MikroTik

emils

Version 6.48beta12 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Wine version: wine-4.0 (Debian 4.0-2) (running on Debian 10, updated to latest version) Same issue on another system running Debian 9 and Wine version wine-1.8.7 (Debian 1.8.7-2) Cha0s confirmed he has the same issue in Windows 10: https://forum.mikrotik.com/viewtopic.php?f=21&t=161320#p802314 ...

emils

Update your WinBox to the latest version (3.24). Cannot do that until the "mouse down in window which has active updates (like counters)" bug is fixed. It was introduced in 3.22 so I am still running 3.21. The bug is described and confirmed in all the Winbox release topics since 3.22 but ...

emils

another bug ... when going under IP/IPSec/Policy, and opening an existing one seems to exit winbox/crash winbox. Or adding new one. You simply cannot edit/create ipsec policies using winbox on 6.47. Winbox just crashes without any error message. Update your WinBox to the latest version (3.24).

emils

@sindy they are having issues with plain L2TP without IPsec encryption. I can confirm there is an issue but I am still struggling to reproduce the issue in a controlled environment even with all the debug information and configurations provided to me.

emils

What's new in 7.0beta8 (2020-Jun-4 15:04):

*) fixed CLI dependencies for routing menu;

Discussion thread: viewtopic.php?f=1&t=161980

emils

What's new in 7.0beta8 (2020-Jun-4 15:04):

*) fixed CLI dependencies for routing menu;

Unfortunately, v7.0beta7 release did not have all the necessary routing changes for public release, here is a hotfix version of v7.0beta8.

emils

Seems that the router is unable to resolve the DoH hostname. Post your DNS configuration and make sure you have at least one dynamic or static DNS server configured.

emils

RouterOS version 7.0beta8 has been released in public "development" channel! What's new in 7.0beta8 (2020-Jun-4 15:04): *) fixed CLI dependencies for routing menu; What's new in 7.0beta7 (2020-Jun-3 16:31): !) added Layer3 hardware offloading support for CRS317-1G-16S+RM more info here: h...

emils

What's new in 7.0beta7 (2020-Jun-3 16:31): !) added Layer3 hardware offloading support for CRS317-1G-16S+RM more info here: https://wiki.mikrotik.com/wiki/Manual:CRS3xx_series_switches#L3_Hardware_Offloading !) enabled BGP support with multicore peer processing (CLI only); !) enabled RPKI support (...

emils

Are you sure it needs the intermediate certificate as well? It works for me with just the root certificate as well. I have published the example on wiki as well if you have any comments:

https://wiki.mikrotik.com/wiki/Manual:I ... over_HTTPS

emils

New version 6.47 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=161887

emils

New version 6.47 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=161887

emils

RouterOS version 6.47 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage s...

emils

whatever All versions.The fix is quite trivial and improves how files are handled on NAND type memory.
eworm Currently DoH will be prioritized over all other DNS configuration. Not sure if this will change any time soon.

emils

New version 6.47rc2 has been released in testing RouterOS channel:

viewtopic.php?f=21&t=161583

emils

Version 6.47rc2 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be downlo...

emils

Winbox v3.24 has been released:

viewtopic.php?f=21&t=161320

emils

What's new in v3.24: *) fixed WinBox crash when viewing firewall rule with src/dst-address-type configured; *) fixed checkbox group disabled state inheritance; *) fixed dates and times in interface link up/down properties (RouterOS v6.47 required); *) fixed system comment message display; *) fixed v...

emils

We have published an updated version of our Bandwidth Test version for Windows with some minor tweaks and authentication support for RouterOS versions newer than 6.43. You can download the utility from our Downloads page or directly from here: https://mt.lv/btest Please remember that Bandwidth Test ...

emils

*) chr - fixed graceful shutdown execution on Hyper-V (introduced in v6.46); How comes 6.45.9 contains a fix for something introduced in 6.46? In case the bug was "backported" from 6.46 it would be good to know what 6.45.x versions are affected. Sorry for the confusion. The fix was backpo...

emils

New version 6.45.9 has been released in long-term RouterOS channel:

viewtopic.php?f=21&t=160881

emils

RouterOS version 6.45.9 has been released in public "long-term" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free stor...

