I think it would be more useful as a limited-user capability where users can be created that have preciselyGive the ability to secure firewall rules.
Welcome to the Safe ModeFor remote systems it will be not good if the managemend firewall rules are deleted.
Just an example, that's cool:Yes, RouterOS v7 has better command history, you will be able to see specific command that was executed.
> /sys history print detail
Flags: U - undoable, R - redoable, F - floating-undo
U redo=/interface eoip remove bridge2
undo=
/interface eoip add arp=enabled arp-timeout=auto disabled=no mac-address=\
6A:F5:C8:E5:62:12 mtu=auto name=bridge2
action="device removed" by="admin" policy=write time=mar/13/2020 14:06:52
> /interface/bridge/add name=brrr
> /sys history print detail
Flags: U - undoable, R - redoable, F - floating-undo
U redo=/interface eoip add name=brrr undo=/interface eoip remove *3
action="device added" by="admin" policy=write time=mar/16/2020 16:44:09
+1Don't forget to add VRF for management interface!
I'm against that. It is completely useless, and it tends to racism.Consider a GeoIP package allowing for firewall filtering by Country
I think the queue trees should allow an additional form of rate configuration in the form of a percentage of the rate of the next higher level in the queue tree.Enable using a global "MAX Speed" parameter you expect on your WAN interfaces. This should then be possible to be used within routeros within queue trees, mangle rules, hotspot etc. Today one needs to define each time an absolute value for Max Limit, Buffer Limit, trigger limit etc.! What a nightmare.
WiFi6 ist 2.4 and 5 GHz.WiFi 6 ( 6 GHz )
lmao, oh god, political correctness has now extended to routers.....I'm against that. It is completely useless, and it tends to racism.Consider a GeoIP package allowing for firewall filtering by Country
My first claim is that it is useless. And I will explain that:lmao, oh god, political correctness has now extended to routers.....I'm against that. It is completely useless, and it tends to racism.Consider a GeoIP package allowing for firewall filtering by Country
There are very good reasons for country blocking, first and foremost is for many people there's absolutely zero need to allow ANY kind of incoming traffic from overseas. All of our routers i'd absolutely like to do a simple chain=input src-country!=Australia action=drop. There's absolutely zero need for anyone in any other country to have any kind of input to our routers, except maybe ICMP. I'm not peering directly overseas, nobody will ever need to login or establish VPN's from overseas etc
Ideally this would pull data periodically from a central MikroTik server similar to DDNS which would make it more effective than just using fixed address-lists
That's a very simple and effective rule that would drastically reduce any vulnerabilities whilst simplifying management. If you feel thats racist well.... thats your problem
You may think so. Take an example. On your server you have a small web server that is for you local bicycle club. There user can get information about training times, when there are competition etc. Lets say a someone from Australia is on vacation in Bali and wants to know when the training is for his son that are home in Australia. Why should he not do that.There are very good reasons for country blocking, first and foremost is for many people there's absolutely zero need to allow ANY kind of incoming traffic from overseas.
My claim was: It is completely useless, and it tends to racism.So I don't know whether using discrimination per country is racist, but it is definitely useless.
Hmm. here is a counter use-case:My claim was: It is completely useless, and it tends to racism.So I don't know whether using discrimination per country is racist, but it is definitely useless.
It is useless for the reasons I described, and it tends to "let's block Nigeria because Nigerians are scammers. let's block Russia because Russians are hackers", etc etc.
That quickly slides towards racism.
As I explained before, that is not going to work. Your own users may appear to come from another country.Imagine you have a service for users from your own country only.
Then it makes sense to block all login attempts from any other country.
Q.E.D.
this is was nearly my user-case. a local WISP. and at one point it was very attempting to do so to fence off all failed authentication to our VPN service. Most of them are from one country.Imagine you have a service for users from your own country only.
And as I did write, how to access these services if the user are out travelling in another country?Hmm. here is a counter use-case:
Imagine you have a service for users from your own country only.
Then it makes sense to block all login attempts from any other country.
Q.E.D.
You are WAY overthinking this. It's really as simple as an address list generated from IANA that says i.e.My first claim is that it is useless. And I will explain that:
You have not defined what "the country of an IP address" is, and neither has the internet.
That would not be an 'input' chain, that would be forward chain, so the rule would not block traffic going to a server that resides behind the router. Only traffic directly destined to the router itself would get blockedYou may think so. Take an example. On your server you have a small web server that is for you local bicycle club. There user can get information about training times, when there are competition etc. Lets say a someone from Australia is on vacation in Bali and wants to know when the training is for his son that are home in Australia. Why should he not do that.There are very good reasons for country blocking, first and foremost is for many people there's absolutely zero need to allow ANY kind of incoming traffic from overseas.
Or your work have an proxy or head quarter in an other country, he the could not open your local web server, since you blocked all from outside Australia.
But if you have no webserver nor other services needed for any other, block it 100% for all, not just for people from overseas. Use VPN to access your local resources if needed.
It isn't useless. It's not about 100% perfect security either (such a thing doesn't exist). It's just about reducing the broader attack spectrum. In the same way most people move the default Winbox port off 8291 to something else, that isn't 100% effective so therefore its a useless feature? may as well not have it?If someone wants to attack you specifically, it is not a big deal for them to use a zombie device in your own country as a proxy. The internet is full of vulnerable devices which have never been upgraded since unpacking. So I don't know whether using discrimination per country is racist, but it is definitely useless.
