Two days ago I upgraded rb4011 from version 6.48.6 to 7.4.1. Since then I can’t access using winbox from outside (internet). DDNS cloud has also stopped working.
I have restarted the computer 3 times without success, I have removed the firewall rules without success.
Has anyone had the same thing happen to them and know how to solve it?
Thanks and best regards.
Love the fact that you can’t access using Winbox through WAN…improved your security a lot!
Nevertheless…for proper help please profide us with proper information (/export file=anynameyoulike and make sure any personal information is removed).
Does the logging mention anything?
I upgraded hap AC2 (128/16) few days ago from latest v6 by using netinstall and then used .backup file, all went well. Its been up and running w/o an issue.
I’m using cake with dscp marks given, also wireguard vpn.. its been up and running. both are excellent.
I would recommend doing a /export show-sensitive name=anyname now and do the netinstall again an rebuild the config from that export.
(pasting it, importing it, whatever you feel comfortable with)
It will likely save you trouble in the future, often seen on routers that had the v6->v7 upgrade.
Do you have a propose for hAP ac lite or Hap ac2 ?
I have one hap lite and after downgrade to 6.47.9 i have better wifi.
My message is about hAP lite and hAP mini. Not about hAP ac lite or hAP ac2. These are entirely different devices.
erlinden. Too safe! 
Logging does not mention anything
I forgot to mention that:
-it doesn't allow ssh access either -->I'm accessing the machine through romon, using another machine that I haven't upgraded yet, thank goodness.
-IP cloud doesn't work
# aug/26/2022 09:16:23 by RouterOS 7.4.1
/interface pppoe-server
add name=TEL service=ServerAIR user=TEL
add name=cu service=cu user=cu
/interface bridge
add fast-forward=no name=b_cu_pppoe
add name=lobridge
add name=publicbridge
/interface ethernet
set [ find default-name=ether1 ] speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps
set [ find default-name=ether6 ] speed=100Mbps
set [ find default-name=ether7 ] speed=100Mbps
set [ find default-name=ether8 ] speed=100Mbps
set [ find default-name=ether9 ] speed=100Mbps
set [ find default-name=ether10 ] speed=100Mbps
/interface vlan
add interface=b_cu_pppoe name=vlan1 vlan-id=20
add interface=b_cu_pppoe name=vlanMNG vlan-id=10
add interface=ether7 name=vlanMNG_net01 vlan-id=10
add interface=ether9 name=vlan_MM vlan-id=20
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether10 name=pppoe-WAN \
use-peer-dns=yes user=user
/interface list
add name=WAN
add name=MNG
add name=Discoverm
add name=LAN
/ip pool
add name=PPPoE_Localcu ranges=10.205.255.1
add name=dhcp_MNG ranges=10.205.1.1-10.205.1.200
add name=PPPoE_cu-FO ranges=10.200.16.1-10.200.16.63
add name=NAT444-2 ranges=100.105.1.177-100.105.1.253
add name=dhcp_pool20 ranges=10.222.222.2-10.222.222.254
add name=NAT444_06M_FI ranges=100.105.1.32/27
add name=NAT444_12M ranges=100.105.1.64/26
add name=NAT444_20M ranges=100.105.1.128/26
add name=NAT444_30M ranges=100.105.1.192/27
add name=NAT444_40M ranges=100.105.1.224/27
add name=NOPAGO ranges=10.53.255.32/27
/ip dhcp-server
add address-pool=dhcp_MNG interface=vlanMNG lease-time=15m name=dhcp_MNG
add address-pool=Gacela disabled=yes interface=vlanMNG_net01 name=\
dhcp_MNG_Gacela relay=10.205.2.254
add address-pool=dhcp_pool20 disabled=yes interface=vlan1 name=dhcp1
/ip pool
add name=NAT444 next-pool=NAT444-2 ranges=100.105.1.128-100.105.1.174
/port
set 0 name=serial0
set 1 name=serial1
/ppp profile
add change-tcp-mss=no dns-server=8.8.8.8,8.8.4.4 local-address=10.205.255.150 \
name=PPPoE_cu only-one=yes rate-limit=150M/150M remote-address=\
154.58.216.130
