Community discussions

 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1409
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

v6.39 [current]

Fri Apr 28, 2017 3:54 pm

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after crash.

WARNING!
This is applicable only for users using Webfig.
If you have only used Webfig on specific router and have never used CLI or Winbox on this device, then after upgrade/reboot device will be reset to default configuration.

Instructions to avoid this:
1) Connect to device through CLI or Winbox before upgrade to 6.39;
2) Reject default configuration;
3) Upgrade device.

The issue will be fixed in 6.39.1.

What's new in 6.39 (2017-Apr-27 10:06):

!) bridge - added "fast-forward" setting and counters (enabled by default only for new bridges) (CLI only);
!) bridge - added support for special and faster case of fastpath called "fast-forward" (available only on bridges with 2 interfaces);
!) bridge - reverted bridge BPDU processing back to pre-v6.38 behaviour; (v6.40 will have another separate VLAN-aware bridge implementation);
!) filesystem - fixed rare situation when filesystem failed to read all configuration on startup;
!) filesystem - fixed rare situation when filesystem went into read-only mode (some configuration might have gotten lost on reboot);
!) firewall - discontinued support for p2p matcher (old rules will become invalid);
!) kernel - fixed UDP checksum handling in rare oveflow situations;
!) l2tp - added fastpath support when MRRU is enabled;
!) ppp - completely rewritten internal fragmentation algorithm (when MRRU is used), optimized for multicore;
!) ppp - implemented internal algorithm for "change-mss", no mangle rules necessary;
!) pppoe - added fastpath support when MRRU and MLPPP are enabled;
!) quickset - configuration changes are now applied only on "OK" and "Apply" (not on mode change);
!) tile - fixed IPSec hardware acceleration out-of-order packet problem, significantly improved performance;
!) winbox - minimal required version is v3.11;
*) address - fixed crash when address is assigned to another bridge port;
*) api - fixed double dynamic flags for "/ip firewall address-list print";
*) capsman - added "extension-channel" XX and XXXX auto matching modes;
*) capsman - added "keepalive-frames" setting;
*) capsman - added "skip-dfs-channels" setting;
*) capsman - added CAP discovery interface list support;
*) capsman - added DFS support;
*) capsman - added EAP identity to registration table;
*) capsman - added ability to specify multiple channels in frequency field;
*) capsman - added save-channel option to speed up frequency selection on CAPsMAN restart;
*) capsman - added support for "background-scan" and channel "reselect-interval";
*) capsman - added support for static virtual interfaces on CAP;
*) capsman - changed channel "width" name to "control-channel-width" and changed default values;
*) capsman - improved CAP status querying;
*) capsman - improved support for communicating frame priority between CAP and CAPsMAN;
*) certificate - SCEP client now supports FQDN URL and port;
*) certificate - allow CRL address to be specified as DNS name;
*) console - fixed "/ip neighbor discovery" export;
*) console - fixed DHCP/PPP add-default-route distance minimal value to 1;
*) console - fixed crash;
*) console - fixed incorrect ":put [/lcd get enabled]" value;
*) ddns - improved "dns-update" authentication validation;
*) defconf - fixed Groove 52 ac band settings;
*) defconf - fixed default configuration generation when wireless package is disabled;
*) dhcp-client - added "script" option which executes script on state changes;
*) dhcpv4 - fixed string option parser;
*) dhcpv4-server - added "lease-hostname" script parameter;
*) dhcpv4-server - by default make server "authoritative";
*) dhcpv4-server - do some lease checks only on enabled object;
*) discovery - fixed LLDP discovery, IPv6 address was not parsed correctly;
*) dude - (changes discussed here: http://forum.mikrotik.com/viewtopic.php?f=21&t=116471);
*) email - check for errors during SMTP exchange process;
*) ethernet - added "voltage-too-low" status for single port power injector devices;
*) ethernet - fixed "loop-protect" on "master-port";
*) ethernet - fixed rare switch chip hang (could cause port flapping);
*) ethernet - fixed unnecessary power cycle of powered device when changing any poe-out related setting on single port power injector devices;
*) ethernet - renamed "rx-lose" to "rx-loss" in ethernet statistics;
*) ethernet - reversed poe-priority on hEX PoE and OmniTIK 5 PoE to make "poe-priority" consistent to all other RouterOS priorities;
*) fastpath - fixed rare crash on devices with dynamic interfaces;
*) fetch - added "http-data" and "http-method" parameters to allow delete, get, post, put methods (content-type=application/x-www-form-urlencoded by default);
*) fetch - fixed authentication failure;
*) fetch - fixed download issue over HTTPS;
*) gps - added "fix-quality" and "horizontal-dilution" parameters;
*) graphing - fixed graph disappearance after power outage;
*) hotspot - added access to HTTP headers using $(http-header-name);
*) ike1 - fixed ph2 ID logging;
*) ike2 - allow multiple child SA traffic selectors on re-key;
*) ike2 - always replace empty TSi with configured address if it is available;
*) ike2 - check child state before allowing rekey;
*) ike2 - default to /32 peer address mask;
*) ike2 - fixed CTR mode;
*) ike2 - fixed EAP message length;
*) ike2 - fixed ISA handler object removal on SA delete;
*) ike2 - fixed RSA authentication without EAP;
*) ike2 - fixed ctr mode;
*) ike2 - fixed disabled DPD;
*) ike2 - fixed last EAP auth payload type;
*) ike2 - fixed ph2 state when sending notify;
*) ike2 - fixed policy release during SA negotion;
*) ike2 - fixed state when sending delete packet;
*) ike2 - improved logging;
*) ike2 - kill only child SAs which are not re-keyed by remote peer;
*) ike2 - log RADIUS timeout message under error topic;
*) ike2 - remove old SA after rekey;
*) ike2 - send EAP identity as user-name RADIUS attribute;
*) ike2 - update "calling_station_id" RADIUS attribute;
*) ike2 - update peer identity after successful EAP authentication;
*) ippool - return proper error message when trying to create duplicate name;
*) ipsec - added "last-seen" parameter to active connection list;
*) ipsec - allow mixing aead algorithms in proposal;
*) ipsec - better responder flag calculator for console;
*) ipsec - disallow AH+ESP combined policies ;
*) ipsec - do not loose "use-ipsec=yes" parameter after downgrade;
*) ipsec - enable aes-ni on i386 and x64 for cbc, ctr and gcm modes;
*) ipsec - fixed "/ip ipsec policy group export verbose";
*) ipsec - fixed "mode-cfg" verbose export;
*) ipsec - fixed SA authentication flag;
*) ipsec - renamed "hw-authenc" flag to "hw-aead";
*) ipsec - show hardware accelerated authenticated SAs;
*) ipsec - updated tilera classifier for UDP encapsulated ESP;
*) l2tp - added support for multiple L2TP tunnels (not to be confused with sessions) between same endpoints (required in some LNS configurations);
*) l2tp - fixed hidden attribute decryption in forwarded CHAP responses for LNS;
*) l2tp-server - added "caller-id-type" to forward calling station number to RADIUS on authentication;
*) l2tp-server - added "use-ipsec=required" option;
*) l2tp-server - fixed upgrade to keep "use-ipsec=yes" in L2TP server;
*) leds - added LTE modem access technology trigger;
*) leds - changed error message on unsupported board;
*) leds - do not update single LED state when it is not changed;
*) leds - show warning on print when "modem-signal-threshold" is not available;
*) log - added "gps" topic;
*) log - added "tr069" topic;
*) log - added missing "license limit exceeded" log entry;
*) log - added warning when Winbox/Dude sessions were denied;
*) log - do not show changes in packet if NAT has not been used;
*) log - make SNMP logs more compact;
*) lte - added "session-uptime" in info command;
*) lte - added LTE signal level reading for Cinterion modems;
*) lte - added error handling for remote AT execute;
*) lte - added initial support for DWR-910 modem;
*) lte - added initial support for Quectel ec25;
*) lte - added initialization for Cinterion;
*) lte - added log entry for SMS delivery report;
*) lte - added support for Vodafone R216 (Huawei);
*) lte - buffer AT events while info command is active;
*) lte - fixed "/interface lte info X once";
*) lte - fixed IPv6 address prefix on interface
*) lte - fixed network mode selection for me909u, mu609;
*) lte - fixed older standard CEREG parsing;
*) lte - fixed support for Huawai R216;
*) lte - fixed user-command;
*) lte - reset interface stats on "link-down";
*) netinstall - fixed typos;
*) ntp - restart NTP client when it is stuck in error state;
*) ppp - added "bridge-horizon" option under PPP/Profile;
