There is no linux support for address lists for route rules. If you want to use more advanced matching then use mangle.
Sadly I can’t reproduce that:
/ip/dns/static add address-list=mikrotik match-subdomain=yes name=mikrotik.com type=FWD
:put [:resolve www2.mikrotik.com]
159.148.147.252
Nothing is added to the address-list mikrotik.
It seems that it works only for external queries, i.e. when some other device uses router as resolver.
15:37:41 dhcp,debug,packet send ether1 → ff02::1:2%5
15:37:41 dhcp,debug,packet type: solicit
15:37:41 dhcp,debug,packet transaction-id: 0f5c06
15:37:41 dhcp,debug,packet → clientid: 00030001 dc2c6e79 7d52
15:37:41 dhcp,debug,packet → ia_na:
15:37:41 dhcp,debug,packet t1: 1800
15:37:41 dhcp,debug,packet t2: 2880
15:37:41 dhcp,debug,packet id: 0x1
15:37:41 dhcp,debug,packet → oro: 23
15:37:41 dhcp,debug,packet → elapsed_time: 16
15:37:41 dhcp,debug,packet → rapid_commit: [empty]
15:37:41 dhcp,debug,packet → ia_pd:
15:37:41 dhcp,debug,packet t1: 1800
15:37:41 dhcp,debug,packet t2: 2880
15:37:41 dhcp,debug,packet id: 0x1
15:37:41 dhcp,debug,packet recv client: ether1 fe80::1 → fe80::de2c:6eff:fe79
:7d52
15:37:41 dhcp,debug,packet type: advertise
15:37:41 dhcp,debug,packet transaction-id: 0f5c06
15:37:41 dhcp,debug,packet → clientid: 00030001 dc2c6e79 7d52
15:37:41 dhcp,debug,packet → serverid: 00030001 ec8ac704 6b5c
15:37:41 dhcp,debug,packet → status: 6 - no prefix
15:37:41 dhcp,debug,packet → status: 2 - no address
15:37:41 dhcp,debug,packet → dns_servers:
15:37:41 dhcp,debug,packet fe80::1
15:37:41 dhcp,debug ia_pd: not found
Cannot obtain ipv6 address from telecom operator equipment through dhcpv6 client
7.5beta11 still doesn’t work with ccr2116 or ccr2004 in combination with mikrotik Q+BC0003-S+ (4 x 10g DAC breakout cable).
still no chance to use ros > 7.2.3 in proper datacenter environments (till 7.2.3 all sfp’s and DAC breakout cables worked stable).
Once again it is obvious that those 1-line change notices are sometimes completely insufficient. Especially when the relevant documentation page is not updated. Everyone is at a loss about what this change does, and what it is useful for.
after upgrade beta5 to beta8 container AdGuard not start
and
after upgrade beta8 to beta11 container AdGuard not start
log
15:50:08 container,info,debug 2022/08/15 12:50:08.460390 [info] AdGuard Home, version v0.107.8
15:50:08 container,info,debug 2022/08/15 12:50:08.482883 [info] Initializing auth module: /opt/adguardhome/work/data/sessions.db
15:50:08 container,info,debug 2022/08/15 12:50:08.483123 [error] auth: open DB: /opt/adguardhome/work/data/sessions.db: open /opt/adguardhome/work/data/sessions.db: permission denied
15:50:08 container,info,debug 2022/08/15 12:50:08.483258 [fatal] Couldn’t initialize Auth module
please fix it
Can you try on beta11 ??
I’ve updated from beta8 > beta11 and I only had to start the containers.
You HAD them running before no ? Because after the fresh deploy or redeploy the file permission are broken and I need to take the USB-stick (on which both container “live”) out, fix the permissions and re-insert in the RB3011 and then they start fine.