add change-tcp-mss=no local-address=10.205.255.20 name=PPPoE_AIR_20/03 \
only-one=no rate-limit="3072k/20480k 3684k/21504k 2304k/13440k 16 8 0"
add address-list=ClientesActivos dns-server=8.8.8.8,8.8.4.4 local-address=\
10.205.255.1 name=ServerAIR-interna only-one=yes remote-address=\
PPPoE_cu-FO
add change-tcp-mss=no local-address=10.205.255.10 name=backup10/01 only-one=\
no rate-limit="1024k/10240k 1228k/12288k 768k/7680k 16 8 0"
add change-tcp-mss=no local-address=10.205.255.6 name=profile1 only-one=no \
rate-limit="4024k/6144k 4228k/7169k 1068k/4480k 16 8 0"
add change-tcp-mss=no local-address=10.205.255.6 name=bkp_06/01 only-one=no \
rate-limit="1024k/6144k 1228k/7169k 768k/4480k 16 8 0"
add change-tcp-mss=no local-address=10.205.255.30 name=PPPoE_AIR_30/06 \
only-one=yes rate-limit="6144k/30720k 7368k/32768k 6912k/20480k 16 8 0"
/queue type
add kind=pcq name=06M-pcq-download pcq-burst-rate=7168k pcq-burst-threshold=\
16 pcq-burst-time=16s pcq-classifier=dst-address pcq-rate=6144k
add kind=pcq name=10M-pcq-download pcq-burst-rate=12288k pcq-burst-threshold=\
16 pcq-burst-time=16s pcq-classifier=dst-address pcq-rate=10240k \
pcq-total-limit=4200KiB
add kind=pcq name=20M-pcq-download pcq-burst-rate=21504k pcq-burst-threshold=\
16 pcq-burst-time=16s pcq-classifier=dst-address pcq-rate=20480k \
pcq-total-limit=3200KiB
add kind=pcq name=30M-pcq-download pcq-burst-rate=36864k pcq-burst-threshold=\
16 pcq-burst-time=16s pcq-classifier=dst-address pcq-rate=30720k
add kind=pcq name=pcq-upload-normal pcq-burst-rate=2048k pcq-classifier=\
src-address pcq-rate=1536k
add kind=pcq name=pcq-upload-mejorado pcq-burst-rate=6144k pcq-classifier=\
src-address pcq-rate=4096k
add kind=fq-codel name=clientes-pppoe
/ppp profile
add change-tcp-mss=no local-address=10.205.255.10 name=PPPoE_AIR_10/02 \
only-one=no queue-type=clientes-pppoe rate-limit=\
"2048k/10240k 3072k/12288k 1920k/7680k 16 8 0"
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no in-filter-chain=ospf-in name=default-v2 originate-default=\
if-installed router-id=10.255.5.1
/routing ospf area
add disabled=no instance=default-v2 name=backbone-v2
/routing table
add fib name=mm
add disabled=no fib name=WAN
/snmp community
set [ find default=yes ] addresses=10.100.5.0/29 authentication-protocol=SHA1 \
encryption-protocol=AES
/system logging action
set 0 memory-lines=3000
/interface bridge port
add bridge=b_cu_pppoe horizon=10 ingress-filtering=no interface=ether1
add bridge=b_cu_pppoe horizon=10 ingress-filtering=no interface=ether2
add bridge=b_cu_pppoe horizon=10 ingress-filtering=no interface=ether4
add bridge=b_cu_pppoe ingress-filtering=no interface=ether5
add bridge=b_cu_pppoe disabled=yes horizon=10 ingress-filtering=no \
interface=ether7
add bridge=b_cu_pppoe horizon=10 ingress-filtering=no interface=ether3
/ip firewall connection tracking
set tcp-established-timeout=15m
/ip neighbor discovery-settings
set discover-interface-list=none
/ip settings
set max-neighbor-entries=8200 rp-filter=loose tcp-syncookies=yes
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add interface=vlanMNG list=MNG
add interface=vlanMNG list=Discoverm
add interface=ether8 list=Discoverm
add interface=ether1 list=Discoverm
add interface=ether3 list=Discoverm
add interface=ether4 list=Discoverm
add interface=ether6 list=Discoverm
add interface=ether7 list=LAN
add interface=b_cu_pppoe list=LAN
add interface=pppoe-WAN list=WAN
add interface=vlan_MM list=WAN
/interface ovpn-server server
set auth=sha1,md5
/interface pppoe-server server
add default-profile=serverAIR-profile disabled=no interface=b_cu_pppoe \
max-mru=1500 max-mtu=1500 one-session-per-host=yes service-name=ServerAIR
add disabled=no interface=ether7 keepalive-timeout=disabled \