*) ppp - added option to specify "interface-list" in PPP/Profile;
*) ppp - fixed rare kernel failure on PPP client connection;
*) ppp - fixed rare kernel failure when receiving IPv6 address on PPP interface;
*) ppp - include rates, limits and address-lists parameters in RADIUS accounting requests;
*) ppp-client - added support for Datacard 750UL, DWR-730 and K4607-Zr;
*) pppoe - added warning on PPPoE client/server, if it is configured on slave interface;
*) pppoe - set default keepalive 10s for newly created PPPoE clients;
*) quickset - added initial LTE AP mode support;
*) rb1100ahx2 - fixed random counter resets for ether12,13;
*) rb3011 - added partitioning support;
*) smb - fixed different memory leaks and crashes;
*) smb - fixed share path on devices with "/flash" directory;
*) smips - reduced RouterOS main package size;
*) snmp - "No Such Instance" error message is replaced with "No Such Object";
*) snmp - added fan-speed OIDs in "/system health print oid";
*) snmp - added optical table;
*) snmp - fixed rare crash;
*) snmp - improved getall filter;
*) snmp - improved response speed when multiple requests are received within short period of time;
*) snmp - increase "engineBoots" value on reboot;
*) snmp - optimized bridge table processing;
*) tile - added initial support for NVMe SSD disk drives;
*) tile - fixed IPSec crash (introduced in 6.39rc64);
*) tile - optimized hardware encryption;
*) tr069-client - added "Device.Hosts.Host.{i}." support;
*) tr069-client - added "Device.WiFi.NeighboringWiFiDiagnostic." support;
*) tr069-client - added "Ethernet.Interface.{i}.MACAddress" parameter;
*) tr069-client - added DHCP server support;
*) tr069-client - added Upload RPC "2 Vendor Log File" support;
*) tr069-client - added architecture name parameter (X_MIKROTIK_ArchName - vendor specific);
*) tr069-client - added basic stats parameters for some interface types;
*) tr069-client - added basic support for "/ip firewall filters";
*) tr069-client - added connection request authentication;
*) tr069-client - added firewall NAT support using vendor Parameters;
*) tr069-client - added parameters for DNS client management support;
*) tr069-client - added ping diagnostics support;
*) tr069-client - added support for escaped entity references (& < > ' ");
*) tr069-client - added support for managing "/system/identity/" value;
*) tr069-client - added support for memory and CPU load parameters;
*) tr069-client - added support for uploading/downloading factory script;
*) tr069-client - added traceroute diagnostics support;
*) tr069-client - close connection if CPE considers XML as invalid;
*) tr069-client - fixed "AddObjectResponse" "InstanceNumber" value;
*) tr069-client - fixed "Device.ManagementServer." value update;
*) tr069-client - fixed XML special character parsing;
*) tr069-client - fixed crash on =acs-url change special case;
*) tr069-client - fixed special escape characters on XML data send;
*) tr069-client - fixed write for "Device.ManagementServer.URL";
*) tr069-client - general improvements on reducing storage space;
*) tr069-client - generate random connection request target path;
*) tr069-client - hide "Device.PPP.Interface.{i}.Password" value;
*) tr069-client - improved LTE monitoring process;
*) tr069-client - increased performance on GetParameterValues;
*) tr069-client - made any Download RPC overwrite configuration except ".alter";
*) tr069-client - make more Parameters deny active notifications;
*) tr069-client - set CHR license ID as ".SerialNumber" value to avoid "no serial number" error in ACS;
*) traceroute - small fix;
*) tunnels - fixed reboot loop on configurations with IPIP and EoIP tunnels (introduced in 6.39rc68);
*) usb - added support for more CP210X devices;
*) userman - allow "name-for-user" to be empty and not unique;
*) userman - automatically select all newly created users to generate vouchers;
*) userman - fixed rare crash when User Manager requested file does not exist on router;
*) userman - fixed rare web interface crash while using Users section;
*) wAP ac - improved 2.4GHz wireless performance;
*) webfig - added menu bar to quickly select between Webfig, Quickset and Terminal;
*) webfig - allow shorten bytes to k,M,G in firewall "connection-bytes" and "connection-rates";
*) webfig - allow to change global variable contents;
*) webfig - allow to enter frequency ranges in wireless scan list;
*) webfig - allow to select "default-encryption" profile on PPP tunnels;
*) webfig - correctly specify routing filter prefix;
*) webfig - do not allow to reorder items if table is sorted by some column;
*) webfig - fixed bridge property display;
*) webfig - fixed delays on key press in terminal;
*) webfig - fixed tab ordering on Google Chrome;
*) webfig - fixed "last-link-up" & "last-link-down" time information;
*) webfig - improved field layout;
*) webfig - make Terminal window work within Webfig window;
*) webfig - show all available options under "Advanced Mode" for wireless interfaces;
*) webfig - show proper error messages for optional erroneous text fields;
*) winbox - added "Flush" button under unicast-fdb menu;
*) winbox - added "group-key-update" to CAPsMAN security settings;
*) winbox - added "k" and "M" unit support to PPP secret limit-bytes parameters;
*) winbox - added "memory-scroll", "filter-cpu", "filter-ipv6-address", "filter-operation-between-entries" parameters;
*) winbox - added "save-selected" setting under CAPsMAN channels;
*) winbox - added "static-virtual" to wireless CAP;
*) winbox - added GPS menu;
*) winbox - added protected routerboard parameters under routerboard settings menu;
*) winbox - allow shorten bytes to k,M,G in firewall "connection-bytes" and "connection-rates";
*) winbox - allow to change user password to empty one;
*) winbox - allow to not specify certificate in IPSec peer settings;
*) winbox - allow to specify "route-distance" in "dhcp-client" if "special-classless" mode is selected;
*) winbox - allow to specify certificate type when exporting it;
*) winbox - allow to specify interfaces that CAPsMAN can use for management;
*) winbox - allow unhide SNMP passwords;
*) winbox - allowed to specify static-dns as list;
*) winbox - do not allow Packet Sniffer "memory-limit" and "file-limit" lower than 10KiB;
*) winbox - do not create time field when copying CAPsMAN access list entry;
*) winbox - do not show "dpd-max-failures" on IKEv2;
*) winbox - do not show empty LTE fields in Info menu;
*) winbox - do not start Traffic Generator automatically when opening "Quick Start";
*) winbox - do not try to disable dynamic items from firewall tables;
*) winbox - fixed "Montly" typo to "Monthly" in Graphing menu;
*) winbox - fixed CAPsMAN channels frequency (allow to specify a list of them);
*) winbox - fixed IPSec "mode-config" DNS settings;
*) winbox - fixed issue when working IPSec policies were shown as invalid;
*) winbox - fixed misleading error when trying to export certificate;
*) winbox - fixed typo in BGP advertisements menu Aggragator->Aggregator;
*) winbox - hide "wps-mode" & "security-profile" in wireless nv2 mode;
*) winbox - hide health menu on RB450;
*) winbox - improved "/tool torch";
*) winbox - increased maximal number of Winbox sessions 20->100;
*) winbox - properly name CAP Interface on new interface creation;
*) winbox - properly show "dhcp-server" warnings;
*) winbox - properly show IPSec "installed-sa" "enc-algorithm" when it is aes-gcm;
*) winbox - properly show wireless registration table stat counters;
*) winbox - removed "sfp-rate-select" setting from ethernet interface;
*) winbox - removed unnecessary "/system health" menu on "hAP ac lite";
*) winbox - set default "dhcp-client" "default-route-distance" value to 1;
*) winbox - show "A" flag for IPSec policies;
*) winbox - show "H" flag for IPSec installed SAs;
*) winbox - show PoE-OUT current, voltage and power only on devices which can report these values;
*) wireless - added Egypt 5.8 country settings;
*) wireless - added PEAP authentication support for wireless station mode;
*) wireless - apply broadcast bit to DHCP requests when using "station-pseudobridge" mode;
*) wireless - do not allow equal MAC addresses between multiple Virtual APs when same "master-interface" is used;
*) wireless - fixed RBSXT5HacD2nr2 small channel support;
*) wireless - fixed crash while running "spectral-scan";
*) wireless - fixed dynamic wireless interface removal from bridge ports when changing wireless mode;
*) wireless - fixed false positive DFS radar detection caused by iPhone 6s devices;
*) wireless - fixed issue when wireless interfaces might not show up in CAP mode;
*) wireless - fixed occasional crash on interface disabling;
*) wireless - fixed rare crash on nv2 configurations;
*) wireless - fixed rare wireless ac interface lockup;
*) x86 - added support for NVMe SSD disk drives;

