v6.43.4 [stable] is released!

ivanfm · Mon Oct 29, 2018 7:32 pm

Hi
Europe/Volgograd time zone is incorrect. should be GMT Offset +04:00 from October 28
It's not MiktoTik problem. All websites I can found show GMT +03:00 for Volgograd today, even Google.

If +04:00 is true, it needs to be fixed in TimeZone Database, not in applications.

This Volgograd change was published in tzdata on 2018-10-18, probably will have a long time to be updated in the servers.

https://github.com/eggert/tz/blob/ddc67 ... 2/NEWS#L50

The brazilian change was published in tzdata on 2018-01-12 and mikrotik and google maps does not use it yet.

Vesic · Tue Oct 30, 2018 7:24 am

Hi
Europe/Volgograd time zone is incorrect. should be GMT Offset +04:00 from October 28
It's not MiktoTik problem. All websites I can found show GMT +03:00 for Volgograd today, even Google.

If +04:00 is true, it needs to be fixed in TimeZone Database, not in applications.

https://www.timeserver.ru/cities/ru/volgograd
https://blogs.technet.microsoft.com/dst ... st-russia/

i

Chupaka · Tue Oct 30, 2018 8:42 am

Anyway, 6.43.4 was released even before this was updated in TZ database

Politicians appeared to be slower than tech guys.

Write to support@mikrotik.com and ask them to update TZ info. Maybe in next version

notToNew · Wed Oct 31, 2018 7:43 am

Sometimes after reboot, my Ltap Mini looses password and let me login without any.

Rebooting again often fixes the problem.
For security considerations this is extremely... Any ideas?
Have not seen this on any other MT router, and have several 100 in the field.

Ulypka · Fri Nov 02, 2018 8:42 am

what about Ticket#2018101022007579?
My ccr still crashing to get fragmented packet of EOIP

ieleja · Fri Nov 02, 2018 8:43 am

hAP ac ( 962UiGS-5HacT2HnT), upgraded at Oct/17 with 6.43.4 build [Oct/17/2018 06:37:48]

after that get 8 reboots up today, that at boot leaves in LOG:
router was rebooted without proper shutdown by watchdog timer

there are no configuration changes, high loads
current firmware 6.43

npero · Fri Nov 02, 2018 8:57 am

Some problem but with 960GSP just regular restart by watchdog every 4 days in old version 6.42.xx have uptime 100day and more, support give me generic answer netinstall to last version and if happens again send again supout.rif.
Also have PowerBox Pro for now only one watchdog restart after update to 6.43.

It is easy to do netinstall for router in your room but in the tower, for now I look this as a new feature automatically router restart nice

or automatic cache cleaner nice new feature.

Chaosphere64 · Fri Nov 02, 2018 9:43 am

hAP ac ( 962UiGS-5HacT2HnT), upgraded at Oct/17 with 6.43.4 build [Oct/17/2018 06:37:48]

after that get 8 reboots up today, that at boot leaves in LOG:
router was rebooted without proper shutdown by watchdog timer

there are no configuration changes, high loads
current firmware 6.43

+1
Exactly the same problem (3x hAP ac + 1 hEX PoE)

GreatForcez · Fri Nov 02, 2018 5:28 pm

I bought two brand new hEX routers, both came with RouterOS 6.40.4. Upgraded from System -> Packages with default configuration still in place. After the upgrade, I could not log back in (it said "wrong username or password"), also WinBox neighbour discovery was not working. But internet traffic was working fine, so I know the router booted and was running succesfully, but I could not access it. Reboot did not help, had to manually reset the device using the reset button. After resetting, I was able to log back in again and the router was succesfully updated. Confirmed this issue with two brand new hEX routers, serial numbers show "..../806/r3" so revision 3???

Also upgraded two CCR1036, no problems.

usmany · Tue Nov 06, 2018 11:42 pm

HI All,
I tried to upgrade my box, see result i got on attached file.

