MikroTik

pe1chl

Yes, but not me. Testing this requires a network of like 6 routers with tunnels between them and BGP running on it. So several locations with different IP addresses are required, 2 addresses at each location. We have that in production but we do not have a separate test environment that replicates i...

pe1chl

No, I don't have a test lab to do that.

pe1chl

Why???

pe1chl

absolutely. that script would need to have the lease variables exposed. The current DHCP scripts dont, you have to let the lease be created then match against it. The current DHCP lease script is called after an address has been assigned, which is fine when you want to use it to create a DNS entry,...

pe1chl

I suggested that too. In fact I think it would be very nice when a DISCOVER-phase script was added that gets all parameters from the DHCP packet and can decide which lease time, which address pool and which option set are to be used (or "none" to ignore the request). It would cover many sp...

pe1chl

It seems like BGP in general is a bit off the current attention hotspot... in 7.17rc there are no announced BGP changes at all, even though there are several new known bugs (introduced over the 7.15 .. 7.16 span) and of course some unimplemented features too.

pe1chl

Yes, that is quite low, my hAP ac2 runs with 1400 kB free at the moment, but it does not have wifi-qcom-ac installed. I noticed that the "Total HDD size" is now reported as 16.0 MiB while I am sure it was like 15.2 MiB before, so that has changed in some recent release. No idea if they rea...

pe1chl

On the other hand, it is not really MikroTik's task to work around the release and support cycle of other equipment... or the fact that people don't have money to renew the equipment they earlier have bought.

pe1chl

What you described, would following the dns list by order be somewhat similar? It would be a step in that direction in my opinion Somewhat similar, but not the same. Usually you get several alternative DNS resolver addresses from your ISP, e.g. in my case 4 (2 IPv4, 2 IPv6), and you would want to l...

pe1chl

Well, one can always wish for more advanced options. What I would like is to have groups of servers, and then at first the servers from the first group are used in some optimized way like I described, and only when all servers from the first group are failing to respond, servers from the second grou...

pe1chl

Causing a reboot just by copying a large file via SMB sounds like a big issue that should be fixed before reaching final. Well, for me it sounds like an irrelevant issue because a router is not an SMB server and the whole SMB function should not have been there... For me, the big problems in BGP sh...

pe1chl

Is there a reason using standard DNS, the in use DNS server always ends up being Cloudflare? No matter which order I put the servers in, the DNS in use always ends up being Cloudflare within a few minutes of arranging them. Or by running the dns leak test. Why is Cloudflare preferred over any other...

pe1chl

I have seen those issues in 7.16 as well: a single disconnected peer disconnects multiple or all peers at the same time, and routes via disconnected peers still appearing in the table. The first I was able to improve a bit by forcing all BGP handling into a single process (input.affinity=main output...

pe1chl

It seems that in the 7.16 (and 7.16.x) versions BGP has become unreliable. Today we had some internet outages and the backup route config I have used for a long time starting with v6 simply no longer works. I have noticed it before and tried different things but never got it working reliably anymore...

pe1chl

it seems that in versions 7.17beta/rc there is some kind of problem that is actively consumes space on a flash on my ac2, I successfully used 7.16rcX for several months without errors, but after updating to 7.17rc2, less than a day later, dozens of saving errors began to appear Did you check space ...

pe1chl

Maybe one of the outside-MikroTik users who have found detailed information about how the system works could reveal some detail about that. I would expect that RouterOS has some tables of available commands and options and directives for the GUI (webfig/winbox) which are used by the generic command ...

pe1chl

Next time partition the router and copy partition before upgrade, then you can simply revert by switching partitions as long as the device isn't completely corrupted... partitioning is a great thing, but... it is not available everywhere, I wish to have it for CHR, but again... but... but... but......

pe1chl

Ok I do not have that many peers on a 7.16 router. but I do see another problem: multiple routes to the same peer over different paths are not stored. do you see that as well? It worked fine before. E.g. we have peers with a GRE/IPsec, a GRE6/IPsec and a L2TP/IPsec tunnel (over LTE) between them for...

pe1chl

Next time partition the router and copy partition before upgrade, then you can simply revert by switching partitions as long as the device isn't completely corrupted...

pe1chl

What is that BGP+BFD problem? I have some BGP problems but not BFD related...

pe1chl

Indeed. But of course you can write a script, and run it at the interval you like, that checks if your smaller subnet is reachable in the route table, and when it is not it disables the blackhole route. That will cause the aggregated route to no longer be advertised. It was possible to do that witho...

pe1chl

Price Reduction Overhaul ??

pe1chl

Before I have suggested that sessions (now workspaces) would optionally be stored on the router itself. Of course there is the issue that the workspace is optimized for the resolution of the device and thus may be incompatible with another device, but still I think it would be useful when there is s...

pe1chl

I can't imagine any major internet operators and distributors that MK has never discussed with them about VTI support.

