Can we get standard 802.11s support? https://wiki.mikrotik.com/wiki/Manual:Interface/HWMPplus indicates that the HWMP+ protocol is based on 802.11s draft but is not compatible with it.
I would love if I could run a script as a firewall action.
this would degrade the packet forwarding performance in an unpredictable but disastrous way.
but you can log the match with custom tags, parse logs with scheduler, and fire actions as needed.
I’ve been waiting over five years for /system upgrade upgrade-package-source to allow specification of its password parameter on the command line instead of demanding it interactively. This one deficiency makes Flashfig entirely useless to us and makes initializing every one of our MikroTik CPEs a multi-step manual process. I’ve been told this is done for “security,” but every other password, encryption key, secret, etc. can be set from the CLI except this one (which is a relatively minor “security” function at best), so I’m not buying that argument. How hard can this be, guys?
Add temperature/voltage graph.
I know it is possible to add it on dude/snmp monitoring, but sometimes it’s complicated, and it should not be big problem for you to add it to the existing graphing routines.
Thanks
You mean like inspecting every packet with a level 7 filter does? Sometimes it’s nice having the ability to do something and then allowing the engineer to make sure that it does not get triggered excessively. Rather than not allowing the engineer to have the ability to do something he might have a need to do.
On that note, it would be really great to have an average cpu value being displayed in the resources tab. At the moment I have to run a script periodically and try to calculate this on my own.
request switch vlan support on RB750Gr3
there are certain “optimised” actions (like add-src/dst-to-address-list) which could have their “script” counterparts, but that doesn’t mean they’re the same. packet forwarding is not a thing where one want to mess with interpreted code. and running a script (executing a series of routeros commands) is actually running an interpreted code.
where i do see the quite a bit of flexibility, but it is a fundamental change how the PF code is organised. say we’re just fine with a serialised code execution on a single core if it comes down to handle a flow, but that doesn’t mean that cpu cycles are there to be wasted on unoptimised execution. also for me is not clear whether the script should be run in a non-blocking or blocking manner. all in all, since its just a set of interpretable code, it would be quite unpredictable whether it is to be executed parallelised or not. the result would be varying delay that could potentially affect (read: ruin) TCP throughput.
i suggested logging and parsing as a workaround, albeit it is far from perfect. but at least you’ll get your messages on fw rule match in a deterministic manner, and then its up to you how those elements will be parsed and interpreted by a script or an external entity (like stuff running on syslog server) - so the desired actions could be fired.
i think this fulfils your requirements of “hands shall not be bound”, but also provides enough safeguarding for the “not so creative/unexperienced” users, whose forwarding performance would be seriously degraded by running code based on firewall rule matches. and for the RouterOS developers its always a give-and-take situation, where to go, what to risk: provide a very versatile toolset where you can do anything, which can (and most probably will) result a thousands of trouble-tickets and sad faces when used inappropriately, or leave it to be solved by the excessive creativity of the few ones who actually do require it. they need to think in the dimensions of megapackets per seconds for a while, and “tinkering” does not fit into the scope no more. and there is a whole world outside of RouterOS, a lots of tools that may be used to contribute to its original functionality, we just need to think outside the box.
on the example you quoted: inspecting packets as level7 filters do. my opinion on this is a bit mixed. L7 filters offer a pretty versatile approach for packet matching, but it is not intended to be used “with every single packet”. there are quite well defined guidelines - presented on regular basis on MUMs by Mikrotik folks - how L7 filters are supposed to be used, or even more harsh: shall be used. and they should not be applied to every packet. because what you get is exactly the situation i described above.
https://mum.mikrotik.com/presentations/EU17/presentation_4058_1490948376.pdf (slides 5 - 9)
https://mum.mikrotik.com/presentations/IT14/touw.pdf (slide 13 and on)
I don’t see why it’s not possible to do the same with a run script on hit rule with some guidelines as you mention exists for the L7 rules. Unfortunately not everybody reads MUM slides.
Yes, the method that you describe of using a firewall rule and logging is an option, but potentially something that can become really messy really quickly.
You do make a good point about whether it should run in the background or block the forwarding of the packet and I would personally argue there that it should be in the background and not delay the forwarding of the packet. Doing it in the background will significantly reduce any knock-on effects on packet throughput providing that it does not get run on each packet and there are cpu cycles to spare.
seems we have to leave it to Mikrotik guys do decide which way to go 
Indupitably
Please add the ability to ping / ssh / telnet / other from the ip dhcp-server screen in winbox. This is already offered from the wireless registration page.
Any chance we could get the ability to form simple socket connections / ssh from the router in a script? Currently it’s really one sided in that it’s possible to connect to the router, but not possible for the router to automatically connect to other things.
Please add compression for the OpenVPN client.
Could we get a proper AT command + reply interface?
Sending down AT commands in the info string and then having them randomly overwrite some output as a response is far from ideal.
On that same topic, it would be great if the /interface ppp-client info section can be rewritten to go away and read all the data and then come back with the data instead of having to be polled repeatedly hoping to get all the data after x polls.
I don’t know if it was already sugested.. but mikrotik Traffic Flow could include BGP AS Numbers.
It is important to know what is going on with your network, and with the AS included a lot of things can be done.
Thanks!!
I hope I can create a counter only supout file, that only take process information and count connections and users.
When my routerboard have more then 100K connections and 2000 users, making supout file will take more 2 hours and bigger then 1GB.
The heavy loading reboot is very hard to debug.
I would like to request the required changes in order to allow 3G/LTE signal strength to be monitored on a continual basis without interrupting the signal - see https://forum.sierrawireless.com/viewtopic.php?f=117&t=10394&sid=4f3f25093fd64b08617370e3afb8222c&p=41108#p41108
this is one of the most highly requested features. It has been promised for the next major release of RouterOS. No ETA…
/ip firewall address-list has a creation-time field that is read only, although it appears in the add box. It would be quite handy if that were writeable at add time, such that the entry would take effect at whatever date and time is entered. This would allow us to schedule changes in account behavior at a future date without having to be sure to log in on that date to make it happen.
Now I must create the same few rules in FILTER ICON again and again in many place of WinBox (I use AutoIt to do it like workaround)
PLEASE ADD the SAVE option for filtering rules.
I will be creating prifile filters like, dhcp with dynamic only, Arp static only, Contrack show network1, conntrack show net2 - You gotta idea. Open filters and select own save before filters rules - perfect.