Need way out from this mess please

NetworkPro · Wed Nov 07, 2018 8:52 am

@usmany this should solve it for you

backup your config with a backup file, as well as export to text format

upgrade to the latest beta with only the packages you are using and you want to keep

system
security
advanced-tools
wireless
dhcp
ppp

upload only these npks

if everything goes fine, then switch back to stable if you need, or keep the beta until the next stable is released

eXS · Fri Nov 09, 2018 6:29 am

After upgrade & logging in for the first time the "Check for Updates" dialog was blank & giving an "error could not connect out of streams resources" at the bottom, this error remained despite trying "Check for updates" - by near accident i noticed if i changed the "Channel" drop down list the error went away and changed back to the normal "System is already up to date" when changed back to "current".

google -> "out of streams resources"

Aytishnikcom · Sat Nov 10, 2018 12:59 pm

RB 3011 does not work SNTP Client, netinstall did not help.
If you disable the SNTP Client then Cloud update time works

translate.google

Chupaka · Sat Nov 10, 2018 1:23 pm

does not work

what does that mean?

can you ping NTP server? don't you block NTP packets in Firewall Filter?

Aytishnikcom · Sat Nov 10, 2018 1:47 pm

RB 3011 When you do reset configuration, and you select the default configuration, the SNTP Client also does not work anyway.
SNTP Client works well on rb2011, RB1100AHx4, 951G-2HnD, D52G-5HacD2HnD-TC
translate.google
ping

