Software-update: RouterOS 7.20
MikroTik heeft versie 7.20 van RouterOS uitgebracht, een besturingssysteem dat zich richt op het uitvoeren van routertaken en meer. Denk daarbij natuurlijk aan het routeren van netwerkverkeer, maar ook aan bandbreedtemanagement, een firewall, het aansturen van draadlozeaccesspoints, een hotspotgateway en een vpn-server. Het kan zowel op de hardware van MikroTik als op x86- of virtuele machines zijn werk doen. Voor het gebruik is een licentie nodig, die bij de aankoop van MikroTik-hardware is inbegrepen. De changelog voor deze uitgave kan hieronder worden gevonden.
What's new in 7.20:arm64/x86/chr - added Aquantia network driverbgp - added brief, unnumbered output for advertisements listbgp - added initial EVPN supportbgp - added NLRI filter for more precise accept/discard of ipv4/6 prefixesbgp - automatically create output.network blackhole routesbgp - decode and log notificationsbgp - fixed nexthop force-self for IPv4 and IPv6bgp - fixed selection of received BGP VPN routesbgp - improved configuration upgrade from versions prior to 7.20bgp - improved loggingbgp - introduced BGP instance configuration (note, downgrading to earlier versions without instance support may cause config issues)bgp - make "as" parameter optional in template configurationbgp - print aigp attribute in advertisementsbgp - refresh WinBox when BGP session is created/deletedbgp - resend routes after nexthop-choice updatebgp - support for Advertising IPv4 Network Layer Reachability Information (NLRI) with an IPv6 Next Hopbridge - added dynamic tagged entry named "switch-cpu" in scenarios where the same VLAN spans multiple switch chips or is used on both HW and SW portsbridge - added verbose STP debug logging (rx/tx BPDU, edge-port and port-role transitions, FDB flush)bridge - added warning log when all MACs cannot be displayed under the host tablebridge - disable/enable HW offload on bonding slave disable/enable (fixes potential MAC learning issue)bridge - fixed MVRP leave indicationbridge - fixed port-id when adding a new port in non-primary MLAGbridge - improved stability when disabling bridge with dynamic VLANs in MSTIbridge - refactored host learning logic in MLAG setups in order to make it more robust and predictablebth - added extra file-share functionality for use with appsbth - improved tunnel name in client config exportbth,file - added direct file sharing from the WinBox Files menucertificate - added "Amazon Root CA 1" to built-in root certificate authorities storecertificate - fixed ACME certificate usage after renewalcertificate - improved stability after failed importcertificate - trust built-in root certificate authority store after configuration resetchr - added Chelsio VF driver for PCIID 5803chr - improved virtio_net performancecloud - fixed restoring "BTH Files" service after a prolonged network outagecloud - reduced "BTH Files" ping interval dynamically upon failureconsole - added use-tz option to :timestamp commandconsole - fixed :convert to=num on MIPSBEconsole - fixed incorrect multibyte to=num conversionsconsole - fixed issue where file completion sometimes shows duplicatesconsole - improved stability and visuals for /interface/wireless/snooper/snoopconsole - improved visuals for brief print when displaying large tablesconsole - improved visuals for hexadecimal stringsconsole - improved visuals for hiding sensitive commandsconsole - include flags by default when printing to valueconsole - prioritize directory specific parameters and hide rarely used ones in print autocompleteconsole - replace TAB characters with spaces when editing scripts and added tab-width user configuration in /console/settingsconsole - unified string representation of ID valuesconsole - updated hints for some /file/print parametersconsole - use file name completions (and basic validation) for file output related parameters for export and print commandsconsole - validate filenames upon addition (if enabled in /console/settings)container - added "device" option to pass a device from /system/hardware menu to a containercontainer - added /container/log menu, keep 100 messages per containercontainer - added default print brief modecontainer - added initial support for container in container setupscontainer - added option to execute commands inside a container using "/container/shell cmd= user="container - added per-container memory limiting and monitoringcontainer - added repull commandcontainer - added SCTP supportcontainer - added support for cpuset, cpu, memory, pids cgroupscontainer - allow picking passthrough devices by descriptive namecontainer - allow read-only mountscontainer - allow to mount individual files, not just directoriescontainer - allow to specify multiple envlistscontainer - allow to use multiple veths in a container, change the in container interface name to same as in RouterOScontainer - can use KVM (x86 and arm64) in container QEMU for faster virtualizationcontainer - display any error prominently in WinBoxcontainer - do not allow multiple containers with same root directorycontainer - enable check-certificate by default for new remote importscontainer - fixed containers that use inotify interfacecontainer - fixed environment variables not being passed to "/container/shell" properlycontainer - fixed QEMU VM to host bridgecontainer - fixed shell exit causing freezecontainer - improved compatibility when running containers with custom "cmd" and "entrypoint" commandscontainer - improved error and log messagescontainer - prevent user from setting "root-dir=/" for a containercontainer - show a more descriptive error when tar extraction fails, particularly "No space left on device"container - show config.json to usercontainer - show explicit stopped flag for containercontainer - stability improvementscontainer - support for direct access to hardware devicescontainer - terminate containers on shutdown, allow them to clean up properlydhcp - show error only after interface status is synced with the system (instead of erroneously displaying it immediately)dhcp-client - show warning if DHCP client is configured on dot1x server portdhcp-server - do not show "I" flag when server is disableddhcp-server - improved logging when dual-stack is enabled but fails to acquire client MAC from DUIDdhcpv4-client - allow specifying DSCP of outgoing packetsdhcpv4-client - allow specifying vlan-priority of outgoing packets (for VLAN interfaces only)dhcpv4-client - show "custom-hostname-suffix" and "custom-source-mac-address" properties if setdhcpv4-server - added "add dns" step to setup wizarddhcpv4-server - added "lease-agent-circuit-id" and "lease-agent-remote-id" variables to the lease scriptdhcpv4-server - added "ntp-none" parameterdhcpv4-server - changed the default value of address-pool to "static-only" in the option matcher, removed "none" optiondhcpv4/v6-client - properly resume client service after underlying interface status changesdhcpv4/v6-server - added CoA supportdhcpv6-client - added "accept-prefix-without-address" allowing client to accept prefix when address is not available although requesteddhcpv6-client - update the routing table and address list on manual client configuration changesdhcpv6-server - added "ignore-ia-na-bindings" setting that allows server to ignore address requests and work just with prefixesdhcpv6-server - do not trim real client DUID when assigning it to the bindingdiscovery - disable discovery on loopback, LTE, ppp-out interfacesdiscovery - improved LLDP Power via MDI TLV with 802.3bt specific field supportdiscovery - output LLDP fault message once per port poe-out status changediscovery - report router as "CAPsMAN" on MNDP under "running" parameterdiscovery - set initial poe-out Tx power above 0dWdisk - allow to format multiple disks at oncedisk - allow to remove Btrfs device by IDdisk - better manage disks disappearing from RAIDdisk - cleanup mountpoint when setting mount-filesystem=nodisk - disallow adding SMB share or user with empty namedisk - do Btrfs remove-device asynchronouslydisk - offer to blink only PCI slots in consoledisk - rename raid-role=unspecified to sparedisk - reset RAID role of old disk after spare assumes a new roledisk - show error when file based block-device uses a mountpoint to be unmounteddisk - show total/free inode counts for fs's that support itdlna - recognize flac extensiondns - fixed memory leak when static CNAME record was matchedfetch - display file sizes between 1-1023 bytes as 1KiB (instead of 0KiB)fetch - include RouterOS version in the "User-Agent" fieldfile - improved file handling performance in WinBox v4filesystem - improved calculation of free space on NAND flash (fixes potential "disk is too small" issue)firewall - added "liberal-tcp-tracking" connection tracking settingfirewall - added connection tracking "total-ip4-entries" and "total-ip6-entries" countersfirewall - allow "dst-limit" matcher to work properly above value 10000firewall - fixed IPv6 firewall interface matchers not matching VRF interfacesfirewall - improved IPv6 connection tracking lookup responsivenessfirewall - improved system stability when processing connections on multicore systemsfirewall - reorganized firewall connection tracking table values and make them persistent between IPv4 and IPv6flashfig - bind to local address (fixes issue when multiple interfaces are enabled)iot - added additional dongle firmwares to iot-bt-extra packageiot - added an option to increase the amount of LoRa's traffic entries displayediot - added support for MQTT last will messageiot - adjusted default LoRa antenna gain values for specific devicesiot - fixed an issue where channel #7 is ignored during LoRa LNS connectioniot - fixed logic for unknown NetIDsiot - fixed support for LoRa Alliance NetID listiot - improved LoRa stability and error recoveryiot - improvement to LoRa band verification logiciot - iot-bt-extra package stability improvement and additional dongle supportiot - LoRa netid filters now can be configured as a "range"iot - LoRa server list is no longer generated if the LR card is not physically attachediot - LR8G/9G firmware updateiot - removed lora-package, LoRa functionality was moved into iot-packageiot - removed non-existent GPIO pin functionalityip - added socksify feature and new NAT action "socksify"ip-service - show service name "nfs" for port 2049ipsec - fixed degraded IPsec performance for IPQ-6010 (introduced in v7.17)ipsec - move raw RSA keys to /ip/ipsec/key/rsaipv6 - added support for IPv6 ND proxying of individual addressesipv6 - do not allow removal of dynamic address on lo interfaceipv6 - fixed "auto-link-local" feature on WireGuard interfaceipv6 - make pref-src work and settable for static routesisis - added passive parameter for interface templateslog - added command to clear memory action entrieslog - improved the "transmit loop detected" warning loglte - added "done" status for modem firmware-upgrade version checklte - added "remove-sent-sms-after-send" option to automatically delete sent SMS messageslte - added log entry if eSIM has no profiles on readlte - added modem-init string response to system loglte - added passthrough support for RG650E-EU modemlte - added show-capabilities eSIM presence detection for MBIM modemslte - allow only one IPv6 APN for AT modemslte - display ICCID regardless of SIM PIN entry statuslte - do not reconfigure modem if deactive eSIM profile is deletedlte - exempt eSIM provision from global CRL certificate settingslte - exit LTE scan if modem reconfiguredlte - fallback to RA for global IPv6 if unattained via AT channel (resets on config change)lte - fixed inappropriate LTE interface inactive flag shown during modem initializationlte - fixed modem recovery on unexpected modem reboot for Chateau 5G and Chateau 5G R16lte - fixed progress message for R11e-LTE modem firmware-upgradelte - fixed rare case