Software-update: RouterOS 7.21
MikroTik heeft versie 7.21 van RouterOS uitgebracht, een besturingssysteem dat zich richt op het uitvoeren van routertaken en meer. Denk daarbij natuurlijk aan het routeren van netwerkverkeer, maar ook aan bandbreedtemanagement, een firewall, het aansturen van draadlozeaccesspoints, een hotspotgateway en een vpn-server. Het kan zowel op de hardware van MikroTik als op x86- of virtuele machines zijn werk doen. Voor het gebruik is een licentie nodig, die bij de aankoop van MikroTik-hardware is inbegrepen. De changelog voor deze uitgave kan hieronder worden gevonden.
What's new in 7.21:arm64 - allow enabling receive packet steering on /system/resource/irq/rps menu in order to overcome unbalanced CPU loadbgp - allow duplicate router-ids for eBGP sessions (RFC 6286)bgp - always advertise extended nexthop cap for all supported address familiesbgp - do not allow iBGP with non-equal ASNsbgp - fixed l2vpn-cisco decoding (introduced in v7.20)bgp - fixed occasional corruption of MPLS labels in BGP VPN update messagesbgp - fixed route refresh subcode 0 warningbgp - fixed selection of received BGP VPN routesbgp - implement RFC 9234 route leak prevention and detection using rolesbonding - added lacp-system-id and lacp-system-priority settingsbonding - fixed lacp-mode=passivebonding - improved stability for 802.3ad LACPbridge - expose more DHCP snooping warning logsbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20)bridge - fixed filter and NAT matching with "mac-protocol=length"bridge - fixed missing local MAC after changing protocol-mode settingbridge - fixed multicast packet receiving on bridge as multicast-router when HW offloading is usedbridge - fixed possible DHCP packet drop caused by the add-dhcp-option82bridge - fixed possible MVRP issues when STP topology changesbridge - fixed static host and MDB entry updates on VLAN add/removebridge - improved DHCP Option 82 values (circuit-id:"interface-name:vid", remote-id:"bridge MAC address")bridge - improved stability after failed protocol-mode=mstp changebridge - improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20)bridge - properly apply bridge MVRP settings on the flybth - added file-share link previewbth - fixed big file uploadbth - fixed file-share expire after rebootbth - make user private-key sensitivecertificate - added certificate "trust-store" parametercertificate - added option to configure built-in trust store (replaced "builtin-trust-anchors" parameter)certificate - added SHA384, SHA512 support for SCEPcertificate - allow ca-crl-host parameter for issued certificatescertificate - fixed incorrect appearance of "invalid-before" and "invalid-after" datescertificate - improved loggingcertificate - on certificate import, added the "issued" flag if the certificate store contains the imported certificate's CA and its private keycertificate - refactored Certificate internal processeschr - fixed guest OS type "Other Linux (64-bit)"console - added "mvrp" to mac-protocol settingconsole - added delimiter parameter to :toarray commandconsole - added fetch-changelog flag to check-for-updates commandconsole - added reset command to settings directoriesconsole - added sensitive flag to QR code in WireGuard "show-client-config"console - added show-sensitive option for print command, hide sensitive settings in print output by defaultconsole - changed file id formatconsole - do not allow to set value as empty for arguments that require selection of a specific list entryconsole - do not set values when "setup" command is interruptedconsole - fixed :convert from=num on MIPSBEconsole - fixed "special-login" setting incorrect channelconsole - fixed autocomplete in fullscreen editor to append tabs, spaces, etcconsole - fixed empty output in route menus when using "print where gateway"console - improved :toip command to get IPv4 address from IPv4 CIDR addressconsole - improved :toip6 command to get IPv6 addresses from IPv6 prefixesconsole - improved hints for address argumentsconsole - improved hints for DHCPv6console - improved printing visuals (column layout and paging)console - improved stabilityconsole - remove unnecessary commands from /ip/hotspot/active menuconsole - removed /quickset menuconsole - return error values for certain commands if action failed (e.g. /system/routerboard/upgrade)console - show fullscreen script editor completions above hintbarconsole - updated "Change your password" to "Change your password (Ctrl-C to skip)"console - updated copyright noticecontainer - add initial Bluetooth device supportcontainer - added "/app" menu for simple containerized app installation (requires "container" package and enabled "container" device-mode)container - added CPU usagecontainer - added hosts settingcontainer - added kill command to send signals (CLI only)container - added option to limit CPUs used by containerscontainer - added root dir sizecontainer - added run command to allow interactive mode (CLI only)container - added stop-time settingcontainer - added update command (CLI only)container - allow /tmp tmpfs to be unlimited in sizecontainer - allow app network to be any bridge interfacecontainer - allow to configure extra ENV variables directly in containercontainer - allow to disable/enable envs and mountscontainer - allow to specify mounts directly in containercontainer - calculate volume sizescontainer - convert container mounts setting to mountlists, old mount name becomes list name, list name can map to