Well, I can understand that. VTI is not something that internet operators would use.
It is something for customers. To connect to their cloud virtual machines, for example.

pe1chl

Why is BGP not getting any love?
There are several known problems in BGP yet no release notes about improvements...

pe1chl

Yes of course it should only update to versions that have been "stable" for a long time, and without modifying them. At the moment, a "beta" is promoted to "stable" and that is when everyone starts installing it and the bugs appear all over the place. So such a "cr...

pe1chl

even in this forum there are people who are asking why they have unrecognized accounts and unrecognized scripts in their devices, that are calling traffic generator, configuring proxy etc. even forum users make mistakes and let in people they did not intend to let in. I still wonder how many of the...

pe1chl

As I wrote above, I would like some new "save as new item" which is easier to use than first COPY, save that copy, and then still have the original open. E.g. in PHPMyAdmin, which performs similar actions as modifying a RouterOS config, you can select a database row, do "edit", y...

pe1chl

But just editing the copied rule, and saving it directly as active without prompt, is one of the great attractors of the "oh no" events. Those, when we click the "ok" button and immediately think "oh, no". That would not be a problem because the copied rule is the same...

pe1chl

I don't see the advantage of creating an entry in disabled status. You can always click DISABLE when that is what you want. Main advantage is that when duplicate is created in disabled state, there's no way that it could disrupt anything. You can edit it and then enable. It cannot disrupt anything ...

pe1chl

I don't see the advantage of creating an entry in disabled status. You can always click DISABLE when that is what you want.

pe1chl

Maybe a nice new feature in winbox would be a "save as new item" button which allows you to start editing something (not only a firewall rule) and then at the end decide that you in fact wanted to do a COPY, edit, and APPLY/SAVE instead?

pe1chl

Duplicating same rule below the original would hardly disrupt anything. Other choice would be to make duplicate initially disabled. Actually, COPY does not create a new rule at all. It only copies the data from an existing rule in a new form, where you can edit it, and only when you click OK or APP...

pe1chl

+1... just generate a .png and display it.

pe1chl

I have a router with two internet connections, ISP1 and ISP2. There is a default route towards ISP1 in the main table, and additionally there are separate route tables for ISP1 and ISP2 with each a default route. There are mangle rules for prerouting and output which match on the statically assigned...

pe1chl

On Mac - If I copy an existing firewall rule, it is putting the copied rule right to the bottom of the list and not directly below it. I'm sire the previous v3 behaviour was to put it underneath but v4 is putting to the bottom. didn't half make me question myself earlier. Is this expected behaviour...

pe1chl

Up to a point. The botnet on that article was composed by high end routers (CCR1036, CCR1072, CCR2004, CCR2116). Those have no firewall or protections whatsoever - since they are professional models. Yeah, that's makes the focus on device-mode so ridiculous - when devices use insecure protocols by ...

pe1chl

Well, one thing is obvious: the issue you describe affects only you. Or else we would have seen many reports. I can only suggest that you /export your configuration ("/export show-sensitive file=anyname") and netinstall the router without default config and import that export connected via...

pe1chl

I think the intention was that with the new devicemode settings it would no longer be possible to change the "Boot device", not that an upgrade of the firmware would be blocked. Maybe auto-upgrade setting would need to be blocked, I'm not certain of that. But it isn't a good idea anymore t...

pe1chl

I agree, it would certainly be useful when there was some location (MikroTik or not) where one could pull ready-made containers for RouterOS for often requested additions! Especially when Docker containers are often only available for amd64 architecture, and may not be tailored to RouterOS use. Ther...

pe1chl

When you have advanced requirements you may want to consider winbox v3.

pe1chl

Incompatibilities between WiFi access points and clients are something that every manufacturer is fighting with... The users ask for new features, better performance, more security, etc etc but expect that all their equipment, no matter if it is a brand new smartphone or a simple IoT device with an ...

pe1chl

The addition of "detect internet" was an unfortunate decision some time ago, probably made in an attempt to make MikroTik routers easier to config (or even do full out-of-the-box automatic config). It basically failed to do so, and now what remains is mainly a nuisance. Unfortunately we ca...

pe1chl

They can easily roll out a OS version for the router and say that OS version xyz is the only OS supported for that specific device and the newer generations can use the NEWER versions of the OS that DOES include a SIMPLE feature like directory restrictions. I'd say that one of the very strong point...

pe1chl

The speeds shown in that screenshot are quite typical for the RB951G-2HnD.
When you are looking for high performance, get a new router with 2G+5G and AC or AX WiFi.

pe1chl

It's an easy excuse say "MT does not deal in file services" but the reality is that they DO offer File services on the router through the USB port and therefore if one service like SMB can implement it and PureFTP or ProFTP can all implement something like this, it stands to reason that c...

pe1chl

In that machine, can you turn power off in the server via ILO with the CCR2004 still powered via standby power?

pe1chl

This kind if "invalid" packets is caused by the connection tracking entry in the router already removed, and the system (or the remote) still sending related traffic. It can even cause leaking of internal addresses because in that case the corresponding NAT action isn't performed either. I...

pe1chl

Due to the number of fixes I updated from latest release 16.x to 17beta4. I am now seeing a lot (like thousands) of 'invalid' dropped packets on the firewall.

It helps to show a couple of example log lines. There are some different reasons why these appear.

pe1chl

For Mac users it started with macOS 11 about 4 years ago when this drastic "aesthetic user experience" change was introduced - item spacing on main menu bar and most window toolbars increased by almost 50%, most UI buttons lost their borders and all UI items lost their contrast. How this ...

pe1chl

Any new information/feedback from mikrotik regarding this?

Yes, they told me it is not planned.
At the moment, there is no plan to add this functionality,., but we will see if it can be supported in the future.