one-session-per-host=yes service-name=cu
/ip address
add address=10.255.5.1 interface=lobridge network=10.255.5.1
add address=10.100.5.1/29 interface=ether6 network=10.100.5.0
add address=10.205.1.254/24 interface=vlanMNG network=10.205.1.0
/ip cloud
set ddns-enabled=yes update-time=no
/ip dhcp-client
add add-default-route=no disabled=yes interface=ether10 use-peer-ntp=no
add add-default-route=no interface=vlan_MM use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=10.205.1.0/24 dns-none=yes gateway=10.205.1.254 ntp-server=\
10.205.1.254
add address=10.205.2.0/24 dns-none=yes gateway=10.205.2.254 ntp-server=\
10.205.2.254
add address=10.222.222.0/24 gateway=10.222.222.1
/ip dns
set servers=1.1.1.1
/ip firewall address-list
add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=bogons
add address=10.0.0.0/11 comment="Private[RFC 1918] - CLASS A/8" list=bogons
add address=100.64.0.0/10 list=bogons
add address=127.0.0.0/16 comment="Loopback [RFC 3330]" list=bogons
add address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=bogons
add address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B # Check if you \
need this subnet before enable it" list=bogons
add address=192.0.0.0/24 comment="Private[RFC 3330] - CLASS C # Check if you n\
eed this subnet before enable it" list=bogons
add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=bogons
add address=192.168.0.0/16 comment="Private[RFC 3330] - TEST-NET" list=bogons
add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=\
bogons
add address=198.18.0.0/15 comment="NIDB Testing" list=bogons
add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=bogons
add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=bogons
add address=224.0.0.0/4 comment=\
"MC, Class D, IANA # Check if you need this subnet before enable it" \
list=bogons
add address=240.0.0.0/4 comment=\
"MC, Class E, IANA # Check if you need this subnet before enable it" \
list=bogons
add address=10.100.5.0/24 list=network
add address=10.205.0.0/16 list=Management
add address=10.255.5.0/24 list=loopback
add address=pt.pool.ntp.org list=zzz
add address=100.105.0.0/22 list=Clientes
add address=10.33.0.0/16 comment="Private[RFC 1918] - CLASS A/8" list=bogons
add address=10.34.0.0/15 comment="Private[RFC 1918] - CLASS A/8" list=bogons
add address=10.36.0.0/14 comment="Private[RFC 1918] - CLASS A/8" list=bogons
add address=10.40.0.0/13 comment="Private[RFC 1918] - CLASS A/8" list=bogons
add address=10.48.0.0/12 comment="Private[RFC 1918] - CLASS A/8" list=bogons
add address=10.64.0.0/10 comment="Private[RFC 1918] - CLASS A/8" list=bogons
add address=10.128.0.0/9 comment="Private[RFC 1918] - CLASS A/8" list=bogons
add address=10.0.0.0/8 comment="Private[RFC 1918] - CLASS A TOTAL" list=\
bogons
add address=10.5.101.0/24 list=network
add address=10.5.102.0/24 list=network
add address=10.205.1.0/24 list=network
add address=10.205.2.0/24 list=network
add address=10.205.3.0/24 list=network
add address=1.10.16.0/20 list=blacklist-1
add address=1.19.0.0/16 list=blacklist-1
add address=1.32.128.0/18 list=blacklist-1
add address=2.56.192.0/22 list=blacklist-1
add address=2.57.186.0/23 list=blacklist-1
add address=2.57.232.0/22 list=blacklist-1
add address=2.59.200.0/22 list=blacklist-1
add address=5.134.128.0/19 list=blacklist-1
add address=5.180.4.0/22 list=blacklist-1
add address=5.183.60.0/22 list=blacklist-1
add address=5.188.10.0/23 list=blacklist-1
add address=5.188.88.0/22 list=blacklist-1
add address=5.188.206.0/24 list=blacklist-1
add address=23.135.225.0/24 list=blacklist-1
add address=23.151.160.0/24 list=blacklist-1
add address=24.137.16.0/20 list=blacklist-1
add address=24.170.208.0/20 list=blacklist-1
add address=24.233.0.0/19 list=blacklist-1
