All my dynamic IP list entries are missing after the upgrade. I had to add them again from backup.
Aren’t dynamic entries kept in RAM (to save lots of glash storage space and potentialky many flash writes)? That would mean that entries are lost on every reboot (upgrade or not).
The problem also occurs with other routers such as HEXs
I have now reduced the DNS cache from 2048 KiB to 1024 KiB.
We do not use DOH and adlist.
Basically the following things are configured
DHCP server
PPPOE dial-in
2 VLANs
Firewall (ipv4 & ipv6) incl. address list (5 entries)
2 x Wireguard connections
2x BGP via the wireguard connections
SNMP
But no idea why it crashes sporadically.
DNS-01 with LE would be awesome!! had to setup cloudflare for a nginx reverse wildcard cert last week
would have been surely more convinient with a built-in DNS-01 functionality
FWIW, I think that’s what he meant by [2]. (it’s a bug in the forum… if you use a “numbered list button”, it does not create a numbered list, you need a “list=1” not just “list=”)
But you can cheat this with the “match-subdomain=yes”, since this puts them in same static “category” in the DNS’s two-step static lookup:
/ip/dns/static/add name=nas.home.arpa type=A address=192.168.88.100 match-subdomain=yes
/ip/dns/static/add name=home.arpa type=NXDOMAIN match-subdomain=yes
Now, this has the side-effect of also resolves “whatever.nas.home.arpa” to same IP as “nas.home.arpa”, but again if you used another match-submdomain=yes… .
My point above is that home.arpa is a valid domain per RFCs & will get sent to uptream DNS per specs – unless /ip/dns matches it somehow that is… So if you don’t want mDNS/DNS-SD stuff like _ipp._tcp.home.arpa kinda stuff leaking (which likely isn’t a huge problem per se, since there is no sensitive info), then some you need some /ip/dns/static to prevent it. Like the “/ip/dns/static/add name=home.arpa type=NXDOMAIN match-subdomain=yes” shown above (without the static host in most cases)
This morning I started upgrading my cAP ac by updating the packages. Now the device seems to be in a boot loop, from my router I can see it disconnecting and connecting constantly and it is not possible to access the UI using WinBox.
I really hope this doesn’t mean I once again have to set up everything from scratch.
Pretty sure you created an export, just in case this happens!? Especially after previous event…
Yes, I should have one still on my desktop. I just had a hard time getting the thing reinstalled using Netinstall last time, and don’t remember what I exactly did to get it finally working.
What includes “the packages” exactly?
The basic ones to make things work, nothing extra added there. I don’t remember by heart which two there are installed (and cannot check because the thing is bricked).
why update packages manually and not use the built-in update functionality?
I did use the built-in functionality. That’s what bugs me, MT is really flaky at times.
I’m afraid this is not fixed yet.
cAP AC, reboot after 2d22h due to kernel failure.
PRTG monitoring shows increasing memory usage until reboot happens.
Back to daily scheduled reboot for now 
I already have an open ticket, will send autosupout there.
4+ days uptime on cap ac here.
/system/resource/print
uptime: 4d1h43m31s
version: 7.16 (stable)
build-time: 2024-09-20 13:00:27
factory-software: 6.44.6
free-memory: 32.5MiB
total-memory: 128.0MiB
cpu: ARM
cpu-count: 4
cpu-frequency: 672MHz
cpu-load: 1%
free-hdd-space: 736.0KiB
total-hdd-space: 16.0MiB
write-sect-since-reboot: 493
write-sect-total: 32280
architecture-name: arm
board-name: cAP ac
platform: MikroTik
Similar problem here.
Instead asking the server it was told to use it gets it from the static entry.