That was in june 2024.
And that has been the status for at least 10 years now.

pe1chl

Current situation is not usable for people doing mobile work on laptops - not even when laptop has high resolution screen. Ruining exsiting well-designed GUIs to unusable low-contrast no-borders style is the hype of today's design. Winbox is not even the worst example of that. And probably the moti...

pe1chl

I'm just getting very frustrated with the numberpad enter key being some sort of a clear command instead of enter. 'ping 192.168.1.5 numbpad-enter' clears the command 'ping 192.168.1.5 reguar-enter' works fine. PLEASE FIX It works OK here (on Linux). It may depend on the OS or the configuration. I ...

pe1chl

Unless you have a fast internet connection with a large subnet and a slow network behind that, it is mostly a waste of time.
You better spend your time on securing your services e.g. not putting services like SSH, telnet, RDP, winbox etc open on internet.

pe1chl

... or get a wider screen. On my 2560x1440 screen where I run winbox 3 at about 80% of the screen width, I have no issues with log messages.
And of course, it is always best to put log messages in files and/or on a syslog server as well, where you can go back in history, use grep to find things, etc.

pe1chl

Did you ever test that working on older releases?

pe1chl

How can i check the process tree to see what is taking up memory ? Unfortunately there is no user-level tool to show that (like there is for processor usage). MikroTik claim that they can see it in a supout.rif. Of course you can upload a supout.rif to your account at mikrotik.com to show the conte...

pe1chl

Instead of all these attempts to let the user find a clear spot, it would be better to have a spectrum analyzer that indicates signal and noise as function of the frequency (channel) and time, with some automated way to find the optimal channel.
(the competitor has it...)

pe1chl

Well, at some point I would have been very interested when this router provided: - running independently from the host box (i.e. RouterOS can be rebooted without host reboot, host can be rebooted and even shut down without effect on CCR) - support for VMware ESXi. At that time the intention was to p...

pe1chl

For this functionality to work completely reliable and predictable, you would want to have a "reload" function for the workspaces. As it is now, when you have two simultaneous sessions sharing the same session/workspace file, and you make changes in one session, it is somewhat unpredictabl...

pe1chl

Yes bgp loaded with large routes can make the whole router get stuck (freeze) , even supout failed to be created, so its hard to explain this situation with MT, happen in 7. 16.1 and ticket has been created and still no answer. To be clear: my issues have nothing to do with large route tables. They...

pe1chl

Would be nice if Mikrotik develops something like RB5009 but with only 2 SFP+ ports, one for Internet and other for local net that could be attached to SFP+ switch

Maybe a CCR2004-1G-2XS-PCIe in a case? (not sure if that board would work without being in a PCIe slot)

pe1chl

The best solution for blocking sites is to realize that it isn't possible to do it at the technical level and has to be done at user policy level. "you get internet on your workplace and you are not allowed to use it to stream youtube for background music and video, if we find you doing that yo...

pe1chl

I have encountered a case before where the Qualcomm datasheets indicates a capability for a chip, but the MikroTik product using the chip does not offer it. The "LHG 5 ac" uses the IPQ4018 which according to https://www.qualcomm.com/products/internet-of-things/networking/wi-fi-networks/ipq...

pe1chl

Yes there sure are terrible issues with BGP in current releases, but it is difficult to debug them. This week I had a case where one BGP peer connects, routes are received OK (remote is RouterOS v6 so none of that stupid "routes are sent only after one keepalive timer" rubbish), then after...

pe1chl

Block Diagram is available:

It was added after the above remarks were made... but IPsec test results not yet, maybe they appear next week.

pe1chl

Stretching for a use case, I suppose you could use this to create semi-airgapped small LANs off a big PoE core switch, as in a hotel where you want a small number of wired ports at the work table, without letting each room's users see devices in other rooms. THAT is their use case! Pop-and-Mom ISPs...

pe1chl

Not too long ago, I had the opportunity to visit Mikrotik's office in Latvia on behalf of my company. I was welcomed by an official representative of Mikrotik, and the first thing he asked was about what we needed, what equipment we would like to see on the market, and what suggestions or ideas we ...

pe1chl

The "hEX refresh" does not have IPsec test results, ... Not to downplay the importance of publishing IPsec results ... but lately they are becoming increasingly irrelevant. Most people are moving towards wireguard (and alikes), which AFAIK doesn't use IPsec HW offload. Maybe you and most ...

pe1chl

The "hEX refresh" does not have IPsec test results, unlike its predecessor the RB750Gr3 which had quite impressive IPsec performance for its price and position in the product line. Does this mean "hEX refresh" does not have IPsec acceleration, and the "twice the performance ...

pe1chl

I have a ticket open since Jul 23 with ID SUP-159987 so you can also refer to that.

pe1chl

Please add the source IP to the message "ipsec,error payload missing: SA".
(the address where the packet was sent from that triggers the message)

pe1chl

Please add the source IP to the message "ipsec,error payload missing: SA".
(the address where the packet was sent from that triggers the message)

pe1chl

So I wanted to add WPA3 to SSID 01 for testing. I tried to apply WPA3 via sec1 to it but for some reason it wouldn't apply the setting, i tried several times and restarted the router a few times as well. In the end the only way the WPA3 setting would apply was by doing it via each wifi interface ma...

pe1chl

t will override the selected security item. Some day I am going to file a feature request at Mikrotik support: "highlight overriden config values in export in different color". Or as a dedicated option in "print detail" or something. I've seen so many exports and always there ar...

pe1chl

It seems that there is difference between security. And SSID (on purpose?). I would always make one item (per SSID) in /interface/wifi/security and use that on all interfaces. Because when specifying security items on /interface/wifi explicitely, it will override the selected security item. When yo...

pe1chl

You do not need VTI to solve that problem! Simple GRE/IPsec tunnels and automatic routing will do it. Yes, and when you want to buy a new car, don´t do it. Buy an horse-drawn carriage you can reach your destination also. Sorry, but it makes no sense to always repeat 'use GRE/IPSec' when remote site...

pe1chl

Well, it is not surprising (to me) that it does not work. Maybe there has been a strange workaround in the network code that made it work before and is now removed? It is completely normal in Linux that the byte order is "wrong" when you look at the bare 32-bit address that way, at least w...

pe1chl

I did not test that yet, but is it really so that in the $ip variable a 32-bit numeric value is returned instead of a dotted quad string? And you could convert that to a string by adding 0.0.0.0 to it? I would expect a function like inet_ntoa() to be required for that conversion. The IP address will...