https://prnt.sc/lgnog5

# nov/10/2018 14:29:33 by RouterOS 6.43.4
# software id = a98y-5s1n
#
# model = RouterBOARD 3011UiAS

/ip firewall filter
add action=accept chain=input comment="ACCEPT WinBox after knock" dst-port=\
    8291 in-interface-list=WAN protocol=tcp src-address-list=KNOCK-SUCCESS
add action=jump chain=input comment="Check port knock  (__1__)" icmp-options=\
    8:0-255 jump-target=knock packet-size=!0-99 protocol=icmp
add action=return chain=knock comment="KNOCK FAILURE return  (__2__)" \
    src-address-list=KNOCK-FAILURE
add action=add-src-to-address-list address-list=KNOCK-SUCCESS \
    address-list-timeout=1h chain=knock comment=\
    "KNOCK 3rd - success 10  (__3__)" packet-size=10 src-address-list=\
    KNOCK2
add action=return chain=knock comment="KNOCK 3rd - success return  (__4__)" \
    src-address-list=KNOCK-SUCCESS
add action=add-src-to-address-list address-list=KNOCK-FAILURE \
    address-list-timeout=1m chain=knock comment=\
    "KNOCK 3rd - failure  (__5__)" src-address-list=KNOCK2
add action=return chain=knock comment="KNOCK 3rd - failure return  (__6__)" \
    src-address-list=KNOCK-FAILURE
add action=add-src-to-address-list address-list=KNOCK2 address-list-timeout=\
    1m chain=knock comment="KNOCK 2nd - success 7  (__7__)" packet-size=7 \
    src-address-list=KNOCK1
add action=return chain=knock comment="KNOCK 2nd - success return  (__8__)" \
    src-address-list=KNOCK2
add action=add-src-to-address-list address-list=KNOCK-FAILURE \
    address-list-timeout=1m chain=knock comment=\
    "KNOCK 2nd - failure  (__9__)" src-address-list=KNOCK1
add action=return chain=knock comment="KNOCK 2nd - failure return  (__10__)" \
    src-address-list=KNOCK-FAILURE
add action=add-src-to-address-list address-list=KNOCK1 address-list-timeout=\
    1m chain=knock comment="KNOCK 1st - success 10  (__11__)" packet-size=\
    10
add action=return chain=knock comment="KNOCK 1st - success return  (__12__)" \
    src-address-list=KNOCK1
add action=add-src-to-address-list address-list=KNOCK-FAILURE \
    address-list-timeout=1m chain=knock comment=\
    "KNOCK 1st - failure  (__13__)"
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment=\
    "scanners-1  Port scanners to list" protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment=\
    "scanners-2  NMAP FIN Stealth scan" protocol=tcp tcp-flags=\
    fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment="scanners-3  SYN/FIN scan" \
    protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment="scanners-4  SYN/RST scan" \
    protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment=\
    "scanners-5  FIN/PSH/URG scan" protocol=tcp tcp-flags=\
    fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment="scanners-6  ALL/ALL scan" \
    protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment="scanners-7  NMAP NULL scan" \
    protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="scanners-8  dropping port scanners" \
    src-address-list=port_scanners
add action=drop chain=forward comment="scanners-9  dropping port scanners" \
    src-address-list=port_scanners
add action=drop chain=input comment="Brute Forcers_winbox_black_list - 1" \
    dst-port=8291 in-interface-list=WAN protocol=tcp src-address-list=\
    black_list
add action=add-src-to-address-list address-list=black_list \
    address-list-timeout=8h chain=input comment=\
    "Brute Forcers_add_black_list - 2" connection-state=new dst-port=8291 \
    in-interface-list=WAN protocol=tcp src-address-list=Winbox_Ssh_stage3
add action=add-src-to-address-list address-list=Winbox_Ssh_stage3 \
    address-list-timeout=1m chain=input comment=\
    "Brute Forcers_Ssh_stage3  -  3" connection-state=new dst-port=8291 \
    in-interface-list=WAN protocol=tcp src-address-list=Winbox_Ssh_stage2
add action=add-src-to-address-list address-list=Winbox_Ssh_stage2 \
    address-list-timeout=1m chain=input comment=\
    "Brute Forcers_Ssh_stage2  -  4" connection-state=new dst-port=8291 \
    in-interface-list=WAN protocol=tcp src-address-list=Winbox_Ssh_stage1
add action=add-src-to-address-list address-list=Winbox_Ssh_stage1 \
    address-list-timeout=1m chain=input comment=\
    "Brute Forcers_Ssh_stage1  -  5" connection-state=new dst-port=8291 \
    in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="Drop DNS" dst-port=53 in-interface-list=\
    WAN protocol=udp
add action=drop chain=input comment="Drop DNS" dst-port=53 in-interface-list=\
    WAN protocol=tcp
add action=drop chain=input comment="Block hole Windows - 1" dst-port=\
    135,137-139,445,593,4444 protocol=tcp
add action=drop chain=forward comment="Block hole Windows - 2" dst-port=\
    135,137-139,445,593,4444 protocol=tcp
add action=drop chain=input comment="Block hole Windows - 3" dst-port=\
    135,137-139 protocol=udp
add action=drop chain=forward comment="Block hole Windows - 4" dst-port=\
    135,137-139 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes \
    protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=accept chain=forward comment=torrent dst-port=50000 \
    in-interface-list=WAN protocol=tcp
add action=accept chain=forward comment="torrent UDP" dst-port=50000 \
    in-interface-list=WAN protocol=udp
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN

does not work
what does that mean?

can you ping NTP server? don't you block NTP packets in Firewall Filter?

JimmyNyholm · Tue Nov 13, 2018 9:38 am

6.43.4 is Stable branch and includes *) bridge - do not learn untagged frames when filtering only tagged packets;
When do we recon that this patch will be available in "Long Term" branch?

eXS · Sat Nov 17, 2018 8:21 am

Today the firewall connections list on one of my 1100x2's in winbox would keep going blank, progressively remaining/becoming more blank the longer the window was left open, despite 300-400 (fluctuating) "items" (bottom of connections window) - for a moment i thought it was because the list was actually clearing out, but checking in the terminal shows a list each time while the winbox connections window shows nothing. closing & re-opening the firewall window reliably brings back the list.

