MikroTik

pe1chl

Everything will be back to normal after upgrading RB firmware to 7.18beta. Not possible on CHR. Simple reboot does the trick as well (just verified on wAP AC). There is no "issue", it is the new normal. It says it shows the available packages after a "check for updates", and app...

pe1chl

On this above, what modems/devices support these eSIM commands?

Most likely some device that still is in development...
We can still hope there will be more 5G client devices :-)

pe1chl

TLDR: ROS DNS forwarder should not switch upstream DNS server just because a single request was answered with status SERVFAIL, because SERVFAIL not necessarily indicates a problem with the specific DNS server. A "good" way to handle this (this is how bind9 does it) is to keep a rolling av...

pe1chl

*) system - added option to list and install available packages (after using "check-for-updates");

Oh that is great! Have been asking for that / suggesting it for ages...
Now get on with it and split off some niche functions/applications into separate packages again!

pe1chl

In CLI Responder parameter for Wireguard peer renamed to "responder" and was "is-responder" in previous versions. So some exported configs will produce syntax error You should understand in general that while RouterOS does automatically convert configuration when you upgrade (an...

pe1chl

hI, In dark mode, why text is in gray and not white, it's not enough contrasted for some people. I think, there should be a separate color settings window, that will allow to select a color for each interface element (fonts, backgrounds, lines, headers, window titles and so on). It's hard to fullfi...

pe1chl

Is anything required for these commands to function after reboot or am I supposed to enter them each time after reboot? I suggest you first use the default settings, make your self familiar with RouterOS a bit more, maybe read some of the docs, and once you know the answer to such generic questions...

pe1chl

It would also be great if there was some layer 2 filtering (aside from ARP) for WAN port, but EBTables is LAN-only and doesn't filter WAN. You can just add another bridge, put your WAN port in it, and move the WAN port config (IP address etc) from the WAN port to that bridge. Then you can apply bri...

pe1chl

Yes, but who has installed 7.17? I probably never will...
Before that, an admin user could set the "try ethernet once" mode and reboot, but even then it would not work on a typical internet connection (at least here, it is all PPPoE)

pe1chl

Ok but even with a flat L2 network the "hacker" must be in the same L2 space (which means at the ISP or maybe in the same street in some cases) and it cannot be "a Russian hacker" (over here the media think that all hackers are Russian) working from home.

pe1chl

You can only set comments on static entries.
So that presumes you have entered those ARP entries manually.
Having them set by the DHCP server ("add ARP for leases") does not count, because then the ARP entries are still considered Dynamic even when the lease is static.

pe1chl

What is wrong with using "bridge filter", which probably indeed will map to ebtables, for that?

pe1chl

It can only be an issue when: - your WAN is actually a plain L2 link to the ISP network and there could be someone on the other side who can connect a machine with netinstall to that - they already know your credentials so they can log in to your router and set "boot ethernet once" and the...

pe1chl

upgrade failed, free 9 kB of kernel disk space First they have to figure out what does this message actually mean... Maybe on some devices there is a separate partition for /boot ? That used to be required/customary on some Linux filesystems or disk devices, to guarantee that the boot code was alwa...

pe1chl

Due to a chip issue which reports board temperature MikroTik decided to remove this parameter from health. The questions was "WHY?" What is the chip doing to cause this decision? Sometimes the reported board temperature is ridiculously high, I have seen that in one of our devices (while o...

pe1chl

Well, I still hope there will also be some unique message code ("topic") for each and every different message that can be logged by RouterOS. As it is now, there are too many different messages grouped under the same topic, and filtering is difficult. (also because the system logging rules...

pe1chl

Thoughts anyone? EoIP is a connectionless protocol, there is no "connection that is closing". However, as with any tunnel protocol, there is the risk of creating a loop where encapsulated traffic is again encapsulated. Maybe the circumstances have changed due to the version upgrade, like ...

pe1chl

Wow... And how about me that, using semantic versioning as a reference, I was thinking that Stable could mean that the software manufacturer should only release as stable code that is free of any known bugs. I think I'll review a little more about versioning standards. It would be desirable when it...

pe1chl

"v7 stable" NOT STABLE. Remember that "stable" in software releases means: "here you have a version that will remain for a while, we will not release a new version every week or two, so you can install this and won't have to update it immediately". The stability refers...

pe1chl

Such a message can also mean that the router is very busy doing something else or the link to the router is slow.
Apparently when the connection cannot be established correctly it will issue some generic message.

pe1chl

I tested on a debug router but it isn't really a viable solution. There are messages logged but they all have topic route,debug,calc and there is no specific message about the recursive route that goes up/down, only information about the reachability of a specific address occurring somewhere in a ch...

pe1chl

Still I think it is a shame that there is total silence from MikroTik about the BGP issues, both on this topic and from support. (I have an open ticket) I wouldn’t go as far as calling it a shame, but it is certainly irritating. Let’s hope for the best and that it gets fixed soon. Perhaps if someon...

pe1chl

I backed my most problematic router off from 7.16.2 to 7.15.3 and the BGP problems seem to have stopped. I saw some appear on other routers due to a bouncing session due to faulty BFD, and so I anticipate moving them all to 7.15.3 (BGP cores and reflectors). Thanks for confirming that! I was quite ...

pe1chl

But does that include up/down messages for routes with check-gateway? I am asking this in the context of this topic, i.e. using recursive routes with ping check to implement failover. Failover seems to work but one never knows if it is happening... Indeed I fear that this topic will include all kind...

pe1chl

Please consider to offload "filter" to the router instead of handling it in the UI. When selecting a filter, all the items are still downloaded from the router and then locally filtered. Instead, the items could be fetched from the router specifying a filter condition, and only the relevan...

