V7.21rc [testing] is released!

Before an upgrade:

  1. Remember to make backup/export files before an upgrade and save them on another storage device;
  2. Make sure the device will not lose power during upgrade process;
  3. Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 7.21rc1 (2025-Dec-03 09:17):

  • bgp - fixed missing VRF parameter in template configuration after upgrade;
  • certificate - added certificate "trust-store" parameter (additional fixes);
  • console - added fetch-changelog flag to check-for-updates command;
  • container - fixed web-top app configuration export (introduced in v7.21beta2);
  • dhcp - execute "lease-script" with DHCP server creator user permissions;
  • ethernet - improved system stability for RB912, RB911 devices;
  • lte - ask for user confirmation before installing eSIM profile (CLI and WinBox 4 only) (additional fixes);
  • ppp - added multi-APN support to ppp-client dialer;
  • pppoe-server - fixed client disconnects when multiple servers with different service names are active (introduced in v7.20);
  • routerboard - do not show "upgrade-firmware" if available installation is older than minimal supported one;
  • switch - fixed issue with VLAN configuration corruption for 98DX224S, 98DX226S, 98DX3236 switches (introduced in v7.21beta2);
  • system - updated PCI id names;

Other changes since v7.20:

  • arm64 - allow enabling receive packet steering on /system/resource/irq/rps menu in order to overcome unbalanced CPU load;
  • bgp - allow duplicate router-ids for eBGP sessions (RFC 6286);
  • bgp - always advertise extended nexthop cap for all supported address families;
  • bgp - do not allow iBGP with non-equal ASNs;
  • bgp - fixed route refresh subcode 0 warning;
  • bgp - fixed selection of received BGP VPN routes;
  • bgp - implement RFC 9234 route leak prevention and detection using roles;
  • bonding - added lacp-system-id and lacp-system-priority settings;
  • bonding - fixed lacp-mode=passive;
  • bonding - improved stability for 802.3ad LACP;
  • bridge - fixed filter and NAT matching with "mac-protocol=length";
  • bridge - fixed missing local MAC after changing protocol-mode setting;
  • bridge - fixed multicast packet receival on bridge as multicast-router when HW offloading is used;
  • bridge - fixed possible MVRP issues when STP topology changes;
  • bridge - fixed static host and MDB entry updates on VLAN add/remove;
  • bridge - improved DHCP Option 82 values (circuit-id:"interface-name:vid", remote-id:"bridge MAC address");
  • bridge - improved stability after failed protocol-mode=mstp change;
  • bridge - properly apply bridge MVRP settings on the fly;
  • bth - added file-share link preview;
  • bth - fixed big file upload;
  • bth - fixed file-share expire after reboot;
  • certificate - added option to configure built-in trust store (replaced "builtin-trust-anchors" parameter);
  • certificate - added SHA384, SHA512 support for SCEP;
  • certificate - allow ca-crl-host parameter for issued certificates;
  • certificate - fixed incorrect appearance of "invalid-before" and "invalid-after" dates;
  • certificate - improved Let's Encrypt logging;
  • certificate - improved logging;
  • certificate - on certificate import, added the "issued" flag if the certificate store contains the imported certificate's CA and its private key;
  • certificate - refactored Certificate internal processes;
  • chr - fixed guest OS type "Other Linux (64-bit)";
  • console - added "mvrp" to mac-protocol setting;
  • console - added delimiter parameter to :toarray command;
  • console - added reset command to settings directories;
  • console - added sensitive flag to QR code in WireGuard "show-client-config";
  • console - added show-sensitive option for print command, hide sensitive settings in print output by default;
  • console - changed file id format;
  • console - do not allow to set value as empty for arguments that require selection of a specific list entry;
  • console - do not set values when "setup" command is interrupted;
  • console - fixed :convert from=num on MIPSBE;
  • console - fixed "special-login" setting incorrect channel;
  • console - fixed autocomplete in fullscreen editor to append tabs, spaces, etc;
  • console - improve :toip6 command to get IPv6 addresses from IPv6 prefixes;
  • console - improved :toip command to get IPv4 address from IPv4 CIDR address;
  • console - improved help for address arguments;
  • console - improved printing visuals (column layout and paging);
  • console - improved stability;
  • console - remove unnecessary commands from /ip/hotspot/active menu;
  • console - removed /quickset menu;
  • console - return error values for certain commands if action failed (e.g. /system/routerboard/upgrade);