emils

Unfortunately we have left it as "testing" by mistake when building the version. It is just the name of the version - this is a stable build published in stable channel.

emils

New version 6.46.6 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=160503

emils

RouterOS version 6.46.6 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

Cha0s, yes.

emils

Version 6.47beta60 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Winbox v3.23 has been released:

viewtopic.php?f=21&t=160050

emils

What's new in v3.23: *) added support for Ctrl+C and Ctrl+A shortcuts in read-only fields; *) always use fixed width font in terminal window; *) do not resize inner windows when main window is resized; *) fixed default configuration approval window disappearing when using "Show Script" but...

emils

New version 6.46.5 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=159693

emils

RouterOS version 6.46.5 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

Version 6.47beta54 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Authority Key Identifier (AKID) and Subject Key Identifier (SKID)

https://tools.ietf.org/html/rfc5280#section-4.2.1.1

emils

Anyone that got DoH configured properly and running into stability issues, please send us a supout.rif file which is generated as soon as possible after the error has occurred with DNS debug logs enabled (topics=dns,!packet).

emils

Version 6.47beta53 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

And before anyone asks, for "Verify DoH Certificate" to work you obviously have to import the root certificate in the Certificate store of your router.

emils

As others are saying. The router does not know what dns.nextdns.io is. Add at least a single regular DNS server which will be used for DoH servers name resolving. Adding a static DNS entry should also suffice.

emils

Enable DNS logs, it should provide all necessary information for troubleshooting. I tested the DoH implementation with various publicly available servers and could not find any issues. If there are any, please let us know.

/system logging add topics=dns

emils

Try setting https://10.5.51.5 as the server.

emils

Version 6.47beta49 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

The window size should be stored in session file. Make sure you have autosave on or save the session before closing.

emils

Winbox v3.22 has been released:

viewtopic.php?f=21&t=158605

emils

What's new in v3.22: *) added 24x24 and 32x32 icon support (RouterOS v6.47 required); *) added Legacy Mode (disabled by default) to allow using older, less secure connections to RouterOS older than v6.43; *) added scroll bar support in item property windows; *) added support for super low DPI - 72, ...

emils

We are looking into the communication issues with The Dude connecting through Agent. Other issues related with The Dude "std failure" message must be caused by old version on either The Dude server or RouterOS client. theprojectgroup , please enable SSH debug logs (/system logging add topi...

emils

New version 6.46.4 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=158100

emils

RouterOS version 6.46.4 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

Version 6.47beta35 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Check the "manager" logging topic. It should contain more information in beta5. Have you checked the logs on Windows using Event Viewer?

emils

What's new in 7.0beta5 (2020-Feb-7 11:56): Introduced issues: - RB850Gx2 and RB911 does not boot New features in this release: !) x86 - introduced UEFI boot mode support; !) vxlan - added support for Virtual eXtensible Local Area Network (VXLAN); !) vrrp - added connection tracking data replication...

emils

Version 6.47beta32 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Currently supported RADIUS attributes for IKEv2 are:
Framed-IP-Address
Framed-IP-Netmask
Framed-Pool
Framed-Route
Acct-Interim-Interval
Mikrotik-Address-List

Please let us know what else is required that is not listed here.

emils

New version 6.46.3 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=157154

emils

RouterOS version 6.46.3 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

Winbox v3.21 has been released:

viewtopic.php?f=21&t=157150

emils

What's new in v3.21: *) added support for HiDPI displays; *) download WinBox specific files from router only into AppData folder and not anywhere else (CVE-2020-5720); *) enabled Drag and Drop support on 64-bit WinBox in Wine; *) font size can be increased/decreased under "Settings/Zoom In"...

emils

Have you guys checked the changelog on your routers? The 6.45.8 changelog contains of all versions between the last long-term version. We can not predict from which version a user is upgrading in a forum topic or on a website. Please stop going off topic. This is not the place to discuss how changel...

emils

6.45 to 6.45.7 versions were released in stable channel only, not in long-term.

emils

This is correct. Listed here are only changes between 6.45.7 and 6.45.8. If you want to know all changes between 6.44.6 and 6.45.8, you have to go through all versions that were released in between.