pe1chl

There is now a new winbox in betatest but I do not know if it has improvements in this area. I agree with you that the route display in traditional winbox does not work correctly now, not only it can really load the router but also it sometimes lags in what it displays compared to what is really in ...

pe1chl

I would like to have logging of state changes of routes with "check-gateway".
I.e. when the state of these routes changes (up to down or down to up) a message is logged with at least the dst-address, gateway, and routing-table.

pe1chl

I would like to have logging of state changes of routes with "check-gateway". I.e. when the state of these routes changes (up to down or down to up) a message is logged with at least the dst-address, gateway, and routing-table. Right now, it is largely invisible how failover solutions like...

pe1chl

I would like to have logging of state changes of routes with "check-gateway".
I.e. when the state of these routes changes (up to down or down to up) a message is logged with at least the dst-address, gateway, and routing-table.

pe1chl

@EdPa is there any chance that SUP-172111 will be fixed before the stable release? hAP ac2 reboots itseft with SMB transfers also with 7.17rc7 ( more info ). Thanks Unfortunately I confirm that it is due to a hardware limit (low RAM) of the hAP ac2 and not a problem of ROS 7.17. SMB works perfectly...

pe1chl

Well, there are even bugs in the basic BGP function, confirmed by others and some by MikroTik too: - when a BGP session closes, at random some other (or all) session closes and has to be re-opened - when a BGP session is established, no routes are exchanged until the keepalive timer elapses for the ...

pe1chl

/interface bridge
add admin-mac=E1:E1:E1:E1:E1:E1

Your admin-MAC is invalid!
The lower bit of the first byte must be zero.

pe1chl

@oskarsk is there anyone working on the BGP issues at the moment?

pe1chl

well it seems we have 2 groups of people... 1 that needs specific features which is only possible in new versions and other group that has all they need and just want stability.... there is no right answer here... Then there is people caught in the middle. We upgraded all our routers to 7.16(.x) an...

pe1chl

But on the RB5009 since the beginning I have been unable to turn on the IGMP Snooping feature, and not only because of the VLANs. Turning it on and IPv6 RA/ND stop working. I had such an issue for quite some time on one of my devices, a hAP ac2 used as a second AP in bridge mode, and at some point ...

pe1chl

I learned the "monkey test lesson" by enabling IGMP-snooping and multicast querier some months ago. It introduced extreme latency on my whole network I could not explain - just to finally determining these 2 bridge settings as the issue. I configured IGMP snooping on our work network (swi...

pe1chl

It could be considered a lesson "do not enable each and every feature just because it looks cool"...
DHCP snooping can be useful in large networks with access for guests and other BYOD equipment, but on a home network it really isn't worth the (potential) trouble.

pe1chl

I have always wondered why the IP fragmentation code in network stacks splits a too-large packet into a maximal size packet and a small remainder... IMHO that only increases the risk that further fragmentation is required further down the path when another smaller MTU is encountered. Back when I mai...

pe1chl

Did you by chance upgrade the Unifi application to version 9.x? I see others reporting RADIUS problems for that version, unclear what the problem is.

pe1chl

But as I understand it, this mode is not compatible with wpa3-psk? PPSK functionality relies on a weakness in WPA2. It is not possible in WPA3. (you will find that it is not available on other manufacturer's devices either) A better solution for this functionality, which works with WPA3 as well, is...

pe1chl

When tracing to a file in ramdisk, I noticed that in the Files window in winbox the size at some point is shown as 252.6MB and the file date no longer changes, but when stopping the trace and downloading the file it is a 329MB file. It appears it was a "one time" fluke. Probably it would ...

pe1chl

When tracing to a file in ramdisk, I noticed that in the Files window in winbox the size at some point is shown as 252.6MB and the file date no longer changes, but when stopping the trace and downloading the file it is a 329MB file. It appears it was a "one time" fluke. Probably it would ...

pe1chl

As I wrote above, it used to be available but apparently it was pulled. And I can understand why. Fortunately, here the fiber providers mostly provide the PON in a NTU box that converts fiber to RJ45 ethernet. You can connect your own router where you have to configure PPPoE over VLAN. The only thin...

pe1chl

That is not called asynchronous, that is called asymmetric! No idea why so often people make up the term asynchronous for "different down and up speeds", it really has nothing to do with that. Back to the "MikroTik and PON" topic: there used to be a MikroTik PON SFP, but it is no...

pe1chl

When tracing to a file in ramdisk, I noticed that in the Files window in winbox the size at some point is shown as 252.6MB and the file date no longer changes, but when stopping the trace and downloading the file it is a 329MB file. I removed the file and restarted the trace to see if it is reproduc...

pe1chl

You need to make room or netinstall that device to clear leftovers from previous versions. Well, "out of memory" probably refers to RAM, not flash. A netinstall can be tried, but it seems more likely there is a memory leak in one of the components he is using. Or due to a script e.g. that...

pe1chl

PON is used to limit the amount of equipment in street cabinets, which reduces costs. It also allows some overbooking of the local access capacity, e.g. the ISP can offer several multi-GBit user connections over a single XG(S)-PON. PPPoE is often used in networks where the access network allows subs...

pe1chl

Yes. But highlights the need for better communication about their roadmap. i.e. If they giving up on the US market, that be good to know – none of new LTE products have US variants. The new cAPax+LTE is actually a nice offering – but worthless here, just like all the previous new LTE devices for pa...

pe1chl

Are we getting yet another offtopic monologue in the Newsletter topic?

pe1chl

Maybe for some of those fast internet connections a device like the CCR2004-1G-2XS-PCIe as a standalone router (2xSFP28 + 1xGbe) would be useful... could be used with a suitable switch depending on the user's requirements. Unfortunately it is not clear if the CCR2004-1G-2XS-PCIe could function in a ...