pe1chl

Depending on what type of router you use (16MB flash toy or one with sufficient flash) you can also configure partitioning so you can always switch back to the previous install without hassle...

pe1chl

Could we get address lists similar to interface lists where you first define a list and then add items to it? The ultimate goal is the ability to nest address lists. This could simplify my configurations immensely. That sure would have been better...and not only for address lists. But it seems that...

pe1chl

My routers do not receive internet routing tables but only a couple of local networks (company networks routed over VPN), but the problem is the same. It for sure is not related to large routing tables.
I have support ticket SUP-159987 open for it since 23/Jul/24 but there is no real progress...

pe1chl

What I suggest is "default" automatic update configured in devices as they come from the factory. In principle, everything is great: the “new” device should, for example, first be connected by the WAN port to the switch or current router and the firmware should be updated. After that - co...

pe1chl

Honestly - do you know many home users who would ever update their router firmware at all? Any manufacturer. I haven't met any. And about the “forced” automatic update. Nobody ever suggested “forced” automatic update. What I suggest is "default" automatic update configured in devices as t...

pe1chl

pe1chl, automatic updates mean for the vendor: more, more and much more testing. You cant push out another "stable release" when there are millions of devices out there potentially to turn into bricks. As I explained in the previous iterations of this topic: there should be a separate cha...

pe1chl

I get the need to dial some things down, but for already-deployed devices, there's got to be a compromise. This affects far more devices than the partition issues do (hundreds vs. dozens for me, anyway). To be fair, I think Mikrotik is listening. The recent change on partitioning shows this. They w...

pe1chl

The issue described in https://forum.mikrotik.com/viewtopic.php?t=207022 has become much worse in 7.16 (BGP sessions close when another session closes) In previous versions it appeared to affect only BGP sessions with the same local IP, now it sometimes affects ALL sessions... When a peer on L2TP/I...

pe1chl

Well, after all that time there still are only two categories of ISP here:
- those that provide each customer with a /48
- those that do not have IPv6 at all.
So I would not want to claim "it became a norm".

pe1chl

I hope at some point some scheme will be found where users upgrading to new versions can keep the features they already had, while newly installed devices need the device-mode setting to get access to those features. (e.g. one of the many schemes proposed where one could set device-mode shortly afte...

pe1chl

@baragoon do you also notice during your debugging that the routes displayed are sometimes completely different from actually installed routes?
Or do you only use commandmode and no winbox? (probably it does not happen in commandmode)

pe1chl

!) device-mode - after upgrade, mode "enterprise" is renamed to "advanced" and bandwidth-test, traffic-gen, partition (command "repartition"), bootloader and downgrade features will be disabled; So that means /partitions/activate (changing active partition) will after ...

pe1chl

Even for the useful RB750Gr3 there is now an announced replacement with 128MB flash! That I didn't know! Where is it? Great news, finally we are leaving the 16MB behind! There is a video on the MikroTik YouTube channel: https://www.youtube.com/watch?v=Zrzq_zPWoQ4 But it is not yet on the products l...

pe1chl

I fully agree! Every time a new feature is added, something else is broken, and we need another cycle to get that fixed. And all that while ready solutions with the same functionality already exist. The only work that would have to be done is the configuration interface -> mapping to configuration f...

pe1chl

It seems to me that Mikrotik would be better of stop trying to develop everything in house and use some opensource software like unbound/nsd for common tasks especially if they are licensed under some non prohibitive license like BSD in case of unbound...

+1

pe1chl

unbound is a recursive resolver. not an authorative dns. It has some limited features in that regard. The features are similar to what the current built-in MikroTik DNS resolver has, plus it can resolve from root servers. (and it supports DNSSEC, and it has a test suite, and it has developers who k...

pe1chl

unbound does not fit into 16mb flash by far. look at the unbound distroless docker images. The binary has at least 4mb+. given microtik has a lot of stuff developed in house (I am pretty sure they dont use any popular ssl library for example). It is all a matter of their limited storage they have o...

pe1chl

container and run whatever you like.

Except then you have no configuration user interface.
Still, it would be nice when someone with container experience would make a container with unbound for RouterOS.

pe1chl

Display of the routing table (IP->Routes) in Winbox (3.41) is quite unstable. After route changes have occurred (by BGP), the displayed routes often are just plain wrong. Nexthop is wrong, Immediate gateway is wrong, AS path is wrong. When winbox is closed and re-opened, it is correct again for that...

pe1chl

so we're far from a "real" DNS server. And, I'm sure others have their own DNS grips. MikroTik should offer "unbound" as an optional DNS resolver package (that replaces the internal one when installed), much like in v6 you could install an optional NTP client/server that would r...

pe1chl

It seems it is quite unstable in 7.16 Arbitrarily, BGP links just get 0 prefixes. Also, the route display in winbox 3.41 is often wrong after the topology has changed. AS Path and Immediate gateway just show bogus results, and after Exit and Re-open winbox they are different. Sometimes when IP->Rout...

pe1chl

Yes...I just used it as an example of a system that has issue tracking, threaded discussions. You do realize you don't have to post the source to track issues/feature requests and voting/discussions right ? There is already a system for this at https://help.mikrotik.com/servicedesk/servicedesk just...

pe1chl

It seems the physical dimensions of the unit are quite well-used.
If the performance of the antennas is optimal for this size is less easy to derive from photos.
But I can assure you that when you have an antenna that performs optimally at some physical size, shrinking it will ALWAYS make it worse.

pe1chl

Of course you should no longer buy devices that have only 16MB, it will be a dead-end. As long as there is no smaller variant of the CAP AX, people will continue to buy the CAP AC. The fact that smaller designs are possible is demonstrated by competitors. You can install AX hardware comparable to t...

pe1chl

We had MT officials here claiming several time it's to much effort for them to improve on this. So that's how it is and it will hardly change. I believe that, like any other company, Mikrotik is doing everything possible to achieve success. They are also targeting large enterprises with core networ...

pe1chl

Nothing stops anyone from stopping at 7.12 - I do in fact, until 16MB can be replace or netinstall'ed. On existing devices, yes. But when you buy new stuff, at some point it will come with a higher version and not allow downgrade. Of course you should no longer buy devices that have only 16MB, it w...

pe1chl

I am having same problem. How do I get the correct files for windows 7 ?