add address=24.236.0.0/19 list=blacklist-1
add address=27.112.32.0/19 list=blacklist-1
add address=admin.ddns.x list=Administrador
/ip firewall filter
add action=jump chain=forward comment="Check Forward" jump-target=\
Check-forward
add action=jump chain=input comment="Check Input" jump-target=Check-input
add action=accept chain=Check-forward comment=Established,related,untracked \
connection-state=established,related,untracked
add action=drop chain=Check-forward comment="Drop invalid" connection-state=\
invalid log-prefix=forward-invalid
add action=drop chain=Check-forward comment="Drop tries to reach not public ad\
dresses from LAN - no hace falta con los FILTER en los CPE" \
dst-address-list=no_internet in-interface-list=LAN log=yes log-prefix=\
!public_from_LAN src-address-list=Clientes
add action=jump chain=Check-forward comment=\
"Drop illegal destination port-services" connection-state=new disabled=\
yes dst-address=154.58.216.128/25 dst-port=\
0-78,81-123,143,161-162,583,587,993,995-1023,5060-5062,8291 \
in-interface-list=WAN jump-target=drop log=yes log-prefix=illegalPorts \
protocol=tcp src-address-list=!Administrador
add action=jump chain=Check-forward comment="Filter icmp" jump-target=ICMP \
protocol=icmp
add action=jump chain=Check-forward comment="Drop not register SIP" \
in-interface-list=WAN jump-target=drop src-address-list="SIP Hacker"
add action=add-src-to-address-list address-list="SIP Hacker" \
address-list-timeout=1w chain=Check-forward connection-state=new \
dst-port=5060 in-interface-list=WAN protocol=udp src-address-list=\
"SIP Trial"
add action=add-src-to-address-list address-list="SIP Trial" \
address-list-timeout=12s chain=Check-forward connection-state=new \
dst-port=5060 in-interface-list=WAN protocol=udp
add action=drop chain=Check-forward comment="Drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN \
log-prefix=!not_DSTNATed
add action=jump chain=Check-forward comment="SYN Flood protect" \
connection-state=new disabled=yes jump-target=SYN-Protect protocol=tcp \
tcp-flags=syn
add action=accept chain=SYN-Protect connection-state=new disabled=yes limit=\
600,5:packet protocol=tcp tcp-flags=syn
add action=log chain=SYN-Protect connection-state=new disabled=yes log=yes \
log-prefix=synPROTEC protocol=tcp tcp-flags=syn
add action=return chain=Check-forward comment=\
"Return to the chain that jumped" disabled=yes
add action=accept chain=ICMP comment="Echo request - Avoiding Ping Flood" \
icmp-options=8:0 limit=1,5:packet protocol=icmp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=\
icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 \
protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=\
3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=accept chain=ICMP comment="allow source quench" icmp-options=4:0 \
protocol=icmp
add action=drop chain=ICMP comment="Deny all other types" disabled=yes \
log-prefix="Deny ICMPin"
add action=drop chain=Check-input comment="drop scanners port" \
src-address-list="port scanners"
add action=accept chain=Check-input comment=\
"Accept established,related,untracked connections" connection-state=\
established,related,untracked
add action=drop chain=Check-input comment="Dropping invalid connections" \
connection-state=invalid log-prefix=input_invalid
add action=accept chain=Check-input comment=\
"Accept ICMP filtered by raw WAN and internal" log-prefix=icmp protocol=\
icmp
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=Check-input comment=\
"Port scanners to list " disabled=yes log-prefix=Pscan protocol=tcp psd=\
21,3s,3,1
add action=jump chain=Check-input comment="Protect WAN" in-interface-list=WAN \
jump-target=InputWan
add action=accept chain=InputWan comment=administradores src-address-list=\