pe1chl

a hAP AC2 is not a NAS!

pe1chl

Ok I just wanted to make sure that it is not a simple issue related to the fragmenting of packets... I use UniFi APs with EAP and RADIUS, but not with MikroTik usermanager (I use FreeRadius). I would not expect that IP fragmentation would be a problem. Long messages are quite usual in these scenario...

pe1chl

Make sure that you don't have some firewall somewhere that drops the 2nd fragment of the transmission because it does not have a valid UDP header (with permitted ports in the firewall)....
Can you send a long ping to your APs? (without "do not fragment" option, of course)

pe1chl

Next time, partition the device (2 partitions), and before you upgrade copy the active partition to the other one. When the upgrade fails, select the other partition as active and reboot and you have your original version and config back. (when it does not boot at all, you can powercycle it during b...

pe1chl

When you want the best WiFi performance in a home router, MikroTik is not the place to be. The usual suppliers of ISP routers like AVM have more attractive products for that. Usually the plain (NAT)routing of those devices is faster than all but the most high-end MikroTik routers as well. When you h...

pe1chl

It would be nice when there was a list of known problems in a stable release, possibly later updated with new known problems introduced with the release. There could be a link to a webpage that has such info and that is updated when new issues are recognized and planned to be fixed, in what version....

pe1chl

Another problem with the ISP's router is that it has no WiFi power management. Normally I set it to the minimum.

MikroTik does not have that either!
In fact TPC (Transmitter Power Control) is mandatory on DFS channels, but almost nobody implements it.

pe1chl

The problem with spectrum is that they don't make it any more. There is a fixed amount, and it has been allocated to all kinds of services. While some services can release it, e.g. where there were microwave links between towers for professional use like telephony and TV distribution that now largel...

pe1chl

The 6GHz band actually is even more troublesome than 5 GHz...
Over here it allows only very low power, outdoor installations are prohibited.
(of course for the same reason: it was already licensed to other users)

pe1chl

You cannot make such blanket statements. It entirely depends on the country and the ISPs. In some places that were behind on broadband internet, fiber has been deployed to all homes and sometimes is offered at very low prices to consumers. In other places where broadband was deployed going along the...

pe1chl

Hopefully there will be a round of BGP fixes in the 7.18 betas so we have something to look forward to...
(there is of course no hope for the bugs to be fixed in 7.17 as there isn't any bgp changelog line...)

pe1chl

While perhaps the older ac chipset cannot directly handle VLAN in hardware... It is a nice try, but the UBNT accesspoints I use at work use the same QCA9984 chip as is used in older MikroTik AC hardware, but it fully supports VLAN assignment per client... and I don't think that would be a software ...

pe1chl

CRS = switch. It has routing capabilities but not much. You're most likely looking for CCR then. And then prices go up up up. E.g. CCR2004-16G-2S+ 16 Gb ethernet ports, 2SFP+ cages, PLENTY of power. No Wifi. No passive cooling. I do have a CCR2004-16G-2S+ in use at work, and maybe I would consider ...

pe1chl

The whole VLAN stuff still s*cks! Any reasonable WiFi network has the capability to assign a different VLAN to each client either via RADIUS or via access list rules. The AP network interface has to support tagged VLANs and the connected clients receive the assigned VLAN untagged, and that should no...

pe1chl

First 2.5G switch has been released already a year ago. 8x 2.5Gb ethernet and 2x SFP+ ports. Not fanless though. https://mikrotik.com/product/crs310_8g_2s_in 10G switch, fanless: https://mikrotik.com/product/crs304_4xg_in Well, what I do not like about the switch products is the relatively small nu...

pe1chl

MikroTik isn't really in 2.5G yet. Yes there are some devices with a single 2.5G port and an SFP that can do 2.5G, but what you really would want is a device like the 5009 but with several 2.5G (UTP) ports. And probably some switches too. And then for the router probably with wireless as well. They ...

pe1chl

That is "source address selection", it applies to outgoing packets (originating from the router) that do not have an explicitly set source address. What the topic is about is "the logging to network ignores the specified source address, that must be a bug". But I agree with @rpla...

pe1chl

No, I don't have a test lab to do that. I do. if you're interested in cloning a sanitized version of your configs, I have four RB5009's and two CCR2004's racked up, with two more 5009's on the shelf. The important part of the config is like this: 1 CCR2004, 3 RB5009, 3 RB951G. The latter are leafno...

pe1chl

Yes, but not me. Testing this requires a network of like 6 routers with tunnels between them and BGP running on it. So several locations with different IP addresses are required, 2 addresses at each location. We have that in production but we do not have a separate test environment that replicates i...

pe1chl

No, I don't have a test lab to do that.

pe1chl

Why???

pe1chl

absolutely. that script would need to have the lease variables exposed. The current DHCP scripts dont, you have to let the lease be created then match against it. The current DHCP lease script is called after an address has been assigned, which is fine when you want to use it to create a DNS entry,...

pe1chl

I suggested that too. In fact I think it would be very nice when a DISCOVER-phase script was added that gets all parameters from the DHCP packet and can decide which lease time, which address pool and which option set are to be used (or "none" to ignore the request). It would cover many sp...

pe1chl

It seems like BGP in general is a bit off the current attention hotspot... in 7.17rc there are no announced BGP changes at all, even though there are several new known bugs (introduced over the 7.15 .. 7.16 span) and of course some unimplemented features too.

pe1chl

Yes, that is quite low, my hAP ac2 runs with 1400 kB free at the moment, but it does not have wifi-qcom-ac installed. I noticed that the "Total HDD size" is now reported as 16.0 MiB while I am sure it was like 15.2 MiB before, so that has changed in some recent release. No idea if they rea...