Upgrade Windows. The program is not compatible with Windows 7.

pe1chl

I can see it still MTs mangle route marking behave like [lookup] fallback to main if it can't find route it is looking for. leave ipv6 for now, just clarify one thing, why above example working two different way? what am i missing? I don't understand what you mean with "if it can't find route ...

pe1chl

Concur, OP is confused or trying to follow to many guides and not really understanding what is being done in them. is there anyway to specify [lookup-only-in-table] in the mangle? MT's default behaviour is [lookup]. i want (scenario 2) to [lookup-only-in-table] not [lookup]. In version 6 it was [lo...

pe1chl

*) bgp - fixed corrupted as-path when received update with empty AS_PATH attribute (introduced in v7.15);

Are you sure this problem has been completely fixed?
I am still seeing corrupted AS-PATH in a setup with mixed iBGP and eBGP... probably will try to switch to exclusive use of eBGP.

pe1chl

We are running a number of MikroTik routers in a central office and branch offices. There is a partial mesh of tunnels between the routers (branch offices all connect to central office but there are some tunnels between branch offices). Sometimes there are 3 tunnels between the same routers: one GRE...

pe1chl

We don't buy the toys that have only 16MB for business! And I (and others) have argued a lot against them. When I first bought MikroTik stuff it was devices like the RB2011 and I immediately partitioned it. Only later things have gone downhill with all those 16MB devices and the issues they caused (...

pe1chl

It looks like someone at MikroTik, maybe as part of a security meeting, has decided that there is a real risk that someone would obtain admin access to a device and then would want to have even more capabilities and would achieve that by downgrading RouterOS. While that undoubtedly has happened some...

pe1chl

Rough timeline for v7.16 beta1 to v7.16 release was from June 5th to September 24th. Beta period can be considered grace period. I think you don't understand (just like you pretend to not understand ANYTHING in this matter) what a grace period would be. A useful grace period would be some time wher...

pe1chl

above quoted line from the manual > "you can use the "save config" button to copy it over to other partitions."" this can be done without any device mode changes, limitation only is applied to manual re-booting to other partition, if main one is still working You cannot &qu...

pe1chl

Yes, that is also why I suggested that the device-mode settings are made available earlier than that they are enforced.
But Normis plays stupid and pretends he does not understand...

pe1chl

No, that is not true. The DNS resolver processes the entries from top to bottom (like the firewall) so you can have that config. I checked with the support: regexes are indeed processed first. Therefore the *\.home\.arpa$ regex of type NXDOMAIN will override non-regex entries regardless of its rela...

pe1chl

pe1chl, why is this so hard to understand? your complaint is about routerboot settings My complaint is NOT about routerboot settings!!! My complaint is about new device-mode settings that disable existing features that can only be re-established with physical access. In particular: routerboot setti...

pe1chl

/system/device-mode/update partition=yes expected end of command (line 1 column 28) you cannot. 7.16 does not know about device-mode "partition". Are you serious? I am directly answering your question about bootloader settings. If you are not interested in real answers, only trolling, you...

pe1chl

Success: CRS326 upgrade from 7.13 -> 7.16 Took 4 minutes before switch started pinging again. But you could upgrade your 7 year old switch to newly developed software in 2024! For most manufacturers your device would have been end-of-life with no new firmware releases, and at most a fix for a newly...

pe1chl

And even if it would exist: you would need to press button or power off. hahha

Well, at least we could plan that as a task to be performed during other visits to each location in the months before the upgrade.

pe1chl

It seems like nobody complaining about "bootloader" device-mode flag. Well, I don't really like that either. When I want to netinstall a device that is not completely dead, I use "try-ethernet-once-then-nand" mode to force it to go to netinstall, instead of fiddling with the but...

pe1chl

It looks like torch uses features like "connection tracking" to show source and destination of traffic, and the source and destination address actually refer to the side that has made the L3 connection, not to the L2 traffic you are torching. As such, it is difficult to predict what will b...

pe1chl

Sorry I am a bit unclear about something regarding device mode. Is/will it become mandatory to use: device-mode is an existing feature that was introduced a couple of versions ago, and it provides a global enable/disable of features that are deemed to be "dangerous". Its most apparent use...

pe1chl

No, that is a bug. It is not related to the logging, it is just that you now see what is happening.
Ever since using v7 connected to v6 I have seen those issues...

pe1chl

That is not a bug, that is a feature of scaled displays. When you scale a single-pixel line by 150%, what else is it supposed to do than randomly making it 1 or 2 pixels thick?

pe1chl

@normis. This is not " your baseless complaints". Sorry to hurt your filings with my opinion as customer, to your new product. Well, it is baseless when it is a complaint about winbox functionality, as winbox is just a GUI on top of RouterOS functionality. I certainly see how MikroTik cou...

pe1chl

Does that also result in a BGP disconnect? In case BGP is running with 180s hold time it may be that the BGP session survives during the restart of a tunnel. In my case the downtime is too long for that (it is caused by scheduled restart of a 5G gateway to cover the daily change of IP by the mobile ...