  • console - show fullscreen script editor completions above hintbar;
  • console - updated "Change your password" to "Change your password (Ctrl-C to skip)";
  • container - add initial Bluetooth device support;
  • container - added "/app" menu for simple containerized app installation (requires "container" package and enabled "container" device-mode);
  • container - added CPU usage;
  • container - added hosts setting;
  • container - added kill command to send signals (CLI only);
  • container - added option to limit CPUs used by containers;
  • container - added root dir size;
  • container - added run command to allow interactive mode (CLI only);
  • container - added stop-time setting;
  • container - added update command (CLI only);
  • container - allow /tmp tmpfs to be unlimited in size;
  • container - allow app network to be any bridge interface;
  • container - allow to configure extra ENV variables directly in container;
  • container - allow to disable/enable envs and mounts;
  • container - allow to specify mounts directly in container;
  • container - calculate volume sizes;
  • container - convert container mounts setting to mountlists, old mount name becomes list name, list name can map to multiple mounts;
  • container - do not allow layer-dir to be within some containers root-dir;
  • container - enable relevant kernel features to support more container apps;
  • container - fixed error for starting container which consists of large number of layers;
  • container - fixed extract issues;
  • container - fixed VETH when using long interface name;
  • container - general container service stability fixes and improvements;
  • container - have per container layer-dir setting to be able to have separate layer stores for different sets of containers;
  • container - improved startup stability for internal processes;
  • container - made it possible to set timeout on /containter/shell;
  • container - make sure a working directory is created if it does not exist;
  • container - show detailed import status, helps understand long imports;
  • container - show image-id field (CLI only);
  • container - shows app URL and "running" status only when port is open;
  • container - store image import data (allows keeping container after netinstall);
  • detnet - do not try detection on slave interfaces;
  • detnet - fixed unnecessary process starting even when feature is not enabled;
  • dhcpv4-client - don't stop client on unsuccessful client option value change;
  • dhcpv4-server - added "support-broadband-tr101" setting to pass additional Option 82 suboptions to RADIUS server;
  • dhcpv4-server - added setting allowing to select client-id, MAC address and opt82 parameters for dynamic lease addition;
  • dhcpv4-server - allow creating static DHCPv4 leases for VETH interfaces;
  • dhcpv4-server - allow to set other gateway types not just IP for dhcp lease "routes" parameter;
  • dhcpv4-server - improved logging;
  • dhcpv4-server - improved setup wizard prompts relating to DNS;
  • dhcpv4-server - respond with hlen 0 when htype is 8;
  • dhcpv4-server - send RADIUS Accounting Stop messages when interim-update is zero;
  • dhcpv6 - improved console hints;
  • dhcpv6-client - do not show I flag for disabled client;
  • dhcpv6-client - fixed misleading "couldn't acquire address, continue with prefix only" error when prefix is not even requested;
  • dhcpv6-relay - added "about" error message option;
  • dhcpv6-relay - enable configuration of options that are added to relayed DHCPv6 requests;
  • dhcpv6-server - added accounting to use-radius setting, similar to DHCPv4 server;
  • dhcpv6-server - attempt to extract MAC from DUID for dual-stack purposes when client uses DUID-EN type of DUID;
  • dhcpv6-server - improved event logging messages;
  • dhcpv6-server - improved service stability when receiving DHCP requests for PPP service clients without included IA_PD;
  • dhcpv6-server - include traffic usage statistics when accounting is stopped due to binding expiry and removal;
  • discovery - correctly report PoE dual signature per-pair class;
  • discovery - fixed MNDP IPv6 status reporting;
  • discovery - send out neighbor discovery immediately on IPv4/IPv6 changes;
  • disk - added nvme-tcp-server-nqn setting to be able to explicitly configure NQN, will default to "nqn.2000-02.com.mikrotik:slot" for new configurations;
  • disk - allow only lowercase chars in iscsi-server-iqn;
  • disk - allow to have type=file devices without rose-storage (needed for file based swap);
  • disk - allow to set smb-share only for type=smb;
  • disk - consolidate client states into single field, as each item can be only one type of "client";