Administrador
add action=jump chain=InputWan comment="Detect attack" jump-target=\
DetectAtack
add action=jump chain=InputWan comment="Drop access to router from atack" \
disabled=yes jump-target=drop src-address-list=input_blacklist
add action=accept chain=InputWan comment="Drop all from WAN" \
connection-state=new dst-port=portwinbox,portwww \
in-interface-list=WAN protocol=tcp
add action=drop chain=InputWan comment="Drop all from WAN" connection-state=\
new in-interface-list=WAN log-prefix=Drop-input-WAN disabled=yes
/ip firewall mangle
add action=mark-routing chain=prerouting comment=To_WAN-FO connection-mark=\
WAN log-prefix=FO-route new-routing-mark=WAN passthrough=no
add action=mark-connection chain=input comment="To_WAN-MO input" \
connection-mark=no-mark in-interface=pppoe-WAN log-prefix=FO-conn-in \
new-connection-mark=WAN passthrough=no
add action=mark-routing chain=output comment="To_WAN-MO out" connection-mark=\
WAN log-prefix=FO-route-out new-routing-mark=WAN passthrough=no
add action=mark-routing chain=prerouting comment=To_WAN-MM connection-mark=\
WAN-MM new-routing-mark=mm passthrough=no
add action=mark-connection chain=input comment="To_WAN-MM input" \
connection-mark=no-mark in-interface=vlan_MM new-connection-mark=WAN-MM \
passthrough=no
add action=mark-routing chain=output comment="To_WAN-MM out" connection-mark=\
WAN-MM new-routing-mark=mm passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-WAN
add action=masquerade chain=srcnat out-interface=vlan_MM
/ip firewall raw
add action=jump chain=prerouting comment="Check from WAN" in-interface-list=\
WAN jump-target=Check-WAN
add action=jump chain=output comment="Filtro icmp-OUTPUT" jump-target=\
ICMP-response log-prefix=RAW-icmp-output out-interface-list=WAN protocol=\
icmp
add action=drop chain=Check-WAN comment=\
"Drop connections FROM blacklisted hosts included bogons" log-prefix=\
FromBlacklist src-address-list=blacklist-1
add action=jump chain=Check-WAN comment=\
"Ports block, Router is not open DNS (53)" jump-target=Block-ports
add action=jump chain=Block-ports comment="Check illegal ports" dst-port=\
0-78,81-442,444-1024 jump-target=drop log-prefix=RAW-illegalPorts \
protocol=tcp
add action=jump chain=Block-ports comment="Accept NTP 123" dst-port=\
0-122,124-442,444-449,501-1024 jump-target=drop log-prefix=RawIllegalUDP \
protocol=udp
add action=return chain=Block-ports comment="Return to the chain that jumped"
add action=jump chain=Check-WAN comment="Check for bad TCP stuff" \
jump-target=TCP-check protocol=tcp
add action=jump chain=Check-WAN comment="Check for bad UDP stuff" \
jump-target=UDP-check protocol=udp
add action=jump chain=Check-WAN comment="Filtro icmp" jump-target=ICMP \
protocol=icmp
add action=jump chain=TCP-check comment="Invalid TCP destination port (0)" \
dst-port=0 jump-target=drop protocol=tcp
add action=jump chain=TCP-check comment="Invalid TCP source port (0)" \
jump-target=drop protocol=tcp src-port=0
add action=jump chain=TCP-check comment="Invalid TCP flag combo" jump-target=\
drop protocol=tcp tcp-flags=!fin,!syn,!rst,!ack
add action=jump chain=TCP-check comment="Invalid TCP flag combo" jump-target=\
drop protocol=tcp tcp-flags=fin,urg
add action=jump chain=TCP-check comment="Invalid TCP flag combo" jump-target=\
drop protocol=tcp tcp-flags=fin,rst
add action=jump chain=TCP-check comment="Invalid TCP flag combo" jump-target=\
drop protocol=tcp tcp-flags=fin,!ack
add action=jump chain=TCP-check comment="Invalid TCP flag combo" jump-target=\
drop protocol=tcp tcp-flags=syn,rst
add action=jump chain=TCP-check comment="Invalid TCP flag combo" jump-target=\
drop protocol=tcp tcp-flags=fin,syn
add action=jump chain=TCP-check comment="Invalid TCP flag combo" jump-target=\