pe1chl

On the other hand, it is not really MikroTik's task to work around the release and support cycle of other equipment... or the fact that people don't have money to renew the equipment they earlier have bought.

pe1chl

What you described, would following the dns list by order be somewhat similar? It would be a step in that direction in my opinion Somewhat similar, but not the same. Usually you get several alternative DNS resolver addresses from your ISP, e.g. in my case 4 (2 IPv4, 2 IPv6), and you would want to l...

pe1chl

Well, one can always wish for more advanced options. What I would like is to have groups of servers, and then at first the servers from the first group are used in some optimized way like I described, and only when all servers from the first group are failing to respond, servers from the second grou...

pe1chl

Causing a reboot just by copying a large file via SMB sounds like a big issue that should be fixed before reaching final. Well, for me it sounds like an irrelevant issue because a router is not an SMB server and the whole SMB function should not have been there... For me, the big problems in BGP sh...

pe1chl

Is there a reason using standard DNS, the in use DNS server always ends up being Cloudflare? No matter which order I put the servers in, the DNS in use always ends up being Cloudflare within a few minutes of arranging them. Or by running the dns leak test. Why is Cloudflare preferred over any other...

pe1chl

I have seen those issues in 7.16 as well: a single disconnected peer disconnects multiple or all peers at the same time, and routes via disconnected peers still appearing in the table. The first I was able to improve a bit by forcing all BGP handling into a single process (input.affinity=main output...

pe1chl

It seems that in the 7.16 (and 7.16.x) versions BGP has become unreliable. Today we had some internet outages and the backup route config I have used for a long time starting with v6 simply no longer works. I have noticed it before and tried different things but never got it working reliably anymore...

pe1chl

it seems that in versions 7.17beta/rc there is some kind of problem that is actively consumes space on a flash on my ac2, I successfully used 7.16rcX for several months without errors, but after updating to 7.17rc2, less than a day later, dozens of saving errors began to appear Did you check space ...

pe1chl

Maybe one of the outside-MikroTik users who have found detailed information about how the system works could reveal some detail about that. I would expect that RouterOS has some tables of available commands and options and directives for the GUI (webfig/winbox) which are used by the generic command ...

pe1chl

Next time partition the router and copy partition before upgrade, then you can simply revert by switching partitions as long as the device isn't completely corrupted... partitioning is a great thing, but... it is not available everywhere, I wish to have it for CHR, but again... but... but... but......

pe1chl

Ok I do not have that many peers on a 7.16 router. but I do see another problem: multiple routes to the same peer over different paths are not stored. do you see that as well? It worked fine before. E.g. we have peers with a GRE/IPsec, a GRE6/IPsec and a L2TP/IPsec tunnel (over LTE) between them for...

pe1chl

Next time partition the router and copy partition before upgrade, then you can simply revert by switching partitions as long as the device isn't completely corrupted...

pe1chl

What is that BGP+BFD problem? I have some BGP problems but not BFD related...

pe1chl

Indeed. But of course you can write a script, and run it at the interval you like, that checks if your smaller subnet is reachable in the route table, and when it is not it disables the blackhole route. That will cause the aggregated route to no longer be advertised. It was possible to do that witho...

pe1chl

Price Reduction Overhaul ??

pe1chl

Before I have suggested that sessions (now workspaces) would optionally be stored on the router itself. Of course there is the issue that the workspace is optimized for the resolution of the device and thus may be incompatible with another device, but still I think it would be useful when there is s...

pe1chl

I can't imagine any major internet operators and distributors that MK has never discussed with them about VTI support.

Well, I can understand that. VTI is not something that internet operators would use.
It is something for customers. To connect to their cloud virtual machines, for example.

pe1chl

Why is BGP not getting any love?
There are several known problems in BGP yet no release notes about improvements...

pe1chl

Yes of course it should only update to versions that have been "stable" for a long time, and without modifying them. At the moment, a "beta" is promoted to "stable" and that is when everyone starts installing it and the bugs appear all over the place. So such a "cr...

pe1chl

even in this forum there are people who are asking why they have unrecognized accounts and unrecognized scripts in their devices, that are calling traffic generator, configuring proxy etc. even forum users make mistakes and let in people they did not intend to let in. I still wonder how many of the...

pe1chl

As I wrote above, I would like some new "save as new item" which is easier to use than first COPY, save that copy, and then still have the original open. E.g. in PHPMyAdmin, which performs similar actions as modifying a RouterOS config, you can select a database row, do "edit", y...

pe1chl

But just editing the copied rule, and saving it directly as active without prompt, is one of the great attractors of the "oh no" events. Those, when we click the "ok" button and immediately think "oh, no". That would not be a problem because the copied rule is the same...

pe1chl

I don't see the advantage of creating an entry in disabled status. You can always click DISABLE when that is what you want. Main advantage is that when duplicate is created in disabled state, there's no way that it could disrupt anything. You can edit it and then enable. It cannot disrupt anything ...

pe1chl

I don't see the advantage of creating an entry in disabled status. You can always click DISABLE when that is what you want.

pe1chl

Maybe a nice new feature in winbox would be a "save as new item" button which allows you to start editing something (not only a firewall rule) and then at the end decide that you in fact wanted to do a COPY, edit, and APPLY/SAVE instead?

pe1chl

Duplicating same rule below the original would hardly disrupt anything. Other choice would be to make duplicate initially disabled. Actually, COPY does not create a new rule at all. It only copies the data from an existing rule in a new form, where you can edit it, and only when you click OK or APP...

pe1chl

+1... just generate a .png and display it.

