ip->firewall->Service Ports are shown as invalid (I) in case “tracking set enabled=no”
Anybody can confirm this (you have to reboot router to replicate this)?
Is that OK or minor bug?
This is supposed to be so. NAT helpers will not work without connection tracking.
Hello,
As mentioned in this post for v6.5, it would appear SSH out from a v6.7 RouterBoard to an SSH host with “ChallengeResponseAuthentication yes” (i.e. most default installs of SSH on any Linux host) still fails - it just times out.
RouterOS to RouterOS is fine, just not to other SSH servers with that option set.
Is anyone else aware of this?
Cheers,
Harry
I have noticed some weird behaviours with SSH recently on routersOS versions. I haven’t traced this as the issue nor have I confirmed it yet (I will try do some testing)
I wonder if this may be a side effect of the change they put in place after the SSH Crash bug was discovered and reported. Its possibly a new config they deployed or the new SSH client has a different setup.
I will try check and update.
Regards
Alexander
to what “most default installation” you are referring to? To my knowledge if you are talking about OpenSSH server on linux installation then there is no difference what is set as ChallengeResponseAuthentication and PasswordAuthentication enables same behaviour on the server side. In theory ChallengeResponseAuthentication can ask several questions/password however the end result is - it uses PAM to authenticate that in turn requests password every single time. Thus there is no additional security for Linux installs using either of configuration keywords.
As such this problems is deemed as low priority as there are methods on how to achieve greater security, like PubkeyAuthentication setting where key is password protected.
However, we will look into this issue that with ChallengeResponseAuthentication yes it is not possible to log in to another host via ssh.
I’ve been chasing down an IPv6 bug that’s been a little difficult to work out.
The circumstances are as follows:
-
Internet connection is PPPoE
-
DHCPv6 Client attached to PPP interface
/ipv6 dhcp-client
add add-default-route=yes interface=Internode pool-name=NODE-PD -
IPv6 address from DHCPv6 Pool
/ipv6 address
add address=::1 from-pool=NODE-PD interface=LAN
(LAN interface is bridge of wireless and local switchports)
This works fine:
ping ipv6.google.com:
Reply from 2404:6800:4006:806::1014: time=15ms
Reply from 2404:6800:4006:806::1014: time=18ms
Reply from 2404:6800:4006:806::1014: time=16ms
Reply from 2404:6800:4006:806::1014: time=17ms
Reply from 2404:6800:4006:806::1014: time=18ms
If you do any of the following:
disable/enable dhcpv6-client
disable/enable pppoe-client interface
release/renew dhcpv6 pool
or
ppp drops out
then it appears that this mechanism breaks:
- IPv6 address from DHCPv6 Pool
/ipv6 address
add address=::1 from-pool=NODE-PD interface=LAN
and ipv6 pings will time out:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
disabling/reenabling the ipv6 address resolves the issue:
Reply from 2404:6800:4006:806::1013: time=16ms
Reply from 2404:6800:4006:806::1013: time=16ms
Reply from 2404:6800:4006:806::1013: time=17ms
Reply from 2404:6800:4006:806::1013: time=17ms
What exactly was done?
wireless - improve rate selection for nstreme protocol
what does this mean and how it work? inverted modem signal trigger? is it for 3G usb modems?
When Data Rates are selected on default
improves data rate selection for best performance - noting to do with disconnect/connect issue
but this is good step MT finally released some improvement for nstreme
seriously no response to this at all? i even have a video showing it?
OK, there was issue when idling to get latencies in thousand.. Was that the sort of issue which was solved?
[quote=“Lakis”]
When Data Rates are selected on default
improves data rate selection for best performance - noting to do with disconnect/connect issue
but this is good step MT finally released some improvement for nstreme
[/quote]
so , maybe mt give us stable and full functionality MiMo with nstreme ?
how long we are waiting ?
I also upgraded my 750UP from ROS6.5 to 6.7. One of them crashes and reboots when accessed from Winbox or Webbox. SSH access allows me in. I have 1 device on a poe port and 2 other ports active without POE.
This one router has some problems already (port 1 is broken, ports 3 and 5 don’t do POE out). I was getting ready to throw this one away, until I saw the 6.7 release and thought ‘maybe this will help’. It didn’t.
What’s curious is that if I just leave it alone, the device works okay: poe-out on port 2, ports 4-5 on the switch.
Routing is fine and system health looks okay (via ssh). Just wish there was a simple explanation for what’s causing Winbox to crash. I haven’t caught anything in the /log.
I have another 750UP that took the upgrade fine and still accessible from Winbox and Webbox.
Edit: Downgraded the router to 6.5 and now Winbox connects and everything is working. Seems like maybe something buggy in the upgrade to 6.7.
my prefix isn’t changing in this case. it’s “semi permanent”.
What do you mean ‘semi permanent’? Either you have a static prefix (like a HE tunnel), or you doesn’t.
my isp gives me the same ipv6 prefix every time i auth.
they reserve the right to change it so its not static.
Successfully updated my Edge and Core RBs.
6.5->6.7
ccr1036 - upgrade from 6.5 to 6.7 OK
Is it possible if i upgrade from ROS V5.26 to ROS v6.7 directly ?