emils

New version 6.45.8 has been released in long-term RouterOS channel:

viewtopic.php?f=21&t=156825

emils

RouterOS version 6.45.8 has been released in public "long-term" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free stor...

emils

Did you reboot the router after setting it?

emils

Look into Dot1x. It can do MAC based auth without EAP in the latest testing builds as well, however you will still need RADIUS server with allowed MAC addresses, but the old (v6) User Manager should suffice.

emils

If your WAN Type is PPPoE on MikroTik this would not work, issue also described here: https://forum.mikrotik.com/viewtopic.php?f=2&t=154743&p=764979#p764979 And I also have (still) an open ticket regarding this, SUP-3815, support acknowledged an issue that fits my description. I was hoping ...

emils

Yes, it was under 6.46. Although not particularly mentioning that files are now hidden. There were a few improvements in package updater. *) upgrade - improved auto package updating using "check-for-updates"; System files have always been hidden / not accessible for a user in RouterOS. Pac...

emils

LeftyTs, the downloaded files are no longer visible in /files section when using Package Updater. You can still reboot the device and it will upgrade. Or use /sys pac upd cancel to free the storage.

emils

New version 6.46.2 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=156315

emils

RouterOS version 6.46.2 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

Windows does not support split include. Instead DHCP options are used to work around the limitation. Check IPsec debug logs, you should see something like this immediately after the tunnel establishes: 14:06:04 ipsec,debug recv DHCP inform from 172.16.3.253 14:06:04 ipsec,debug,packet secs = 600 14:...

emils

Please provide the ticket number starting with "SUP-". We are unable to reproduce the issue.

emils

Please try setting "Send INITIAL-CONTACT" to no for both peers. If that does not resolve the issue, it is most likely firewall related. You have to use routing marks for at least one of the connections. Really depends on the configuration, which should be posted for us to be able to help y...

emils

Version 6.47beta19 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

This behavior is expected because the router can not know which peer the policy should be assigned after upgrading your router. Please specify the peer for your policy and export configuration after that - it should consist of the peer parameter then.

emils

New version 6.46.1 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=154848

emils

RouterOS version 6.46.1 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

Post your IPsec config and full debug logs (/system logging add topics=ipsec,!packet)

emils

Guscht You need to send supout.rif file to support@mikrotik.com and brief problem description. We are currently unable to reproduce such issue. ivicask Have you tried the 6.46 stable and 6.47 testing versions? RoMoN works for me now. Make sure both the end user and the agent is updated. If it is no...

emils

Try typing "rw-client1" in "Local ID" section on iOS. If that does not help, you have to generate a new client certificate with some subject Alt. Name and type the same value in the Local ID section.

emils

There are communication problems between the router and the iPhone. Most likely NAT related. The client's port (1) seems highly suspicious.

emils

Issue with many PPP (including PPPoE) sessions will be fixed in the next stable and testing builds. All issues with file accessing including Dude, skins, etc will also be fixed in stable and testing builds. We are already working on 6.46.1 version and if all goes smoothly it will be released this ye...

emils

sba you are most likely using proxy arp on the relay router which will respond with its own MAC address to ARP requests causing false positive conflicts. Spending entire morning figuring out what is causing the issue when the issues is clearly mentioned in your Log sounds doubtful.

emils

As some of you have already seen, we have released a brand new User Manager for RouterOS version 7. It is included in v7.0beta4 extra packages zip file on our downloads page. The package is available for all current architectures excluding SMIPS. Mainly EAP authentication method support and custom R...

emils

bnw, should affect only a few CRS devices (CRS3xx).

emils

Version 6.47beta8 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be down...

emils

What's new in 7.0beta4 (2019-Dec-06 13:21): !) included all features and fixes from 6.46 version; !) implemented completely new User Manager package; *) dhcpv4-server - added "option-set" parameter for each "vendor-class-id"; *) dhcpv4-server - added "radius-password' param...

emils

rmozer Lora package for x86 was never publicly released. How did you obtain it for 6.45.7? Is it installed on your system when looking at System Packages menu? Znevna No those typo's are not fixed in this release. mbovenka Please keep us updated on what you find. You can also generate a supout.rif ...