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after crash.
 
raffav
Member Candidate
Member Candidate
Posts: 289
Joined: Wed Oct 24, 2012 4:40 am

Re: v6.39 [current]

Fri Apr 28, 2017 4:05 pm

Cool
Very big changelog
i a near future the changelog wil be on a book :lol:
 
kostikbel
just joined
Posts: 13
Joined: Tue May 27, 2014 1:16 pm

Re: v6.39 [current]

Fri Apr 28, 2017 4:19 pm

On CRS125, console spits the following:
loading kernel... OK
setting up elf image... OK
jumping to kernel code
Starting...
chmod: /flash/rw/run/netns: No such file or directory
Starting services...
Is this something to worry about ?
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1409
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.39 [current]

Fri Apr 28, 2017 4:52 pm

kostikbel - This is a harmless message. It shows up on upgrade. There is no need to worry about it at all.
 
cheeze
Member Candidate
Member Candidate
Posts: 146
Joined: Tue Jul 31, 2012 7:44 am

Re: v6.39 [current]

Fri Apr 28, 2017 6:14 pm

WOW....

Awesome, well done.

Lets hope bugs are minimal on it.
 
User avatar
Cha0s
Forum Veteran
Forum Veteran
Posts: 908
Joined: Tue Oct 11, 2005 4:53 pm

Re: v6.39 [current]

Fri Apr 28, 2017 8:31 pm

Enable/Disable buttons and key shortcuts (enable/disable) on anything BGP related (instances, peers, filters, etc), stopped working on winbox 2.
 
dadoremix
Member Candidate
Member Candidate
Posts: 118
Joined: Sat May 14, 2011 11:31 am

Re: v6.39 [current]

Fri Apr 28, 2017 8:35 pm

Minimum version is 3.11 winbox


Sent from my iPhone using Tapatalk Pro
 
User avatar
Cha0s
Forum Veteran
Forum Veteran
Posts: 908
Joined: Tue Oct 11, 2005 4:53 pm

Re: v6.39 [current]

Fri Apr 28, 2017 8:39 pm

Minimum version is 3.11 winbox
That refers to winbox 3.

There have been multiple 'minimum versions' requirements in previous releases but that always refers to Winbox 3 since Winbox 3 doesn't download the dlls from the router as winbox 2 does. So the winbox client must be up to date to be able to connect to the router.

Winbox 2 does not work this way. It's just a loader. It downloads the specific version dlls from the router. If winbox 2 was not supported anymore the router wouldn't even provide any dlls for winbox 2 to be able to connect.
 
User avatar
joaoalberto
Trainer
Trainer
Posts: 2
Joined: Mon Apr 17, 2017 6:21 am

Re: v6.39 [current]

Fri Apr 28, 2017 9:02 pm

Great! Starting tests... :D
 
ivugrinec
Frequent Visitor
Frequent Visitor
Posts: 75
Joined: Thu Feb 17, 2011 11:43 am

Re: v6.39 [current]

Fri Apr 28, 2017 10:08 pm

Hi,

I am interested in this change log entry:

!) bridge - reverted bridge BPDU processing back to pre-v6.38 behaviour; (v6.40 will have another separate VLAN-aware bridge implementation);

What happened? Is there a thread about this?
 
pe1chl
Forum Guru
Forum Guru
Posts: 5928
Joined: Mon Jun 08, 2015 12:09 pm

Re: v6.39 [current]

Fri Apr 28, 2017 10:19 pm

Updated an LHG5 from 6.35.4 to 6.39
Came back to default IP address after reboot.
Used Quickset to set a different IP... now is unreachable.
I have seen a similar problem on another LHG5, address in the Neighbor discovery packets is 0.0.0.0
and it shows as empty on the list in another router, mac-telnet does not work.
After powercycle it is back at defaults again.
I think it indicates the flash is corrupted and it requires a netinstall.
Is there any way to "reboot to netinstall" from the "running" version without having to press the button?
(the device is mounted on the roof...)
 
andriys
Forum Guru
Forum Guru
Posts: 1187
Joined: Thu Nov 24, 2011 1:59 pm
Location: Kharkiv, Ukraine

Re: v6.39 [current]

Fri Apr 28, 2017 10:28 pm

Is there any way to "reboot to netinstall" from the "running" version without having to press the button?
Try this:
/system routerboard settings set boot-device=try-ethernet-once-then-nand
/system reboot
 
Brightstar
just joined
Posts: 3
Joined: Wed Jun 18, 2014 3:50 pm

Re: v6.39 [current]

Fri Apr 28, 2017 10:32 pm

Pretty serious issue for RB3011 users that have "tried" to repartition on past versions renders the router unbootable with a kernel corruption and bootloop.

When I first got the RB3011 my first thing was to re-partition to 2 partitions so that I can keep a backup before any updates. Didn't work! (As we know)
Now, with this new version I saw that it was fixed in the release notes so I thought fantastic! I shall update!

However, it seems that my past attempts must have done something because when I consoled into the router and checked the partitions it was showing 2!

So I tried swapping partitions, nothing. Didn't work. The fix is to go into the repartition menu via console and change the partition number back to 1 partition. Once done the router rebooted and loaded up fine.

Then I tested in winbox the repartition to 2 and that works fine. Though the display doesn't show the version loaded, it's blank and copy to other partition shows part. Probably just a display error as the router is working fine.

So, a suggestion for the devs. On RB3011 devices, when upgraded to this new version, it should FORCE the partition count to 1 to prevent this issue!

Cheers,
Neil
 
pe1chl
Forum Guru
Forum Guru
Posts: 5928
Joined: Mon Jun 08, 2015 12:09 pm

Re: v6.39 [current]

Fri Apr 28, 2017 10:43 pm

Is there any way to "reboot to netinstall" from the "running" version without having to press the button?
Try this:
/system routerboard settings set boot-device=try-ethernet-once-then-nand
/system reboot
Thanks, that sounds like a good way!
 
Lakis
Forum Veteran
Forum Veteran
Posts: 701
Joined: Wed Sep 23, 2009 7:52 pm

Re: v6.39 [current]

Fri Apr 28, 2017 11:27 pm

Winbox Wireless Security profile missing
 
kellogs
Member Candidate
Member Candidate
Posts: 114
Joined: Sun Jan 04, 2009 10:55 am

Re: v6.39 [current]

Fri Apr 28, 2017 11:50 pm

Upgraded to this version and my bgp stop passing traffic!

Had to revert back
 
User avatar
dash
newbie
Posts: 37
Joined: Tue Apr 28, 2015 12:05 pm

Re: v6.39 [current]

Fri Apr 28, 2017 11:50 pm

Same issue with RB3011 as reported by Brightstar, bootloop on RB3011 after updating it to 6.39
 
User avatar
Cha0s
Forum Veteran
Forum Veteran
Posts: 908
Joined: Tue Oct 11, 2005 4:53 pm

Re: v6.39 [current]

Sat Apr 29, 2017 7:18 am

Same issue with RB3011 as reported by Brightstar, bootloop on RB3011 after updating it to 6.39
Same here.
 
Njumaen
newbie
Posts: 37
Joined: Wed Feb 24, 2016 8:41 pm

Re: v6.39 [current]

Sat Apr 29, 2017 9:47 am

Same issue with RB3011 as reported by Brightstar, bootloop on RB3011 after updating it to 6.39
Same here.
Here as well.

Due to the previous posts I was alerted an got my W10 notebook loaded with netinstall and both stable and current .npk at hand
Thank to the FSM, I did daily config-backups on an attached SSD (where the Dudes datatbase is) so a netboot of 6.39 and restore of the latest config was really easy!

I'm one of those guys trying to do create a partition "in the old days"... Just my luck.. ;-)

No other problems so far...

Ralf.
 
irghost
Member Candidate
Member Candidate
Posts: 282
Joined: Sun Feb 21, 2016 1:49 pm

Re: v6.39 [current]

Sat Apr 29, 2017 10:18 am

loading kernel... OK
setting up elf image... OK
jumping to kernel code
ERROR: no system package found!
Kernel panic - not syncing: Attempted to kill init!
Rebooting in 1 seconds..

RouterBOOT booter 3.33

RouterBoard 2011UiAS-2HnD

CPU frequency: 600 MHz
 Memory speed: 200 MHz
  Memory size: 128 MiB
    NAND size: 128 MiB

Press any key within 5 seconds to enter setup.....

RB2011 Does Not BOOT after Upgrade
MTCNA MTCRE MTCTCE MTCUME MTCWE MTCIPv6E MTCINE
 
bbs2web
Member Candidate
Member Candidate
Posts: 201
Joined: Sun Apr 22, 2012 6:25 pm
Location: Johannesburg, South Africa
Contact:

Re: v6.39 [current]

Sat Apr 29, 2017 10:38 am

You can review correspondence in the following post:
viewtopic.php?f=1&p=594913
Hi,
!) bridge - reverted bridge BPDU processing back to pre-v6.38 behaviour; (v6.40 will have another separate VLAN-aware bridge implementation);
What happened? Is there a thread about this?
 
girtsu
just joined
Posts: 2
Joined: Wed Feb 22, 2017 11:52 am

Re: v6.39 [current]

Sat Apr 29, 2017 10:55 am

RB1100AHx2 multiple public addresses on ethernet 12, after upgrade only some of them are reachable. Packet sniffer shows incoming traffic to eth12/respective IP but no activity in mangle prerouting. Before upgrade and after downgrade (from 6.37.5(stable)) all is working fine.
 
SambathKEO
just joined
Posts: 2
Joined: Sat Apr 29, 2017 10:45 am

Re: v6.39 [current]

Sat Apr 29, 2017 11:45 am

Here, there is a trouble about Port Forwarding with 951Ui router board running Router OS v6.39(just updated). The story:

I currently use a Hikvision NVR with the setting below:
- IP address: 192.168.1.111 /24
- HTTP port: 80
- Server port: 8000
My router IP address: 192.168.1.1
My Public IP address: 36.37.xxx.123

Now the problem is that i need to remote view my NVR using public IP, but i cannot make the port forwarding to work.
By the way, i am kind of not so clear about port forwarding in Mikrotik. Yet in the past, I used to make it work by just using a simple rule like this

" chain=dstnat action=dst-nat to-addresses=192.168.1.111 to-ports=80 protocol=tcp dst-address=36.37.xxx.123 dst-port=80 "
Yet, this rules doesn't work now. Is there something that i missed? Please someone help me solve this issue
All the help is appreciated!!!
 
mikruser
Member
Member
Posts: 385
Joined: Wed Jan 16, 2013 6:28 pm

Re: v6.39 [current]

Sat Apr 29, 2017 12:39 pm

6.39 - another epic fail bugged version from mikrotik. Kill ipsec, kill sip-trunk.

