V7.20.8 [long-term] is released!

[EdPa]

Before an upgrade:

1. Remember to make backup/export files before an upgrade and save them on another storage device;
2. Make sure the device will not lose power during upgrade process;
3. Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 7.20.8 (2026-Jan-30 11:17):

• bgp - fixed route refresh subcode 0 warning;
• bgp - implement revised input error handling per RFC 7606;
• bridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20.7);
• container - fixed nftables/iptables not working with "Message too long" error;
• health - fixed fan and PSU state logging for MIPSBE devices;
• poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
• poe-out - fixed PSU state recovery upon unplug/replug on CRS320;
• ppp - added initial support for BG770A-GL modem firmware update;
• route - prevent creating routing tables with the same name;
• routing-filter - fixed num-set matcher;
• sfp - fixed sfp-ignore-rx-loss parameter for RB760iGS;
• snmp - fixed handling of the script "dont-require-permissions" parameter when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput;
• snmp - fixed permission error reporting when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput (introduced in v7.20.7);
• snmp - fixed script "run-count" update after execution;
• system - fixed rare partial loss of RouterOS configuration;
• user-manager - properly release database backup file after backup creation;
• w60g - fixed possible memory leak when an interface is disabled;
• zerotier - improved route removal;

To upgrade, click Check For Updates under System/Packages menu and select the long-term Channel in RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

• Everything went smoothly
• I encountered an issue after the update (please post about the device, configuration, and unexpected symptoms)
• I encountered an issue, but solved it (please post the solution)

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. The file must be generated while a router is not working as suspected or after some problem has appeared on the device

Please keep this forum topic strictly related to this particular RouterOS release.

[rextended]

For ALL, apply this fix:

Fix for BUGS, ERRORS on default RouterOS firewall rules and firewall changes from 6.43 to 7.21.2 / 7.22beta6

[maisondasilva]

For this version, does it use rule 6.49.19 or MikroTik RouterOS 7.21.2 / 7.22beta6?

Buying - RB1100AHx4 Dude Edition - Questions about Firewall

search tag # rextended default firewall rules WARNING: default WAN and LAN interface list must be defined WARNING: if you do not know what you are doing, you probably lose control of your device MikroTik RouterOS 6.49.19 default firewall rules (fixed for reflect new 7.21.2 / 7.22beta6 rules change) for IPv4 must be also created interface lists, remember to correct assign interfaces inside lists and bridge. /interface list add name=WAN comment=defconf add name=LAN comment=defconf /interface…

[rextended]

Now that there's also (it seems, finally) a long-term release, this also comes out.
The latest version for v7 should be used as a reference, since it's RouterOS 7.

If there is anything significant, I'll point it out.

[deanMK]

Why to apply your settings? Its not fixed in this version that thing ? Why need to apply scripts to fix something that, should work out of the box with this firmware?

[RaresC95]

I think those settings are needed only if you update from RouterOS v6 to RouterOS v7 Long-Term. If you are coming from RouterOS V7 Stable or other channel, it doesn’t need that.

[CGGXANNX]

The fixes are needed when you are coming from older RouterOS 7 versions too. Because upgrades normally don't modify existing firewall rules. If you upgrade from < 7.18 to >= 7.18 for example, the IPv6 fasttrack rule is not automatically added.

Same with the new additions to the "CAPsMAN" rule. If you upgrade from < 7.20.7, your rule will not automatically get the new conditions.

[rextended]

@RaresC95

I think those settings are needed only if you update from RouterOS v6 to RouterOS v7 Long-Term. If you are coming from RouterOS V7 Stable or other channel, it doesn’t need that.

ALSO refers to any version after "7.0alpha0" and up until now.

@rextended

This applies to any version of RouterOS 6.43 and later,
and also to any version of RouterOS 7.0 and later,
especially if the machine has never been reset to default after various upgrades and updates.

---

@deanMK Just read what's already written in the other topic, without going off topic in this one:

@rextended

This needs to be clear: Anyone who updates or upgrade RouterOS will not have these updates (or default firewall) automatically applied.

So, if the machine originally had, for example, RouterOS 6.43 (or earlier) and was updated to 6.43+ or 7.xx+,
it will still NOT have the default firewall rules and the configuration fixes.

The only way to apply the fixes on such upgraded devices,
aside from using this script or comparing your rules with the default ones and applying the fixes manually,
is to run netinstall or reset-configuration.

[ToTheFull]

I added those to my Hap ax2 manually after using the script on my CHR all my firewall rules vanished!

[infabo]

which ones vanished? ip or ipv6? There is not a single "remove" command for the "ip" section. And the commands for ipv6 are very well restricted to specific address list items.

[rextended]

There's a topic specifically for this
(besides the fact that it doesn't remove any rules at all, and what's written is visible to everyone...)
don't pollute this, it's for 7.20.8 release.

[rextended]

@ToTheFull

on my CHR all my firewall rules vanished!

Mumble mumble.....

@EdPa

*system - fixed rare partial loss of RouterOS configuration;

[rextended]

@EdPa

• system - fixed rare partial loss of RouterOS configuration;

Please, what is meant by this?

[bratislav]

So you "fix" for ALL above is only for 7.20.8?

[rextended]

from 6.43 to 7.21.2 / 7.22beta6

igoring release date, 6.43 < 7.20.8 < 7.22beta6

---

don't pollute this topic, it's for 7.20.8 release.

All questions related to the other topic should be asked there, not here,
otherwise it's always the same story with every release.

Just read the answers already provided and the text already written.
Anything missing will be added for clarity.
Just read what's already written first.

[roe1974]

ltAP mini ugraded, no issues … but:
Is there no longer a bad blocks display under 7.20.8?

PS: Or was there never one at ltAP?

[dang21000]

shown on cli ; but not in wb4

[roe1974]

not even on cli …

[roe1974]

FreeMem with 7.20.7: 21MiB

FreeMem with 7.20.8: 17MiB

hmmmmmm………

[lurker888]

It was disabled for devices with (only) nor flash. (The ones where the product page specifies memory as "flash" instead of "nand".) This metric doesn't make much sense for these.