Then Is see what you do wrong. There should be no input rules coming from the outside using the input chain. VPN is the way to go if you need to access services on the router.That would not be an 'input' chain, that would be forward chain.
I'm sorry to tell you, but that isn't possible. Addresses have not been assigned that way! I also sometimes thought it would have been much betterIt's really as simple as an address list generated from IANA that says i.e.
1.x.x.x/8 = Belongs in USA.
2.1.x.x/16 = Belongs to Belaruse
3.x.x.x/8 = Australia
etc etc
Functionally identical to an address list allow/block rule, except without having many thousands of entries in the address list and cluttering it up.
I am entirely aware of this, what I provided was clearly just an oversimplified example, I thought that was clear when I mentioned 'instead of having several thousand address list entries'I'm sorry to tell you, but that isn't possible. Addresses have not been assigned that way! I also sometimes thought it would have been much better
when it had been done that way, but it hasn't.
LIRs have assigned /24.../16 blocks to "users" (companies, internet providers) completely randomly, within their region. So it is rarely possible
to aggregate subsequent blocks into larger blocks that represent a country. The blocks for Australia are completely intermixed with blocks for
the asia-pacific region. The list of blocks for Australia would have many thousands of entries no matter how you like that.
I hoped you would have understood by now that this is not possible because there is no simple attribute on a packet that indicates it is "from Australia" so such filters can only work with that address list of thousands of entries in place.I am entirely aware of this, what I provided was clearly just an oversimplified example, I thought that was clear when I mentioned 'instead of having several thousand address list entries'
It's doing exactly the same job as manually adding them to an address list. But in a very simplified and clean way by just enabling 1 option and specifying countries. Ideally that is then dynamically updated
The alternative is entries need to be manually added to a MikroTik, that could be hundreds/thousands of routes especially if I want to do multiple things with multiple countries
Then I need another script running that updates this list automatically...... it's just really messy to keep everything updated and everything in sync.... when it could be a simple 1 tick-box operation instead.
The use of separate packages for part of functionality (like routing, advanced tools, PPP, etc) has been abandoned in v7. Everything is now in a single package except the truly special things like UPS monitoring.Please can upload All packages as separated files then we can use fetch command also , add Https mikrotik certificate for url download.mikrotik.com
installing packages required unzip the file and upload it agian some sites time we use mobile network and slow connection.
Remember, you don't need to convince anyone in this forum, just MikroTik. Non-technical reasons and user's business decisions aside, first question is what exactly should MikroTik provide. I see big difference between just support for something and providing all the data.So why are you so opposed to having a country feature?
But you can just handle them in the input firewall, right? That is where I regulate the other services as well, when they are enabled.The problem is the dude service on ports 2210 and/or 2211. They are not in the IP-Services settings.
The huge big network security problem is you can't turn this off or limit IP access in the IP-Services settings !!!!!!
Never mind - I got an email that says Dude uses the same ports as Winbox.Put Dude ports 2210 and 2211 in IP-Services where it belongs
Currently , IP->-Services has a field "Available From"
This functions with api , api-ssl , ftp , ssh , telnet , winbox , www , www-ssl
These services can be turned off/on and/or blocks of IP-networks can be used for each service.
The problem is the dude service on ports 2210 and/or 2211. They are not in the IP-Services settings.
The huge big network security problem is you can't turn this off or limit IP access in the IP-Services settings !!!!!!
This client Dude service is running and there is zero IP-Services control. This is a huge gigantic bulging security problem !
Every day, I see thousands of entries in my Mikrotik logs - example "jun/25 13:32:09 warning denied winbox/dude connect from 185.209.0.62"
Yesterday , I counted 4-thousand "winbox/dude" connect logs. And I know it's not winbox because I IP-Services limit what IP blocks can connect using winbox , so it has to be dude !
I suspect this has the potential to allow remote break-ins where an attacker may be able to do anything they want to your Mikrotik.
Also - it might be a good idea to add ICMP to the IP-Services section
North Idaho Tom Jones
That is normal for using that kind of limit. As I already wrote, the service accepts the connection then drops it and logs a message.And why do I still get "warning denied winbox/dude connect from" indicating remote IP addresses in my logs when I have the IP-Services for winbox configured to only allow my IP address blocks ?
Again - thank you for your prompt reply(s) to my questionsThat is normal for using that kind of limit. As I already wrote, the service accepts the connection then drops it and logs a message.And why do I still get "warning denied winbox/dude connect from" indicating remote IP addresses in my logs when I have the IP-Services for winbox configured to only allow my IP address blocks ?
When you do not like that, add a firewall rule (probably with address list) for the filtering.
Yes, that is how it works. In Linux this is called "TCP Wrappers" with their associated config files "/etc/hosts.allow" and "/etc/hosts.deny". It sits between the listening TCP port and the daemon that runs the connection, it first accepts the connection (or rather the kernel does that), looks up the source network in those files, and if not allowed it just closes the connection again. This whole thing was invented before firewalls were available in operating systems.Question - Am I correct to assume for IP-Services ssh, telnet, http, https api … Is it also "service accepts the connection then drops it if not allowed" ( aka accept the connection , check access-list, then drop if not allowed - if allowed then continue the service connection) ?
