Might be same issue for you.
We started rolling it out for security sake. 1/3 of flashed routers lose internet/IP
We found that DHCP server (which is on bridge) goes to “unknown” and goes red
Also, under bridge ports, random ports will also go to “unknown”
Changing those back to correct settings restores all service
routeros 6.41+ have new implementation of bridges beware of that change
because that we need 6.40.x fixed version to update without the issues on bridge for in production rotuers with many vlans on bridges until shedule a maintenance windows to upgrade una controlled time without service disruption
I’m in a rural location and going through 3 different mikrotik radios to hook into our local WISP. All were on 6.41.3 and I’ve upgraded them to 6.42.1 now. However, the final client radio link that is setup as a bridge seems to be having all kinds of problems. After upgrading, when I try to access via winbox it the logs are all empty and the whole winbox interface is unresponsive. On top of that I’m having huge issues with outbound web and ftp traffic? It’s a little hard to tell what is going on because I know the WISP has implemented some aggressive firewall blacklist rules until they can patch-up all their mikrotik gear.
Is it possible my issue is the routeros upgrade from 6.41.3 to 6.42.1? Everything went really pear shaped after I patched, but their could have been changes in the network core happening at the same time.
BartoszP, chechito - We will release 6.40.8 as soon as possible. As we just yesterday found out about this vulnerability, we were lucky that 6.42.1 was already on the way. In order to release a version, we have to test it first. 6.40.8 is coming, but will take most likely one or two days. I assume that no one here wants to install un-tested bugfix version on their routers 
miro263, skullzaflare, sspratt - Please generate supout file on your device while problem is present. Send this file to support@mikrotik.com.
Jotne, msatter, Pea, Kraken2k - This is how RouterBOOT upgrade been working since always. You need to reboot device manually after you have performed upgrade feature. Since RouterBOOT mainly is responsible for booting process we do not want to make fully automatical RouterBOOT upgrade process or force it because it rarely has any updates for already released products and automated upgrade/reboot might lead up to more problems than bring anything good into equation. However, if you want to forget about firmware, then you can enable auto-upgrade feature and RouterBOOT will upgrade itself upon the next reboot when RouterOS will be upgraded - RouterOS upgrade, reboot, one more reboot in order to upgrade RouterBOOT.
Then why not give more information about that in the routerboard settings. You know how it works so you do not need such information, I know it now, but for all other that click the upgrade button to sync the firmware it will remain a mystery. Just add som words what to do will help others.
Warnings are already there. Can you provide screen shot where we can see that the warning is missing?
Not in WebFig. I have upgraded two hap ac2 yesterday to 6.43rc4 and nothing visible happened on pressing the “upgrade firmware” button in System->Routerboatd (done that with 6.43rc4 already running to be clear, and after reboot, the new firmware is shown as running). Overlay windows do indicate errors like “cannot connect, scan is not running” in wireless configuration, so it should not be a browser incompatibility.
I’ve updated a CCR1036 from 6.42 to 6.42.1 and webfig now only works on one of two configured IP addresses on the same interface.
Edit: Solved and not related to the update.
Hi strods, this happened for the first time that log message about upgrade was missing completely.
Unfortunately all my devices are upgraded already, so I cannot check if the warning was in System/Routerboard/Settings.
But it was definitely missing in log.
Now if I look into terminal I still see 2 lines (I pressed Upgrade button twice ). But this should not be there while the router was already rebooted, right?
I think this is expected. You installed the firmware upgrade and rebooted without opening the terminal. Critical messages are stored to be shown the next time you open the terminal, that was after reboot.
If you open the terminal before reboot you will not see these messages after reboot.
Just updated one of our Metal G-52SHPacn to new v6.42.1 RouterOS.
tools/netwatch does not work anymore. When the tested server is “up”, we run [:global srvstat “up”] to set the variable srvstat. Did work with 6.41.2
Looks like up event is not working.
Version 6.42 has this changelog entry:
*) netwatch - limit to read, write, test and reboot policies for Netwatch script execution;
I guess that breaks your use case.