  • disk - do not allow setting raid-master when have filesystem;
  • disk - do not allow starting Btrfs replace when replace is suspended;
  • disk - do not delete partition configs on device remove and eject (fixes lost config with unstable hardware);
  • disk - fixed for SMB mount to be writable by container;
  • disk - fixed iscsi client;
  • disk - fixed iscsi export disable;
  • disk - fixed issue with double "/" in SMB share path for some clients;
  • disk - fixed SATA eject/scan;
  • disk - fixed write RAID superblock;
  • disk - improved cleanup order to avoid waiting for timeouts on shutdown;
  • disk - improved RDS2216 SATA controller;
  • disk - improved system stability;
  • disk - rename nvme-tcp client name to nqn everywhere symmetrically with server;
  • disk - show NVMe critical warnings;
  • disk - unshare iscsi and nfs client/server ids, add iscsi-server-iqn;
  • disk - update interface type/speed after scan;
  • disk - use default label when nothing specified when formatting from WinBox;
  • dns - added VRF support for ":resolve" command;
  • dns - added VRF support for DNS servers;
  • email - added "certificate-verification" parameter;
  • email - return all errors to console when executed from console;
  • eoipv6,gre6,ipip6 - added "dont-fragment" setting and allow packet fragmentation for packet sizes exceeding underlay interface MTU;
  • ethernet - added "unsupported speed" warning for forced 1Gbps, 2.5Gbps, 5Gbps, 10Gbps baseT modes;
  • ethernet - change default L2MTU 1518 to 1596 for RB5009;
  • ethernet - fixed 2.5G-baseT link-partner-advertising on RB5009, hAP ax3, Chateau ax devices;
  • evpn - fixed Ethernet Segment (ES) routes;
  • fetch - added "http-percent-encoding" parameter;
  • fetch - fixed http headers appearance when received payload is empty;
  • fetch - send http-data for any http method;
  • file - distinguish empty mount points from disks;
  • file - improved stability and interoperability with WinBox and console;
  • firewall - added "h" flag indicating that firewall service helper is applied for particular connection;
  • firewall - added support for TOS/mask matching for raw rules;
  • firewall - fixed "tls-host" not matching expected hosts;
  • firewall - fixed hotspot value loss on rule enable/disable;
  • firewall - fixed strip-ipv4-options always passthrough;
  • firewall - hide hw-offload setting from devices that do not support it;
  • firewall - improved system stability and memory allocation when using firewall services;
  • firewall - make hw-offload=yes default setting in /ip/firewall/filter menu;
  • firewall - use the highest TTL as timeout value for domain address list entries if multiple domain names resolve to same IP;
  • health - upgraded fan controller firmware to latest version;
  • hotspot - added TOTP support for local hotspot users;
  • hotspot - improved system stability;
  • ike2 - adapt rekey procedure for compatibility with Libreswan;
  • iot - added LoRa Round Trip Time monitoring support;
  • iot - added Modbus rx-switch-offset parameter which helps offset Rx window;
  • iot - added mqtt disconnect/connect GUI options;
  • iot - added support for Modbus port baud-rates from 9600 to 115200;
  • iot - changed LoRa packet's timestamp format, which fixes duty cycle issues for some servers;
  • iot - improved Modbus multi-write registers handling;
  • ip-service - do not duplicate entries for containers running in same netns;
  • ip-settings - limit IPv4/IPv6 max-neighbor-entries maximum value;
  • ippool6 - added "Valid Lifetime" and "Preferred Lifetime" options and use them when constructing IPv6 address;
  • ippool6 - fixed minor memory leak;
  • ippool6 - log address removal;
  • ippool6 - take into account "subnet-id" when specified on address;
  • ipsec - fixed CHACHA20 typo in log messages;
  • ipsec - support Post-Quantum Pre-shared Key (PPK) with QKD integration (CLI only);
  • ipv6 - added "none" option for IPv6/ND/Prefix when advertising just options, not prefix;
  • ipv6 - added "self" option for IPv6/ND DNS advertise settings;
  • ipv6 - allow to specify on which interfaces to accept Router-Advertisements;
  • ipv6 - do not disable/enable Router-Advertisements functionality based on IPv6/ND configuration;
  • ipv6 - properly remove SLAAC installed route when prefixes expire;
  • ipv6 - remove SLAAC installed DNS server and route on expire;
  • isis - improved service stability when receiving a hello packet;
  • isis - improved stability;
  • l3hw - added per-VLAN "l3-hw-offloading" setting and "H" flag for /interface/vlan menu;
  • l3hw - display warning when partial offloading is active (suggest users to use suppress-hw-offloading to control which routes gets HW offloaded and which are CPU processed);