You can make a jump rule and add multiple rules to it, all with an address list. Not exactly the same, but should work.option to specify multiple adress lists inside single firewall rule?
No, it's bad idea. USB Stick are detected and dhcp-client is automatical created, you can do many fix to your needs by scripts&schedulers.Add support for LTE Devices to be controlled via CAPsMAN
That's right yes. reason = "Shutting down because DHCP broken script triggered a restart."When the reason for the reboot is an upgrade of ROS, the router already logs that...
Maybe it was just an unfortunate example and you want to be able to specify other messages like "shutdown for maintenance in rack #2"?
No, you are misunderstanding my request. I want to be able to specify the reboot reason in a script. For example: I have 10 scripts each that have a set of sequences that might lead to a reboot. Now my router reboots due to 1 of these scripts. It's hard for me to determine which one. If I could in each script give it a unique reboot reason by calling /system reboot reason="blah" then I'd be able to immediately see after reboot which one of those scripts initiated the reboot.If the reboot reason is written to the log before syslog is up and running, it will not send it out externally. So you need to look in local logs.
When you are doing such advanced things, I would advise setting up an external logserver and do remote logging to that.No, you are misunderstanding my request. I want to be able to specify the reboot reason in a script. For example: I have 10 scripts each that have a set of sequences that might lead to a reboot. Now my router reboots due to 1 of these scripts. It's hard for me to determine which one. If I could in each script give it a unique reboot reason by calling /system reboot reason="blah" then I'd be able to immediately see after reboot which one of those scripts initiated the reboot.If the reboot reason is written to the log before syslog is up and running, it will not send it out externally. So you need to look in local logs.
Yes, that would be a useful approach. Unfortunately I operate in an infrastructure-less environment where the configurations are built up and destroyed dynamically and as such we don't have a syslog server option.When you are doing such advanced things, I would advise setting up an external logserver and do remote logging to that.No, you are misunderstanding my request. I want to be able to specify the reboot reason in a script. For example: I have 10 scripts each that have a set of sequences that might lead to a reboot. Now my router reboots due to 1 of these scripts. It's hard for me to determine which one. If I could in each script give it a unique reboot reason by calling /system reboot reason="blah" then I'd be able to immediately see after reboot which one of those scripts initiated the reboot.If the reboot reason is written to the log before syslog is up and running, it will not send it out externally. So you need to look in local logs.
Then you can also keep log messages that occurred just before a crash, including messages you write in the log from a script.
You can easily set this up on any Linux machine, e.g. a Raspberry Pi or similar.
Isn't that what's already supported? https://wiki.mikrotik.com/wiki/Manual:I ... or_Classes- vendor class identifier (a string)
In the light of MAC address randomization it becomes less and less useful...- MAC address (a value and a mask)
Ok I was not aware of that. Indeed it is most like what I need except that I would like an extra match capability on MAC address/mask.Isn't that what's already supported? https://wiki.mikrotik.com/wiki/Manual:I ... or_Classes- vendor class identifier (a string)
But that is in fact one of the the applications I have for it :-)In the light of MAC address randomization it becomes less and less useful...- MAC address (a value and a mask)
Exactly. There are a few good use cases where client device MAC randomization doesn't make any sense and it's good to have some way to remind users to switch off MAC randomization for a particular SSID.But that is in fact one of the the applications I have for it :-)In the light of MAC address randomization it becomes less and less useful...- MAC address (a value and a mask)
You may be surprised as a network engineer, but SWos does not require this information!Can I have a link to the Feature requests for SWos
I am looking for feature of subnet mask default gateway on SWos software.
Without this feature it is impossible to manage/monitor a MikroTik device running on SWos from a different subnet. I am surprised it is omited and is a major limitation.
Regards,
David
Network Engineer, CCNA
They listing at that post :) and now... ros7.1beta3Feature request: add do-not-round option for /ping. (or accuracy=1/10, 1/100, 1/1000 or so)
Currently the /ping utility rounds to ms, which accuracy is enough in most cases. However, there are situations where there is a serious need for greater accuracy, e.g. gives a linux ping.
SecondedWinbox is wonderful, but a small suggestion: consider adding snapping capabilities to the several windows that can be opened within Winbox. It would be much easier to organize it.
Thanks.
I refer to the option you have in Windows: select the title bar of the window you want to snap, and drag it to the edge of your screen. An outline indicates where the window will snap to once you drop it. Drag it to the left or right side of your screen depending on where you want to snap it to. Some other interfaces allow you to snap windows against each other.Maybe you should explain what "snapping capabilities" are?
I like your taskbar aproach and the access to the open windows. And also compatible with the tile suggestion.Oh... well I prefer stacked windows rather than tiled ones, and I would like to see a "taskbar" or similar feature where you can click windows that have gone buried under others, to raise them again. Or some "lower" function that you can click in a large window to move it back to the bottom of the stack.
In daily use I usually have a "log" window full-sized as backdrop and open other windows on top of that. When I advertently click on the log somewhere it raises that window and all other windows disappear behind it. They can be raised only one by one via the menus, but it would be convenient when the log window could be moved back to the backdrop and/or when a list of open windows can be seen or called.
Easy for a teddy bear with straw for a neck!!!at Win10 we can Snap windows by Win + [Left/Right arrow]. For working with 3 monitors it's OK.