[@rb3011] /container> print
0 name=“6854c06d-c61c-4b53-9ae5-c1fe0d4a2045” tag=“pihole/pihole:latest” os=“linux” arch=“arm” interface=veth1 root-dir=disk3/pihole mounts=“” dns=“”
logging=yes status=running
1 name=“13dea836-a00b-459d-8580-a565cd61035d” tag=“adguard/adguardhome:latest” os=“linux” arch=“arm” interface=veth2 root-dir=disk3/adguard mounts=“” dns=“”
workdir=“/opt/adguardhome/work” logging=yes status=running
[@rb3011] /container>
yes when upgrading from beta8 to beta11 the same
helps to recreate the container
my 4011
[@home] /container> print
0 ;;; adguard
name=“3616b40d-9483-4297-b372-83d2ef4166e2” tag=“adguard/adguardhome:latest” os=“linux” arch=“arm” interface=veth1 root-dir=adguardhome mounts=agh_workdir,agh_conf dns=“” hostname=“adguardhome” workdir=“/opt/adguardhome/work” logging=yes
status=running
/container/mounts> print
2 name=“agh_workdir” src=“/adguardhome/tmp” dst=“/opt/adguardhome/work”
3 name=“agh_conf” src=“/adguardhome/home” dst=“/opt/adguardhome/conf”
*) sfp - improved stability when using 2.5G optical modules in CCR2116, CCR2216 and CRS518;
/ I did the upgrade to beta11 on CCR2116-12G-4S and still have the issue with the ISP GPON / SFP module.
When I reboot the CCR, the SFP status are good and the CCR recognize it at Alcatel xxx but after some hours, the SFP description disappear and PSU 1 and 2 plus fan 1 to 4 show status fail. I need to reboot the CCR2116 to fix.
MT: Still need to fix the SFP+ compatibility, stability and performance.
One of the things you have to understand about Docker is that user and group databases are different inside the container relative to outside it. If you ever used NFS without something like idmapd or NIS+ alongside it, it’s the same problem: user 1234 might not even exist on both sides, much less be the same user.
This is one reason why Docker has volumes, which RouterOS’s container implementation calls “mounts.” Permission changes then persist along with the data, so they don’t have to be fixed after each container redeployment.
I need to take the USB-stick (on which both container “live”) out, fix the permissions and re-insert in the RB3011 and then they start fine.
If you’re using volumes, you should be able to do this on-device, even if the container doesn’t start. Try something like this:
/container
add …same parameters as normal… cmd=sh
start 1 ; not 0, that's broken at the moment
shell 1
chown myuser /path/to/broken/file
exit
stop 1
start 0
The old container should start now and attach the mounts that you fixed with the temporary container.
It’s too bad you have to keep the tarball around, or re-fetch from a remote-image to create the second container. The copy-from parameter should accept another local container by number, name, tag… Anything unique it can latch onto. Cloning one existing container to create another is a normal thing in the Docker world.
mounts=“”
That’s part of your problem. No mounts means all the data gets stored inside the container, so when the container is nuked, so is the data. Put it on external volumes, and it will persist beyond the lifetime of the container.
Having user data in the container is fine if it’s normally recreated, such as by an automated container build pipeline that stuffs fresh data in each time, but when you have a case like this where you need persistent configuration, use volumes/mounts.
What’s new in 7.5beta11 (2022-Aug-17 13:14):
*) bgp - improved stability when “default-originate” is configured;
BGP vrf still broken,
- “default originate” now successfully advertised to CE,
- BGP vrf session now can show “Established”
- BGP uptime still show “496 days”
- prefix count still show “0”
- BGP advertised from CE still not propagate / withdrawn correctly.
Thanks for pointing out the shell command. Looked over it.
Also for the other detailed clarifications. Although I have 10-20 “containers” running on my Synology NAS and have dozens of “mounts” around I never looked down to the nifty details.
On my NAS, I make the folders, make sure they are writable by the specific user and never had any issue on the Synology with that.
we still have bgp crash when have more the 200 peers and more then one fullroute provider.
Up to the first full route it s fine, load fast and update slow, check rpki is working.
then when we enable the second full route provider it stops to receive messages stay up for a while then the session starts to flap and we see the memory going up.
Then after some huors the bgp crashes and all the bgp info are inaccessible through cli or winbox.
regards
Ros
Do you have existing report and ticket re: your issue what does MT say on this? we have in the same situation it just that we don’t have luxury on waiting for MT to stabilize BGP in ROS v7
sure, MikroTik support #[SUP-81652]
with daily update with supout, but very few or no reply by MT.
we have in our NAPs CCR2216 and CCR1072 with v7 and we provided supout from both of them.
While they improve bgp stability I advice you to leave only routeserver sessions and one fullroute provider.
regards
Ros
bgp advertisement monitoring still doesn’t work, too:
nothing happens when you follow the sample…
If anyone is having problem connecting devices with WPA3, try
/interface/wifiwave2/security/set (yourWiFiprofile) sae-pwe=hunting-and-pecking
also, GCMP encryption should work with WPA3-Personal? Unable to connect any device.
RouterOS v7.5rc1 has been released