where AT dialer could stoplte - improved EC200A-EU firmware-upgrade stabilitylte - improved SMS sending stability over MBIM protocollte - refresh eSIM profile list after successful provisionlte - renamed "uicc" to "iccid" in LTE monitor and eSIM profile printlte - show ip-type in /interface/lte/apn/printlte - use modem-supplied IPv6 address over EUI-64 when availablemacvlan - allow creating macvlan interfaces on all interfaces with a MAC addressmpls - fixed minimal dynamic-label-range settingnet - fixed possible slave flag issues after user configuration changesnet - improved system stability when processing TCP/UDP connectionsnet - prevent removal of lo interface via WinBoxnetinstall - added after-install controls (reboot after installation, shutdown after installation, none)netinstall - alert on unreadable configuration scriptsnetinstall - detect inactive install interfacenetinstall - fixed install for PPC devicesnetinstall - fixed mutually exclusive checkbox behaviornetinstall - show router and package architecturenetinstall - warn user if not enough space on devicenetinstall-cli - added MAC filter option "--mac"netinstall-cli - added multiple install option "-m"netinstall-cli - improved client device architecture detectionnetwatch - added "early-success-detection" and "early-failure-detection" properties for ICMP probenetwatch - fixed date and time for statsovpn - added support for sha384 hmacovpn - improved tunnel setup speeds in configurations with large ammount of active OVPN clientspartitions - fixed failure to repartition correctly from 32MB partition sizepartitions - hide partition menu on unsupported boards (without NAND)partitions - limit minimal partition size to 60MBpoe-out - added support for line-interactive and offline UPS on CRS320poe-out - firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces)poe-out - firmware update for 802.3bt capable boards (the update will cause brief power interruption to poe-out interfaces)poe-out - improved dual-signature detection on CRS320poe-out - improved short-circuit detection and reporting on CRS320poe-out - increased maximum power margin for all classes on CRS320port - added IPv6 support for "remote-access" toolport - improved port status handling at unexpected device removalppp - added "dhcpv6-use-radius" PPP profile feature that enables "use-radius" option on dynamically created DHCPv6 serversppp - added "remote-ipv6-prefix-reuse" PPP profile feature that allows to advertise same prefix on multiple VPN clients at the same timeppp - added DHCPv6 assigned prefix to address list when configured and received from RADIUSppp - added dhcpv6-lease-time profile configuration propertyppp - do not send initial echo request if keepalive-timeout=disabledppp - improved system stability when closing connectionspppoe-server - added accept-untagged=yes/no option to accept untagged traffic in combination with pppoe-over-vlan-rage propertyptp - added PTP support for RDS2216 deviceptp - removed delays between timestamping and packet transmission, improving PTP precisionqos-hw - added mirror-buffers property and monitoring valuesradius - fixed issue with Session-Timeout attribute functionalityromon - changed default "disabled=yes" to "disabled=no" under /tool/romon/portromon - improved error messageroute - added missing and remove unnecessary parameters from /ipv6/route menuroute - afi naming consistency in logsroute - attempt to clean up stuck routes in the routing tableroute - do not allow to modify dynamic routesroute - fixed incorrectly set nexthop interfaces for BGP VPN routesroute - fixed issue when route table is installed to kernel without fib settingroute - fixed skipping updated destinationsroute - improved stabilityroute - removed fib-reinstallroute - update router ID when disabled address is removedrouterboot - fixed boot MAC for CRS212 switch ("/system routerboard upgrade" required)routing-filter - added filter-wizard (filter generator with v6-like syntax)routing-filter - added sync commandrouting-filter - make "chain" and "list" parameters required when adding new itemsfp - fixed low power mode pins on CRS326-4C+20G+2Q+ for optical QSFP modulessfp - fixed qsfp28 breakout disablesfp - improved initialization and linking for sfp28 on CRS518sfp - improved SFP handling for CRS418 devicesfp - improved system stability with some GPON modules for CCR2004 and CCR2116 devicessmips - reduced package size, removed hotspot feature and provide it as a separate packagesniffer - added CPU number and fast-path status in per-packet commentsniffer - save packets in pcapng format, it now includes interface name the packet was sniffed on, packet direction and nanosecond timestamp resolutionsnmp - added SNMP OIDs for firewall connection tracking "total-entries", "total-ip4-entries" and "total-ip6-entries"snmp - improved service stability when processing v3 requestssnmp - set maximum message size to 4 KBssh - improved stability on busy serverssh - show user public key fingerprint under /user/ssh-keysssh/sftp - fixed session disconnects during file transferssl/tls - fixed SSL looping behavior when multiple different TLS connections were usedsupout - added certificate settings sectionsupout - added IP Service sectionsupout - added MPLS settings sectionsupout - added VXLAN VTEP sectionswitch - fixed bonding MAC flush in certain cases for 98DX224S, 98DX226S, 98DX2528, and 98DX3236 switch chipsswitch - fixed egress-rate on QSFP portsswitch - fixed port blocking by MSTP for 88E6393X, 88E6191X and 88E6190 switchesswitch - hide cpu-flow-control on irrelevant devicesswitch - improved bond MAC flush for 88E6393X, 88E6191X and 88E6190 switchesswitch - improved hash calculation for 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches (affects load balancing for bonds, ECMP routes, and VXLAN source port)switch - improved ingress-rate limit precision for 88E6393X, 88E6191X and 88E6190 switchesswitch - reset all Ethernet