pe1chl

I have a router with two internet connections, ISP1 and ISP2. There is a default route towards ISP1 in the main table, and additionally there are separate route tables for ISP1 and ISP2 with each a default route. There are mangle rules for prerouting and output which match on the statically assigned...

pe1chl

On Mac - If I copy an existing firewall rule, it is putting the copied rule right to the bottom of the list and not directly below it. I'm sire the previous v3 behaviour was to put it underneath but v4 is putting to the bottom. didn't half make me question myself earlier. Is this expected behaviour...

pe1chl

Up to a point. The botnet on that article was composed by high end routers (CCR1036, CCR1072, CCR2004, CCR2116). Those have no firewall or protections whatsoever - since they are professional models. Yeah, that's makes the focus on device-mode so ridiculous - when devices use insecure protocols by ...

pe1chl

Well, one thing is obvious: the issue you describe affects only you. Or else we would have seen many reports. I can only suggest that you /export your configuration ("/export show-sensitive file=anyname") and netinstall the router without default config and import that export connected via...

pe1chl

I think the intention was that with the new devicemode settings it would no longer be possible to change the "Boot device", not that an upgrade of the firmware would be blocked. Maybe auto-upgrade setting would need to be blocked, I'm not certain of that. But it isn't a good idea anymore t...

pe1chl

I agree, it would certainly be useful when there was some location (MikroTik or not) where one could pull ready-made containers for RouterOS for often requested additions! Especially when Docker containers are often only available for amd64 architecture, and may not be tailored to RouterOS use. Ther...

pe1chl

When you have advanced requirements you may want to consider winbox v3.

pe1chl

Incompatibilities between WiFi access points and clients are something that every manufacturer is fighting with... The users ask for new features, better performance, more security, etc etc but expect that all their equipment, no matter if it is a brand new smartphone or a simple IoT device with an ...

pe1chl

The addition of "detect internet" was an unfortunate decision some time ago, probably made in an attempt to make MikroTik routers easier to config (or even do full out-of-the-box automatic config). It basically failed to do so, and now what remains is mainly a nuisance. Unfortunately we ca...

pe1chl

They can easily roll out a OS version for the router and say that OS version xyz is the only OS supported for that specific device and the newer generations can use the NEWER versions of the OS that DOES include a SIMPLE feature like directory restrictions. I'd say that one of the very strong point...

pe1chl

The speeds shown in that screenshot are quite typical for the RB951G-2HnD.
When you are looking for high performance, get a new router with 2G+5G and AC or AX WiFi.

pe1chl

It's an easy excuse say "MT does not deal in file services" but the reality is that they DO offer File services on the router through the USB port and therefore if one service like SMB can implement it and PureFTP or ProFTP can all implement something like this, it stands to reason that c...

pe1chl

In that machine, can you turn power off in the server via ILO with the CCR2004 still powered via standby power?

pe1chl

This kind if "invalid" packets is caused by the connection tracking entry in the router already removed, and the system (or the remote) still sending related traffic. It can even cause leaking of internal addresses because in that case the corresponding NAT action isn't performed either. I...

pe1chl

Due to the number of fixes I updated from latest release 16.x to 17beta4. I am now seeing a lot (like thousands) of 'invalid' dropped packets on the firewall.

It helps to show a couple of example log lines. There are some different reasons why these appear.

pe1chl

For Mac users it started with macOS 11 about 4 years ago when this drastic "aesthetic user experience" change was introduced - item spacing on main menu bar and most window toolbars increased by almost 50%, most UI buttons lost their borders and all UI items lost their contrast. How this ...

pe1chl

Any new information/feedback from mikrotik regarding this?

Yes, they told me it is not planned.
At the moment, there is no plan to add this functionality,., but we will see if it can be supported in the future.

That was in june 2024.
And that has been the status for at least 10 years now.

pe1chl

Current situation is not usable for people doing mobile work on laptops - not even when laptop has high resolution screen. Ruining exsiting well-designed GUIs to unusable low-contrast no-borders style is the hype of today's design. Winbox is not even the worst example of that. And probably the moti...

pe1chl

I'm just getting very frustrated with the numberpad enter key being some sort of a clear command instead of enter. 'ping 192.168.1.5 numbpad-enter' clears the command 'ping 192.168.1.5 reguar-enter' works fine. PLEASE FIX It works OK here (on Linux). It may depend on the OS or the configuration. I ...

pe1chl

Unless you have a fast internet connection with a large subnet and a slow network behind that, it is mostly a waste of time.
You better spend your time on securing your services e.g. not putting services like SSH, telnet, RDP, winbox etc open on internet.

pe1chl

... or get a wider screen. On my 2560x1440 screen where I run winbox 3 at about 80% of the screen width, I have no issues with log messages.
And of course, it is always best to put log messages in files and/or on a syslog server as well, where you can go back in history, use grep to find things, etc.

pe1chl

Did you ever test that working on older releases?

pe1chl

How can i check the process tree to see what is taking up memory ? Unfortunately there is no user-level tool to show that (like there is for processor usage). MikroTik claim that they can see it in a supout.rif. Of course you can upload a supout.rif to your account at mikrotik.com to show the conte...

pe1chl

Instead of all these attempts to let the user find a clear spot, it would be better to have a spectrum analyzer that indicates signal and noise as function of the frequency (channel) and time, with some automated way to find the optimal channel.
(the competitor has it...)

pe1chl

Well, at some point I would have been very interested when this router provided: - running independently from the host box (i.e. RouterOS can be rebooted without host reboot, host can be rebooted and even shut down without effect on CCR) - support for VMware ESXi. At that time the intention was to p...