pe1chl

Well, that whole "it will reboot to change the setting" makes the whole thing even worse than it already is. Not only is it required to physically go to each router, and to connect to the CLI and issue the command and press the button, but also it will cause an interruption in the network ...

pe1chl

The message shown on CLI is quite clear and does not leave room for interpretations: update: please activate by turning power off or pressing reset or mode button in 4m27s Maybe for you? For me that is not clear. When I press reset or mode button, it will activate the setting. But will it also rebo...

pe1chl

So how about adding a kind of " grace period " for post-7.16 updates? The newly introduced device modes could be activated without physical interaction for a period of something like 24 hours after that update. If no action is taken in that time the modes become locked, just as they are n...

pe1chl

I don't know what you understood. In simple words: any change you make to device-mode settings can be either commited/confirmed by pusing reset-button or a cold reboot. Well, I should mention that I was quite surprised the first time when I confirmed a device mode change with pressing the reset but...

pe1chl

Upgraded to 7.16 and now it has become much worse...
When a peer on L2TP/IPsec disconnects because their public IP has changed and they re-establish the L2TP/IPsec session, I have observed several times that all BGP sessions (15 total) go to Idle state and have to re-connect.

pe1chl

The issue described in https://forum.mikrotik.com/viewtopic.php?t=207022 has become much worse in 7.16 (BGP sessions close when another session closes) In previous versions it appeared to affect only BGP sessions with the same local IP, now it sometimes affects ALL sessions... When a peer on L2TP/IP...

pe1chl

I fully agree! I think that when an existing feature requires a new device-mode setting after an upgrade, the corresponding device-mode should be automatically set as part of the upgrade.
Only on new devices or after reset-to-defaults, a new device-mode regime should become active by default.

pe1chl

Normally, partitioning works like this: you set the number of partitions to 2, the device will reboot and now you see 2 partitions, one is your running system and the other one is empty. Then you highlight part0 and choose "copy to" part1. After that you have two partitions that are the sa...

pe1chl

I sure hope there will be a clear explanation of what happens to existing devices that use those features, for all reasonable existing device-mode settings. E.g. in my devices, the setting is "enterprise" and on some of them "container: yes". After I upgrade to 7.17, will my part...

pe1chl

Support personnel told me it wasn't possible in Winbox 3.x (suprises me...), and it would have to wait until a new Winbox is developed.
But now that there is a beta of Winbox 4, it still doesn't work!

pe1chl

Yes, in case you can have the same config on all your devices and can get them in a deployment center where they are experiencing their first powerup, that is an option too.

My remarks were mainly target at the issue of cloning an existing config into the new, more powerful device you just bought.

pe1chl

ofca, I understand your concern, but if you do not have any kind of backup access to these devices, how are you recovering in case of some failed upgrade? An alternative to push-button is cold reboot (power cycle). In case of some failed upgrade, I use "partitions" to recover. But you are...

pe1chl

If someone is port scanning you then it's not really legitimate is it. You did not understand!!! When the VPS at IP address a.b.c.25 is scanning for ports and you block a.b.c.0/24 you also affect the legitimate webservice running at address a.b.c.86 that has nothing to do with the portscanning. You...

pe1chl

The firewall rules that I have added to catch such traffic still have hits, so I doubt it has been fixed...

pe1chl

My experience with this is that you will soon block subnets from cloud VPS services that host both legitimate webservices and "researchers" (or hackers) that use the VPS to scan for open ports. So your rules will surely block /24 networks but after shorter or longer time you will get compl...

pe1chl

I don't think we will get any further with that issue when people report it only like that.
Either make a ticket at the support system including your supout.rif or post the (possibly anonymized) export file.
I have several routers running 7.16 both at home and at work and I have not observed this.

pe1chl

You cannot do that from filter lists.
It also is not a good idea, in general.
You may inadvertently block legitimate traffic!

pe1chl

That will not fully work anymore, as more and more devices use DoH and DoT to "work around" such admin intervention.
Also, users use "VPN services" to work around it.

pe1chl

No, that is a bit lacking in MikroTik RouterOS, there is no easy way of cloning configurations. You can do an export to file and remove all config that has MAC address in it, and edit it so it can be imported to other devices. But you need to study what config is already present on those (default co...

pe1chl

Not again something with the special character replacement in filenames?

pe1chl

Would be great if MikroTik had rDNS for DHCP clients, I miss being able to identify the clients making requests to my Adguard Home server. You can add a script that will be run when the DHCP server issues a lease, and in that script you can add a static DNS entry. Some people have done that and pub...

pe1chl

No, that is not true. The DNS resolver processes the entries from top to bottom (like the firewall) so you can have that config.
Of course the syntax of the wildcard record is wrong, it should have been: .*\.home\.arpa$
(it is a posix regexp which is different from the common filename regexp)

pe1chl

My RouterOS 7.15.3 was upgraded to version 7.16, and DNS functionality encountered issues: 1. Upgraded from version 7.15.3 to 7.16 using the /system package check-for-upgrade by winbox. 2. After the automatic reboot, an autoupgrade was generated, but the DNS dynamic servers were empty. However, bot...

pe1chl

*) health - removed board-temperature on RB5009UPr+S+IN device; why? Well, I noticed that the value is ridiculous. On most devices it is higher than CPU temperature, one one device even 10 degrees higher. Probably someone has researched that and concluded that the circuitry is wrong and the value c...

pe1chl

you will have to enable this feature with the button or a cold reboot (power unplug), then you can switch partitions again Sure, I got that... But devices are remote and I do not have physical access... Definitely something to be handled with care. I agree that this is BAD. I always put a second pa...