That feature has been present for years. But people don't bother to really study the matter so they often will not find that by themselves.As for features I believe I read this somewhere recently where someone was suggesting firewall lists within firewall lists.
That way we can select a number of firewall lists into a group of their own and so on.
That makes no sense! TCP and UDP are different protocols, they cannot be grouped.more important for me will be a selective protocol not only TCP or UDP and creating double rules but have a protocol list 6 TCP + 17 UDP in one FW RULE - this can grup my firewall rules drastically.
As I said before: people don't bother to really study the matter so they often will not find that by themselves.Access List of other Access List will be greate like the rules like a one regex: 10.50.[128-254].[30-35] who will match my all 128 branches with printers range in each branch - now I generate 128 rules for one LISTs in Access List.
TCP&UDP for 53, 3389 can be done by 2 rules, not 4.That makes no sense! TCP and UDP are different protocols, they cannot be grouped.
I agree, but although it would be possible to do all kinds of custom scripting for this it would be even more welcome when there would be some standard facility to automatically use link quality metrics in routing protocols. I.e. a worse link can get a lower preference so it is not completely disabled but can still be used as a fallback when all other paths fail.I want routers to poll their radio neighbor and get the RSSI/SNR/MCS values and act upon them. If there's a heavy rain storm causing a link to run at MCS0/1 or flapping, or lots of retransmission I want to disable the OSPF interface so traffic does not use that link and takes another path until it comes back to normal stable values
At the moment it causes havoc with phone calls
Absolutely. However assuming we stick with OSPF it's not viable as it would break compatibility with other devices. However if its another protocol that rides on top of it as an extension and can completely override the OSPF behavior (much like what MPLS does) then, maybe
I agree, but although it would be possible to do all kinds of custom scripting for this it would be even more welcome when there would be some standard facility to automatically use link quality metrics in routing protocols. I.e. a worse link can get a lower preference so it is not completely disabled but can still be used as a fallback when all other paths fail.
It appears that a major market for MikroTik is the wireless network where multiple wireless links are combined with routers to form a network, and it is a bit of a pity that the wireless world and the routing world are completely isolated. The wireless world has metrics like RSSI/SNR/CCQ/MCS but the routing world assumes all links are equal and 100%.
That has been available for many years already! Look at Tools->GraphingPlease add average cpu usage for the last day / month / year whatever.
I agree. All other platforms reports Up's and Down's.Please make some adjustments to OSPF neighbor reporting
First and foremost please take adjacency changes out of the debug,raw log location, its ridiculous. At the moment only 'Down' is included in 'route, ospf, info' so you can see when a neighbor goes down, but you cannot get a log message when neighbor goes up.
Mikrotik has already made kernel patches just for Tilera, so no worries there.( Tilera CPU support is dropped by linux kernel - so its no future ).
Mikrotik has already made kernel patches just for Tilera, so no worries there.( Tilera CPU support is dropped by linux kernel - so its no future ).
+10Cant you already do that via firewall, dont understand what more you need, if you want to block DNS requests form outside net, or alow only DNS requests from that ip range simple make firewall rule with tcp/udp 53 ports..Hello
to disable DNS attacking
please add listen address on better from use ip firewall filters
/ip dns allow-remote-requist=yes
/ip dns listen-src-address=192.168.88.0/24,x.xx,y.y.y
Regards
ctrl + homeIn the scripts and schedules editor in winbox can we please add the ability to select all - ie ctrl a? At the moment in order to select a big script you have to manually drag from start to finish.
INTERFACE TIME NUM DIR SRC-MAC DST-MAC VLAN SRC-ADDRESS DST-ADDRESS PROTOCOL SIZE CPU FP
ether1 0.3 1 <- 00:50:56:A6:61:84 FF:FF:FF:FF:FF:FF 192.168.99.1: who has 192.168.99... arp 60 1 no
ether1 1.29 2 <- 00:50:56:A6:61:84 FF:FF:FF:FF:FF:FF 192.168.99.1: who has 192.168.99... arp 60 1 no
ether1 2.29 3 <- 00:50:56:A6:61:84 FF:FF:FF:FF:FF:FF 192.168.99.1: who has 192.168.99... arp 60 1 no
ether1 3.307 4 <- 00:50:56:A6:61:84 FF:FF:FF:FF:FF:FF 192.168.99.1: who has 192.168.99... arp 60 1 no
ether1 4.3 5 <- 00:50:56:A6:61:84 FF:FF:FF:FF:FF:FF 192.168.99.1: who has 192.168.99... arp 60 1 no
ether1 5.3 6 <- 00:50:56:A6:61:84 FF:FF:FF:FF:FF:FF 192.168.99.1: who has 192.168.99... arp 60 1 no
Under /system logging action for target=remote please add some option to include the topics in the message sent to the remote log server.
E.g. add [topic,topic,topic] between the system name and the message when this option is set.
That is fixed text. I want to see the topics that are visible when logging in memory. These differ per message.Prefix already exist...
Ah, sorry, I have misunderstand...That is fixed text. I want to see the topics that are visible when logging in memory. These differ per message.Prefix already exist...
E.g. [system,info,account] or [ipsec,error]
See my post here from 2017. MT has not fixed anything of this yet.That is fixed text. I want to see the topics that are visible when logging in memory. These differ per message.