Downgrade to 6.37.5, and all work fine.
do not ask me why it is necessary.
 
User avatar
Cha0s
Forum Veteran
Forum Veteran
Posts: 908
Joined: Tue Oct 11, 2005 4:53 pm

Re: v6.39 [current]

Sat Apr 29, 2017 1:28 pm

Same issue with RB3011 as reported by Brightstar, bootloop on RB3011 after updating it to 6.39
Same here.
Here as well.

Due to the previous posts I was alerted an got my W10 notebook loaded with netinstall and both stable and current .npk at hand
Thank to the FSM, I did daily config-backups on an attached SSD (where the Dudes datatbase is) so a netboot of 6.39 and restore of the latest config was really easy!

I'm one of those guys trying to do create a partition "in the old days"... Just my luck.. ;-)

No other problems so far...

Ralf.
For me it was a little more complicated.
My daily backups did not work for some reason. When I tried to restore the backup it always said that the password was wrong. Even though the backup was created without a password.

I had to find an older backup before 6.38.5, restore that, then restore the latest backup. If I tried to restore the latest backup directly I always got 'bad password' error either on a 6.38.5 fresh netinstall or 6.39 fresh netinstall.
 
Marino
Frequent Visitor
Frequent Visitor
Posts: 53
Joined: Sun Jun 14, 2015 7:26 pm

Re: v6.39 [current]

Sat Apr 29, 2017 2:12 pm

Here, there is a trouble about Port Forwarding with 951Ui router board running Router OS v6.39(just updated). The story:

I currently use a Hikvision NVR with the setting below:
- IP address: 192.168.1.111 /24
- HTTP port: 80
- Server port: 8000
My router IP address: 192.168.1.1
My Public IP address: 36.37.xxx.123

Now the problem is that i need to remote view my NVR using public IP, but i cannot make the port forwarding to work.
By the way, i am kind of not so clear about port forwarding in Mikrotik. Yet in the past, I used to make it work by just using a simple rule like this

" chain=dstnat action=dst-nat to-addresses=192.168.1.111 to-ports=80 protocol=tcp dst-address=36.37.xxx.123 dst-port=80 "
Yet, this rules doesn't work now. Is there something that i missed? Please someone help me solve this issue
All the help is appreciated!!!
Shouldn't this be to-ports=8000? -> chain=dstnat action=dst-nat to-addresses=192.168.1.111 to-ports=80
You said your server hosts on port 8000
 
eddieb
Member Candidate
Member Candidate
Posts: 141
Joined: Thu Aug 28, 2014 10:53 am
Location: Netherlands

Re: v6.39 [current]

Sat Apr 29, 2017 3:22 pm

Upgraded my 2011 to 6.39 without problems.
- IPSEC-IPSEC tunnel works,
- IPSEC-L2TP dailin works,
- Firewall rulez works,
- DHCP works,
- CAPS-MAN (2x 962, 1x 2011) works ...
no problems so far

E.
Running 6.45.7 (stable) on :
CCR1009-8G-1S (2x ipsec/l2tp site-to-site, ipsec/l2tp roadwarrior, dhcpd, dns), CRS125-24G-1S, RB1100, RB962UiGS-5HacT2HnT (10pc), RB931-2nD, RB951, RB750GL ,RB2011UAS-RM, CHR running dude (CHR running in VirtualBox on OSX)
 
Institor
just joined
Posts: 9
Joined: Sat Apr 29, 2017 3:28 pm

Re: v6.39 [current]

Sat Apr 29, 2017 3:32 pm

HAP ac lite - After update I can't create SMB share on external drive (usb). Can somebody confirm that?
 
bratislav
Frequent Visitor
Frequent Visitor
Posts: 50
Joined: Mon May 05, 2014 10:36 am

Re: v6.39 [current]

Sat Apr 29, 2017 4:34 pm

Upgrade went well on RB750GL but DNS has gone berserk
NAME                    CPU        USAGE
firewall-mgmt                         3%
ethernet                            0.5%
console                               1%
dns                                  82%
firewall                            2.5%
networking                            2%
winbox                                3%
logging                               0%
management                            6%
routing                               0%
queuing                               0%
telnet                                0%
bridging                              0%
unclassified                          0%
total                               100%
 
blu33agl3
just joined
Posts: 5
Joined: Tue Oct 25, 2016 4:46 pm

Re: v6.39 [current]

Sat Apr 29, 2017 5:54 pm

my hAP ac lite gone with bootloop after upgrade to 6.39
and my CHR too.
 
ivanfm
newbie
Posts: 47
Joined: Sun May 20, 2012 5:07 pm

Re: v6.39 [current]

Sat Apr 29, 2017 6:00 pm

Updated some devices :

RouterBOARD wAP 2nD r2 : all configuration was lost, the device had to be reconfigured from scratch.
RB951 and 751 : without trouble.
 
User avatar
doneware
Trainer
Trainer
Posts: 539
Joined: Mon Oct 08, 2012 8:39 pm
Location: Hungary

Re: v6.39 [current]

Sat Apr 29, 2017 7:14 pm

Upgrade went well on RB750GL but DNS has gone berserk
check whether you're being used as an attack amplifier

look whether /ip dns cache is filled with junk entries
#TR0359
 
andreeii
just joined
Posts: 3
Joined: Mon Nov 04, 2013 11:49 pm

Re: v6.39 [current]

Sat Apr 29, 2017 7:48 pm

I just finished testing 6.39 release on 951G and hEX.

The hEX is the edge router and 951G is an ap/switch.

On the 951G i have an ip-camera connected on port 5 and the port is in a bridge with a vlan that goes to the main router,this vlan has a 10.x.x.x/24 subnet on it and the lan subnet is 192.x.x.x/24.

This configuration worked fine on 6.35 and previous versions i could reach the ipcamera on the 10.x.x.x/24 subnet from my lan subnet. On 6.39 could not connect to the ip-camera.The weird thing is that the camera was receiving DHCP settings but i could not ping or reach.

If i setup a DHCP client on the bridge of the 951G that contains the port and vlan it would receive an ip and i could now ping the camera from the 951G but still not from the network.

On port 5 of the 951G i connected a mAPlite and tried to see if there is something wrong with the camera,but i found the same behavior. The mAPlite was getting an ip form DHCP server but i was not able to reach the lan or even the gateway on the 10.x.x.x/24 network.
 
SambathKEO
just joined
Posts: 2
Joined: Sat Apr 29, 2017 10:45 am

Re: v6.39 [current]

Sat Apr 29, 2017 8:20 pm

Here, there is a trouble about Port Forwarding with 951Ui router board running Router OS v6.39(just updated). The story:

I currently use a Hikvision NVR with the setting below:
- IP address: 192.168.1.111 /24
- HTTP port: 80
- Server port: 8000
My router IP address: 192.168.1.1
My Public IP address: 36.37.xxx.123

Now the problem is that i need to remote view my NVR using public IP, but i cannot make the port forwarding to work.
By the way, i am kind of not so clear about port forwarding in Mikrotik. Yet in the past, I used to make it work by just using a simple rule like this

" chain=dstnat action=dst-nat to-addresses=192.168.1.111 to-ports=80 protocol=tcp dst-address=36.37.xxx.123 dst-port=80 "
Yet, this rules doesn't work now. Is there something that i missed? Please someone help me solve this issue
All the help is appreciated!!!
Shouldn't this be to-ports=8000? -> chain=dstnat action=dst-nat to-addresses=192.168.1.111 to-ports=80
You said your server hosts on port 8000
Dear Marino, Thanks for your reply. Indeed, i did forwarding for both port 80 and 8000. yet, it doesn't work.
Anyway, I just found out another thing, that is I can remote to my NVR when i connect my device(PC or Phone) to another network such as Mobile Data or another Wifi..This means the port forwarding is partly working..The real problem is that i cannot not remote to NVR when my device and NVR are in the same network. So what is the problem?
Any further comments are appreciated
 
User avatar
Cha0s
Forum Veteran
Forum Veteran
Posts: 908
Joined: Tue Oct 11, 2005 4:53 pm

Re: v6.39 [current]

Sat Apr 29, 2017 8:34 pm

I just found out another thing, that is I can remote to my NVR when i connect my device(PC or Phone) to another network such as Mobile Data or another Wifi..This means the port forwarding is partly working..The real problem is that i cannot not remote to NVR when my device and NVR are in the same network. So what is the problem?
The problem is that you need NAT Loopback or NAT Hairpinning for this to work from within the same subnet.
Your rules most likely do not cover this and the latest update definitely did not cause that.
 