pe1chl

Hi We have updated all routers to 7.16 since Wednesday. Now we have the problem that the routers hang up after a while and no longer allow connections. The only thing that helps is a restart. Both CHR version and hardware such as RB5009UPr+S+. Does anyone have the same problem? No, don't have that ...

pe1chl

Ok thanks. But please also explain if "short circuit" is an undesirable condition for the router, or if it can just be in that state forever without any risk of damage, overheating, etc. I understand that the name gives an idea, that something is wrong, but that is literally what it is. A...

pe1chl

I wonder, as there are some hints about this in the release notes. Is Bridge IGMP/MLD snooping when using VLAN working now? It was broken until 7.15.1, especially when using IPv6, multicast packets got dropped by the bridge breaking RA and IPv6 autoconfiguration. Indeed I had issues with that, but ...

pe1chl

I had not, and now that I have upgraded it (from 7.15.3 to 7.16) the red warning indeed disappears. Thanks for the hint. What remains confusing is that in the log it says "ether5 detected poe-out status: wait_for_load" which is fine, but in the ethernet interface table it still says "...

pe1chl

@pe1chl Did you also upgrade FW on that device ? I've seen a similar report, I think, which was solved when fw was upgraded. I had not, and now that I have upgraded it (from 7.15.3 to 7.16) the red warning indeed disappears. Thanks for the hint. What remains confusing is that in the log it says &qu...

pe1chl

I have upgraded a couple of RB5009UPr+S+ routers (the PoE model) and I observe that on outputs that are configured for "auto on" but have a normal (non-PoE) device connected, a red " poe status: short circuit " is now being displayed in the interface->ethernet window. There alway...

pe1chl

That is only a "proposed standard" Proposed? Wow... You don't know what it means? Read RFC 2026. And why other recursive engines implement that? Are bind, unbound, knot, and others wrong following those recomendations? Anyone can implement it, but it is not mandatory. Maybe with regex in ...

pe1chl

That is only a "proposed standard", one of several that were made with the same objective. When you want to use that domain and don't want to leak it you can easily configure that yourself using a static record in the DNS resolver. What Mikrotik probably should implement is DNS forwarders...

pe1chl

".home.arpa" DNS queries are still being leaked to the WAN network and is not conform to rfc8375. Can it be fixed ASAP please? That is only a "proposed standard", one of several that were made with the same objective. When you want to use that domain and don't want to leak it yo...

pe1chl

What type of router do you have? Is it a CHR?

pe1chl

Please add to the "Before an upgrade:" section:
4) when upgrading a CHR, check that it has at least 1GB RAM allocated, and increase RAM before attempting upgrade.
(see SUP-161771)

pe1chl

Sorry, in my case I upgraded from 7.15.3 to 7.16

You need to file a bug in the support system: https://help.mikrotik.com/servicedesk
(when posting only here in the release topic it will probably not be noticed... unless a flood of such reports comes in)

pe1chl

I have downgraded to version 7.15.3 and still the same problem That is not an answer to the question above. Did you upgrade from 7.15.3 to 7.16 or did you try 7.16x versions in between? (beta,rc) There have been changes to PoE and they affect the programming of a PoE controller, downgrading does no...

pe1chl

When I wanted to juggle the wlan names in my 4011 (apparently the defaults have swapped) I noticed an issue with WDS. I don't use WDS, but there are two fields "WDS default cost" and "WDS cost range" that may be new. In the physical interfaces they were set to 100 and 50-150 resp...

pe1chl

All my static leases for other Mikrotik devices got messed up after update to 7.16. Switches and APs .Looks like the MAC on the bridges got reset somehow.

I don't see that issue here. MAC on bridges is still the Admin MAC that was set all the time (I think defconf now sets it as well).

pe1chl

*) dhcpv4-server - added matcher ability to match substring; It would be even nicer when the matcher could match other DHCP request fields than options... E.g. the requester's MAC address. I would like to put IEEE-assigned MAC addresses in a different pool than Locally assigned ("random")...

pe1chl

*) dhcpv4-server - added matcher ability to match substring; It would be even nicer when the matcher could match other DHCP request fields than options... E.g. the requester's MAC address. I would like to put IEEE-assigned MAC addresses in a different pool than Locally assigned ("random")...

pe1chl

The Dude has always been more or less in that status.
It would be better when it would be released as open source, so MikroTik would not have to work on it anymore and still it could be developed by enthousiast users.

pe1chl

In a reasonably configured company environment, running exe files from the download folder is not allowed...

pe1chl

According to changelogs (https://mikrotik.com/download/changelogs), development tree should be at 7.1rc7. That page is wrong. development is the same as testing now. Talking in account the quality of the releases, beta-versions should first got to development channel. RCs should go to testing chann...

pe1chl

It is very unlikely that an issue that affects clients with a certain manafacturer of wifi interface and a certain authentication protocol is caused by hardware issues on the AP side. This is 99% sure a driver issue. But, when we deployed a large WiFi installation using the competitor's (in the same...

pe1chl

More RCs increase the probability that 7.16.0 will be reasonably stable. I think this is better than having to wait for 7.16.1 or 7.16.2. In a critical environment you will have to do that anyway, as 7.16 will get much more exposure than any of the beta or rc releases and new problems will inevitab...

pe1chl

I have both a hAP ac2 where from the beginning wlan1 was 2GHz and wlan2 was 5GHz, and the 4011 where that always has been the other way around. It already caused problems when pasted my 2011 config because that had only 2GHz which was of course wlan1, so had to edit that config to wlan2. But now it ...

