RouterOS 7.16.2 is the version that does not have a bug in Hotspot

RouterOS General
1

I have several IP subnets as follows:

  • Hotspot: 172.16.0.0/21


  • Application: 192.168.46.0/24


  • Cable: 192.168.1.0/24

On RouterOS version 7.16.2:

  1. A user who logs into the hotspot and gets a DHCP IP (e.g., 172.16.1.2) can access web services (ports 80 and 443), SSH, etc., on 192.168.46.8.
  2. After logging into the hotspot, the user attribute is AH.
  3. A device with IP 192.168.1.17 can still access web services (ports 80 and 443), SSH, etc., on 192.168.46.8.

However, since version 7.17 up to 7.18.2:

  1. A user who logs into the hotspot and gets a DHCP IP (e.g., 172.16.1.2) cannot access web services (ports 80 and 443), SSH, etc., on 192.168.46.8. Ping to this IP also times out.
  2. Internet access (e.g., Google, etc.) is still working fine.
  3. If IP 172.16.1.2 is bypassed (P), the user can access services on 192.168.46.8.
  4. After logging into the hotspot, the user attribute changes to (AD).
  5. A device with IP 192.168.1.17 can still access services on 192.168.46.8, so this issue seems to affect only the hotspot subnet only.

This issue only occurs in versions above 7.16.2 and started happening since 7.17.
This issue in the hotspot reminds me of Client Isolation, where the user cannot interact with other IPs, whether within the same subnet or across different subnets.
For now, my temporary solution is to downgrade to version 7.16.2.

I have encountered this issue on several devices:

  • CCR2004


  • RB-1100AHx4


  • RB-450Gx4


  • RB-750Gr3

Has anyone else experienced this issue? Is there any solution other than downgrading?

2

Have seen what you describe on 7.18.2.

I couldn’t downgrade to 7.16.2 (probably device-mode issue). Could downgrade to 6.49.18.
tile CCR1009 btw.

I setup hotspot on 7.18.2 as a test, and it works on a fresh unit (RB2011). Perhaps some existing config is a factor, or did you manage to isolate it to only some routerboard variants? RADIUS mac authentication was used, but not on the fresh units, perhaps it is related to the issue?