drop protocol=tcp tcp-flags=rst,urg
add action=jump chain=UDP-check comment="Invalid UDP destination port (0)" \
dst-port=0 jump-target=drop protocol=udp
add action=jump chain=UDP-check comment="Invalid UDP source port (0)" \
jump-target=drop protocol=udp src-port=0
add action=accept chain=ICMP comment="Echo request - Avoiding Ping Flood" \
icmp-options=8:0 limit=1,5:packet protocol=icmp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=\
icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 \
protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=\
3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=accept chain=ICMP comment="Allow source quench" icmp-options=4:0 \
protocol=icmp
add action=drop chain=ICMP comment="Deny all other types" log-prefix=\
"RAWDeny ICMP"
add action=drop chain=drop comment="Log everything that we drop" log-prefix=\
RawDrop
add action=drop chain=prerouting src-address=10.53.255.0/24
/ip firewall service-port
set sip ports=5060,5061,4399
/ip ipsec identity
add peer=MTCO-MTK1
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0
add dst-address=192.168.1.0/24 peer=MTCO-MTK1 src-address=192.168.11.0/24 \
tunnel=yes
/ip route
add disabled=no distance=2 dst-address=0.0.0.0/0 gateway=vlan_MM \
routing-table=mm
add disabled=no distance=2 dst-address=0.0.0.0/0 gateway=pppoe-WAN \
pref-src="" routing-table=WAN scope=30 suppress-hw-offload=no \
target-scope=10
add comment=IPSEC-k1 disabled=no dst-address=192.168.1.0/24 gateway=\
2.137.226.56 routing-table=WAN-FO target-scope=30
add disabled=no dst-address=0.0.0.0/0 gateway=10.0.3.1 routing-table=Gibra
add disabled=no distance=2 dst-address=0.0.0.0/0 gateway=10.32.0.121
add comment="GA" disabled=no distance=30 dst-address=100.105.2.0/24 \
gateway=10.100.5.4 scope=20
add comment="AT" disabled=no distance=30 dst-address=100.105.3.0/24 \
gateway=10.100.5.4 scope=20
add disabled=no dst-address=0.0.0.0/0 gateway=19.0.0.1 routing-table=Equinix
add comment="Ips mng" disabled=no dst-address=10.205.2.0/24 gateway=\
10.100.5.4
add disabled=no dst-address=0.0.0.0/0 gateway=10.100.5.4 routing-table=Gacela
add disabled=no dst-address=10.5.101.20/32 gateway=10.100.5.4
add disabled=no dst-address=0.0.0.0/0 gateway=212.231.228.1 routing-table=mm
add disabled=no distance=2 dst-address=0.0.0.0/0 gateway=212.231.228.1 \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
/ip service
set telnet disabled=yes
set ftp address=100.105.1.0/24 port=211
set www port=portwww
set ssh disabled=yes port=8822
set api address=100.105.0.0/16
set winbox port=portwinbox
set api-ssl disabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ppp aaa
set use-radius=yes
/ppp secret
add name=cu profile=PPPoE_cu remote-address=100.105.1.178 service=pppoe
add local-address=10.0.3.2 name=Gibraleon profile=default-encryption \
remote-address=10.0.3.1 service=l2tp
/routing filter rule
add chain=ospf-in disabled=yes rule=\
"if (dst in 10.5.101.0/28 && dst-len in 28-32) { reject; }"
/routing ospf interface-template
add area=backbone-v2 auth-id=1 auth-key="" cost=10 disabled=no interfaces=\
lobridge networks=10.255.5.1 passive priority=1
add area=backbone-v2 auth-id=1 auth-key="" cost=10 disabled=no interfaces=\
ether6 networks=10.100.5.0/29 passive priority=1
add area=backbone-v2 auth-id=1 auth-key="" cost=10 disabled=no interfaces=\
vlanMNG networks=10.205.1.0/24 passive priority=1
/routing rule
add action=lookup disabled=no src-address=100.105.1.128/26 table=mm
/snmp
set enabled=yes trap-version=3
/system identity
set name=M.co
/system logging
set 1 topics=error,!pppoe
set 2 topics=warning,!interface
add topics=radius,!debug
add prefix=PPPoE topics=pppoe,!debug
add prefix=INTERFACE topics=interface
add topics=account
add topics=e-mail