pe1chl

After upgrading my RB4011iGS+5HacQ2HnD from 7.15.1 to 7.16rc4 I noticed that apparently the default name of the wireless interfaces has been swapped. I am using the "wireless" package (with both versions) as I need the 2GHz WiFi to work. Until now, the wlan1 interface was 5GHz and the wlan...

pe1chl

As Winbox 4 is based on Qt... shouldn't it be possible to have more flexibility in theming/appearance compared to old platform? Yes, I would think so. Ideally there would be the capability of loadable skins like with Firefox. Lacking that, there should at least be the possibility of a "custom&...

pe1chl

Well, I have wished for a long time that one could select a sub-queue in a queue tree based on the value of the packet priority field, instead of only on a packet mark, and it never happened. It should be possible as the "tc" command in Linux can do it, and it would save another step in pa...

pe1chl

All those manufacturers that make the routers that ISPs supply with the 1Gbps+ internet connections they deliver today. AVM, Arcadyan, Linksys, etc etc etc. Those are all CPE type routers. My main concern and use case is for Service Provider BNG's, terminating hundreds, thousands or tens of thousan...

pe1chl

The point is that when you use constructs that allow you to process a single stream of information in multiple threads, and also you need to guarantee that the processing is done in sequence, you are only wasting effort on thread synchronization that is not made up for in the increased performance o...

pe1chl

This "software based offload" looke like multithreading to me in this case... Multithreading is often not useful in these cases because at least a single connection will have to be processed in sequence. I.e. when you have a single PPPoE client connected to your ISP via a single network i...

pe1chl

I think we may be talking about different use cases.

Which other manufacturers and products are you comparing Mikrotik to ?

All those manufacturers that make the routers that ISPs supply with the 1Gbps+ internet connections they deliver today.
AVM, Arcadyan, Linksys, etc etc etc.

pe1chl

What is that even supposed to be, "software based offload"? What we have now is a situation where PPPoE client is handled in software. The ethernet frames are received just like IP, and then the PPPoE header is stripped off in software. It looks like this causes some load on the CPU limiti...

pe1chl

Is it also on the todo list to have the service (and other services, e.g. NTP) on more than one VRF?
(like /ip dns set vrf=vrf1,vrf2,vrf3)

pe1chl

Yes, the problem is related to XCB, but the component that issues the error message is the XCB handling module of QT. You can find it here:
https://github.com/qt/qtbase/blob/dev/s ... window.cpp

pe1chl

At home where I use a local X server it works OK, but at work I use a VM as Linux workstation via Xtightvnc (an X server that provides a "tightvnc" server that I connect from the Windows machine) and an issue occurs: Whenever I make a window larger, beyond some size it no longer re-draws, ...

pe1chl

You don't need to export it. Just find the old WinBox3 directory and move the files to the new WinBox4 directory and your saved routers will be shown. Import/Export is not needed in this case, as WinBox4 does not yet have any import button. But it is only the list of routers, not the saved sessions...

pe1chl

+1 for PPPoE. My CCR2116 maxes out at around 900MBps on my pppoe uplink.

And/or support of the hardware-accellerated PPPoE that some chips support (even low-end ones)...

pe1chl

The big problem with the VRF construct in RouterOS is that most of services that support VRF only support a single VRF. That may be OK for something like a management interface that you would want to have only on the management VRF, but for services like DNS resolver or NTP server which you would wa...

pe1chl

It means "listen for DNS queries on vrf=mgmtvrf", right? It does not determine where DNS queries are sent. Of course the right solution would be to have multiple DNS resolver instances that can all be set up differently... Even without VRF, I may want to have different external DNS servers...

pe1chl

Interestingly, the same request is pending at the competitor for at least 3 years...
Start wondering if it may be technically difficult or impossible to get that information on the AP side...

pe1chl

Version 7 does not do that anymore so that cannot be the cause... Anyway, that still is contrary to what the TCP RFC says. 'destination unreachable' should only terminate a new connection (SYN state), but when it occurs during a session it should be treated just like a timeout (no ACK received). Whe...

pe1chl

Are there any plans to make the disconnect timeout settable? I would like to be able to keep a winbox session connected even when a remote router is unreachable for a minute or two (up to 3). That can happen when BGP re-routes failed links, when WiFi links change frequency due to DFS, or when a remo...

pe1chl

JSON and XML are just examples, I could have named INI format just as well.
The point is that I want to be able to view, diff, repair, store in a version control system, etc etc.

pe1chl

Suggestions: - make the state files (settings, addresses, workspaces) human-readable e.g. by using JSON or XML format instead of binary This you and probably others suggested many times for years in Winbox release topics. It did not find an 👂 as they still opted for their proprietary binary Format....

pe1chl

Suggestions:
- make the state files (settings, addresses, workspaces) human-readable e.g. by using JSON or XML format instead of binary
- make the location of workspace files configurable, including having files sent to the managed router itself (as a file in the flash)

pe1chl

I can't login to MikroTik with Woobm USB stick.
UPD: Woobm has always worked terribly

I think Woobm was a short-lived product that did not meet up to its expectations, it has been discontinued and probably is no longer really supported...

pe1chl

> Linux distribution users wish for better distribution methods (unclear, many say current way is OK!) I am dubious about "many" saying it "is OK!". You have to open the terminal and navigate to the extract location, to run the binary manually - this is definitely "not OK&q...

pe1chl

Make sure you check if and how long they will be supported... "UniFi AP AC" is an ambiguous product designation, and some of the products with a name resembling that are out of support. Probably can be had for cheap.

pe1chl

Good side: It does look modern I think that is the worst disadvantage. It is the same as in Windows: Windows UI visibility and usability peaked in the Windows 2000/XP days. Then it was easy to use, it had good contrast, and it was tweakable when you did not like things like colors, border width, et...

Search found 12554 matches