pazda
just joined
Posts: 1
Joined: Sat Apr 29, 2017 8:10 pm

Re: v6.39 [current]

Sat Apr 29, 2017 8:46 pm

Upgraded couple of devices: cAP2n, mAP Lite, wAPac, 3011, 750, x86 Alix and all without any issue.
Services like CAPsMAN, DHCP, OVPN, firewall, NTP... etc. no problems :)
 
Marino
Frequent Visitor
Frequent Visitor
Posts: 53
Joined: Sun Jun 14, 2015 7:26 pm

Re: v6.39 [current]

Sat Apr 29, 2017 9:54 pm

Here, there is a trouble about Port Forwarding with 951Ui router board running Router OS v6.39(just updated). The story:

I currently use a Hikvision NVR with the setting below:
- IP address: 192.168.1.111 /24
- HTTP port: 80
- Server port: 8000
My router IP address: 192.168.1.1
My Public IP address: 36.37.xxx.123

Now the problem is that i need to remote view my NVR using public IP, but i cannot make the port forwarding to work.
By the way, i am kind of not so clear about port forwarding in Mikrotik. Yet in the past, I used to make it work by just using a simple rule like this

" chain=dstnat action=dst-nat to-addresses=192.168.1.111 to-ports=80 protocol=tcp dst-address=36.37.xxx.123 dst-port=80 "
Yet, this rules doesn't work now. Is there something that i missed? Please someone help me solve this issue
All the help is appreciated!!!
Shouldn't this be to-ports=8000? -> chain=dstnat action=dst-nat to-addresses=192.168.1.111 to-ports=80
You said your server hosts on port 8000
Dear Marino, Thanks for your reply. Indeed, i did forwarding for both port 80 and 8000. yet, it doesn't work.
Anyway, I just found out another thing, that is I can remote to my NVR when i connect my device(PC or Phone) to another network such as Mobile Data or another Wifi..This means the port forwarding is partly working..The real problem is that i cannot not remote to NVR when my device and NVR are in the same network. So what is the problem?
Any further comments are appreciated
Hi, herewith an example for nat hairpin your subnet:

chain=srcnat action=masquerade src-address=192.168.1.0/24 dst-address=192.168.1.0/24 out-interface=<your lan interface> log=no

Place it before the other nat rules. Hope this helps.
 
User avatar
MTeeker
Frequent Visitor
Frequent Visitor
Posts: 75
Joined: Tue Jun 14, 2011 2:42 pm
Location: Australia

Re: v6.39 [current]

Sun Apr 30, 2017 1:58 am

Just updated to 6.39 from 37.5. on RB2011UiAS-2HnD-IN. It went smoothly.
It's nice to see IP Cloud (DDNS) starts working again. It has been broken for a quite while....

It could be irrelevant but I always ensure that all filename.npk (extracted form relevant zip), when placed under Files List tab, are shown with proper icons (red arrow) before I do a System Reboot to flash new firmware (This is my preferred way). I don't recall having an issue with flashing new firmware to date.

Image
 
User avatar
dash
newbie
Posts: 37
Joined: Tue Apr 28, 2015 12:05 pm

Re: v6.39 [current]

Sun Apr 30, 2017 11:29 am

The Routerboard settings are not being stored. I tried to change the boot device setting. After a reboot the previous setting has been restored. Also the "reformat hold button" time is set to 00:00:00 every time after reboot,- even though 00:00:00 it is not an accepted value.

Not sure if this is a version related issue...
 
dadoremix
Member Candidate
Member Candidate
Posts: 118
Joined: Sat May 14, 2011 11:31 am

Re: v6.39 [current]

Sun Apr 30, 2017 11:59 am

I have
Hex3 with vlans ugrade ok
Rb435g upgrade ok
Sxt lite2 p2p link upgrade ok
Rstp bridge working


Sent from my iPhone using Tapatalk Pro
 
bratislav
Frequent Visitor
Frequent Visitor
Posts: 50
Joined: Mon May 05, 2014 10:36 am

Re: v6.39 [current]

Sun Apr 30, 2017 2:42 pm

Upgrade went well on RB750GL but DNS has gone berserk
check whether you're being used as an attack amplifier

look whether /ip dns cache is filled with junk entries
Actually you are right ... on that particular router i forgot to close input from internet ...and it was literally bombarded by millions of DNS request ...
Thanks ...
 
rea0056
just joined
Posts: 2
Joined: Sun Apr 30, 2017 2:53 pm

Re: v6.39 [current]

Sun Apr 30, 2017 2:57 pm

Hi,

Can somebody explain this "ppp - implemented internal algorithm for "change-mss", no mangle rules necessary;" .Because now I'm still using mangle to modify tcp mss.

Cheers,
Faiz
 
vitaly2016
newbie
Posts: 46
Joined: Wed Jan 20, 2016 9:26 am
Location: Ukraine
Contact:

Re: v6.39 [current]

Sun Apr 30, 2017 3:43 pm

Yesterday upgraded my RB3011 from 6.38.5 to 6.39. All works good.
Then I upgraded a lot of wAP, wAP-ac, mAP, cAP and other access points via RB3011's CAPSMAN.
All access points upgraded successfully.
 
User avatar
ahteran
newbie
Posts: 32
Joined: Sun Nov 09, 2014 5:07 pm

Re: v6.39 [current]

Sun Apr 30, 2017 4:32 pm

Upgraded 6.38.5 to 6.39
No problem on RB450 and RB433
 
bbs2web
Member Candidate
Member Candidate
Posts: 201
Joined: Sun Apr 22, 2012 6:25 pm
Location: Johannesburg, South Africa
Contact:

Re: v6.39 [current]

Sun Apr 30, 2017 4:50 pm

We've upgraded a variety of devices without issues (CCR1036-12G-4S, CCR1036-8G-2S+, CHR, x86, RB433GL RB411U, hAP ac, 750Gr2, 750Gr3) which utilise MPLS, VPLS, BGP, OSPF, bridging, L2TP (server & client), etc...

We have however noticed that a CHR router appears to be restarting its SNMP process almost exactly once an hour and is sending warmStart SNMP traps, herewith a sample:
15:07:09 2017/04/30 ZBXTRAP 1.1.1.36
PDU INFO:
  contextEngineID                <80>^@:<8C>^D1101
  notificationtype               TRAP
  version                        3
  receivedfrom                   UDP: [1.1.1.36]:35807->[1.1.1.26]
  errorstatus                    0
  messageid                      1250437036
  securitylevel                  3
  securityEngineID               <80>^@:<8C>^D1101
  securityName                   hidden-core-profile1
  contextName
  securitymodel                  3
  transactionid                  444
  errorindex                     0
  requestid                      1705408997
VARBINDS:
  DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (505) 0:00:05.05
  SNMPv2-MIB::snmpTrapOID.0      type=6  value=OID: SNMPv2-MIB::warmStart
Device's uptime:
> sys resource print 
                   uptime: 6h16m45s
                  version: 6.39 (stable)
Device's clock:
> sys clock print 
                  time: 15:44:12
                  date: apr/30/2017
SNMP process uptime is 5.05 seconds, although system uptime is several hours.We monitor 1962 SNMP items every 60 seconds where Zabbix groups SNMP queries together (ie not querying every SNMP OID individually).
Last edited by bbs2web on Mon May 01, 2017 1:36 am, edited 1 time in total.
 
FIPTech
Member
Member
Posts: 469
Joined: Tue Dec 22, 2009 1:53 am

Re: v6.39 [current]

Sun Apr 30, 2017 5:10 pm

*) dhcpv4-server - added "lease-hostname" script parameter;


Cannot get this variable to work. Other previously available variables are working.

It would be useful if lease-scripts could execute when the IP is not renewed by the client, so that we can easily remove a DNS entry.

I tried to use
 :if ($leaseBound = 0)
for this but it does not work.

In the mean time here is a workaround to get the hostname :
# Write DNS record for DHCP lease

:local topdomain;
:local hostname;

# Top domain
:set topdomain "mydomain.fr";

/ip dhcp-server lease;
        
    :set hostname ([get [find address=$leaseActIP] host-name]);

:if ($leaseBound = 1) do={

/ip dns static add name=($hostname . "." . $topdomain) address=$leaseActIP;
    
}
This line using the new lease-hostname parameter does not work :
/ip dns static add name=($lease-hostname . "." . $topdomain) address=$leaseActIP;
 
beef
just joined
Posts: 9
Joined: Wed Dec 02, 2015 1:47 am

Re: v6.39 [current]

Sun Apr 30, 2017 8:02 pm

(admin please delete) --- Turns out my ISP authentication served borked at the same time I updated FW and I assumed the wrong thing.
Last edited by beef on Tue May 02, 2017 1:47 am, edited 1 time in total.
 
miharoot
just joined
Posts: 21
Joined: Sun May 19, 2013 3:59 pm

Re: v6.39 [current]

Sun Apr 30, 2017 11:59 pm

Last edited by miharoot on Mon May 01, 2017 6:49 pm, edited 1 time in total.
 
zakynthoswifi
Frequent Visitor
Frequent Visitor
Posts: 74
Joined: Thu Jul 17, 2014 12:38 am
Location: Zakynthos
Contact:

Re: v6.39 [current]

Mon May 01, 2017 1:04 am

Please make the 10sec keep alive timeout from pppoe unselectable
Ilias Theodosis
Network & Security Engineer
Cisco CCNA,CCNP,CCIE
Network Solutions Ltd.
Zakynthos, Greece
 
jezekus
just joined
Posts: 6
Joined: Sun Jun 09, 2013 9:08 pm

Re: v6.39 [current]

Mon May 01, 2017 12:12 pm

RB SXT 5HPnD - upgrade from 6.38.5 to 6.39 successful

RB 751U-2HnD - upgrade from 6.38.5 to 6.39 router keeps reloading default configuration after every reboot, tried reflashing, setting from scratch, but after reboot configuration is wiped and default is loaded - this is really bad.