counters on reset-counters command on QoS Port menuswitch - rework ethernet counters for 98DXxxxx, 98PX1012 and CRS1xx/2xx switches (add tx-drop-queueX-byte/packet, tx-drop-byte/packet, tx-queueX-byte to /in/eth and updated GUI)system - added support for OpenFlow 1.3 (new package "openflow" available)system - do not automatically retry in case /system/package/update download failssystem - fixed bb-upgrade failure on RB5009system - fixed certain notifications (e.g. kid-control activity, connection tracking table) (introduced in v7.17)system - fixed stuck TCP transmit on virtual interfaces, leading to retransmitssystem - improved system configuration journaling proceduresystem - improved system stability for hEX refresh and hEX S (2025)system - improved system stability when processing large amount of trafficsystem - merge /system/resource/usb and /system/resource/pci into /system/resource/hardware and create a device treeusb - improved system stability after unplugging USB device for RB5009user - added tiny delay on any user login attempt to limit login attemptsuser - change /user/active/request-logout to /user/active/removeveth - added dhcp=yes/no property to be able to easily run a container in LAN, runs a special dynamic dhcp-client on interface and sets acquired address/gateway/dns to in-container interfaceveth - added mac-address propertyveth - make veth interface MAC address stable in both RouterOS and container (container-side MAC incremented by +1 from RouterOS-side interface)vrrp - added "connection-tracking-port" and "connection-tracking-mode" settings for "sync-connection-tracking"vrrp - added proxy-arp supportvrrp - fixed invalid TCP connection state after failover with enabled sync-connection-trackingvrrp - fixed sync-connection-tracking issue when parent interface is disabled/enabledvrrp - improved responsiveness when router has many IP addresses depending on VRRP statevrrp - improved stability when removing VRRP interface with enabled sync-connection-trackingvrrp - make MTU property read-onlyvxlan - added checksum and learning propertiesvxlan - fixed unset behavior for "local-address" and "bridge" propertiesvxlan - prevent socket sharing (cannot create multiple VXLAN interfaces using the same UDP port with different checksum or vtep-vrf settings)vxlan - rename "vrf" setting to "vtep-vrf"webfig - added token authentication (no password prompt on reload or new window, logout button will log out all related sessions, removing a user will disconnect from active sessions)webfig - allow network map scrolling in Dudewebfig - basic mobile keyboard support for terminalwebfig - do not show Keepalive if not set in GRE Tunnel formwebfig - filter out unusable Bands and Channels for wifi interfaceswebfig - fixed an issue where dynamic dropdown lists were hidden despite having valueswebfig - fixed container parameterswebfig - fixed hiding New button with skinswebfig - fixed issue where legacy WebFig login page was usedwebfig - fixed skin limits for radio buttonswebfig - fixed Target field duplicate when disabling simple queuewebfig - improved stability when displaying read-only scriptswebfig - make columns a bit wider in tableswebfig - make the Close buttons actual buttons, not linkswebfig - mask certain fields where values match default valuewebfig - redesign logical "not" operator selectorwebfig - remove duplicate flag labels in QuickSet tableswebfig - show system note on loginwebfig - use lexicographical sort in dropdown listswebfig - use time stamps for volatile graphs (improved graph visualization)wifi - added tr069 support for wifi interfaceswifi - avoid picking 5GHz channels by default which are unlikely to be supported by clients, can be overridden with channel.deprioritize-unii-3-4wifi - fixed inability to apply steering profile to device's native wifi interfaceswifi - fixed issue where station mode looped connecting to the same BSSID, preventing switching to other APswifi - increased wifi scan listwifi - restart CAPsMAN only on significant configuration changeswifi-qcom - accept VLAN-tagged packets from clients with vlan-idwifi-qcom - added country profile "UK 5.8 fixed" and "ETSI 5.5-5.7 Outdoor"winbox - added "Digest Algorithm" under "System/Certificates" menuwinbox - added "Note" field in LTE Firmware Upgradewinbox - added "Reselect Time" for wifiwinbox - added Address List Extra Time under "IP/DNS" menuwinbox - added EAP identity under "WiFi/Registration" menuwinbox - added Heartbeat under "Bridge/MLAG" menuwinbox - added Installation under "WiFi" menuwinbox - added missing columns under "System/Users/SSH Keys" menuwinbox - added missing Comments under "User Manager" menuswinbox - added missing properties to "Container" menu and improved field orderingwinbox - added missing WPA2 PSK SHA2 option under "WiFi/Security" menuwinbox - added MPLS Manglewinbox - added option to create new entries under "System/Users/SSH Keys" menuwinbox - allow to specify CAPsMAN Address as IPv6 LLwinbox - bump minimal WinBox version to 3.42winbox - correctly unset Locked CAPsMAN fieldwinbox - differentiate PPP Profile Rx/Tx Queue settingswinbox - display errors from the "Files/Sync" menuwinbox - fixed "Rate" and "Full Duplex" monitor values after link down under "Interface/Ethernet" menuwinbox - fixed container RAM parameter typewinbox - fixed missing warning under "Routing/BGP/Instances" menuwinbox - fixed Record Type field under "Tools/Netwatch" menuwinbox - improved byte type field representationwinbox - improved Switch QoS layoutwinbox - make IPv6 Immediate Gateway read-onlywinbox - make log message field as multilinewinbox - move CAPsMAN settings button from Remote CAP to WiFi tablewinbox - removed duplicate mounts optionwinbox - rename Ping Timeout field to Intervalwinbox - rename SMS Type field to Modem Typewinbox - rework LTE firmware upgrade buttons into one windowwinbox - show "Switch" related menus only on boards that support such featureswinbox - show all columns under "System/Users/SSH Keys" menu by defaultwinbox - use same WireGuard default values as in consolewireguard - fixed minor memory leak when IPv6 is disabledwireguard - improved system stability on busy deviceswireless - changed CLI snooper column name "freq" to "channel"