  • l3hw - fixed issue with IPv4 ARP and IPv6 neighbor resolve for CRS812;
  • l3hw - fixed partial offloading with /31 routes;
  • l3hw - fixed per-VLAN counters when packets are going through CPU;
  • l3hw - fixed VLAN and VXLAN counters for CRS520 device;
  • l3hw - improved stability and performance during L3HW enable with many routes;
  • l3hw - improvements and optimizations for IPv4 /32 and IPv6 /128 route offloading;
  • l3hw - prioritize local IP address over ARP/neighbor entry with same IP (fixes incorrect packet flow);
  • log - fixed ISO8601 time format;
  • log - fixed remote logging on remote-protocol configuration change;
  • log - fixed unnecessary file creation when configuring a disabled log action with "target=disk";
  • log - hide irrelevant log action parameters;
  • log - limit firewall log prefix length;
  • log - limit log socket buffer memory size;
  • lte - provide firmware download URL when no LTE package installed on "SXT LTE3-7";
  • lte - added "force-delete" command to allow deletion of active eSIM profiles;
  • lte - added additional logging for error reported by modem during APN profile setup;
  • lte - added command to send out EUICC generated notifications manually;
  • lte - added confirmation prompt when deleting eSIM profile;
  • lte - added support for additional D-Link DWM-222 variation (vendor-id="0x2001" device-id="0x7e46");
  • lte - added support for additional Huawei E3372-325 variation (vendor-id="0x3566" device-id="0x2001");
  • lte - added support for R11e-LTE6 v039 firmware release and availability notification;
  • lte - clear SIM not present error when performing modem FW upgrade;
  • lte - discontinued support for RBSXTLTE3-7, further versions will use v7.20 LTE firmware package;
  • lte - do not retry activation for IPv4 and IPv6 APNs on QMI modems if only one address family is assigned;
  • lte - fixed cases where LTE monitor could show abnormalities;
  • lte - fixed MTU inheritance from master interface in multi-APN setups;
  • lte - fixed MTU setting for AT modems;
  • lte - force sms-protocol to AT for FG621-EA modem;
  • lte - improved AT modems at-chat control channel handling after modem has closed AT channel unexpectedly;
  • lte - improved modem recovery for Chateau 5G and Chateau 5G R16;
  • lte - improved stability for FG621-EA modem;
  • lte - improved system stability when receiving SMS messages;
  • lte - relay EUICC generated notifications after profile enable/disable/remove/provision;
  • lte - rework multiapn support for AT modems;
  • lte - unify "SIM not present" status for all modems;
  • macsec - work on hardware-offloaded support (available only on QCA8081 PHY: RB5009, hAP ax3, Chateau ax ether1 port);
  • media - fixed console autocomplete for path parameter;
  • mpls - fixed LDP filter upgrade from v6 where neighbor parameter is not specified;
  • mpls - fixed update of LDP Address message when local addresses change;
  • mpls - properly renew services when LDP transport address changes its state;
  • netinstall - fixed install with old RouterBOOT;
  • ospf - changed nssa-translator default value from no to candidate;
  • ospf - fixed OSPF interface "Standby" state detection;
  • ospf - improved stability;
  • ospf - show interface as separate prop for interface and neighbor;
  • ovpn-server - added support for pushing IPv6 routes;
  • poe-out - added input name hint to poe max-power settings;
  • poe-out - added LED blink on error for RB5009;
  • poe-out - firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces);
  • poe-out - fixed CRS354 misreporting approved LLDP power;
  • poe-out - improved firmware update stability;
  • poe-out - improved power-on mechanism for 802.3at capable boards;
  • port - added comment for /port/remote-access (CLI only);
  • port - added support for additional baudrates for USB to serial adapters;
  • port - do not show serial port for ATL 5G R16;
  • port - fixed displaying "baud-rate=auto" on x86;
  • port - fixed export for default serial port name;
  • port - give "gps" prefix for R11e-LR8G and R11e-LR9G GPS ports;
  • ppp - added setting to set BG77 modem cellular connection mode (auto; lte-m; nb-iot) (CLI only);
  • ppp - improved service stability when using IPv6 with DHCP and RADIUS accounting;
  • qos-hw - added "default" flags to default entries;
  • qos-hw - added "mirror-profile" which allows to select profile (traffic-class) for mirrored traffic;
  • qos-hw - always show usage and PFC counters, even when they are zero;
  • qos-hw - fixed counters for ports that are configured with "offline" tx-manager;
  • qos-hw - fixed profile add/remove for CRS812;