pe1chl

For this functionality to work completely reliable and predictable, you would want to have a "reload" function for the workspaces. As it is now, when you have two simultaneous sessions sharing the same session/workspace file, and you make changes in one session, it is somewhat unpredictabl...

pe1chl

Yes bgp loaded with large routes can make the whole router get stuck (freeze) , even supout failed to be created, so its hard to explain this situation with MT, happen in 7. 16.1 and ticket has been created and still no answer. To be clear: my issues have nothing to do with large route tables. They...

pe1chl

Would be nice if Mikrotik develops something like RB5009 but with only 2 SFP+ ports, one for Internet and other for local net that could be attached to SFP+ switch

Maybe a CCR2004-1G-2XS-PCIe in a case? (not sure if that board would work without being in a PCIe slot)

pe1chl

The best solution for blocking sites is to realize that it isn't possible to do it at the technical level and has to be done at user policy level. "you get internet on your workplace and you are not allowed to use it to stream youtube for background music and video, if we find you doing that yo...

pe1chl

I have encountered a case before where the Qualcomm datasheets indicates a capability for a chip, but the MikroTik product using the chip does not offer it. The "LHG 5 ac" uses the IPQ4018 which according to https://www.qualcomm.com/products/internet-of-things/networking/wi-fi-networks/ipq...

pe1chl

Yes there sure are terrible issues with BGP in current releases, but it is difficult to debug them. This week I had a case where one BGP peer connects, routes are received OK (remote is RouterOS v6 so none of that stupid "routes are sent only after one keepalive timer" rubbish), then after...

pe1chl

Block Diagram is available:

It was added after the above remarks were made... but IPsec test results not yet, maybe they appear next week.

pe1chl

Stretching for a use case, I suppose you could use this to create semi-airgapped small LANs off a big PoE core switch, as in a hotel where you want a small number of wired ports at the work table, without letting each room's users see devices in other rooms. THAT is their use case! Pop-and-Mom ISPs...

pe1chl

Not too long ago, I had the opportunity to visit Mikrotik's office in Latvia on behalf of my company. I was welcomed by an official representative of Mikrotik, and the first thing he asked was about what we needed, what equipment we would like to see on the market, and what suggestions or ideas we ...

pe1chl

The "hEX refresh" does not have IPsec test results, ... Not to downplay the importance of publishing IPsec results ... but lately they are becoming increasingly irrelevant. Most people are moving towards wireguard (and alikes), which AFAIK doesn't use IPsec HW offload. Maybe you and most ...

pe1chl

The "hEX refresh" does not have IPsec test results, unlike its predecessor the RB750Gr3 which had quite impressive IPsec performance for its price and position in the product line. Does this mean "hEX refresh" does not have IPsec acceleration, and the "twice the performance ...

pe1chl

I have a ticket open since Jul 23 with ID SUP-159987 so you can also refer to that.

pe1chl

Please add the source IP to the message "ipsec,error payload missing: SA".
(the address where the packet was sent from that triggers the message)

pe1chl

Please add the source IP to the message "ipsec,error payload missing: SA".
(the address where the packet was sent from that triggers the message)

pe1chl

So I wanted to add WPA3 to SSID 01 for testing. I tried to apply WPA3 via sec1 to it but for some reason it wouldn't apply the setting, i tried several times and restarted the router a few times as well. In the end the only way the WPA3 setting would apply was by doing it via each wifi interface ma...

pe1chl

t will override the selected security item. Some day I am going to file a feature request at Mikrotik support: "highlight overriden config values in export in different color". Or as a dedicated option in "print detail" or something. I've seen so many exports and always there ar...

pe1chl

It seems that there is difference between security. And SSID (on purpose?). I would always make one item (per SSID) in /interface/wifi/security and use that on all interfaces. Because when specifying security items on /interface/wifi explicitely, it will override the selected security item. When yo...

pe1chl

You do not need VTI to solve that problem! Simple GRE/IPsec tunnels and automatic routing will do it. Yes, and when you want to buy a new car, don´t do it. Buy an horse-drawn carriage you can reach your destination also. Sorry, but it makes no sense to always repeat 'use GRE/IPSec' when remote site...

pe1chl

Well, it is not surprising (to me) that it does not work. Maybe there has been a strange workaround in the network code that made it work before and is now removed? It is completely normal in Linux that the byte order is "wrong" when you look at the bare 32-bit address that way, at least w...

pe1chl

I did not test that yet, but is it really so that in the $ip variable a 32-bit numeric value is returned instead of a dotted quad string? And you could convert that to a string by adding 0.0.0.0 to it? I would expect a function like inet_ntoa() to be required for that conversion. The IP address will...

pe1chl

Depending on what type of router you use (16MB flash toy or one with sufficient flash) you can also configure partitioning so you can always switch back to the previous install without hassle...

pe1chl

Could we get address lists similar to interface lists where you first define a list and then add items to it? The ultimate goal is the ability to nest address lists. This could simplify my configurations immensely. That sure would have been better...and not only for address lists. But it seems that...

pe1chl

My routers do not receive internet routing tables but only a couple of local networks (company networks routed over VPN), but the problem is the same. It for sure is not related to large routing tables.
I have support ticket SUP-159987 open for it since 23/Jul/24 but there is no real progress...

pe1chl

What I suggest is "default" automatic update configured in devices as they come from the factory. In principle, everything is great: the “new” device should, for example, first be connected by the WAN port to the switch or current router and the firmware should be updated. After that - co...

pe1chl

Honestly - do you know many home users who would ever update their router firmware at all? Any manufacturer. I haven't met any. And about the “forced” automatic update. Nobody ever suggested “forced” automatic update. What I suggest is "default" automatic update configured in devices as t...