E.g. [system,info,account] or [ipsec,error]
True, but in this case I am not referring to cleanup of the topic names or capabilities to match it inside RouterOS, but toSee my post here from 2017. MT has not fixed anything of this yet.That is fixed text. I want to see the topics that are visible when logging in memory. These differ per message.
E.g. [system,info,account] or [ipsec,error]
viewtopic.php?t=124291
Support has only sad that they are looking inn to it. Nothing has changed in v7
When I look in the logging that my BSD syslog server writes to disk I see:Can you post an example on how it looks like and how you would like it to be.
firewall,info MikroTik: FI_D_port-test input: in:ether1 out:(unknown 0), src-mac 00:05:00:01:00:01, proto TCP (SYN), 11.11.183.214:47494->22.20.2.91:24063, len 40
dhcp,debug,packet MikroTik: Parameter-List = Subnet-Mask,Router,Domain-Server,Domain-Name,NETBIOS-Name-Server,Static-Route
script,info MikroTik: script=pool pool=default-dhcp used=9 total=244
dhcp,info MikroTik: DHCP-vlan1-Home assigned 192.168.10.186 to 3D:8E:20:1D:F0:29
dns,error MikroTik: DoH server connection error: remote disconnected while in HTTP exchange
dns,packet MikroTik: <gew1-accesspoint-e-l0np.ap.spotify.com:A:107=104.199.64.182>
wireless,info MikroTik: 9E:7A:3A:89:36:A1@wlan2: disconnected, received disassoc: sending station leaving (8)
bridge,stp MikroTik: wlan2 forwarding
dhcp,warning MikroTik: DHCP-vlan1-Home offering lease 192.168.10.206 for D8:BF:C0:50:33:DC without success
l2tp,ppp,info MikroTik: <l2tp-Kjell-Ivar>: disconnected
ipsec,info MikroTik: ISAKMP-SA deleted 22.20.2.91[4500]-9.19.78.44[4500] spi:46f07f9aaad565f3:4b0b7aaaa22ae161 rekey:1
l2tp,info MikroTik: first L2TP UDP packet received from 9.19.78.44Well, when I do not set BSD Syslog I cannot set Syslog Facility. That is required because I use that to direct the logs on the syslog server to the correct file.Try to remove the check mark for BSD Syslog format and see if it changes.
I do log to Splunk directly, but I have tested it with rsyslog server and it works there as well.
2) already exist by address-list, but1) Need support for global variables that could be used in firewall rules and scripts.
2) Need support for dns-names in firewall rules.
For example, to save any state of a process between individual script launches.example for 1) ?
What's a convenient way to update ip-addresses when one dns-name has multiple ip-addresses?2) already exist by address-list, but
For example, in the script, an SMS is sent via the lte port to a certain phone number.example for 1) ?
" already exist by address-list" is not "already exist the address-list"What's a convenient way to update ip-addresses when one dns-name has multiple ip-addresses?2) already exist by address-list, but
":global" variables already exist...For example, to save any state of a process between individual script launches.example for 1) ?
???For example, for more convenient writing of configuration scripts for different routers according to a single template.
This has been resolved in the version 7 beta so I guess you will have to wait until that becomes the stable version.Could you please merge the standard NTP client code with the NTP server package code so that both support using DNS FQDN's for the source.
untill is not like this, you can still use scripting for update IP.set the syslog remote address as fqdn or domain name and not only IP.
:log $severity message=$message;
The :log command should accept a variable for the log event severity e.g.
:global type "warning"
:global message "test"
:execute ":log $type $message"
Then you are doing it wrong. You should do the configuration under /interface ethernet switchAbut we stuck on the switch itself as the hardware offload turned-off when we activated vlan-filtering.
Yes , I am aware there will be some additions in x86 to manage the ASICs on ONIE compatible switches.Are you not under-estimating the effort?
It should be easy to make a RouterOS version that runs on the management CPU, but it should also be able to manage the switching ASIC in use in the product.
When your switch has switching hardware that MikroTik does not already support because the same chipset is used on one of their switches (maybe a different number of chips), there is more work to be done, right?
We do not even have that for native MikroTik hardware! All RouterOS versions for a specific CPU contain all drivers for all routers with that CPU.I am aware that none the existing ROS operating systems with switch chip ASIC drivers and software code are running on x86 CPU hardware - however you have a good head start and there should be no need to start from scratch. How much software work would be involved to take the ROS x86 source code , and add in the switch chip ASIC code & ROS functions so that an updated x86 ROS could run on some of the x86 CPU based ONIE compatible switches ? Also - because there are several types and brands of ethernet switch chip ASICs, could it be as simple as creating optional packages that can be downloaded and installed on x86 ROS - where - depending on the ASIC , a specific ROS package that supports that specific ASIC can be packaged downloaded and installed onto normal x86 ROS already installed on a ONIE bare-metal switch which then add support for the ASIC. And - because there are several types of ASICS, it might be possible to have a x86 ROS package list - where each optional package adds support for a specific ASIC.
Frist ... Thank You very much for introducing me to https://www.opencompute.org/wiki/Networ ... NOS_Status ..... very interestingWell ... when it comes to hardware - software - firmware - features and cost ...
. I guess I am more of a "How do I do it" person and not a "I can't do that because it's to hard" person.