/system package update
set channel=testing
/system resource irq rps
set sfp-sfpplus1 disabled=no
/system watchdog
set watchdog-timer=no
/tool graphing interface
add interface=ether10
add interface=ether7
add interface=ether9
/tool romon
set enabled=yes
/tool romon port
set [ find default=yes ] forbid=yes
add disabled=no interface=ether3
add disabled=no interface=ether6
add disabled=no interface=ether1
add disabled=no interface=ether2
add disabled=no interface=ether7
add disabled=no forbid=yes interface=vlanMNG
add disabled=no forbid=yes interface=ether10
add disabled=no forbid=yes interface=ether8
I hope I don't have to do a netinstall, the computer is in a remote place.
Best regards
Running CRS328-24P-RS+ and I noticed when I upgraded to 7.4.1 my troughput on my 500 MB Internet would not go over 300 MB and my CPU % on the appliance was maxed out durring the speed test. I downgraded to 7.2.3 and my througput is back to the 480 MB Range and the CPU % only reaches about 85% during the speed test. I saw similar results on 3 different systems when upgrading to 7.4.1. I tried the 7.5.1 RC and it acted the same way. I believe 7.3.1 did not have this issue, but can’t remember for sure what version they were all on before upgrading to 7.4.1 firmware.
Make sure you check your throughput on all your devices. 7.41 seems to cap throughput on the CRS328 at 300 MB, maxing out CPU Usage at that speed. So far it is the only one I have found with the issue.
First rule of MT networking: don’t use ROS speedtest to assess throughput and/or load it causes. Never ever. It was always really only usable as a traffic generator without capability to do it wirespeed. Always use external tools (e.g. a pair of computers running iperf3) to conduct tests if meaningful results are expected.
Possibly this is because the device is limited to just one CPU core now?
I upgraded a CRS309-1G-8S+ from 7.4 → 7.4.1 and it failed to restart. On the serial console it output “kernel loading failed”. I was able to recover using netinstall, but after the upgrade no link/status lights on the SFP+ ports work.
I also upgraded an RB5009UG+S+IN at the same time: no issues so far there.
Doesn’t matter what the test is, if results change solely based on a firmware upgrade, then the firmware upgrade caused the change? Meaningful enough for me. Speedtest.net is what I always use to test bandwidth…may not be the best but seems to get consistent results.
Very well could be, but odd the new firmware increases the CPU Demand that much. They should fix it OR just have a warning that certain models shouldn’t upgrade beyond 7.31.
Well, after all this is a switch, you should not shout too loud if the routing performance changes.
In addition, official test results indicate that CRS328-24P is capable of routing (realistically) at 300Mbps give or take.
I attempted upgrade to v7.4.1, just to discover the legendary instabilities of my hAP AC2 were back with it. Kernel failures, out of memory conditions. It basically reboot 3 to 4 times per hour at minimum, even with almost no traffic. I underclocked the unit without improvements.
The stability of this device (changed under warranty without any improvement) has been a nightmare for me for 2 years, but it eventually managed to be completely stable on recent 6.48.x and 6.49.x series, so I am pretty confident software would eventually work for it on v7.x as well.
Meanwhile will have to downgrade.
Do you have Layer 3 Switching enabled? It limits some of the firewall/NAT capabilities, but should punt most of the routing to the switch chip.
CRS 328 do not support Fasttrack or NAT connection offloading.
New version v7.5 has been released!
http://forum.mikrotik.com/t/v7-5-stable-is-released/160518/1