  • qos-hw - fixed shared-pools for CRS812;
  • qos-hw - remove unnecessary "offline" tx-manager for CRS812 (not supported by hardware);
  • queue - improved system stability when using SFQ kind of queues;
  • route - added options in /routing/settings to adjust check-gateway=ping timers;
  • route - fixed SNMP output for ECMP routes having interface gateways;
  • route - hide suppress-hw-offload setting from devices that do not support it;
  • route - improved stability;
  • route - improved system stability with multicast routing;
  • route - make check-gateway=ping work on p2p interface gateways;
  • route - removed /routing stats mem-blocks;
  • routerboot - fixed boot MAC for CRS305-1G-4S+ and CRS328-4C-20S-4S+ switches ("/system routerboard upgrade" required);
  • sfp - expose sfp-cmis-module-state to monitor;
  • sfp - filter out non-breakout modes for breakout modules;
  • sfp - fixed combo-mode change for CRS326-4C+20G+2Q+;
  • sfp - fixed missing link up/down notifies;
  • sfp - improved initialization and linking for 25G DAC on CRS812;
  • sfp - improved system stability with some GPON modules for CRS418, CCR2004 and CCR2116 devices;
  • sfp - recognize 40G Active Cable (XLPPI);
  • sfp - remove 40G-baseCR4, 40G-baseSR4-LR4 from sfp-supported list for qsfp28-x-3 interfaces;
  • snmp - added lldpLocChassisId OID;
  • snmp - count only "bound" leases for mtxrDHCPLeaseCount OID;
  • snmp - make lldpLocPortId and lldpLocPortDesc OIDs information consistent with LLDP TLVs;
  • socksify - improved system stability when using Socksify service;
  • ssh - renamed User SSH keys "key-owner" field to "info";
  • ssh - "always-allow-password-login" replaced with "password-authentication" in SSH settings;
  • ssh - added support for ED25519-SK keys;
  • ssh - improved logging of failed login attempts;
  • ssh - refactored SSH service internal processes;
  • supout - added info log entry when autosupout.rif is generated;
  • switch - added dynamic "copy-to-cpu" ACL rule for loop-protecct;
  • switch - automatically add local bridge MAC to switch FDB;
  • switch - improved HW bond load balancing by adding MPLS labels to transmit hash for 98DXxxxx, 98CXxxxx switches;
  • switch - improved stability on MediaTek switch chips;
  • swos - fixed "allow-from" setting for MIPSBE devices;
  • system - added disks to /system/resource/hardware list;
  • system - fixed local update package filename generation;
  • system - fixed network header offset for interfaces with MAC (fixes VRRP Tx on IGMP snooping bridge);
  • system - fixed potential configuration loss when available disk space was insufficient;
  • system - fixed saving panic logs to autosupout.rif for ARM CRS3xx devices;
  • system - improved system stability when processing different kinds of lists;
  • system - improved system stability when processing GRE packets on TILE devices;
  • system - improved system stability;
  • system - limit number of interface-lists to 244;
  • tr069-client - added LTE link recovery timer setting;
  • tr069-client - allow disabling Device.WiFi.AccessPoint;
  • traffic-generator - added support for injecting pcapng files;
  • undo - do not show internally issued commands in /system/history;
  • undo - show console commands in winbox/webfig for /system/history entries;
  • usb - LTE modem and USB-Serial Controller enumeration fix;
  • usb - support video capture devices for arm64 and x86, for passthrough to containers;
  • user-manager - added RadSec support;
  • veth - add container-mac-address setting;
  • veth - added default print brief table mode;
  • veth - added dhcp setting that allows to auto-configure IPv4 address, works when VETH is bridged with other interfaces and there is a DHCP server running somewhere on that network;
  • veth - complain immediately when VETH gateway not reachable, more detailed error message when network setup fails;
  • veth - fixed VETH interface not getting an IP addresses in a vlan-aware bridge containing multiple DHCP servers;
  • veth - fixes IP address not appearing in the app menu when VETH uses DHCP;
  • veth - show only when container package installed;
  • vrf - added read-only property to IPv4/IPv6 addresses, ARP and IPv6 neighbor;
  • vrf - allow setting comment on default "lo" interface;
  • vrrp - do not show "ttl not 255" warning when received VRRP VRID does not match with configured VRID;
  • vrrp - fixed gratuitous ARP being sent after VRRP is disabled (fixes packet forwarding on HW offloaded bridge after VRRP is disabled);
  • webfig - added a hint for Undo/Redo buttons;
  • webfig - added Apps menu to login;
  • webfig - added capability to check/uncheck entry tree in skin designer;
  • webfig - added Copy capability;