arm64/x86/chr - added Aquantia network driverbgp - added brief, unnumbered output for advertisements listbgp - added initial EVPN supportbgp - added NLRI filter for more precise accept/discard of ipv4/6 prefixesbgp - automatically create output.network blackhole routesbgp - decode and log notificationsbgp - fixed nexthop force-self for IPv4 and IPv6bgp - fixed selection of received BGP VPN routesbgp - improved configuration upgrade from versions prior to 7.20bgp - improved loggingbgp - introduced BGP instance configuration (note, downgrading to earlier versions without instance support may cause config issues)bgp - make "as" parameter optional in template configurationbgp - print aigp attribute in advertisementsbgp - refresh WinBox when BGP session is created/deletedbgp - resend routes after nexthop-choice updatebgp - support for Advertising IPv4 Network Layer Reachability Information (NLRI) with an IPv6 Next Hopbridge - added dynamic tagged entry named "switch-cpu" in scenarios where the same VLAN spans multiple switch chips or is used on both HW and SW portsbridge - added verbose STP debug logging (rx/tx BPDU, edge-port and port-role transitions, FDB flush)bridge - added warning log when all MACs cannot be displayed under the host tablebridge - disable/enable HW offload on bonding slave disable/enable (fixes potential MAC learning issue)bridge - fixed MVRP leave indicationbridge - fixed port-id when adding a new port in non-primary MLAGbridge - improved stability when disabling bridge with dynamic VLANs in MSTIbridge - refactored host learning logic in MLAG setups in order to make it more robust and predictablebth - added extra file-share functionality for use with appsbth - improved tunnel name in client config exportbth,file - added direct file sharing from the WinBox Files menucertificate - added "Amazon Root CA 1" to built-in root certificate authorities storecertificate - fixed ACME certificate usage after renewalcertificate - improved stability after failed importcertificate - trust built-in root certificate authority store after configuration resetchr - added Chelsio VF driver for PCIID 5803chr - improved virtio_net performancecloud - fixed restoring "BTH Files" service after a prolonged network outagecloud - reduced "BTH Files" ping interval dynamically upon failureconsole - added use-tz option to :timestamp commandconsole - fixed :convert to=num on MIPSBEconsole - fixed incorrect multibyte to=num conversionsconsole - fixed issue where file completion sometimes shows duplicatesconsole - improved stability and visuals for /interface/wireless/snooper/snoopconsole - improved visuals for brief print when displaying large tablesconsole - improved visuals for hexadecimal stringsconsole - improved visuals for hiding sensitive commandsconsole - include flags by default when printing to valueconsole - prioritize directory specific parameters and hide rarely used ones in print autocompleteconsole - replace TAB characters with spaces when editing scripts and added tab-width user configuration in /console/settingsconsole - unified string representation of ID valuesconsole - updated hints for some /file/print parametersconsole - use file name completions (and basic validation) for file output related parameters for export and print commandsconsole - validate filenames upon addition (if enabled in /console/settings)container - added "device" option to pass a device from /system/hardware menu to a containercontainer - added /container/log menu, keep 100 messages per containercontainer - added default print brief modecontainer - added initial support for container in container setupscontainer - added option to execute commands inside a container using "/container/shell cmd= user="container - added per-container memory limiting and monitoringcontainer - added repull commandcontainer - added SCTP supportcontainer - added support for cpuset, cpu, memory, pids cgroupscontainer - allow picking passthrough devices by descriptive namecontainer - allow read-only mountscontainer - allow to mount individual files, not just directoriescontainer - allow to specify multiple envlistscontainer - allow to use multiple veths in a container, change the in container interface name to same as in RouterOScontainer - can use KVM (x86 and arm64) in container QEMU for faster virtualizationcontainer - display any error prominently in WinBoxcontainer - do not allow multiple containers with same root directorycontainer - enable check-certificate by default for new remote importscontainer - fixed containers that use inotify interfacecontainer - fixed environment variables not being passed to "/container/shell" properlycontainer - fixed QEMU VM to host bridgecontainer - fixed shell exit causing freezecontainer - improved compatibility when running containers with custom "cmd" and "entrypoint" commandscontainer - improved error and log messagescontainer - prevent user from setting "root-dir=/" for a containercontainer - show a more descriptive error when tar extraction fails, particularly "No space left on device"container - show config.json to usercontainer - show explicit stopped flag for containercontainer - stability improvementscontainer - support for direct access to hardware devicescontainer - terminate containers on shutdown, allow them to clean up properlydhcp - show error only after interface status is synced with the system (instead of erroneously displaying it immediately)dhcp-client - show warning if DHCP client is configured on dot1x server portdhcp-server - do not show "I" flag when server is disableddhcp-server - improved logging when dual-stack is enabled but fails