pe1chl

pe1chl, automatic updates mean for the vendor: more, more and much more testing. You cant push out another "stable release" when there are millions of devices out there potentially to turn into bricks. As I explained in the previous iterations of this topic: there should be a separate cha...

pe1chl

I get the need to dial some things down, but for already-deployed devices, there's got to be a compromise. This affects far more devices than the partition issues do (hundreds vs. dozens for me, anyway). To be fair, I think Mikrotik is listening. The recent change on partitioning shows this. They w...

pe1chl

The issue described in https://forum.mikrotik.com/viewtopic.php?t=207022 has become much worse in 7.16 (BGP sessions close when another session closes) In previous versions it appeared to affect only BGP sessions with the same local IP, now it sometimes affects ALL sessions... When a peer on L2TP/I...

pe1chl

Well, after all that time there still are only two categories of ISP here:
- those that provide each customer with a /48
- those that do not have IPv6 at all.
So I would not want to claim "it became a norm".

pe1chl

I hope at some point some scheme will be found where users upgrading to new versions can keep the features they already had, while newly installed devices need the device-mode setting to get access to those features. (e.g. one of the many schemes proposed where one could set device-mode shortly afte...

pe1chl

@baragoon do you also notice during your debugging that the routes displayed are sometimes completely different from actually installed routes?
Or do you only use commandmode and no winbox? (probably it does not happen in commandmode)

pe1chl

!) device-mode - after upgrade, mode "enterprise" is renamed to "advanced" and bandwidth-test, traffic-gen, partition (command "repartition"), bootloader and downgrade features will be disabled; So that means /partitions/activate (changing active partition) will after ...

pe1chl

Even for the useful RB750Gr3 there is now an announced replacement with 128MB flash! That I didn't know! Where is it? Great news, finally we are leaving the 16MB behind! There is a video on the MikroTik YouTube channel: https://www.youtube.com/watch?v=Zrzq_zPWoQ4 But it is not yet on the products l...

pe1chl

I fully agree! Every time a new feature is added, something else is broken, and we need another cycle to get that fixed. And all that while ready solutions with the same functionality already exist. The only work that would have to be done is the configuration interface -> mapping to configuration f...

pe1chl

It seems to me that Mikrotik would be better of stop trying to develop everything in house and use some opensource software like unbound/nsd for common tasks especially if they are licensed under some non prohibitive license like BSD in case of unbound...

+1

pe1chl

unbound is a recursive resolver. not an authorative dns. It has some limited features in that regard. The features are similar to what the current built-in MikroTik DNS resolver has, plus it can resolve from root servers. (and it supports DNSSEC, and it has a test suite, and it has developers who k...

pe1chl

unbound does not fit into 16mb flash by far. look at the unbound distroless docker images. The binary has at least 4mb+. given microtik has a lot of stuff developed in house (I am pretty sure they dont use any popular ssl library for example). It is all a matter of their limited storage they have o...

pe1chl

container and run whatever you like.

Except then you have no configuration user interface.
Still, it would be nice when someone with container experience would make a container with unbound for RouterOS.

pe1chl

Display of the routing table (IP->Routes) in Winbox (3.41) is quite unstable. After route changes have occurred (by BGP), the displayed routes often are just plain wrong. Nexthop is wrong, Immediate gateway is wrong, AS path is wrong. When winbox is closed and re-opened, it is correct again for that...

pe1chl

so we're far from a "real" DNS server. And, I'm sure others have their own DNS grips. MikroTik should offer "unbound" as an optional DNS resolver package (that replaces the internal one when installed), much like in v6 you could install an optional NTP client/server that would r...

pe1chl

It seems it is quite unstable in 7.16 Arbitrarily, BGP links just get 0 prefixes. Also, the route display in winbox 3.41 is often wrong after the topology has changed. AS Path and Immediate gateway just show bogus results, and after Exit and Re-open winbox they are different. Sometimes when IP->Rout...

pe1chl

Yes...I just used it as an example of a system that has issue tracking, threaded discussions. You do realize you don't have to post the source to track issues/feature requests and voting/discussions right ? There is already a system for this at https://help.mikrotik.com/servicedesk/servicedesk just...

pe1chl

It seems the physical dimensions of the unit are quite well-used.
If the performance of the antennas is optimal for this size is less easy to derive from photos.
But I can assure you that when you have an antenna that performs optimally at some physical size, shrinking it will ALWAYS make it worse.

pe1chl

Of course you should no longer buy devices that have only 16MB, it will be a dead-end. As long as there is no smaller variant of the CAP AX, people will continue to buy the CAP AC. The fact that smaller designs are possible is demonstrated by competitors. You can install AX hardware comparable to t...

pe1chl

We had MT officials here claiming several time it's to much effort for them to improve on this. So that's how it is and it will hardly change. I believe that, like any other company, Mikrotik is doing everything possible to achieve success. They are also targeting large enterprises with core networ...

pe1chl

Nothing stops anyone from stopping at 7.12 - I do in fact, until 16MB can be replace or netinstall'ed. On existing devices, yes. But when you buy new stuff, at some point it will come with a higher version and not allow downgrade. Of course you should no longer buy devices that have only 16MB, it w...

pe1chl

I am having same problem. How do I get the correct files for windows 7 ?