Reverting to 6.38.5
 
ditonet
Forum Veteran
Forum Veteran
Posts: 841
Joined: Mon Oct 19, 2009 12:52 am
Location: Europe/Poland/Konstancin-Jeziorna
Contact:

Re: v6.39 [current]

Mon May 01, 2017 2:15 pm

@FIPTech
:local leaseHostName;
:set leaseHostName $"lease-hostname";
Then use 'leaseHostName' variable instead of 'lease-hostname'.

HTH,
Grzegorz | MTCNA, MTCRE, MTCSE | konsultacje MikroTik Warszawa
It is a book about a Spanish guy called Manual. You should read it. - Dilbert
 
senawalker
just joined
Posts: 1
Joined: Mon May 01, 2017 4:06 pm

Re: v6.39 [current]

Mon May 01, 2017 4:14 pm

Sir i have problem

rules p2p block bit torrent its gone...

some one can help me fix then?

dont say downgrade sir... i need solution for renew OS 6.39 thanks you
 
willglynn
just joined
Posts: 2
Joined: Mon May 01, 2017 4:18 pm

Re: v6.39 [current]

Mon May 01, 2017 4:21 pm

:cry: :cry: :cry: :cry:

Killed my RB2011iL. I managed to downgrade it but it still locks up as soon as a LAN device tries to access WAN.

If I hard reset to factory; will my saved backup config still be there?
I have an RB2011 that never came back from the upgrade. On-site personnel report the screen is stuck at "loading kernel". Working on serial access now.
 
pe1chl
Forum Guru
Forum Guru
Posts: 5928
Joined: Mon Jun 08, 2015 12:09 pm

Re: v6.39 [current]

Mon May 01, 2017 4:36 pm

Sir i have problem

rules p2p block bit torrent its gone...

some one can help me fix then?

dont say downgrade sir... i need solution for renew OS 6.39 thanks you
Those rules did not work anyway.
It is not easy to block such things due to advances in the protocols to avert blocking.
 
CMNET
just joined
Posts: 2
Joined: Mon May 01, 2017 5:46 am

Re: v6.39 [current]

Mon May 01, 2017 5:01 pm

just upgraded one of my 15 RB2011 routers to v 6.39... totally crashed. Was not able log back into it without driving to the site. Upon re-accessing it everything in the programming was wiped back to default. Took multiple trys to get the IP address set to static, kept reverting to automatic. once I got it stay I was able to get it to downgrade to 6.37 bugfix. Never had this issue with a OS upgrade, whats up?

I actually "killed the cat" twice! Once at the site after the first downgrade and got the router back working, I attempted to do the upgrade again, assuming there must have been a glitch the first time, NOPE! same issue. I am not able to send the issue to Mikrotik as is stated to do because when it wipes back to default the router can no longer access the internet.
 
ulysses
Frequent Visitor
Frequent Visitor
Posts: 79
Joined: Fri Sep 25, 2015 1:26 pm

Re: v6.39 [current]

Mon May 01, 2017 5:41 pm

Same here. Bricked my 2011. VERY frustrating. Had to work additional time to restore config on another router, it's on 6.34.5. What's happening? haven't you guys at Mikrotik tested it on the hardware?
 
zojka
just joined
Posts: 20
Joined: Tue Aug 12, 2014 12:26 pm

Re: v6.39 [current]

Mon May 01, 2017 7:27 pm

Sir i have problem

rules p2p block bit torrent its gone...

some one can help me fix then?

dont say downgrade sir... i need solution for renew OS 6.39 thanks you
Those rules did not work anyway.
It is not easy to block such things due to advances in the protocols to avert blocking.
Hi, I also looking for solution, run FW L7 instead of p2p matcher.
 
pe1chl
Forum Guru
Forum Guru
Posts: 5928
Joined: Mon Jun 08, 2015 12:09 pm

Re: v6.39 [current]

Mon May 01, 2017 8:03 pm

L7 matching is becoming more and more difficult due to encryption, and the use of random portnumbers
makes it difficult to apply it to a limited part of the traffic. That results in performance problems and
false positives on traffic you did not want to filter.
I know it is an unwelcome message, but "blocking certain traffic" is becoming less and less viable.
 
raffav
Member Candidate
Member Candidate
Posts: 289
Joined: Wed Oct 24, 2012 4:40 am

Re: RE: Re: v6.39 [current]

Mon May 01, 2017 8:21 pm

L7 matching is becoming more and more difficult due to encryption, and the use of random portnumbers
makes it difficult to apply it to a limited part of the traffic. That results in performance problems and
false positives on traffic you did not want to filter.
I know it is an unwelcome message, but "blocking certain traffic" is becoming less and less viable.
Agree,
There is hardware dedicated for that propose.
Router is was not designed to filter l7

Enviado de meu XT1580 usando Tapatalk
 
kdave
just joined
Posts: 1
Joined: Tue May 02, 2017 1:10 am

Re: v6.39 [current]

Tue May 02, 2017 1:21 am

Upgrading wAP G-5HacT2HnD from 6.38.5 to 6.39 led to factory reset after reboot (I saw a similar report posted). The configuration was lost. Restoring from backup worked, but I observed subjective decrease of connection quality over wifi (noticeable lags, connections stuck). Downgrade to 6.38.5 worked and connection quality was ok again.
 
arturo
just joined
Posts: 2
Joined: Tue May 02, 2017 3:43 am

Re: v6.39 [current]

Tue May 02, 2017 4:07 am

Issues spoted:

1) *CRITICAL* - the same as CMNET and ulysses:
- RB750Gr3 - updated correctly
BUT
- RBwAPG-5HacT2HnD - after upgrade configuration lost, seems router is not saving configuration - applying configuration changes works, but power loss or reboot option ends with factory configuration
- RB941-2ND - as above - after upgrade configuration lost, applying configuration changes works, but power loss or reboot option ends with factory configuration

2) Minor:
WebFig ->Quickset - Country selection
After setting any country, saving and reloading the page shows country one further on the list. Eg - default option "no_country_selected" is shown as "north_korea", seting "poland" after reloading shows "portugal"
 
pe1chl
Forum Guru
Forum Guru
Posts: 5928
Joined: Mon Jun 08, 2015 12:09 pm

Re: v6.39 [current]

Tue May 02, 2017 10:47 am

I can confirm the above on several devices (mostly LHG5).
There is really something here that has to be fixed!
 
User avatar
morituruz
newbie
Posts: 33
Joined: Fri Oct 17, 2014 9:00 am

Re: v6.39 [current]

Tue May 02, 2017 11:27 am

!) firewall - discontinued support for p2p matcher (old rules will become invalid);
So how we should detect p2p traffic now?
p2p matcher with two-step method (add destination ip to address list and block/prioritize this list) is working very good for me.
 
Ansy
Frequent Visitor
Frequent Visitor
Posts: 72
Joined: Mon Oct 17, 2011 1:32 pm
Location: Russia
Contact:

Re: v6.39 [current]

Tue May 02, 2017 11:37 am

Updated 6.39 OK:
  • two hAP lite (smips RB941-2nD) devices
  • one RB751U-2HnD (mipsbe) device
  • one hEX (mmips RB750Gr3) device
But another hEX RB750Gr3 bricked into bootloop (BEEP, reboot, BEEP, reboot, ... ) and doesn't accept any control actions -- netinstall too.
What can I do with it? RMA?
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24276
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: v6.39 [current]

Tue May 02, 2017 11:42 am

!) firewall - discontinued support for p2p matcher (old rules will become invalid);
So how we should detect p2p traffic now?
p2p matcher with two-step method (add destination ip to address list and block/prioritize this list) is working very good for me.
It's great that you think it did it's job, but actually it was not doing anything.
It was broken for a long time, and was not actually capturing any modern p2p traffic, instead it was breaking some legitimate traffic.
You can make actually working rules with l7 filters:

https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/L7
No answer to your question? How to write posts
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1409
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.39 [current]

Tue May 02, 2017 11:50 am

This is applicable only for users using Webfig.

We have managed to reproduce problem with default configuration after reboot. We will try to fix this as soon as possible.
If you have only used Webfig on specific router and have never used CLI or Winbox on this device, then after upgrade/reboot device will be reset to default configuration.

Instructions to avoid this:
1) Connect to device through CLI or Winbox before upgrade to 6.39;
2) Reject default configuration;
3) Upgrade device.
 