..........
Now - today 40+ years later, I have a pretty good idea of what direction technology is going.
I've seen hundreds of computer companies loose money and go out of business because they do not have products that the world wants to pay for.
ASIC Drivers/APIs are not "Open-Sourced" you need buy "license/contract" from the manufacturer to have full access to ASIC to be able to implement specific functions for offloading-to-ASIC. Currently what you get now is a CPU based switch( = software switch ) - that cannot handle large Gb/s , TB/s switching-routing - due the limitations of the PCI-E bus bandwidth (PCIE-E Version 4.0 ×16: 31.5 GB/s ) and X86-CPU computational limits ( impossible ).I guess what I am asking for , is a Mikrotik ONIE compatible x86 ROS with optional ASIC drivers.
Then I could install x86 Mikrotik with the correct ASIC package on some ONIE switches - such as the one in this picture ( qty 64 100-gig ports ) or any other x86 CPU based ONIE switch which has an optional Mikrotik x86 ROS package for the specific ASIC chip set.
onie-100-Gig--64-ports.png.
Or - I could wait until Mikrotik makes a switch like this...
ppp secret already has a comment field like most of the configuration records in RouterOS!please add email, phone and notes in ppp secret
Then create a backup and a scheduler with +1h who do a load of this backup.Like an inverted safe mode.
I've done this many a time on remote located Cisco routers & Cisco switches.osc86 write:Then create a backup and a scheduler with +1h who do a load of this backup.Like an inverted safe mode.
You can do many disconnection in this 1h time and you have a safe information that in 1h if you not disable this scheduler then it came back to proper Point Of Time with reboot.
In command (terminal) mode, you already have that!I'd like to be able to queue changes and apply them all at once. Like an inverted safe mode.
I often need this when I have to make multiple changes to interfaces / ip addresses.
In my Linux "stripped" CLI smbclient executable file has size 1.7 MB and more than 100 dynamicaly loaded libraries in addition. Don't you know why? Because SMB protocol is a creature of MicroSoft with all it complex functionality such as authentications, versions, locks, printing, etc. And thus it is too complex for such class device. I am sure it's implementation is not nesessary and definitelly can decrease stability of RouterOS.Please add SMB support to the fetch tool
+1
I agree with that! Support for complex protocols like SMB should not be expanded, but rather it should be REMOVED (e.g. the IP->SMB feature).In general, I think Mikrotik device must be considered a ROUTER, and not a soapbox with home gateway.
I have also suggested this to Mikrotik support via email, if Mikrotik as an established professional wireless manufacturer, with good production capabilitys would certify their LoRa products for Helium network, it would probably BOOST SALES extremely.For LoRaWAN devices
Add a package to support their 'light hotspot' so we can use Mikrotik's on the helium network. Helium is a rapidly growing IoT network.
Helium.com
Satori: Please add SMB support to the fetch tool
Well, that would be nice but there are plenty of different versions to choose from using alternativ network protocols as well as different authentication protocols. Depending of which ones you pick the implementation can be quite complex which would reflect on the code size and manability. Have a look at https://en.wikipedia.org/wiki/Server_Message_Block. You have to be more specific than just "SMB"...Rextended: Right! +10
YES - PLEASE - Time Machine support. SMB 2.0 / AFP - something for the damm Apple users!HFS+ formatted storage, AFP, Spotlight indexing, Time Machine support, SMB 2.0
Working Bonjour (mDNS) intra-router (not inter) routing across subnets with example
That is the about same thing as IPIP tunnel with IPsec protection...Feature request: network interfaces for IPsec in Tunnel mode.
Tell that to people trying to setup Google Cloud VPN on MikroTik...That is the about same thing as IPIP tunnel with IPsec protection...Feature request: network interfaces for IPsec in Tunnel mode.
"losing connection" does not activate autosave on close. That only works when you close the connection yourself by exiting winbox or closing the window.When Winbox looses connection, or otherwise have been closed not the proper way, it always messes up my windows. After reopen all my windows are messed up and I have to organise them again. I know there is "Autosave on close" checkbox, but it is not working right. I can uncheck it, but it is back on reconnect.
That is already available, but it is not very clear to new users how it is supposed to work.So to make this bug repotr more as a feature request. Maybe you can implement default template in Winbox? If I connect to new MT device my log is always on right side in full length, Interfaces, DHCP server leases on left side etc.
Thx for the tip, will use it.That is already available, but it is not very clear to new users how it is supposed to work.
In the winbox connection setup window, under Tools enable Advanced mode.
Then you can select the saved session file to be used for the connection. You can share it between different devices so you have the same layout for those devices.
Isn't it just working when safe mode is enabled?"losing connection" does not activate autosave on close. That only works when you close the connection yourself by exiting winbox or closing the window.
I have requested before to have an "autosave on disconnect", that would certainly be useful. and also the possibility to tweak the parameters for automatic disconnect, it happens much too soon I think. when a link needs to re-establish it already is too late and all sessions are lost, it should be possible to keep trying for a minute or so.
Probably difficult, as the success of an import does not only depend on the syntax of each imported line, but also on the state of the router at the time it is imported.How about a "dry run" option to import? This way we could test an export, to see if it would actually run to the end? An easy way to check if the restore would stop in the middle of the run...
