

https://mikrotik.com/product/hex_2024#testresults

infabo

I'd like to hear an explanation why this is the default behavior: If (accept-priority of AP2) = (hold-priority of AP1), a connection to AP2 will be allowed only if the MAC address can no longer be reached via AP1. This basically - IMHO - leads to unnecessary disconnect messages in log. Client is con...

infabo

I did search the forum to try to see what you are asking for, but there are no post about SUP-172111 SUP-172111 is the new ticket for a bug that was already fixed in the 7.15rc (SUP-151054): https://forum.mikrotik.com/viewtopic.php?p=1071424&hilit=151054#p1071424 It's back from 7.17beta: hAP ac...

infabo

Or, cheaper than throwing away 1,5k€ (it will end up as a keeper unless you offer it as an 1€ auction anyways): write to Mikrotik support and ask about the compatibility. You cant expect in a community forum to have the solution after one single day. https://help.mikrotik.com/servicedesk/servicedesk...

infabo

Isn't it related? I hadn't noticed that, but in any case, the Winbox 4b12 version isn't opening and is generating errors, and according to the changelog it should run on macOS BigSur. It's a shame that they discontinued macOS 11, because in some countries a new MacBook isn't that cheap. beta12 does...

infabo

I have a very bad experience with jumping to such high release versions.
........
I don't wanna risk it because there are over 300 subscribers connected to it.

Yeah, I would not risk either. As one subscriber I would even shoot you for rebooting this device in fc...g production!

infabo

ROS main package size increased in 7.17. But I think not more than around 200kb. On 7.16.2 it reports 765KiB "free-hdd-space". So not to worry right now. But Mikrotik needs to keep an eye on that. I hope 7.14 was enough of the trouble.

infabo

I disagree.

infabo

For me, specifically adding the connect-priority=0/1 (in combination with default settings mostl) made my Samsung S21+ and iPhone 11 roam without disconnecting first.

I would call this a workaround. Sort of. I don't know why "accept- equals hold-priority" is the default after all.

infabo

Also my laptop, which has the Intel AX211 is no longer giving me headaches.

Weren't you on the "My Mikrotik wifi6 works like a charm"-train all the time?

infabo

Because I have a "strong opinion" on Fortinet especially (as one of these "enterprise" vendors), here is my 2 cents - with ChatGPT "polite" filter applied. So please don't say it is ChatGTP made up. Enterprise solutions like Fortinet often come with their own challenges...

infabo

Always to complain

infabo

ROS 7.14 introduced a new queue type for ethernet interfaces on LTE devices (e.g. Chateau line). *) defconf - use "fq_codel" queue as default interface queue for wired ports on LTE devices; In "/system/default-configuration/print" it is implemented like this: /queue type add name...

infabo

/interface detect-internet set detect-interface-list=all Please remove that detect internet thing by: /interface detect-internet set detect-interface-list=none You already know where your WAN "lives". No need to detect and mess up your config with that crzy magic wand. You did not tell us...

infabo

No, not the same level. It keeps the attacker out for another 100ms or so. I hope this is just a sample TBH

infabo

@gjmelena what is your issue with create enabled? And regarding the free ticket system: Mikrotik uses a commercial ticket system: https://help.mikrotik.com/servicedesk/servicedesk And on case you wrote directly to support@mikrotik.com, this also be channeled to their ticket system IIRC. If you did n...

infabo

you could have opted for a cheaper device that does not have routing and wifi built in.

Name this cheaper Mikrotik device with built-in 5G support without the other bells and whistles (wifi, etc.)

infabo

Because OP is running an OpnSense firewall.

infabo

you can stick them upside down and tell your wife it stands for "W" like wife.

infabo

Try BTH.

https://help.mikrotik.com/docs/spaces/R ... ck+To+Home

infabo

Agreed. Do an export with sensitive so you have reference config at hand (in case there are some vpns or something important configured). then netinstall (with reset config) to latest ROS.

infabo

wifi-qcom-ac drivers may not be affected at all. No issue here as well.

infabo

this device should have a default firewall config. Maybe it is quick set as CPE or something - as these quickset profiles remove firewall rules IIRC.

infabo

wifi-qcom-ac for some also could work.

infabo

At least the wifi CAPsMAN config remains

infabo

about downgrades, there is ZERO logical reason to knowingly downgrade to a version with a known CVE, possibly allowing easy access to the device by a hacker. Zero. Do not try to find it. This is new to me ... that ROS upgrader has built in function to check certain ROS package against database of C...

infabo

@holvoetn look here: https://help.mikrotik.com/docs/spaces/ROS/pages/93749258/Device-mode#Devicemode-Featureclarification I've seen a response to a bug ticket this will be prevented later on. Until this I believe what on help.mikrotik.com is documented. "routerboard" restricts "system...

infabo

It is still possible to downgrade ROS as normis already explained. see https://help.mikrotik.com/docs/spaces/R ... edversions

infabo

The real question is: how many people - in teh real world - rely on traffic-gen, re-partition and downgrade to insecure ROS versions with known security vulnerabilities? Ok, the routerboot settings thing may be an issue for someone. But tbh: if you have the regular need to mess around with routerboa...

infabo

There is never a perfect world. But for certain device types, cloud provisioning these days is leading the way. There also needs to be local management. If we cloud provision, the device info and network/device password would be saved at an administrative level. We copy password and use it to acces...

infabo

Won't happen. It would be ridiculous to introduce security measures in stable branch while keeping "loose device-mode" in a long-term branch for another long period of time.

infabo

*) dns - fixed lookup order for static DNS entries (introduced in v7.16.1);

I did not know that there is an documented lookup order at all? Any details? Is this the problem reported here: viewtopic.php?p=1111498#p1111473 ?

infabo

Something I would ask support@mikrotik.com

infabo

Cloud device management is as secure as using cloud password vaults. Go ahead, there are many enterprise hardware vendors out there. I for myself chose Mikrotik, because they dont do (and obviously honestly dont believe in) that Cloud crap.
Sry for the offtopic post.

infabo

- Develop a damned cloud portal for us "enterprise" [IT/MSP/WISP/Enterprise/Professional] for us to manage and provision XYZ devices [Pro/Enterprise] type of hardware MikroTik develops. This would create the added layer of security

cloud and security. lol. keep your enterprise stuff.

infabo

yes, but why would you want to disconnect local radios again?

infabo

Depends on the Qt version. 6.5 LTS still supports macos 11. 6.8LTS support macos 15.

Well played. Finally Mikrotik tooling has to move with industry.🙀

infabo

PS: provisioning local radios is only needed once. They pick up changes as any other radios managed by capsman automatically.

infabo

you can use

/interface/wifi/radio provision

to provision you local radios according to your provisioning rules.

Thats it. Also documented. https://help.mikrotik.com/docs/spaces/R ... ovisioning

infabo

:::::::: Important notice. We are using the Qt framework, as you probably know, but Qt is dropping support for macOS 11 and earlier. We do need to upgrade Qt, to fix the known performance issues in Windows, slow log scrolling etc. People with older Apple computers than 2014-2015. will not be able t...

infabo

One disabled ovpn-server was/is always there - even if you do not use ovpn server at all. Configuration is upgraded and new server is created only if in older version at leat one parameter in server configuration was set by you to non-default value. Word. I am going to observe/check once 7.17 final...

infabo

See the changelog: *) ovpn - added VRF support to OVPN server (server menu now supports multiple entries and previous server configuration is automatically imported); That first OVPN server that you have is the default server, same as there was one before. I'd like to add this: This shows you the &...

infabo

And probably delete partitions is restricted as well.

Search found 2395 matches