to acquire client MAC from DUIDdhcpv4-client - allow specifying DSCP of outgoing packetsdhcpv4-client - allow specifying vlan-priority of outgoing packets (for VLAN interfaces only)dhcpv4-client - show "custom-hostname-suffix" and "custom-source-mac-address" properties if setdhcpv4-server - added "add dns" step to setup wizarddhcpv4-server - added "lease-agent-circuit-id" and "lease-agent-remote-id" variables to the lease scriptdhcpv4-server - added "ntp-none" parameterdhcpv4-server - changed the default value of address-pool to "static-only" in the option matcher, removed "none" optiondhcpv4/v6-client - properly resume client service after underlying interface status changesdhcpv4/v6-server - added CoA supportdhcpv6-client - added "accept-prefix-without-address" allowing client to accept prefix when address is not available although requesteddhcpv6-client - update the routing table and address list on manual client configuration changesdhcpv6-server - added "ignore-ia-na-bindings" setting that allows server to ignore address requests and work just with prefixesdhcpv6-server - do not trim real client DUID when assigning it to the bindingdiscovery - disable discovery on loopback, LTE, ppp-out interfacesdiscovery - improved LLDP Power via MDI TLV with 802.3bt specific field supportdiscovery - output LLDP fault message once per port poe-out status changediscovery - report router as "CAPsMAN" on MNDP under "running" parameterdiscovery - set initial poe-out Tx power above 0dWdisk - allow to format multiple disks at oncedisk - allow to remove Btrfs device by IDdisk - better manage disks disappearing from RAIDdisk - cleanup mountpoint when setting mount-filesystem=nodisk - disallow adding SMB share or user with empty namedisk - do Btrfs remove-device asynchronouslydisk - offer to blink only PCI slots in consoledisk - rename raid-role=unspecified to sparedisk - reset RAID role of old disk after spare assumes a new roledisk - show error when file based block-device uses a mountpoint to be unmounteddisk - show total/free inode counts for fs's that support itdlna - recognize flac extensiondns - fixed memory leak when static CNAME record was matchedfetch - display file sizes between 1-1023 bytes as 1KiB (instead of 0KiB)fetch - include RouterOS version in the "User-Agent" fieldfile - improved file handling performance in WinBox v4filesystem - improved calculation of free space on NAND flash (fixes potential "disk is too small" issue)firewall - added "liberal-tcp-tracking" connection tracking settingfirewall - added connection tracking "total-ip4-entries" and "total-ip6-entries" countersfirewall - allow "dst-limit" matcher to work properly above value 10000firewall - fixed IPv6 firewall interface matchers not matching VRF interfacesfirewall - improved IPv6 connection tracking lookup responsivenessfirewall - improved system stability when processing connections on multicore systemsfirewall - reorganized firewall connection tracking table values and make them persistent between IPv4 and IPv6flashfig - bind to local address (fixes issue when multiple interfaces are enabled)iot - added additional dongle firmwares to iot-bt-extra packageiot - added an option to increase the amount of LoRa's traffic entries displayediot - added support for MQTT last will messageiot - adjusted default LoRa antenna gain values for specific devicesiot - fixed an issue where channel #7 is ignored during LoRa LNS connectioniot - fixed logic for unknown NetIDsiot - fixed support for LoRa Alliance NetID listiot - improved LoRa stability and error recoveryiot - improvement to LoRa band verification logiciot - iot-bt-extra package stability improvement and additional dongle supportiot - LoRa netid filters now can be configured as a "range"iot - LoRa server list is no longer generated if the LR card is not physically attachediot - LR8G/9G firmware updateiot - removed lora-package, LoRa functionality was moved into iot-packageiot - removed non-existent GPIO pin functionalityip - added socksify feature and new NAT action "socksify"ip-service - show service name "nfs" for port 2049ipsec - fixed degraded IPsec performance for IPQ-6010 (introduced in v7.17)ipsec - move raw RSA keys to /ip/ipsec/key/rsaipv6 - added support for IPv6 ND proxying of individual addressesipv6 - do not allow removal of dynamic address on lo interfaceipv6 - fixed "auto-link-local" feature on WireGuard interfaceipv6 - make pref-src work and settable for static routesisis - added passive parameter for interface templateslog - added command to clear memory action entrieslog - improved the "transmit loop detected" warning loglte - added "done" status for modem firmware-upgrade version checklte - added "remove-sent-sms-after-send" option to automatically delete sent SMS messageslte - added log entry if eSIM has no profiles on readlte - added modem-init string response to system loglte - added passthrough support for RG650E-EU modemlte - added show-capabilities eSIM presence detection for MBIM modemslte - allow only one IPv6 APN for AT modemslte - display ICCID regardless of SIM PIN entry statuslte - do not reconfigure modem if deactive eSIM profile is deletedlte - exempt eSIM provision from global CRL certificate settingslte - exit LTE scan if modem reconfiguredlte - fallback to RA for global IPv6 if unattained via AT channel (resets on config change)lte - fixed inappropriate LTE interface inactive flag shown during modem initializationlte - fixed modem recovery on unexpected modem reboot for Chateau 5G and Chateau 5G R16lte - fixed progress message for R11e-LTE modem firmware-upgradelte - fixed rare case where AT dialer could stoplte - improved EC200A-EU firmware-upgrade stabilitylte - improved SMS sending stability over MBIM protocollte - refresh eSIM profile list after successful provisionlte - renamed "uicc" to "iccid" in LTE monitor and eSIM profile printlte - show ip-type in /interface/lte/apn/printlte - use