also cname records not printed it seems
/ip/dns/static/print
Columns: NAME, TYPE, ADDRESS, TTL
NAME TYPE ADDRESS TTL
;;; defconf
0 router.lan A 192.168.1.1 1d
1 unifi CNAME 1d
2 jozska.ddns.pista.hu A 192.168.1.1 5s
/system/script/print
Flags: I - invalid
0 name="DDNS" owner="welder" policy=ftp,read,test dont-require-permissions=no last-started=2024-09-30 11:38:15 run-count=4580
source=
:local hostName [/system/identity/get name];
:local resolvedIP [:resolve domain-name=$hostName server=ddns.pista.hu type=ipv4];
:log info $resolvedIP;
:local ipaddress [/ip/address/get [find interface="vodafone"] address];
:log info $ipaddress;
:local currentIP [:pick $ipaddress 0 [:find $ipaddress "/"]];
:if ($resolvedIP != $currentIP) do={
:log info ("Pista DDNS: " . $hostName . " : " . $resolvedIP . " -> " . $currentIP);
:local result [/tool/fetch user=MikroTik password="Jelszo" url=("https://ddns.pista.hu/nic/update?system=dyndns&hostname=".$hostName."&myip=".$currentIP)
as-value output=user];
:log info $result;
} else={
:log info ($hostName . " : " . $resolvedIP . " == " . $currentIP);
}
/log/print
11:40:15 script,info 192.168.1.1
11:40:15 script,info 78.139.9.126/24
11:40:15 script,info Pista DDNS: jozska.ddns.pista.hu : 192.168.1.1 -> 78.139.9.126
11:40:15 fetch,info Download from ddns.pista.hu FINISHED
11:40:16 script,info data=nochg 78.139.9.126
11:40:16 script,info ;downloaded=0;duration=00:00:01;status=finished
(domain names are not real!!! mangled)
Despite the initial problems I faced (loss of connectivity, no DoH, Wireguard failing, which I believe was all to do with wrong time), I have had over 5 days of stable uptime on my hAP AX3
This is a home router, no trunking to other switches etc.
I use:
6 VLANs (with DHCP, Firewall rules) etc, 5 of which have wifi (2 each, for 2.4 and 5ghz)
DoH
Wireguard
Basic extras like interface and address lists
A few scripts and scheduled tasks for backups
Pretty basic stuff but has been fine since.
Confirm a similar behaviour of 5009 and hap ac3. WAN has an IP address assigned and suddenly stops passing connections. There is no useful info in the log. It happened 2 or 3 times during the last 24 hours. Restart is the only way to make WAN work again.
Before 7.16 the routers had 7.15.3 and worked stable for a couple of weeks without a reboot.
Even on my CCR1009, connections suddenly stopped working after approx. 1d of uptime.
-faxxe
I don’t think we will get any further with that issue when people report it only like that.
Either make a ticket at the support system including your supout.rif or post the (possibly anonymized) export file.
I have several routers running 7.16 both at home and at work and I have not observed this.
Today the model hex with routeros 7.16 has already failed to respond 3 times and had to be restarted.
Here is the config of one of the routers where the problem occurs. I have changed names and public IPs.
Maybe someone will find the error.
The fact is that I have about 10 routers in use and the problem occurs everywhere since version 7.16. They are all configured similarly. So with BGP and Wireguard, DNS and Firewall. SNMP queries and API queries are also made. I don’t know if this is related. Backup files are also created and retrieved via ftp.
# 2024-09-30 16:10:18 by RouterOS 7.16
# software id = XXXXXXX
#
# model = RB5009UG+S+
# serial number = HFXXXXXXXXX
/interface bridge
add admin-mac=78:9A:18:61:C7:D5 auto-mac=no comment=BR-CUST name=BR-CUST port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=1-AP
set [ find default-name=ether2 ] name=2-Uplink
set [ find default-name=ether3 ] name=3-Uplink
set [ find default-name=ether4 ] name=4-Uplink
set [ find default-name=ether5 ] name=5-Uplink
set [ find default-name=ether6 ] name=6-Uplink
set [ find default-name=ether7 ] name=7-Uplink
set [ find default-name=ether8 ] name=8-Internet
/interface wireguard
add listen-port=13231 mtu=1420 name=WG01
add listen-port=13232 mtu=1420 name=WG02
/interface vlan
add interface=BR-CUST name=VLAN20-PublicInternet vlan-id=20
/interface list
add name=WAN
add name=LAN
add name=VPN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool-CUSTBusiness ranges=192.168.11.120-192.168.11.150
add name=pool-CUSTGuest ranges=172.18.2.100-172.18.2.200
/ip dhcp-server
add address-pool=pool-CUSTGuest interface=VLAN20-PublicInternet name=CUST-Guest server-address=172.18.2.1