emils

New version 6.46 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=154444

emils

New version 6.46 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=154444

emils

RouterOS version 6.46 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage s...

emils

Have you tried this release? If it is not fixed here, then open a support ticket with supout.rif file with enabled dhcp debug logs.

emils

We will continue improving APC UPS support in 6.47 releases.

emils

Thank you very much. IPsec DNS issue confirmed. Hopefully we can squeeze the fix in for the final 6.46 release.

emils

ivicask Thank you very much for reporting. Issue reproduced.

kmrue Can you specify the UPS model?

emils

New version 6.46rc1 has been released in testing RouterOS channel:

viewtopic.php?f=21&t=154286

emils

Version 6.46rc1 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be downlo...

emils

IPsec on RB1100x4/RB4011 will be fixed in the next release. Thank you for reporting.

emils

grusu what router are you using?

emils

Signal Strength setting using Winbox will be fixed in the next beta version.

emils

Version 6.46beta68 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

It is expected in the latest RouterOS versions. You can disable it with:

/system note set show-at-login=no

emils

It is for initiators only (as described in the wiki) to connect to implementations that work over non-standard port. Anyway, you should not use IPsec on other ports than UDP/500 and UDP/4500.

emils

jacekes Should be fixed now.

Sunlight, flameproof Please send supout.rif file to support@mikrotik.com

maryaadmins Check if addresses are not given out by the Cisco router. In most cases, your described issue is caused by another DHCP server in your network.

emils

Post IPsec debug logs (topics=ipsec,!packet) from time when the disconnect happens.

emils

Please try the latest testing release of RouterOS 6.46beta59. Let me know whether it resolves the issue.

*) ike2 - improved CHILD SA rekey process with Apple iOS 13;

emils

*) ike2 - fixed phase 1 rekeying (introduced in v6.45);
This is supposed to fix "ipsec,error Mikrotik: got fatal error: INVALID_SYNTAX"?

Works well on all my devices. Thanks Mikrotik for the update!

Yes.

emils

Currently not a high priority. Most likely RouterOS v7 will be released sooner with User Manager package that supports EAP.

emils

New version 6.45.7 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=153378

emils

New version 6.44.6 has been released in long-term RouterOS channel:

viewtopic.php?f=21&t=153379

emils

RouterOS version 6.44.6 has been released in public "long-term" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free stor...

emils

RouterOS version 6.45.7 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

Version 6.46beta59 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Changes in v7beta3 capsman - fixed UDP communication between CAPsMAN and CAP; certificate - fixed ECDSA certificate parsing; crs3xx - fixed SFP/SFP+ module detection; ike2 - fixed EAP payload processing on initiator; package - added RouterOS system packages for all current architectures; poe - fixed...

emils

It is a mess if you are using old and insecure versions (6.39.3 is already 2 years old). Upgrade to the latest stable version and almost all Wiki examples will work or perhaps the issue is somewhere else. https://wiki.mikrotik.com/wiki/Manual:IP/IPsec#Road_Warrior_setup_using_IKEv2_with_RSA_authenti...

emils

Version 6.46beta55 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Winbox v3.20 has been released:

viewtopic.php?f=21&t=152988

emils

What's new in v3.20: *) allow to filter by IPv6 addresses and prefixes; *) build 64-bit Winbox as well (https://mt.lv/FeuQe); *) do not leave files locked on computer when uploading files to router; *) fixed problem where some fields were not shown for read only users; *) fixed Winbox crash when cop...

emils

It depends. You most likely can use the same certificate on IPsec responder and RADIUS server, but the certificates SAN will have to match the IPsec server for IKE to establish.

emils

Most (if not all) EAP authentication methods requires certificates. Some methods require only the CA certificates while others require a client certificate. You will need to generate self-signed certificates on either the router or the RADIUS server. The RADIUS server will require its own server (en...

emils

This is fixed in the latest testing release:

*) defconf - fixed default configuration loading on RBmAPL-2nD (introduced in v6.45);

emils

Try setting the "remote-certificate" parameter to "none". Since the certificates does not have private key, the certificate verification fails. Since they essentially are CA certificates, you do not need to specify them, just installed in the certificate store.