Why? The system must already have some kind of validation. Even if it doesn't, we already have 50% of the work done - it's the safe mode. There is already enough checks to stop the execution when an error is found.Probably difficult, as the success of an import does not only depend on the syntax of each imported line, but also on the state of the router at the time it is imported.
E.g. when the /export contains an "add" line with a name, and an item with that name already exists on the router when it is imported, it errors out.
So you would need to have a known state before the import (usually you would want "reset-configuration no-default-configuration" as a starting point but that is not necessarily true) and then build the config line-by-line from the import and then again discard it all.
Who said something about syntax? I was talking about validating in the context of the router. Validating syntax would be good too, if we changed something, but I was talking about sanity check against the actual router. And, yes: it is reasonable to assume a full wipe and test against either the default conf or the empty one.I explained why it is not so easy: validating an import file is not only a matter of reading it line by line and making sure there are no syntax errors, but also checking that each line is valid in the context of the router state as it is as the line is read (which changes after applying each line).
This changes everything. I was talking about a full export/restore. A partial one would be, as You pointed out, much harder to validate..... but that depends. I regularly send partial exports to users wanting to join a network that I manage, and these users are expected to import these into their already configured router.
I could understand why someone would want to validate the file to see if it can be fully applied to their router before they attempt that, but it should not assume a blank or default router then.
I do log these changes to Splunk, so it could be sorted and read on later time.We are tracking changes to MikroTik device configurations using scripts on the local devices and we log the changes on a private server.
2021-10-09 21:53:08 10.11.12.1 server1 xyz added new script
2021-10-03 00:10:00 10.11.12.1 server1 xyz removed static dns entry
2021-10-02 00:10:00 10.11.12.1 server xyz removed static dns entryMaybe for you it is not a big problem, but for me it is. My logs are sent to a write-only remote syslog server and now my admin password is permanently archived there, possibly to be seen by someone else in the future.Not a big problem. Only user who can log in can see the password or if log is sent remote.
That is another scenario where it would be bad.I do see the problem when you have different types of users. Example Read only user will see these message.
sshd[8494]: Failed password for invalid user admin from 172.25.1.1 port 11206 ssh2
sshd[8496]: Failed password for invalid user chris from 172.25.1.1 port 63459 ssh2
sshd[8498]: Failed password for invalid user david from 172.25.1.1 port 52512 ssh2
sshd[8500]: Failed password for invalid user foobar from 172.25.1.1 port 35772 ssh2
sshd[8494]: Failed password for invalid user not_a_known_user from 172.25.1.1 port 11206 ssh2
sshd[8496]: Failed password for invalid user not_a_known_user from 172.25.1.1 port 63459 ssh2
sshd[8498]: Failed password for invalid user not_a_known_user from 172.25.1.1 port 52512 ssh2
sshd[8500]: Failed password for invalid user not_a_known_user from 172.25.1.1 port 35772 ssh2Yes, he is serious. This is a real problem, and bad practice all around. One can type password instead of user for various reasons, ranging from not paying attention to bad interface design.
Are you serious right now?
Change your password and be more responsible next time?
What should these buttons do in that case?Please add "Packet Sniffer" and/or "Torch" buttons to the firewall rule box.
In Europe, 6 GHz WiFi is only allowed indoor on low power (200mW EIRP). Not much use for an outdoor AP here, unless you want to illuminate an enclosed back garden and do not mind violating the rules.I have a new product feature request which I think Mikrotik should consider.
- An outdoor tri-band ( 2.4-Ghz & 5-GHz & 6-GHz Wi-Fi 6E ) outdoor AP
Does Europe have rules for higher TX power point-to-point microwave links verses lower TX power on mult-point links ( similar to the FCC rules which allow higher power on point-to-point microwave links ) ?In Europe, 6 GHz WiFi is only allowed indoor on low power (200mW EIRP). Not much use for an outdoor AP here, unless you want to illuminate an enclosed back garden and do not mind violating the rules.I have a new product feature request which I think Mikrotik should consider.
- An outdoor tri-band ( 2.4-Ghz & 5-GHz & 6-GHz Wi-Fi 6E ) outdoor AP
pe1chl - question for you - not directly related to this specific "Feature requests" forum topic.No, we have an EIRP limit here, which of course means you can run higher TX power on lower gain (thus wider beam) antennas.
But the EIRP limit is fixed: 30dBm on channel 100-136 in/outdoor, and 23dBm on the indoor-only channels (low 5GHz channels and also now on 6 GHz).
There is an exception: it is allowed to run 6 GHz outdoor with max 14dBm mobile, but of course that is not very useful for PtP links (fixed install not allowed).
It would be silly to do that. Upload it as a file and then /import it. Or make a script that auto-generates the configuration (which likely has a repeating pattern).EDIT - have you ever tried pasting in 63-thousand lines of code into any server , especially a Mikrotik ??? Over 7 MEG of text in a single paste. The possible buffer-overruns is huge !
I am aware I could upload the a file then import it ( I do that all of the time ).It would be silly to do that. Upload it as a file and then /import it. Or make a script that auto-generates the configuration (which likely has a repeating pattern).EDIT - have you ever tried pasting in 63-thousand lines of code into any server , especially a Mikrotik ??? Over 7 MEG of text in a single paste. The possible buffer-overruns is huge !