Also, albeit only twice/rarely, i've gotten a login authentication error logged, at the same time as i'm logging in, using stored credentials, it's as if i'm connecting too fast after launching winbox or something, that or resources being tied up is causing a glitch when i'm launching/connecting quickly, i'm not sure.

things feel kind of buggy lately, but i don't know if it's this-version specific as i'm doing things that i wasn't before. i couldn't afford a 2nd re-boot after the last upgrade (above post) which i've had to do in the past for other misc/buggy reasons on other devices after reset or upgrade.

venthyl · Sun Nov 18, 2018 10:44 pm

LHG 60, 6.43.4 after uograde

ap died after 3th frequency change

no ping response, no link with second device

schadom · Fri Nov 23, 2018 7:33 pm

BGP route filtering seems broken starting with v6.43.x. Eample below.

IXP Peering:

> routing bgp peer print detail where name=AS_SOMEPEER
Flags: X - disabled, E - established 
 0 E name="AS_SOMEPEER" instance=default remote-address=x.x.x.x remote-as=12345 tcp-md5-key="xxx" 
     nexthop-choice=default multihop=no route-reflect=no hold-time=3m ttl=default max-prefix-limit=10 
     in-filter=ixp-peer-in out-filter=ixp-ixp-peer-out address-families=ip default-originate=never remove-private-as=no 
     as-override=no passive=no use-bfd=no

In-Filter:

> routing filter print where chain=ixp-peer-in
Flags: X - disabled 
 0   ;;; ---- IXP Peer In ----
     chain=ixp-peer-in prefix-length=16-24 address-family=ip invert-match=no action=accept set-bgp-local-pref=300 
     set-bgp-prepend-path="" 
     
 1   chain=ixp-peer-in address-family="" invert-match=no action=reject set-bgp-prepend-path=""

IP Route:

> ip route print detail where received-from=AS_SOMEPEER
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, 
B - blackhole, U - unreachable, P - prohibit 
 0 ADb  dst-address=x.x.x.x/19 gateway=x.x.x.x gateway-status=x.x.x.x reachable via  sfp-sfpplus1 distance=20 
        scope=40 target-scope=10 bgp-as-path="12345" bgp-local-pref=300 bgp-med=0 bgp-origin=igp received-from=AS_SOMEPEER 

 1 ADb  dst-address=x.x.x.x/32 gateway=x.x.x.x gateway-status=x.x.x.x reachable via  sfp-sfpplus1 distance=20 
        scope=40 target-scope=10 bgp-as-path="12345" bgp-origin=igp received-from=AS_SOMEPEER 

 2 ADb  dst-address=x.x.x.x/32 gateway=x.x.x.x gateway-status=x.x.x.x reachable via  sfp-sfpplus1 distance=20 
        scope=40 target-scope=10 bgp-as-path="12345" bgp-origin=igp received-from=AS_SOMEPEER 

 3 ADb  dst-address=x.x.x/22 gateway=x.x.x.x gateway-status=x.x.x.x reachable via  sfp-sfpplus1 distance=20 
        scope=40 target-scope=10 bgp-as-path="12345" bgp-local-pref=300 bgp-origin=igp received-from=AS_SOMEPEER

Why are the /32 routes installed and active? Seems like the prefix-length=16-24 filter attribute is handled incorrectly.
Already contacted MT support two days ago, no reply yet.

Thanks

mducharme · Fri Nov 23, 2018 9:00 pm

Why are the /32 routes installed and active? Seems like the prefix-length=16-24 filter attribute is handled incorrectly.
Already contacted MT support two days ago, no reply yet.

I think the address-family="" in your reject rule is probably causing it to not match anything.

schadom · Fri Nov 23, 2018 9:09 pm

I think the address-family="" in your reject rule is probably causing it to not match anything.

Already tried that, no difference. From my perspective a reject rule without any attributes (inculding address-family) should always reject everything.

mducharme · Fri Nov 23, 2018 9:13 pm

Already tried that, no difference. From my perspective a reject rule without any attributes (inculding address-family) should always reject everything.

address-family="" on the reject rule would only reject routes where address-family = NULL, which should never be true.