emils

I'm seeing a problem with DNS resolution of ipsec peer in this beta: I have an ipsec peer that happens to have a correct ipv4 address, but an ipv6 address that does not work. On boot, the ipv6 address is picked up, but the ipsec remains in message-1-sent state forever. I need to do /ip ipsec peer d...

emils

Probably one of the following reasons: * traffic is blocked in forward chain. * you are not using the correct source address for this traffic - an IPsec policy matches only specific traffic mostly based on source and destination addresses. If the traffic you are sending does not match it - the traff...

emils

Yes, that is correct. Both the initiator and the responder has to provide a certificate with the SAN matching its ID. Only remote-id=ignore will remove this validation.

emils

The responder is closing the connection with AUTHENTICATION_FAILED notification. Debug logs on the other side should reveal more information.

emils

You need to enable debug logging and confirm that every peer sends the ID as you are expecting. If a certificate has more than one SAN, IPsec can choose any one of them. What happens if you manually specify the my-id parameter instead of leaving it to auto? Debug logging can be enabled with this com...

emils

Version 6.46beta44 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

As stated here: viewtopic.php?f=1&t=152006

Current state of GUI (WebFig and Winbox) are not completely up to date in RouterOS v7. Report only issues visible in console.

Closing the topic for now.

emils

It kind of works now. You can download a torrent by enabling the service (/ip/torrent/set enabled=yes) and downloading a .torrent file to the router. It should automatically detect the file and it will appear under /ip/torrent/torrents/print. The implementation is quite old and basic and "downl...

emils

Currently hardware acceleration is disabled on RB3011. Will be fixed at some point in the future.

emils

The issue that OP reported will be fixed in the next beta. It was introduced by the phase 1 rekeying support for IKEv2 in 6.45. As far as I know, proposal-check will only work for IKEv1. IKEv2 both sides act independently and will rekey and reauthenticate based on their own configured values. Curren...

emils

Next time, please report bugs according to the template: viewtopic.php?f=1&t=152006

Anyway, this will be fixed in the next beta.

emils

This will be fixed in the next beta.

emils

Please post your '/ip ipsec export hide-sensitive' command output. Make sure you have pfs-group set to none under IPsec Proposals for this specific peer.

emils

Logs on the other side should be inspected since it is the one who sends the INVALID_SYNTAX payload and it can mean anything.

emils

Most likely never since RSA keys are not considered as an authentication method in IKEv2 RFC.

https://tools.ietf.org/html/rfc8247#section-3.1

emils

New version 6.45.6 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=152033

emils

RouterOS version 6.45.6 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

You will need to use local-proxy-arp for this to work. This way the router will respond to ARP requests with its own MAC address and hosts will send traffic to the router which would then decide what to do with this traffic.

emils

Version 6.46beta38 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Probably has nothing to do with "0.0.0.0" in the logs. Most likely IPsec connection is not established. Start off by verifying there are active connections under IPsec Active Peers and Installed SAs menus.

emils

Note that this setup is only viable when one side is behind NAT. Otherwise you can specify DNS directly in GRE settings with ipsec-secret starting from 6.45.1. The bridge on server side acts like a loopback interface on which the internal address is configured used for GRE tunnel communication. If e...

emils

Isn't there anything between the dying and deleted messages? If that is an L2TP client, then it should initiate a new ISAKMP-SA when the old one is dying. If it is L2TP server then it should receive a new ISAKMP-SA request from the client. Do you actually experience any issues with the tunnel not wo...

emils

RouterOS version 6.45.5 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

Is there an autosupout.rif file on the router by any chance?

emils

It is possible that both sides try to establish a connection simultaneously. You can see in the screenshot that one peer is initiator and one responder. You can use passive=yes on one side to make sure it does not initiate a connection. Having two active sessions between the same devices should not ...

emils

Version 6.46beta34 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

RSA or ECDSA certificates? I am currently struggling to get ECDSA auth to work on Apple devices and getting the same error. RSA auth seems to work fine though.