  • webfig - added missing PPP types to Skin Designer;
  • webfig - added TCP State column for connection tracking table;
  • webfig - check if device is still reachable before disconnect on error;
  • webfig - fixed container config memory high input;
  • webfig - fixed issue where routes and PIM table did not load;
  • webfig - fixed issue where Torch stops running;
  • webfig - fixed name and title store in skins;
  • webfig - fixed new item window name when using skins;
  • webfig - improved mikrotik_logo.svg;
  • webfig - improved service stability after deleting a skin;
  • webfig - increase graph width for better scaling;
  • webfig - increase maximum number size in forms;
  • webfig - make close button a button instead of link;
  • webfig - make combobox accessible to screen readers;
  • webfig - remember last user in login page;
  • webfig - turn off auto-capitalize and auto-correct for on-screen keyboards;
  • wifi - added "CAP" information field on interfaces view;
  • wifi - added CAPsMAN forwarding support (datapath.traffic-processing=on-capsman);
  • wifi - added configuration parameters relevant to the upcoming WiFi 7 products;
  • wifi - enable configuration of "3gpp-info-raw" and "realms-raw" interworking parameters;
  • wifi - fixed issue when trying to use interface as bonding slave;
  • wifi - fixed multi-passphrase usage in combination with access-list;
  • wifi - fixed possible duplicate values for WPA3 authentication types in scan results;
  • wifi - fixed possible memory leak when failing to start AP on chosen channel;
  • wifi - fixed some CAPsMAN settings to be optional;
  • wifi - improved formatting of FT request action frames;
  • wifi - improved interface stability when encountering authentication failures;
  • wifi - improved stability when capturing data at high rates with wifi sniffer;
  • wifi - increased accounting interval, maximum client entry count for 2.4GHz probe response delay feature;
  • wifi - rename ft-wpa2-eap authentication type to "ft-eap";
  • wifi - split access-list time property in days and time;
  • wifi-qcom - added Unsolicited BSS Transition Management Request support;
  • wifi-qcom - improved default RTS/CTS policy for CPE station radios;
  • wifi-qcom - multicast-enhance will no longer apply for station mode configured devices;
  • wifi,wireless - include "Event-Timestamp" in RADIUS accounting messages;
  • winbox - added "Last Status" and "Last Address" fields in "Tools/Email" menu;
  • winbox - added file selector for BTH files;
  • winbox - added Forwarding Table in "MPLS" menu;
  • winbox - added missing "SM-DP+ Oid" LTE eSIM provisioning field;
  • winbox - added Sessions tab in "Routing/RPKI" menu;
  • winbox - added support for new settings and fixed several existing ones;
  • winbox - Bandwidth test, Speed test, Ping, Traceroute tools use RouterOS DNS service to resolve domain names;
  • winbox - fixed "Too many entries" not showing in WinBox v4;
  • winbox - fixed Disk iscsi/smb configuration;
  • winbox - fixed Disk NVMe-TCP configuration;
  • winbox - fixed Dude/Tools appearance after Apply action;
  • winbox - fixed graphs in some forms with big numbers;
  • winbox - fixed Keepalive Time format in "Routing/BGP" menus;
  • winbox - fixed switch QoS monitor for mirror properties;
  • winbox - hide certificate "Issuer" field for certificate template;
  • winbox - hide IPv6 addresses for IP neighbors that no longer have them;
  • winbox - make multiple address fields required;
  • winbox - make separate inputs for WiFi Interworking "Authentication Types" and "Connection Capabilities" fields;
  • winbox - make VETH gateway fields not required;
  • winbox - move VRF from Ethernet to generic Interface table;
  • winbox - removed "Add" for dynamic DNS servers;
  • winbox - reorder BGP and OSFP tabs in logical order;
  • winbox - restore route max object 10000 limit;
  • winbox - show "Trusted" field for certificate template;
  • winbox - show warnings in "Routing/BGP" menus;
  • winbox - show warnings in Disk menu;
  • winbox - updated and shortened window titles (e.g. Address List -> Addresses);
  • wireguard - added VRF option (CLI only);
  • wireguard - allow to add AllowedIPs cofiguration for client configuration template;
  • wireless - added last-ip parameter for the CAPSMAN registration-table tab;
  • wireless - improved system stability when stopping scan process;
  • www - added option to disable individual web services in /ip/service/webserver and IP>Services>Web Server;
  • www - handle escaped characters in resource IDs and names for REST API requests;
  • www - process REST API requests only after user authentication is completed;
  • www - removed ability to publish directories via "/files" www service;