If you want it to reject any address family you need !address-family instead of address-famiy=""

schadom · Fri Nov 23, 2018 9:15 pm

Already tried that, no difference. From my perspective a reject rule without any attributes (inculding address-family) should always reject everything.
address-family="" on the reject rule would only reject routes where address-family = NULL, which should never be true.

If you want it to reject any address family you need !address-family instead of address-famiy=""

You are right, thank you very much! This is quite irritating and could possibly be improved in future ROS/Winbox releases, as address-family=NULL should never occur. After collapsing the address-family options in Winbox, the reject rule works as expected:

asdf.png

Additionally invert-match=no (default) and set-bgp-prepend-path="" (default) are also added for every newly created rule by default, eg.:

> add chain=test action=reject
> print where chain=test      
Flags: X - disabled 
 0   chain=test invert-match=no action=reject set-bgp-prepend-path=""

The current approach just bloats the /routing filter print output with unnecessary information.
What speaks against hiding attributes if they have default values?

mducharme · Sat Nov 24, 2018 7:58 am

Additionally invert-match=no (default) and set-bgp-prepend-path="" (default) are also added for every newly created rule by default

When I create a new routing filter rule on my home router (running 6.43.4) it does not have those added for every newly created rule by default. I'm not sure how you are getting those on newly created rules by default, unless you are creating them by copying existing rules.

The thing about address-family="" vs. !address-family is well documented when it comes to working with the MikroTik firewall since the routing filters and the firewall are designed similarly. This behavior can catch people by surprise the first time, but once you know to look for it (collapsing the options in your screenshot above), the behavior is entirely consistent throughout the firewall and routing filter interface. Although I agree that it would be nice if the result was made more clear than it is, there are more important issues to be fixed.

tevolo · Thu Nov 29, 2018 6:51 pm

We have experienced many issues with 6.43.4 and losing the DHCP server functionality. We recently upgraded 20 CCRs from 6.38/6.38.1 and on 4 of the routers, DHCP server doesn't work. Eventually the router slows down too and cannot make a Supout.rif file. The DHCP server is shown in the config file, but it doesn't work and if you attempt to add a new dhcp server on the Bridge, it doesn't work. Reboot attempts do not resolve anything. We even tried to fix with onsite netinstalls which do not repair the DHCP server problems.
Only fix was to downgrade 6.42.7 and DHCP server comes back.
Been having way too many problems with RouterOS and updates lately. Really hoping for some stability very soon as reputation is going sour for us and Mikrotik.

Snap 2018-11-29 at 09.42.26.png

Grvuser · Sat Dec 01, 2018 2:41 am

Just Updated to this SW release, and I am unable to connect to Groove. It keeps giving me a invalid username and password. Tried resetting a couple of times, but it doesn't seem to reset at all. It connects to the setup network right away. Any help would be appreciated to connect back to Groove.

cdemers · Sat Dec 01, 2018 3:10 pm

Have you tried using the latest winbox?

Sent from my SM-A520W using Tapatalk

vecernik87 · Mon Dec 03, 2018 3:03 am

Just Updated to this SW release, and I am unable to connect to Groove. It keeps giving me a invalid username and password. Tried resetting a couple of times, but it doesn't seem to reset at all. It connects to the setup network right away. Any help would be appreciated to connect back to Groove.

@Grvuser: Which version did you upgrade from? There has been several changes recently which affects the way how winbox communicate and it is recommended to use newest winbox (currently 3.18) to avoid issues when logging in. Invalid username/password is one of typical issues which happens on older Winbox versions under some circumstances.

We have experienced many issues with 6.43.4 and losing the DHCP server functionality.

@tevolo: How many dhcp-servers do you have on each router and how many users per one dhcp-server? If you have any update about this issue, please share it. What are other "many issues"? Is there anything else except dhcp-server issues?

emils · Mon Dec 03, 2018 2:20 pm

New version 6.43.7 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=142316

v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Re: v6.43.4 [stable] is released!

Who is online