Upgrade Windows. The program is not compatible with Windows 7.

pe1chl

I can see it still MTs mangle route marking behave like [lookup] fallback to main if it can't find route it is looking for. leave ipv6 for now, just clarify one thing, why above example working two different way? what am i missing? I don't understand what you mean with "if it can't find route ...

pe1chl

Concur, OP is confused or trying to follow to many guides and not really understanding what is being done in them. is there anyway to specify [lookup-only-in-table] in the mangle? MT's default behaviour is [lookup]. i want (scenario 2) to [lookup-only-in-table] not [lookup]. In version 6 it was [lo...

pe1chl

*) bgp - fixed corrupted as-path when received update with empty AS_PATH attribute (introduced in v7.15);

Are you sure this problem has been completely fixed?
I am still seeing corrupted AS-PATH in a setup with mixed iBGP and eBGP... probably will try to switch to exclusive use of eBGP.

pe1chl

We are running a number of MikroTik routers in a central office and branch offices. There is a partial mesh of tunnels between the routers (branch offices all connect to central office but there are some tunnels between branch offices). Sometimes there are 3 tunnels between the same routers: one GRE...

pe1chl

We don't buy the toys that have only 16MB for business! And I (and others) have argued a lot against them. When I first bought MikroTik stuff it was devices like the RB2011 and I immediately partitioned it. Only later things have gone downhill with all those 16MB devices and the issues they caused (...

pe1chl

It looks like someone at MikroTik, maybe as part of a security meeting, has decided that there is a real risk that someone would obtain admin access to a device and then would want to have even more capabilities and would achieve that by downgrading RouterOS. While that undoubtedly has happened some...

pe1chl

Rough timeline for v7.16 beta1 to v7.16 release was from June 5th to September 24th. Beta period can be considered grace period. I think you don't understand (just like you pretend to not understand ANYTHING in this matter) what a grace period would be. A useful grace period would be some time wher...

pe1chl

above quoted line from the manual > "you can use the "save config" button to copy it over to other partitions."" this can be done without any device mode changes, limitation only is applied to manual re-booting to other partition, if main one is still working You cannot &qu...

pe1chl

Yes, that is also why I suggested that the device-mode settings are made available earlier than that they are enforced.
But Normis plays stupid and pretends he does not understand...

pe1chl

No, that is not true. The DNS resolver processes the entries from top to bottom (like the firewall) so you can have that config. I checked with the support: regexes are indeed processed first. Therefore the *\.home\.arpa$ regex of type NXDOMAIN will override non-regex entries regardless of its rela...

pe1chl

pe1chl, why is this so hard to understand? your complaint is about routerboot settings My complaint is NOT about routerboot settings!!! My complaint is about new device-mode settings that disable existing features that can only be re-established with physical access. In particular: routerboot setti...

pe1chl

/system/device-mode/update partition=yes expected end of command (line 1 column 28) you cannot. 7.16 does not know about device-mode "partition". Are you serious? I am directly answering your question about bootloader settings. If you are not interested in real answers, only trolling, you...

pe1chl

Success: CRS326 upgrade from 7.13 -> 7.16 Took 4 minutes before switch started pinging again. But you could upgrade your 7 year old switch to newly developed software in 2024! For most manufacturers your device would have been end-of-life with no new firmware releases, and at most a fix for a newly...

pe1chl

And even if it would exist: you would need to press button or power off. hahha

Well, at least we could plan that as a task to be performed during other visits to each location in the months before the upgrade.

pe1chl

It seems like nobody complaining about "bootloader" device-mode flag. Well, I don't really like that either. When I want to netinstall a device that is not completely dead, I use "try-ethernet-once-then-nand" mode to force it to go to netinstall, instead of fiddling with the but...

pe1chl

It looks like torch uses features like "connection tracking" to show source and destination of traffic, and the source and destination address actually refer to the side that has made the L3 connection, not to the L2 traffic you are torching. As such, it is difficult to predict what will b...

pe1chl

Sorry I am a bit unclear about something regarding device mode. Is/will it become mandatory to use: device-mode is an existing feature that was introduced a couple of versions ago, and it provides a global enable/disable of features that are deemed to be "dangerous". Its most apparent use...

pe1chl

No, that is a bug. It is not related to the logging, it is just that you now see what is happening.
Ever since using v7 connected to v6 I have seen those issues...

pe1chl

That is not a bug, that is a feature of scaled displays. When you scale a single-pixel line by 150%, what else is it supposed to do than randomly making it 1 or 2 pixels thick?

pe1chl

@normis. This is not " your baseless complaints". Sorry to hurt your filings with my opinion as customer, to your new product. Well, it is baseless when it is a complaint about winbox functionality, as winbox is just a GUI on top of RouterOS functionality. I certainly see how MikroTik cou...

pe1chl

Does that also result in a BGP disconnect? In case BGP is running with 180s hold time it may be that the BGP session survives during the restart of a tunnel. In my case the downtime is too long for that (it is caused by scheduled restart of a 5G gateway to cover the daily change of IP by the mobile ...

pe1chl

Well, that whole "it will reboot to change the setting" makes the whole thing even worse than it already is. Not only is it required to physically go to each router, and to connect to the CLI and issue the command and press the button, but also it will cause an interruption in the network ...

pe1chl

The message shown on CLI is quite clear and does not leave room for interpretations: update: please activate by turning power off or pressing reset or mode button in 4m27s Maybe for you? For me that is not clear. When I press reset or mode button, it will activate the setting. But will it also rebo...

pe1chl

So how about adding a kind of " grace period " for post-7.16 updates? The newly introduced device modes could be activated without physical interaction for a period of something like 24 hours after that update. If no action is taken in that time the modes become locked, just as they are n...

pe1chl

I don't know what you understood. In simple words: any change you make to device-mode settings can be either commited/confirmed by pusing reset-button or a cold reboot. Well, I should mention that I was quite surprised the first time when I confirmed a device mode change with pressing the reset but...

pe1chl

Upgraded to 7.16 and now it has become much worse...
When a peer on L2TP/IPsec disconnects because their public IP has changed and they re-establish the L2TP/IPsec session, I have observed several times that all BGP sessions (15 total) go to Idle state and have to re-connect.

Search found 12622 matches