LED problems：
[admin@911-1] > system leds set interface=wlan1 type=wireless-signal-strength
input does not match any value of type
[admin@911-1] > system leds set interface=wlan1 type=wireless-status
input does not match any value of type
[admin@911-1] >
Yes, netwatch is no longer usable to start scripts. Even to write to global variables fails. Only write to .txt files works. On up event, I need to write the server status up to a variable or file and start a script.
Still did not find a solution for that use. A high interval schedule is no option.
This boggles my mind…
In Winbox you can see the message the firmware is upgraded but you will have to first open the window Settings to see that. Why not display it in the Routerboard window where you initiate the upgrade???
Now you think did I click that Upgrade button or not because nothing happened..and click again and again…
Now that the firmware has the same version as RouterOS, and assuming that not every update to RouterOS really includes
a changed firmware version, maybe something can be done to change the warning after the firmware update so that it
does not require a reboot when nothing other than the version has changed?
As it is now, every update requires two reboots, and in many cases (e.g. when updating from 6.42 to 6.42.1) that is likely
not very necessary.
Maybe your problem is that you haven’t specified which LED? Don’t know what hardware you are using, so don’t know how many LEDs there are.
Not related to Winbox security issue, but seems like a bug …
On 6.41.x and 6.42.x MNDP trafic is not visible anymore in firewall output chain …
For example I am using this rules
/ip firewall raw> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=output action=passthrough log=yes log-prefix="" protocol=udp
1 ;;; MT discovery
chain=prerouting action=notrack dst-port=5678 log=no log-prefix="" protocol=udp dst-address=255.255.255.255
2 ;;; MT discovery
chain=output action=notrack dst-port=5678 log=no log-prefix="" protocol=udp dst-address=255.255.255.255
And on 6.40.x it works as expected
print stats
Flags: X - disabled, I - invalid, D - dynamic
# CHAIN ACTION BYTES PACKETS
0 D ;;; special dummy rule to show fasttrack counters
prerouting passthrough 55 903 342 279 167
1 prerouting notrack 295 008 2 176
2 output notrack 25 870 195
But on 6.41.x and 6.42.x no packet is ever detected in output chain
print stats
Flags: X - disabled, I - invalid, D - dynamic
# CHAIN ACTION BYTES PACKETS
0 output passthrough 226 965 1 663
1 ;;; MT discovery
prerouting notrack 99 706 724
2 ;;; MT discovery
output notrack 0 0
So is this some undocumented new feature and if so what is the benefit, or is it just a bug?
Regards
Excellent thought and in the release notes it should also state that the firmware is updated and that a upgrade is recommended. If nothing has changed then always as last line in release notes: “- no firmware upgrade needed when you current firmware is x.xx.x or higher.”
If Mikrotik don’t want to go trough this administration then consider to only increase the firmware revision when it is updated. So lastest firmware can be 6.41.4 and the RouterOS version could be 6.42.1.
Being cosmetic, it could also sync with RouterOS version without the user knowing. On downgrade it will show the sync or downgrade automatically like is the case now if I remember that correctly.
How to disable dynamic dhcp client on LTE links?
/ip dhcp-client print detail
Flags: X - disabled, I - invalid, D - dynamic
0 D interface=lte1 add-default-route=yes default-route-distance=2 use-peer-dns=yes use-peer-ntp=yes dhcp-options=hostname,clientid
status=error dhcp-server=192.168.8.1
Leaving as above with static address on lte interface (i need static rules for routing with marks) will generate a lot of errors in logs
“dhcp-client on lte1 failed to add IP address 192.168.8.100: already have such address (6)”
Adding a disabled rule does not block the creation of a dynamic entry.
/ip dhcp-client print detail
Flags: X - disabled, I - invalid, D - dynamic
0 XI interface=lte1 add-default-route=yes default-route-distance=2 use-peer-dns=no use-peer-ntp=no dhcp-options=hostname,clientid
1 ID interface=lte1 add-default-route=yes default-route-distance=2 use-peer-dns=yes use-peer-ntp=yes dhcp-options=hostname,clientid
The modem is USB Huaweii E3372h hi-link mode