emils

Version 6.46beta28 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Remote-id=ignore simply skips the ID checking against remote peer's certificate. Responder should always send the ID_r payload as per rfc7296.

https://tools.ietf.org/html/rfc7296#appendix-C.2

emils

There are no SMIPS devices with USB slot.

emils

I would guess the policy generation fails since it does not match the policy template: /ppp profile add change-tcp-mss=yes local-address=10.222.22.1 name=\ "L2TP Remote Connection" remote-address="VPN Pool" use-encryption=\ required /ip ipsec policy set 0 dst-address=0.0.0.0/0 sr...

emils

RouterOS version 6.45.3 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

Version 6.46beta16 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Often there are small changes/adjustments/refactoring in the code that does not (should not) change any functionality, but unfortunately some issues may be introduced in such way. We will resolve the RB4011 SFP+ interface issue in the next stable build. I apologize for any inconvenience. As for SNMP...

emils

RouterOS version 6.45.2 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

Note that published results are strictly synthetic and achieved with only plain IPsec tunnel configured on the router. For example, connection tracking can significantly reduce the encrypted throughput. Also if you are using L2TP, it creates additional overhead thus bringing the encrypted throughput...

emils

When disabling Fast Track, make sure all established connections are either removed or timed out. When disabling the fasttrack-connection rule already established connections will still be Fast Tracked. The most easiest way to verify that is not the case here is to reboot the router after disabling ...

emils

IKEv2 allows the usage of UDP/4500 even for first messages and RouterOS currently defaults to that. Forcing the port to UDP/500 may introduce some compatibility issues since packet format is still left the same. IKE normally listens and sends on UDP port 500, though IKE messages may also be received...

emils

First - check if packets are not being FastTracked. You can easily verify this by looking at the Connections table under IP Firewall. If there is "F" flag for the specific connection, you have to either disable FastTrack completely or exclude this traffic from being FastTracked. If FastTra...

emils

Between two RouterOS devices PFS group must match on both ends. You can not set 'none' on one side and a different PFS group on the other (regardless if it matches the group configured under Profile menu). If you want to learn how this works internally, I would suggest reading the IKEv2 RFC (rfc7296...

emils

It is normal to leave pfs-group to 'none' for IKEv2. It actually uses the group from phase 1 (profile) for child SA creation if set to 'none' when rekeying too. In IKEv2 the first child SA is created during the IKE SA creation, meaning it uses the same PFS group too. And not all implementations supp...

emils

Thanks for the feedback. We will try to add it in the 6.45.2 as well. It will also be possible to specify both the src-address-list and connection-mark parameters to form a single NAT rule. If anyone is wondering, currently an example is published here.

emils

Version 6.46beta9 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be down...

emils

Or set tunnel=yes for action=none policies. We will fix action=none policies in next release.

EDIT: actually this is not correct and addresses will change after the phase 1 recreation.

emils

dash, it will be fixed in the next beta, however you will need to have the same version on server and client (either both pre-6.45 or both post-6.45).

filzek, you can connect to NordVPN servers using IKEv2.

emils

RouterOS version 6.44.5 has been released in public "long-term" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free stor...

emils

RADIUS authentication issue is already fixed in the latest beta. We will try to release a new stable version next week with a few fixes.

emils

Version 6.46beta6 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be down...

emils

What's new in v3.19: *) fixed problem where Winbox could not login into RouterOS v6.45 (or later) router; *) fixed DHCP lease sorting by "last seen" column; If you experience version related issues, then please report them to support@mikrotik.com. Winbox is available here: http://www.mikro...

emils

all_packages-mmips-6.45.1.zip should be working now.

emils

New version 6.45.1 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=149786

emils

New version 6.45.1 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=149786

emils

RouterOS version 6.45.1 has been released in public "stable" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage...

emils

The thing is, PPP and IPsec are completely unrelated things and currently there is no way to associate the L2TP and the IPsec sessions with each other.

emils

The comment from the Identity that was used for the peer to identify itself is carried over to the active-peers menu. For example, if you have a comment "L2TP server" for the IPsec identity, then this comment will be shown for all active peers which used this Identity. Obviously, it is not...