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

  • Everything went smoothly
  • I encountered an issue after the update (please post about the device, configuration, and unexpected symptoms)
  • I encountered an issue, but solved it (please post the solution)
0 voters

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. The file must be generated while a router is not working as suspected or after some problem has appeared on the device

Please keep this forum topic strictly related to this particular RouterOS release.

1 Like

Still (as reported before…) this parameter is called “builtin-trust-store". Any chance to update that in the changelog?

No, there are two different things! What you meant is related to this changelog item:

And that item does already mention "built-in".

While the item you quoted:

is another new "feature". If you go to your certificate list, you'll see that now each certificate has this section:

That allows you to specify the individual sections where the certificate should be trusted.

As an example: Before this version, if you implement EAP-TLS authentication with User Manager, for Dot1X or Hotspot, WPA2/3-Enterprise, etc, the client being authenticated only needs to present a certificate signed by any of the CA you might have in your certificate list. Which means if you have that R12 intermediate certificate from Let's Encrypt in your list for example (like in my screenshot), in theory Let's Encrypt would be able to issue fake certificates that allow login to your Hotspot or WPA2-Enterprise WiFi. This is actually a big security hole.

Now in 7.21 even if I have this R12 certificate from Let's Encrypt in my list, I can turn off the checkboxes like userman, dot1x, radius, etc... on this particular certificate, and only keep dns and fetch for example, and Let's Encrypt won't be able to issue certificates that can give access my EAP-TLS WPA3-Enterprise WiFi anymore.

2 Likes

Ah! Ok, got it… Now that I saw this and re-read the changelog it makes sense.

No idea why I missed this before… Thanks for clarification!

Does not generate wg preshared key - auto

And fasttrack still doesn't work after rebooting the router, although it is enabled.

Still waiting for ability to disable autoreplacement of tabs with spaces in scripts...

1 Like

:smiling_cat_with_heart_eyes:

Uhm...

“BE” without 6 GHz band does not give anything mindblowing as main problem nowadays is congestion of 2,4 and 5 GHz bands…

2 Likes

And 6GHz will be congested even faster if everybody start using 320MHz channels… Just like old days when 5GHz AC band and 80MHz channels become popular

This is unfortunately NOT a good change!

My ISPs only give out dynamic IPv6 prefixes via DHCPv6 which change with each PPPoE redial/router reboot. Those prefixes have both Valid Lifetime and Preferred Lifetime set at 5 hours. The problem is that when the router reboots for example, RouterOS doesn't announce that the old prefixes are deprecated, which means after a reboot the clients all have multiple prefixes, both new as well as the old, no longer valid ones, marked as preferred. As a result, they may have no IPv6 connectivity to the internet if they pick the addresses with the old prefixes as source addresses.

Until now I was able to workaround the issue by setting:

/ipv6 nd prefix default
set preferred-lifetime=10m valid-lifetime=10m

And the advertised prefixes are valid/preferred for at most 10 minutes. Which means when the issue occurred after a router reboot/redial, clients will have a period of invalid "preferred" addresses for at most 10 minutes, before the old addresses disappear and IPv6 WAN connectivity is possible again.