+1 for that.I would like to see a new feature where there is added support for NAT444 where it would be possible to have a ip-firewall-nat statement that understands CGN /21 ( or and / ) port-range into a live IP /30 ( or any / ).
... having so many rules likely will result in performance problems ...Safe mode will not help you when making thousands of changes, its undo buffer will have overrun long before that.
(I think it can only contain about 20 commands, maybe less)
Unless you have a very powerful router, having so many rules likely will result in performance problems.
Maybe it can work when the rules somehow can be made two-level, i.e. a first level that selects e.g. on subnet and then jumps to a dedicated
chain where several rules for that subnet (from the customer IP space) are handled and that ends in an accept.
This avoids having to go through half the 63000 rules (on average) for every new connection. It can be done with more than 2 levels as well.
There are some limited possibilities with "dude", but it is mostly for monitoring.Would be possible to make central management for switches / routers like CAPSman is ?
For admins like I am ( with hundreds and hundreds Mikrotik devices under one big roof )it would be awesome.
IMHO the "webfig" should be made fully capable like "winbox" and then winbox can be dropped and replaced by someAlso native MacOS and Linux Winbox would be awesome, but this is what i saying (typing) here nonstop.
For admin which spend most of their work hours in winbox....native version for their main OS should be obvious choice.
Some of these "desktop-like experience in browser" attempts may be sort of ok, but I have yet to see one as good as native, with right controls, fast, snappy, ...
/interface ethernet
set [ find name=ether2 ] disabled=yes volatile=yesThere may be three types of semi-work-arounds for what you describe.Allow for volatile changes to the configuration. E.g. add a keyword "volatile" or "volatile=yes" to each configuration command, and when this is passed to a configuration item it is applied to the running router but not saved in the flash, so it will be lost at the next reboot. It will also not appear in backups or exports.
Example:Now ether2 will be disabled until this is reversed or the router is rebooted, at which time it is enabled again.Code: Select all/interface ethernet set [ find name=ether2 ] disabled=yes volatile=yes
I know that, but that is not a behavior I would want to copy to other devices. It has been inherited from long long ago. But it also leads to mysterious problems, e.g. when someone modifies the config, forgets to write it, and then (months) later the power cycles and the config change is lost.This is how Cisco works. Any config you are setting will not be stored in a reboot, if you do not "write mem" or "copy running-config startup-config"
This is already implemented in v7. of RouterOS.Please add more detailed description to log
script,info EndCMD
script,info ;undoable=true
script,info ;time=mar/15/2022 14:02:06;undo=/ip firewall address-list remove *636
script,info .id=*33;action=address list entry added;by=admin;policy=write;redo=/ip firewall address-list add address=cnn.com disabled=no list=demo
script,info StartCMDNo config, but use this command:What logging config did you make to see this detailed logging?
/system history print detail# Get detailed command history RouterOS >= v7
# ----------------------------------
:if ([:tonum [:pick [/system resource get version] 0 1]] > 6 and $CmdHistory) do={
:global cmd
:local f 0
:foreach i in=[/system history find] do={
:if ($i = $cmd) do={ :set f 1 }
:if ($f != 1) do={
:log info message="StartCMD"
:log info message=[/system history get $i]
:log info message="EndCMD"
}
}
:global cmd [:pick [/system history find] 0]
}In Winbox -> Settings -> "Inline Comments"Would it be possible to have a flag to display firewall filter comments in winbox not as a new line before the filter rule, but as a column ? It would greatly improve the readability of the UI IMHO. Thank you.
Fastest feature request implementation everIn Winbox -> Settings -> "Inline Comments"Would it be possible to have a flag to display firewall filter comments in winbox not as a new line before the filter rule, but as a column ? It would greatly improve the readability of the UI IMHO. Thank you.
Is already requested, and probably is to the end to the to-do list.Dark mode for winbox please.
Adguard already support it:
). why this wiki pade have been removed ?
You can! There is a feature to do that in webfig ("skin") and starting from some recent winbox version that should also work in winbox.I really want to be able to hide certain categories/tabs in winbox, it would be fantastic even if it works locally for the winbox client.
Minimum:And what characters you expect instead of "?" ?
/tool sms inbox print proplist=message /tool sms inbox ....I even can not to use LTE at all and pull a wire directly to my home, yes, I got it.You can directly read SMS with AT commands on HEX way.
RouterOS do not support at all any special characters of any language.
I think the issue is that SMS does not use a standard character set like UTF-8 but uses its own character sets GSM-7 and UCS-2. There would have to be a translation from these to UTF-8 or ISO-8859-x. Likely MikroTik consider that just "a step too far".I even can not to use LTE at all and pull a wire directly to my home, yes, I got it.You can directly read SMS with AT commands on HEX way.
RouterOS do not support at all any special characters of any language.
Do you mean this news?However I hope we will see the current DoH implementation (and fetch tool?) to be updated to use HTTP3, which then includes Quic for layer 4 transport.
) 
client
dev tun
remote xxx.xxx.x.xx 1194 udp
remote xxx.xxx.x.xx 443 tcp
cipher AES-128-CBC
tls-cipher TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256
auth SHA256
nobind
resolv-retry infinite
persist-key
persist-tun
⠀ ⠀vnStat is a console-based network traffic monitor for Linux and BSD that keeps a log of network traffic for the selected interface(s).