/ip smb users
set [ find default=yes ] disabled=yes
/interface pppoe-client
add add-default-route=yes disabled=no interface=8-Internet name=PROVIDER profile=default-encryption use-peer-dns=yes user=*******************************
/routing bgp template
set default address-families=ip,ipv6 as=65506 disabled=no output.redistribute=connected,bgp router-id=10.0.251.130 routing-table=main
/snmp community
set [ find default=yes ] authentication-protocol=SHA1 security=authorized
/system logging action
set 3 remote=10.15.90.5 src-address=192.168.11.100 syslog-facility=syslog
/interface bridge port
add bridge=BR-CUST comment=defconf interface=2-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=3-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=4-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=5-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=6-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=7-Uplink internal-path-cost=10 path-cost=10
add bridge=BR-CUST comment=defconf interface=sfp-sfpplus1 internal-path-cost=10 path-cost=10
add bridge=BR-CUST interface=1-AP internal-path-cost=10 path-cost=10
add bridge=BR-CUST interface=VLAN20-PublicInternet internal-path-cost=10 path-cost=10 pvid=20
/ip firewall connection tracking
set udp-stream-timeout=5m udp-timeout=5m
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=BR-CUST tagged=1-AP,BR-CUST vlan-ids=20
add bridge=BR-CUST vlan-ids=1
/interface list member
add interface=BR-CUST list=LAN
add interface=8-Internet list=WAN
add interface=WG02 list=VPN
add interface=WG01 list=VPN
/interface wireguard peers
add allowed-address=::/0,0.0.0.0/0 endpoint-address=XXXXXXXXXXXXX endpoint-port=51823 interface=WG01 name=peer1 persistent-keepalive=10s public-key=\
"XXXXXXXXXXXXXXXXXXXXXXX"
add allowed-address=::/0,0.0.0.0/0 endpoint-address=XXXXXXXXXXXXXX endpoint-port=13239 interface=WG02 name=peer2 persistent-keepalive=10s public-key=\
"XXXXXXXXXXXXXXXXXXXXXXXXXX="
/ip address
add address=192.168.11.100/24 interface=BR-CUST network=192.168.11.0
add address=172.20.254.2/28 interface=8-Internet network=172.20.254.0
add address=10.21.255.38/30 interface=WG01 network=10.21.255.36
add address=10.21.252.34/30 interface=WG02 network=10.21.252.32
add address=172.18.2.1/24 interface=VLAN20-PublicInternet network=172.18.2.0
/ip dhcp-client
add comment=defconf interface=8-Internet
/ip dhcp-server network
add address=172.18.2.0/24 dns-server=172.18.2.1 gateway=172.18.2.1
add address=192.168.11.0/24 dns-server=192.168.11.100 gateway=192.168.11.100
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=10.18.0.0/16 list=XXXXXXXXX
add address=10.15.200.0/24 list=XXXXXXXXX
add address=10.15.91.0/24 list=XXXXXXXXX
add address=10.15.90.32 list=YYYYYYYYYYY
add address=10.15.90.68 list=YYYYYYYYYYY
add address=10.1.252.0/24 list=YYYYYYYYYYY
add address=10.0.0.0/8 list=RFC1918
add address=172.16.0.0/12 list=RFC1918
add address=192.168.11.0/16 list=RFC1918
add address=XXXXXXXXXX/27 list=XXXXXXXXX
/ip firewall filter
add action=accept chain=forward in-interface-list=VPN out-interface-list=VPN
add action=accept chain=forward src-address-list=XXXXXXXXX
add action=accept chain=input src-address-list=XXXXXXXXX
add action=accept chain=forward src-address-list=YYYYYYYYYYY
add action=accept chain=input src-address-list=YYYYYYYYYYY
add action=accept chain=output
add action=drop chain=input in-interface=PROVIDER src-address-list=BL_LIST
add action=add-src-to-address-list address-list=BL_LIST address-list-timeout=4w2d10h chain=input dst-port=53,161,123 in-interface=PROVIDER protocol=udp src-address-list=!RFC1918
add action=add-src-to-address-list address-list=BL_LIST address-list-timeout=none-dynamic chain=input dst-port=53,161,123,5060,25,23 in-interface=PROVIDER protocol=tcp src-address-list=\
!RFC1918
add action=drop chain=input dst-port=53,161,123,5060 in-interface=PROVIDER log-prefix="DNS DROP" protocol=udp src-address-list=!RFC1918
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=accept chain=input comment=" accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=" accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="drop invalid" connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat comment=masquerade dst-address=172.20.254.0/24 ipsec-policy=out,none