Now with the change in 7.21 the two settings above are ignored. Instead, the lifetime is now taken from the pool with the ISP prefix, and in my case with 5 hours lifetime.

I am now sitting here with my devices having no IPv6 for the next 4.3 hours:

Could you please change it, so that the lifetime values are the smaller values of the settings and what stored in the pool?

Well theoretically without IPV6 for the next 4.3 hours as you wouldnt deploy this for real yet. :wink:

My question is why do I see a new button called APP on my ax3, just below Tools and just before Container but on my RGB450 RB, the new APP button is missing??

7.21rc1, and latest winbox on both, plus boards updated to firmware etc.

The App thing is only available for arm64 and x86, and requires the container package: Containerized App management - RouterOS - MikroTik Documentation.

And this time it's in the documentation too ...

Requirements

The App system inherits the same requirements as the Container package:

  • Architecture Support: arm64, and x86 architectures
  • Container Package: Must be installed
  • Device Mode: Container mode must be enabled (requires physical access and device reset)
  • External Storage: Highly recommended for optimal performance
  • Memory Requirements: Adequate RAM for container operations (16MB SPI flash devices may require external storage for images)
  • Architecture Limitations: Devices with EN7562CT CPU (like hEX Refresh) are not supported

Yeah I had the container package loaded and assumed if I can load the container package the APP button would be available.

Unfortunately. after a few hours trying 7.21rc1 on my home RB5009, I have to downgrade back to 7.20.5. This is the first time I had to downgrade something on this RB5009. The issues I encountered include:

  • The prefix lifetime change mentioned in the post above.

  • Fasttrack (both IPv4 and IPv6) no longer working. All the counters on the "dummy" dynamic rules are not increasing except for a few KiB and a few packets on the IPv4 dummy counters which appear to have increased for a very short time right after reboot.

  • Very simple DSTNAT rules simply no longer work, in both the IPv4 and IPv6 NAT tables. Here as some of the rules:

    /ip firewall nat
    add action=dst-nat chain=dstnat dst-address-type=local dst-port=53 \
        in-interface-list=VLAN protocol=udp to-addresses=10.23.8.6
    add action=dst-nat chain=dstnat dst-address-type=local dst-port=53 \
        in-interface-list=VLAN protocol=tcp to-addresses=10.23.8.6
    add action=dst-nat chain=dstnat dst-address-type=local dst-port=853 \
        in-interface-list=VLAN protocol=tcp to-addresses=10.23.8.6
    

    The counters are simply not increasing and stays at 0 except for the first rule which has a couple of packets counted. When I turn on logging on all of the rules and reboot the router, it turns out that right after reboot for some seconds, the DSTNAT rules would be hit (hence the few packets counters). However after a few tens of seconds, none of the counters are increasing and nothing is logged anymore. Something might have changed internally after the post boot activities have completed. Replacing in-interface-list with in-interface made no difference.

    It might have something to do with the fasttrack counters also stop increasing after a short period after boot.

Anyway, I've downgraded back to 7.20.5 and everything is working normally again. Once I've more time, I'll try to reproduce the issues on other devices.

I noticed in this version that my IP cameras are having micro stutterers in live view on both version 7.20.x and 7.21rc downgrade to 7.19.6 Fix

I can confirm that (for IPv4) and still IPsec with User Manager stops working after upgrade from v7.20.x ( post V7.21beta [testing] is released! - #25 by kowal with SUP-201086)

Thanks, the problem has been fixed.

On upgrading to this from beta9 (?) my iperf3 container will no longer auto-start on boot. /container/print complains:

Flags: S - STOPPED
Columns: NAME, ROOT-DIR, INTERFACE, CPU-USAGE, TAG
#   NAME           ROOT-DIR        INTERFACE  C  TAG
;;; child spawn failed: container run error
0 S iperf3:latest  /iperf3:latest  veth1      0  quay.io/tangent/iperf3:latest

The logs say the same thing.

If I remove it and re-add it, it runs until the next reboot, and then the problem recurs.

This is on an RB4011, so no /app without USB storage or a tmpfs imitation.

It doesn't matter because this container writes nothing but one tiny temporary file per connection attempt internally, on /tmp, which I recall being auto-mapped onto tmpfs by the container.npk runner.