User avatar
morituruz
newbie
Posts: 33
Joined: Fri Oct 17, 2014 9:00 am

Re: v6.39 [current]

Tue May 02, 2017 12:41 pm

It's great that you think it did it's job, but actually it was not doing anything.
It's doing its job pretty well actually.
I just checked it again right now on 6.39rc41.

Rules disabled:
Image


Rules enabled:
Image
 
Ansy
Frequent Visitor
Frequent Visitor
Posts: 72
Joined: Mon Oct 17, 2011 1:32 pm
Location: Russia
Contact:

Re: v6.39 [current]

Tue May 02, 2017 1:14 pm

!) firewall - discontinued support for p2p matcher (old rules will become invalid);
So how we should detect p2p traffic now?
p2p matcher with two-step method (add destination ip to address list and block/prioritize this list) is working very good for me.
For BitTorrent traffic (sorry for video only -- that's not my content):
https://www.youtube.com/watch?v=diA-5e7TdZM
This is applicable only for users using Webfig.

We have managed to reproduce problem with default configuration after reboot. We will try to fix this as soon as possible.
If you have only used Webfig on specific router and have never used CLI or Winbox on this device, then after upgrade/reboot device will be reset to default configuration.

Instructions to avoid this:
1) Connect to device through CLI or Winbox before upgrade to 6.39;
2) Reject default configuration;
3) Upgrade device.
How about those who DID upgrade to 6.39 and have bricked/bootlooping devices?
Any special instructions to recover?
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1409
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.39 [current]

Tue May 02, 2017 1:56 pm

Ansy - This problem will reset configuration of device. It will not make device go into bootloop. If you have such problem, then write to support@mikrotik.com. Send backups, export files, supout file so we can try to trace the issue. If device has serial port, then connect to router through it and check what you can see on it.
 
Koli
just joined
Posts: 1
Joined: Thu Dec 15, 2016 9:38 am

Re: v6.39 [current]

Tue May 02, 2017 2:06 pm

Hi Everyone
I have routerboard Hap Ac Lite RB952UI -5AC2ND.. Today i update new version 6.39 and after install
my router still reboot every second.. Can't connect,, i tried to boot with netinstall but doesn't work..
Can you help please!!
 
User avatar
Cha0s
Forum Veteran
Forum Veteran
Posts: 908
Joined: Tue Oct 11, 2005 4:53 pm

Re: v6.39 [current]

Tue May 02, 2017 2:24 pm

So how we should detect p2p traffic now?
Personally I haven't found any 100% reliable method without having to do some settings on each torrent client's PC (read bellow).
But I haven't looked into it the last 2-3 years to be honest, so there maybe other solutions now.

The old p2p matcher that mikrotik had only worked for non encrypted bittorrent transfers, which AFAICT are pretty much non-existent nowadays.


What I ended up doing was configure Windows to set a custom DSCP (TOS) tag on all packets generated by uTorrent (or whatever application you want).
Then with a simple mangle rule I can match this DSCP and apply a custom packet mark which in turn is used in my queues.
It works flawlessly and it doesn't care about which ports the client is using or if it has encryption enabled.

A few months back I tried implementing the same solution on a Linux desktop but with little research I didn't find any way to do dscp tagging per process.
So it definitely isn't a universal solution, but it works for me :)
 
User avatar
morituruz
newbie
Posts: 33
Joined: Fri Oct 17, 2014 9:00 am

Re: v6.39 [current]

Tue May 02, 2017 3:16 pm

Thanks, i know about layer7 based solutions.
Personally I haven't found any 100% reliable method without having to do some settings on each torrent client's PC (read bellow).
But I haven't looked into it the last 2-3 years to be honest, so there maybe other solutions now.
Nobody talk about 100% but please take a look at screenshots in my comment #67 — only three simple rules almost stopped uploads in torrent client. No DSCP, no L7.
 
User avatar
Cha0s
Forum Veteran
Forum Veteran
Posts: 908
Joined: Tue Oct 11, 2005 4:53 pm

Re: v6.39 [current]

Tue May 02, 2017 3:22 pm

Thanks, i know about layer7 based solutions.
Personally I haven't found any 100% reliable method without having to do some settings on each torrent client's PC (read bellow).
But I haven't looked into it the last 2-3 years to be honest, so there maybe other solutions now.
Nobody talk about 100% but please take a look at screenshots in my comment — only three simple rules almost stopped uploads in torrent client. No DSCP, no L7.
My solution does work 100% but it needs for each PC on your network to setup Policy Based QoS via Group Policy editor to apply the DCSP tag.
It's not the easiest to setup and maintain, but since I implemented this about 4-5 years ago I've never ever had any problems with torrents being mis-classified by my firewall/queues. Actually this method doesn't even care if the traffic is bittorrent or not. It will limit whatever that comes out of uTorrent.

I saw your screenshots but they mean nothing to me tbh. I can't see the full rules nor your exact configuration on qBittorrent.
Either way, encryption is the way to go and the old p2p matcher would have stopped working sooner or later anyway. The last 7 years it never worked for me with encryption enabled.

That said, if your goal is to block the bittorrent traffic instead of doing traffic shaping on it, then this has been solved for many years now without using the p2p matcher.. Search on the forum to find the relevant threads on the subject.
 
irghost
Member Candidate
Member Candidate
Posts: 282
Joined: Sun Feb 21, 2016 1:49 pm

Re: v6.39 [current]

Tue May 02, 2017 3:27 pm

loading kernel... OK
setting up elf image... OK
jumping to kernel code
ERROR: no system package found!
Kernel panic - not syncing: Attempted to kill init!
Rebooting in 1 seconds..

RouterBOOT booter 3.33

RouterBoard 2011UiAS-2HnD

CPU frequency: 600 MHz
 Memory speed: 200 MHz
  Memory size: 128 MiB
    NAND size: 128 MiB

Press any key within 5 seconds to enter setup.....

RB2011 Does Not BOOT after Upgrade

This Problem
please help
i recover my RB2011 With netinstall
but i dont know what was wrong with my rb2011
MTCNA MTCRE MTCTCE MTCUME MTCWE MTCIPv6E MTCINE
 
pe1chl
Forum Guru
Forum Guru
Posts: 5928
Joined: Mon Jun 08, 2015 12:09 pm

Re: v6.39 [current]

Tue May 02, 2017 3:33 pm

This is applicable only for users using Webfig.

We have managed to reproduce problem with default configuration after reboot. We will try to fix this as soon as possible.
If you have only used Webfig on specific router and have never used CLI or Winbox on this device, then after upgrade/reboot device will be reset to default configuration.
Ok that probably matches most of the cases where I have seen it fail. Good find!
However, note that there is not only the case of "back to default configuration" but also "no longer able to save any configuration".
Is that covered by this as well?
 
User avatar
rushlife
Member Candidate
Member Candidate
Posts: 102
Joined: Thu Nov 05, 2015 12:30 pm
Location: czech republic

Re: v6.39 [current]

Tue May 02, 2017 3:52 pm

Big thanks for script on dhcp-client, it's handy.
BUT, what about script for "dhcp-client" integrated in ppp client / section ?

Thanks guys.
 
myrolm
just joined
Posts: 1
Joined: Tue May 02, 2017 10:27 am

Re: v6.39 [current]

Tue May 02, 2017 3:55 pm

RB750r2: No openvpn interfaces after reboot, no certificates, device went back to defaults. After setup and reboot defaults again.
 
ulysses
Frequent Visitor
Frequent Visitor
Posts: 79
Joined: Fri Sep 25, 2015 1:26 pm

Re: v6.39 [current]

Tue May 02, 2017 4:14 pm

So, what should we do with the bricked devices? Downgrade? I am still to follow the netinstall route... Honestly, last thing I was planning to do on my holiday
 
dadoremix
Member Candidate
Member Candidate
Posts: 118
Joined: Sat May 14, 2011 11:31 am

Re: v6.39 [current]

Tue May 02, 2017 4:17 pm

Try with netinstall
And again set as new
Do not restore old config, make it ad new


Sent from my iPhone using Tapatalk Pro
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: v6.39 [current]

Tue May 02, 2017 5:06 pm

*) dhcp-client - added "script" option which executes script on state changes;
FINALLY!

Now we can make actual stateful DDNS updates whenever they're needed instead of running a script every x minutes!

Lots of enhancements in this version. Kudos!
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
dl1nux
just joined
Posts: 20
Joined: Tue Jan 03, 2017 11:45 am

Re: v6.39 [current]

Tue May 02, 2017 5:26 pm

Well, I should have read that thread before...

just upgraded my RB2011iL-RM yesterday evening, and it crashed...
Will have to go to the location to check what is broken, but I guess, after reading this posts, it has lost its config or I have to netinstall it.....
I always use winbox, also for upgrading (system packages online upgrade)

:-(
 
FIPTech
Member
Member
Posts: 469
Joined: Tue Dec 22, 2009 1:53 am

Re: v6.39 [current]

Tue May 02, 2017 6:54 pm

@ ditonet

Thanks, i did forget to put " " around the lease-hostname variable :(

stupid error.