add action=masquerade chain=srcnat comment=masquerade ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment=masquerade dst-address-list=!RFC1918 ipsec-policy=out,none
/ip firewall service-port
set sip disabled=yes
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set telnet disabled=yes
set ftp address=10.0.0.0/8,192.168.11.0/16,172.16.0.0/12
set www address=10.0.0.0/8,192.168.11.0/16,172.16.0.0/12
set ssh address=10.0.0.0/8,192.168.11.0/16,172.16.0.0/12
set api address=10.0.0.0/8,192.168.11.0/16,172.16.0.0/12
set winbox address=10.0.0.0/8,192.168.11.0/16,172.16.0.0/12
/ip smb shares
set [ find default=yes ] directory=/pub
/ipv6 address
add address=2003:a:a39:5300::1 interface=BR-CUST
/ipv6 dhcp-client
add add-default-route=yes interface=PROVIDER pool-name=PROVIDERV6 request=prefix
/ipv6 dhcp-server
add address-pool=PROVIDERV6 interface=BR-CUST lease-time=15m name=DHCP
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/routing bfd configuration
add disabled=no interfaces=WG02
add disabled=no interfaces=WG01
/routing bgp connection
add add-path-out=all address-families=ip,ipv6 as=65506 connect=yes disabled=no input.filter=BGP-01-IN listen=yes local.role=ebgp name=LOCATION01 output.filter-chain=BGP-01-OUT .redistribute=\
connected,bgp remote.address=10.21.255.37/32 .as=65505 router-id=10.0.251.130 routing-table=main templates=default use-bfd=yes
add add-path-out=all address-families=ip,ipv6 as=65506 connect=yes disabled=no input.filter=BGP-02-IN listen=yes local.role=ebgp name=LOCATION02 output.filter-chain=BGP-02-OUT .redistribute=\
connected,bgp remote.address=10.21.252.33/32 .as=65330 router-id=10.0.251.130 routing-table=main templates=default use-bfd=yes
/routing filter rule
add chain=BGP-02-OUT disabled=no rule="if (dst in 192.168.11.0/24 || dst in 172.18.2.0/24) {accept;} else { set bgp-path-prepend 3; accept}"
add chain=BGP-01-OUT disabled=no rule="if (dst in 192.168.11.0/24 || dst in 172.18.2.0/24) {accept;} else { set bgp-path-prepend 7; accept}"
add chain=BGP-01-IN disabled=no rule="if (dst in 10.18.0.0/16) {set bgp-path-peer-prepend 10; accept}"
add chain=BGP-01-IN disabled=no rule="if (dst in 10.0.0.0/8 || dst in 172.16.0.0/12 || dst in 192.168.11.0/16) {set bgp-path-peer-prepend 12; accept;} "
add chain=BGP-02-IN disabled=no rule="if (dst in 10.15.0.0/16) {set bgp-path-peer-prepend 12; set bgp-path-prepend 12;\r\
\n accept}"
add chain=BGP-02-IN disabled=no rule="if (dst in 10.0.0.0/8 || dst in 172.16.0.0/12 || dst in 192.168.11.0/16) {set bgp-path-peer-prepend 2; accept;} "
/snmp
set contact=MAILADRESS enabled=yes location="CUSTOMER"
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=GW01
/system logging
add action=remote prefix=SI-CUST01 topics=info
add action=remote prefix=SI-CUST01 topics=critical
add action=remote prefix=SI-CUST01 topics=error
add action=remote prefix=SI-CUST01 topics=warning
add prefix=SI-CUST01 topics=backup,bfd,bgp,dhcp,dns,firewall,interface,pppoe,wireguard,backup
/system note
set show-at-login=no
/system script
add dont-require-permissions=no name=AutomaticRestart owner=stc policy=reboot,read,write,test source=":local PingCount 300;\r\
\n:local stop false;\r\
\n:while ([/ping 8.8.8.8 count=1 interval=5]=0 && stop=false) do={\r\
\n :set PingCount (\$PingCount-5);\r\
\n #:log info \"Reboot after \$PingCount s\";\r\
\n :if (\$PingCount<=0) do={\r\
\n :set stop true;\r\
\n :log info \"NOT PING ON 8.8.8.8 - REBOOT!!!\";\r\
\n /system reboot;\r\
\n };\r\
\n};\r\
\n\r\
\n:set PingCount (300-\$PingCount);\r\
\n:if (stop=false) do={:log info \"Reboot stop after \$PingCount/300 s\";};"
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool netwatch
add disabled=no down-script=":log info \"Der Ping test war nicht erfolgreich. Der Router wird neu gestartet\";\r\
\n:if ([/system resource get uptime]>30) do={\r\
\n :log info \"Not ping on 8.8.8.8\";\r\
\n /system script run AutomaticRestart;\r\
\n}" host=8.8.8.8 http-codes="" name=RebootPing startup-delay=3m test-script="" thr-loss-count=20 type=icmp up-script=""
/user group
add name=backup policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,password,sensitive,!winbox,!web,!sniff,!api,!romon,!rest-api
Edit:
I have also updated a CRS326-24G-2S+ switch to 7.16. SNMP and API queries are also made there. However, no routing DHCP, BGP or similar. The problem does not occur with this switch. So I think it is due to a component.