modem-supplied IPv6 address over EUI-64 when availablemacvlan - allow creating macvlan interfaces on all interfaces with a MAC addressmpls - fixed minimal dynamic-label-range settingnet - fixed possible slave flag issues after user configuration changesnet - improved system stability when processing TCP/UDP connectionsnet - prevent removal of lo interface via WinBoxnetinstall - added after-install controls (reboot after installation, shutdown after installation, none)netinstall - alert on unreadable configuration scriptsnetinstall - detect inactive install interfacenetinstall - fixed install for PPC devicesnetinstall - fixed mutually exclusive checkbox behaviornetinstall - show router and package architecturenetinstall - warn user if not enough space on devicenetinstall-cli - added MAC filter option "--mac"netinstall-cli - added multiple install option "-m"netinstall-cli - improved client device architecture detectionnetwatch - added "early-success-detection" and "early-failure-detection" properties for ICMP probenetwatch - fixed date and time for statsovpn - added support for sha384 hmacovpn - improved tunnel setup speeds in configurations with large ammount of active OVPN clientspartitions - fixed failure to repartition correctly from 32MB partition sizepartitions - hide partition menu on unsupported boards (without NAND)partitions - limit minimal partition size to 60MBpoe-out - added support for line-interactive and offline UPS on CRS320poe-out - firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces)poe-out - firmware update for 802.3bt capable boards (the update will cause brief power interruption to poe-out interfaces)poe-out - improved dual-signature detection on CRS320poe-out - improved short-circuit detection and reporting on CRS320poe-out - increased maximum power margin for all classes on CRS320port - added IPv6 support for "remote-access" toolport - improved port status handling at unexpected device removalppp - added "dhcpv6-use-radius" PPP profile feature that enables "use-radius" option on dynamically created DHCPv6 serversppp - added "remote-ipv6-prefix-reuse" PPP profile feature that allows to advertise same prefix on multiple VPN clients at the same timeppp - added DHCPv6 assigned prefix to address list when configured and received from RADIUSppp - added dhcpv6-lease-time profile configuration propertyppp - do not send initial echo request if keepalive-timeout=disabledppp - improved system stability when closing connectionspppoe-server - added accept-untagged=yes/no option to accept untagged traffic in combination with pppoe-over-vlan-rage propertyptp - added PTP support for RDS2216 deviceptp - removed delays between timestamping and packet transmission, improving PTP precisionqos-hw - added mirror-buffers property and monitoring valuesradius - fixed issue with Session-Timeout attribute functionalityromon - changed default "disabled=yes" to "disabled=no" under /tool/romon/portromon - improved error messageroute - added missing and remove unnecessary parameters from /ipv6/route menuroute - afi naming consistency in logsroute - attempt to clean up stuck routes in the routing tableroute - do not allow to modify dynamic routesroute - fixed incorrectly set nexthop interfaces for BGP VPN routesroute - fixed issue when route table is installed to kernel without fib settingroute - fixed skipping updated destinationsroute - improved stabilityroute - removed fib-reinstallroute - update router ID when disabled address is removedrouterboot - fixed boot MAC for CRS212 switch ("/system routerboard upgrade" required)routing-filter - added filter-wizard (filter generator with v6-like syntax)routing-filter - added sync commandrouting-filter - make "chain" and "list" parameters required when adding new itemsfp - fixed low power mode pins on CRS326-4C+20G+2Q+ for optical QSFP modulessfp - fixed qsfp28 breakout disablesfp - improved initialization and linking for sfp28 on CRS518sfp - improved SFP handling for CRS418 devicesfp - improved system stability with some GPON modules for CCR2004 and CCR2116 devicessmips - reduced package size, removed hotspot feature and provide it as a separate packagesniffer - added CPU number and fast-path status in per-packet commentsniffer - save packets in pcapng format, it now includes interface name the packet was sniffed on, packet direction and nanosecond timestamp resolutionsnmp - added SNMP OIDs for firewall connection tracking "total-entries", "total-ip4-entries" and "total-ip6-entries"snmp - improved service stability when processing v3 requestssnmp - set maximum message size to 4 KBssh - improved stability on busy serverssh - show user public key fingerprint under /user/ssh-keysssh/sftp - fixed session disconnects during file transferssl/tls - fixed SSL looping behavior when multiple different TLS connections were usedsupout - added certificate settings sectionsupout - added IP Service sectionsupout - added MPLS settings sectionsupout - added VXLAN VTEP sectionswitch - fixed bonding MAC flush in certain cases for 98DX224S, 98DX226S, 98DX2528, and 98DX3236 switch chipsswitch - fixed egress-rate on QSFP portsswitch - fixed port blocking by MSTP for 88E6393X, 88E6191X and 88E6190 switchesswitch - hide cpu-flow-control on irrelevant devicesswitch - improved bond MAC flush for 88E6393X, 88E6191X and 88E6190 switchesswitch - improved hash calculation for 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches (affects load balancing for bonds, ECMP routes, and VXLAN source port)switch - improved ingress-rate limit precision for 88E6393X, 88E6191X and 88E6190 switchesswitch - reset all Ethernet counters on reset-counters command on QoS Port menuswitch - rework ethernet counters for 98DXxxxx, 98PX1012 and CRS1xx/2xx switches (add tx-drop-queueX-byte/packet, tx-drop-byte/packet, tx-queueX-byte to /in/eth and updated GUI)system - added support for OpenFlow 1.3 (new package "openflow" available)system - do not