So the final working script to write a DNS record for each IP lease :

(note that this is a simplified script, it does not verify neither delete DNS multiple registrations and does not delete the DNS recording when the IP is released.)
# DNS record for DHCP lease
:local topdomain;

# Configure your domain
:set topdomain "yourdomain.com";

:if ($leaseBound = 1) do={
/ip dns static add name=($"lease-hostname" . "." . $topdomain) address=$leaseActIP;
}
I would be interested to know if somebody success in deleting a record at IP releasing.

This is something quite standard in DHCP clients (Dibbler for example), this could be coded inside Router OS for simplicity.
 
User avatar
alexcherry
just joined
Posts: 20
Joined: Tue Jan 11, 2011 5:01 pm

Re: v6.39 [current]

Tue May 02, 2017 7:33 pm

Hi guys, we are developers of Radius software - splynx.com and it looks that inside the 6.39 were broken Accounting STOP packets.
It was reported to us by several clients today. The issue is described below :

In case when Mikrotik stops the PPP session, it sends wrong Framed-IP address (10.0.0.0). We work with the Framed-IP address as part of session identification, so our Radius cannot close the session correctly. In all previous versions always correct Framed-IP address came back from Mikrotik to Radius server.

Here is a correct START packet, where Framed-IP is the IP address of customer (192.168.102.5) :

START:
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 15728642
NAS-Port-Type = Ethernet
User-Name = "alex"
Calling-Station-Id = "C8:2A:14:2D:05:AE"
Called-Station-Id = "service1"
NAS-Port-Id = "ether3"
Acct-Session-Id = "81300002"
Framed-IP-Address = 192.168.102.5
Acct-Authentic = RADIUS
Event-Timestamp = "May 2 2017 18:15:50 CEST"
Acct-Status-Type = Start
NAS-Identifier = "NAS-SPLYNX"
Acct-Delay-Time = 0
NAS-IP-Address = 10.0.1.36

And here is a STOP packet with broken Framed-IP address :
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 15728642
NAS-Port-Type = Ethernet
User-Name = "alex"
Calling-Station-Id = "C8:2A:14:2D:05:AE"
Called-Station-Id = "service1"
NAS-Port-Id = "ether3"
Acct-Session-Id = "81300002"
Framed-IP-Address = 10.0.0.0
Acct-Authentic = RADIUS
Event-Timestamp = "May 2 2017 18:16:38 CEST"
Acct-Session-Time = 48
Idle-Timeout = 0
Session-Timeout = 0
X-Ascend-Data-Rate = 1000000
Ascend-Xmit-Rate = 1000000
X-Ascend-Data-Rate = 500000
Ascend-Data-Rate = 500000
Mikrotik-Rate-Limit = "500000/1000000 0/0 0/0 1/1 5 250000/500000"
Acct-Input-Octets = 55500
Acct-Input-Gigawords = 0
Acct-Input-Packets = 862
Acct-Output-Octets = 6912
Acct-Output-Gigawords = 0
Acct-Output-Packets = 54
Acct-Status-Type = Stop
Acct-Terminate-Cause = NAS-Request
NAS-Identifier = "NAS-SPLYNX"
Acct-Delay-Time = 0
NAS-IP-Address = 10.0.1.36
 
FIPTech
Member
Member
Posts: 469
Joined: Tue Dec 22, 2009 1:53 am

Re: v6.39 [current]

Tue May 02, 2017 8:27 pm

Here is a slightly better script to add a DNS entry for each DHCP lease. Version 6.39 simplify the script thanks to the new lease-hostname variable.

This one check for existence of static DNS entries with the same fully qualified domain names or same addresses and delete them before adding a new DNS entry, if necessary.
If a static DNS entry with the same domain name and same address as the lease exist the script does not update the DNS server.

See https://wiki.mikrotik.com/wiki/Setting_ ... DHCP_lease for more informations (old method, more processor hungry).

This script use the DHCP server lease script function available recently.
# DNS record for DHCP lease

:local topdomain;
:local FullHostName;
:local NoUpdate false;


# Configure your domain
:set topdomain "yourdomain.com";

:if ($leaseBound = 1) do={

:set FullHostName ($"lease-hostname" . "." . $topdomain)

/ip dns static;

:foreach n in [find] do={
# If a static DNS entry is the same as the lease then leave it and mark to not Update it
:if (([get $n name] = $"FullHostName") and ([get $n address] = $leaseActIP)) do={
:set NoUpdate true;
} else={
# If some DNS entry with same fully qualified domain name or same address already exist remove it
:if (([get $n name] = $"FullHostName") or ([get $n address] = $leaseActIP)) do={
   :log info ("Removing from Static DNS : " . [get $n name] .  " @ " . [get $n address]);
    remove $n;
  }
 }
}
# Add new Static DNS Entry if necessary

:if ($NoUpdate = false) do={
:log info ("Adding to Static DNS : " . $"FullHostName" .  " @ " . $leaseActIP);
add name=($"lease-hostname" . "." . $topdomain) address=$leaseActIP;
 }
 
}
Last edited by FIPTech on Wed May 03, 2017 2:32 am, edited 2 times in total.
 
arturo
just joined
Posts: 2
Joined: Tue May 02, 2017 3:43 am

Re: v6.39 [current]

Tue May 02, 2017 9:35 pm

This is applicable only for users using Webfig.

We have managed to reproduce problem with default configuration after reboot. We will try to fix this as soon as possible.
If you have only used Webfig on specific router and have never used CLI or Winbox on this device, then after upgrade/reboot device will be reset to default configuration.

Instructions to avoid this:
1) Connect to device through CLI or Winbox before upgrade to 6.39;
2) Reject default configuration;
3) Upgrade device.
Diagnosis: correct - problems with devices configured by Webfig
Solution: wrong/not working

Description:
RBwAPG-5HacT2HnD yesterday after multiple retries brought to normal operation by reverting to 6.38.5 firmware and reconfiguring to production configuration.
Following strods advice:
- connected to wAP ac via winbox
- winbox without asking reverted configuration of wAP to factory one
- upgraded to 6.39
- connected via Winbox to make initial changes
- configuration finalized via Webfig
- test through "Reboot" option - failed - wAp woke up with factory configuration
- downgrade to 6.38.5, reconfigurig everything, working again as supposed

Learning: if you won't like to be beta tester and spend 4 hours of your time on finding the issues/solutions, wait at least 2 weeks before upgrading to new version of firmware :-(
 
moep
newbie
Posts: 48
Joined: Mon Jul 02, 2012 2:12 pm

Re: v6.39 [current]

Tue May 02, 2017 10:05 pm

HAP ac lite - After update I can't create SMB share on external drive (usb). Can somebody confirm that?
can confirm with hEX and attached 1 TB USB SSD
also the exisiting shares are inaccessible!

please fix it :)
 
kivimart
newbie
Posts: 40
Joined: Thu Oct 10, 2013 3:06 pm

Re: RE: Re: v6.39 [current]

Tue May 02, 2017 11:17 pm

HAP ac lite - After update I can't create SMB share on external drive (usb). Can somebody confirm that?
can confirm with hEX and attached 1 TB USB SSD
also the exisiting shares are inaccessible!

please fix it :)
Same here on HapAC

Sent from my SM-G930F using Tapatalk
 
alphahawk
Frequent Visitor
Frequent Visitor
Posts: 98
Joined: Fri Mar 28, 2008 6:40 pm

Re: v6.39 [current]

Wed May 03, 2017 2:30 am

!) firewall - discontinued support for p2p matcher (old rules will become invalid);
So how we should detect p2p traffic now?
p2p matcher with two-step method (add destination ip to address list and block/prioritize this list) is working very good for me.
It's great that you think it did it's job, but actually it was not doing anything.
It was broken for a long time, and was not actually capturing any modern p2p traffic, instead it was breaking some legitimate traffic.
You can make actually working rules with l7 filters:

https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/L7
Normis it actually worked with unencrypted p2p. That was all I really cared for. What I would be interested to know is how does a L7 filter performer compared to the p2p matcher?
 
mmmigoro
newbie
Posts: 39
Joined: Mon Feb 14, 2011 3:48 pm
Location: PRAHOVA, Romania

Re: v6.39 [current]

Wed May 03, 2017 8:02 am

Running 2 BGP Full Routing Table here and 2 additional regional table on a CCR1036-12G-4S and after upgrade from v6.38 to v6.39 I noticed some CPU usage decrease. Previously one CPU core was always 100%, now with v6.39 it fluctuates between 85-95%.
Also power consumption is down by almost 1Wh (this grabbed my attention in the first place, then discovered the lower CPU usage).

Good job guys! Perhaps you can also let us know what was done in BGP area to lower the CPU usage?
 
User avatar
strods
MikroTik Support
MikroTik Support
Topic Author
Posts: 1409
Joined: Wed Jul 16, 2014 7:22 am
Location: Riga, Latvia

Re: v6.39 [current]

Wed May 03, 2017 1:46 pm

Version 6.39.1 has been released:
viewtopic.php?f=21&t=121306

Who is online

Users browsing this forum: No registered users and 18 guests