emils

Version 6.45beta62 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

https://wiki.mikrotik.com/wiki/Manual:I ... entication

emils

Great, much appreciated! Can't wait for it... Will we see this before version 6.45 final release? Currently looks like no, it will not make it into 6.45. We are already finalizing the 6.45 version. VTI support requires new kernel and we are still not sure whether it should or should not be implemen...

emils

Yes, it has hardware accelerated IPsec like the rest of the IPQ4018/IPQ4019 devices. Simply the spec sheet is not fully populated yet.

emils

msatter we have already plans for such feature. But connection marks will be used instead of routing marks.

emils

viewtopic.php?f=2&t=147070&p=723661#p723661

emils

No, it is not possible at the moment. Please post your request to this thread. We are monitoring the feature requests and will implement them in future updates.

viewtopic.php?f=1&t=128439

emils

Do not see any reason why API authentication would not work in 6.45 either. Is there anything in the logs? Are you using the post v6.43 login method?

https://wiki.mikrotik.com/wiki/Manual:API#Initial_login

emils

Try the latest beta version, it has a fix for EAP to prefer SAN for identity checking. If that does not work either, post your '/certificate print' output .

emils

When we introduced the new hashing and encryption for user passwords in v6.43, we had to leave the old type of passwords for downgrade possibility. Now they are removed and only strong encrypted passwords are stored. Note that downgrading below 6.43 will cause all passwords to be blank. What's new i...

emils

osc86, SNMPv3 issues will be fixed in the next release.

emils

Version 6.45beta54 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Perhaps, you misinterpreted my e-mail or I worded it wrongly. To clarify: It should be possible to establish L2TP over IPsec with RSA authentication. What I meant with that quote is you can not use match-by=certificate to match a specific client certificate by a specific IPsec Identity. You can use ...

emils

"no-track" is not the same as "accepted by RAW". It fixes a specific case when connection tracking is disabled, RAW firewall rules are accepting (sending to connection tracking) some traffic, but the firewall rules are invalid, because the connection tracking is disabled. The fir...

emils

Version 6.45beta50 has been released. Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free storage space for all RouterOS packages to be dow...

emils

Here is the configuration I used to test compatibility with NordVPN. However, it is not working yet with the latest public beta version (6.45beta45). You will need to upgrade to the next beta when it is released. I will probably make an official tutorial on wiki later. /ip ipsec mode-config add name...

emils

Update: I have it now working and writing this with a IKEv2 connection through PureVPN. I have still to adapt the manually generated Ipsec Policy and it a PITA to do because sometimes a 0.0.0.0/ is expected but then I receive the TS_UNEXPECTED error. After several time going round and round the Src...

emils

Simply create second IPsec Policy on both routers: 192.168.252.0/24 <-> 192.168.100.0/24

emils

Try setting the remote-id to ignore.

emils

New version 6.43.16 has been released in long-term RouterOS channel:

viewtopic.php?f=21&t=148519

emils

RouterOS version 6.43.16 has been released in public "long-term" channel! Before an upgrade: 1) Remember to make backup/export files before an upgrade and save them on another storage device; 2) Make sure the device will not lose power during upgrade process; 3) Device has enough free sto...

emils

msatter All EAP methods require at least the root CA certificate for IKEv2. On Windows, it is possible, that the CA certificate is already in the Trusted Windows Certificate store so you do not have to import anything. Either ask your provider for the CA certificate or try finding out which certifi...

emils

Not working with Android clients (using https://play.google.com/store/apps/details?id=org.strongswan.android . Any tips towards getting Android working would be appreciated. Also I noticed occasional VPN connections failing using beta42 and 45. Downgrading to 6.44.3 made that issue go away but hope...

emils

There are no new features added with this conntrack fix as you are comparing to TCP loose setting. The fix addresses some stability issues in setups with large connection tracking tables. It also improves connection tracking processing performance.

emils

Anyone willing to test it, here is your chance. Let me know if any help with configuration is needed.

What's new in 6.45beta45 (2019-May-13 09:22):

!) ike2 - added support for EAP authentication methods (eap-tls, eap-ttls, eap-peap, eap-mschapv2) as initiator (CLI only);

Search found 906 matches