automatically retry in case /system/package/update download failssystem - fixed bb-upgrade failure on RB5009system - fixed certain notifications (e.g. kid-control activity, connection tracking table) (introduced in v7.17)system - fixed stuck TCP transmit on virtual interfaces, leading to retransmitssystem - improved system configuration journaling proceduresystem - improved system stability for hEX refresh and hEX S (2025)system - improved system stability when processing large amount of trafficsystem - merge /system/resource/usb and /system/resource/pci into /system/resource/hardware and create a device treeusb - improved system stability after unplugging USB device for RB5009user - added tiny delay on any user login attempt to limit login attemptsuser - change /user/active/request-logout to /user/active/removeveth - added dhcp=yes/no property to be able to easily run a container in LAN, runs a special dynamic dhcp-client on interface and sets acquired address/gateway/dns to in-container interfaceveth - added mac-address propertyveth - make veth interface MAC address stable in both RouterOS and container (container-side MAC incremented by +1 from RouterOS-side interface)vrrp - added "connection-tracking-port" and "connection-tracking-mode" settings for "sync-connection-tracking"vrrp - added proxy-arp supportvrrp - fixed invalid TCP connection state after failover with enabled sync-connection-trackingvrrp - fixed sync-connection-tracking issue when parent interface is disabled/enabledvrrp - improved responsiveness when router has many IP addresses depending on VRRP statevrrp - improved stability when removing VRRP interface with enabled sync-connection-trackingvrrp - make MTU property read-onlyvxlan - added checksum and learning propertiesvxlan - fixed unset behavior for "local-address" and "bridge" propertiesvxlan - prevent socket sharing (cannot create multiple VXLAN interfaces using the same UDP port with different checksum or vtep-vrf settings)vxlan - rename "vrf" setting to "vtep-vrf"webfig - added token authentication (no password prompt on reload or new window, logout button will log out all related sessions, removing a user will disconnect from active sessions)webfig - allow network map scrolling in Dudewebfig - basic mobile keyboard support for terminalwebfig - do not show Keepalive if not set in GRE Tunnel formwebfig - filter out unusable Bands and Channels for wifi interfaceswebfig - fixed an issue where dynamic dropdown lists were hidden despite having valueswebfig - fixed container parameterswebfig - fixed hiding New button with skinswebfig - fixed issue where legacy WebFig login page was usedwebfig - fixed skin limits for radio buttonswebfig - fixed Target field duplicate when disabling simple queuewebfig - improved stability when displaying read-only scriptswebfig - make columns a bit wider in tableswebfig - make the Close buttons actual buttons, not linkswebfig - mask certain fields where values match default valuewebfig - redesign logical "not" operator selectorwebfig - remove duplicate flag labels in QuickSet tableswebfig - show system note on loginwebfig - use lexicographical sort in dropdown listswebfig - use time stamps for volatile graphs (improved graph visualization)wifi - added tr069 support for wifi interfaceswifi - avoid picking 5GHz channels by default which are unlikely to be supported by clients, can be overridden with channel.deprioritize-unii-3-4wifi - fixed inability to apply steering profile to device's native wifi interfaceswifi - fixed issue where station mode looped connecting to the same BSSID, preventing switching to other APswifi - increased wifi scan listwifi - restart CAPsMAN only on significant configuration changeswifi-qcom - accept VLAN-tagged packets from clients with vlan-idwifi-qcom - added country profile "UK 5.8 fixed" and "ETSI 5.5-5.7 Outdoor"winbox - added "Digest Algorithm" under "System/Certificates" menuwinbox - added "Note" field in LTE Firmware Upgradewinbox - added "Reselect Time" for wifiwinbox - added Address List Extra Time under "IP/DNS" menuwinbox - added EAP identity under "WiFi/Registration" menuwinbox - added Heartbeat under "Bridge/MLAG" menuwinbox - added Installation under "WiFi" menuwinbox - added missing columns under "System/Users/SSH Keys" menuwinbox - added missing Comments under "User Manager" menuswinbox - added missing properties to "Container" menu and improved field orderingwinbox - added missing WPA2 PSK SHA2 option under "WiFi/Security" menuwinbox - added MPLS Manglewinbox - added option to create new entries under "System/Users/SSH Keys" menuwinbox - allow to specify CAPsMAN Address as IPv6 LLwinbox - bump minimal WinBox version to 3.42winbox - correctly unset Locked CAPsMAN fieldwinbox - differentiate PPP Profile Rx/Tx Queue settingswinbox - display errors from the "Files/Sync" menuwinbox - fixed "Rate" and "Full Duplex" monitor values after link down under "Interface/Ethernet" menuwinbox - fixed container RAM parameter typewinbox - fixed missing warning under "Routing/BGP/Instances" menuwinbox - fixed Record Type field under "Tools/Netwatch" menuwinbox - improved byte type field representationwinbox - improved Switch QoS layoutwinbox - make IPv6 Immediate Gateway read-onlywinbox - make log message field as multilinewinbox - move CAPsMAN settings button from Remote CAP to WiFi tablewinbox - removed duplicate mounts optionwinbox - rename Ping Timeout field to Intervalwinbox - rename SMS Type field to Modem Typewinbox - rework LTE firmware upgrade buttons into one windowwinbox - show "Switch" related menus only on boards that support such featureswinbox - show all columns under "System/Users/SSH Keys" menu by defaultwinbox - use same WireGuard default values as in consolewireguard - fixed minor memory leak when IPv6 is disabledwireguard - improved system stability on busy deviceswireless - changed CLI snooper column name "freq" to "channel"
Source:
Tweakers.net