multiple mountscontainer - do not allow layer-dir to be within some containers root-dircontainer - enable relevant kernel features to support more container appscontainer - fixed error for starting container which consists of large number of layerscontainer - fixed extract issuescontainer - fixed VETH when using long interface namecontainer - general container service stability fixes and improvementscontainer - have per container layer-dir setting to be able to have separate layer stores for different sets of containerscontainer - made it possible to set timeout on /container/shellcontainer - make sure a working directory is created if it does not existcontainer - show detailed import status, helps understand long importscontainer - show image-id field (CLI only)container - shows app URL and "running" status only when port is opencontainer - store image import data (allows keeping container after netinstall)detnet - do not try detection on slave interfacesdetnet - fixed unnecessary process starting even when feature is not enableddhcpv4-client - don't stop client on unsuccessful client option value changedhcpv4-server - added "support-broadband-tr101" setting to pass additional Option 82 suboptions to RADIUS serverdhcpv4-server - added setting allowing to select client-id, MAC address and opt82 parameters for dynamic lease additiondhcpv4-server - allow creating static DHCPv4 leases for VETH interfacesdhcpv4-server - allow to set other gateway types not just IP for dhcp lease "routes" parameterdhcpv4-server - improved loggingdhcpv4-server - improved setup wizard prompts relating to DNSdhcpv4-server - respond with hlen 0 when htype is 8dhcpv4-server - send RADIUS Accounting Stop messages when interim-update is zerodhcpv6-client - do not show I flag for disabled clientdhcpv6-client - fixed misleading "couldn't acquire address, continue with prefix only" error when prefix is not even requesteddhcpv6-relay - added "about" error message optiondhcpv6-relay - enable configuration of options that are added to relayed DHCPv6 requestsdhcpv6-server - added accounting to use-radius setting, similar to DHCPv4 serverdhcpv6-server - attempt to extract MAC from DUID for dual-stack purposes when client uses DUID-EN type of DUIDdhcpv6-server - improved event logging messagesdhcpv6-server - improved service stability when receiving DHCP requests for PPP service clients without included IA_PDdhcpv6-server - include traffic usage statistics when accounting is stopped due to binding expiry and removaldiscovery - correctly report PoE dual signature per-pair classdiscovery - fixed MNDP IPv6 status reportingdiscovery - send out neighbor discovery immediately on IPv4/IPv6 changesdisk - added nvme-tcp-server-nqn setting to be able to explicitly configure NQN, will default to "nqn.2000-02.com.mikrotik:slot" for new configurationsdisk - allow only lowercase chars in iscsi-server-iqndisk - allow to have type=file devices without rose-storage (needed for file based swap)disk - allow to set smb-share only for type=smbdisk - consolidate client states into single field, as each item can be only one type of "client"disk - do not allow setting raid-master when have filesystemdisk - do not allow starting Btrfs replace when replace is suspendeddisk - do not delete partition configs on device remove and eject (fixes lost config with unstable hardware)disk - fixed iscsi clientdisk - fixed iscsi export disabledisk - fixed issue with double "/" in SMB share path for some clientsdisk - fixed SATA eject/scandisk - fixed SMB mount to be writable by containerdisk - fixed write RAID superblockdisk - improved cleanup order to avoid waiting for timeouts on shutdowndisk - improved RDS2216 SATA controllerdisk - improved system stabilitydisk - rename nvme-tcp client name to nqn everywhere symmetrically with serverdisk - show NVMe critical warningsdisk - unshare iscsi and nfs client/server ids, add iscsi-server-iqndisk - update interface type/speed after scandisk - use default label when nothing specified when formatting from WinBoxdns - added VRF support to ":resolve" commanddns - added VRF support to DNS serversemail - added "certificate-verification" parameteremail - return all errors to console when executed from consoleeoipv6,gre6,ipip6 - added "dont-fragment" setting to control packet fragmentation for packet sizes exceeding underlay interface MTUethernet - added "unsupported speed" warning for forced 1Gbps, 2.5Gbps, 5Gbps, 10Gbps baseT modesethernet - change default L2MTU 1518 to 1596 for RB5009ethernet - fixed 2.5G-baseT link-partner-advertising on RB5009, hAP ax3, Chateau ax devicesethernet - improved Ethernet port mapping to ensure a consistent and reliable interface order for wAP axethernet - improved system stability for RB912, RB911 devicesevpn - fixed Ethernet Segment (ES) routesfetch - added "http-percent-encoding" parameterfetch - fixed http headers appearance when received payload is emptyfetch - send http-data for any http methodfile - distinguish empty mount points from disksfile - improved error messages provided to GUIfile - improved stability and interoperability with WinBox and consolefirewall - added "h" flag indicating that firewall service helper is applied for particular connectionfirewall - added support for TOS/mask matching for raw rulesfirewall - clear relevant masqueraded connection tracking entries on IP address changefirewall - fixed "tls-host" not matching expected hostsfirewall - fixed hotspot value loss on rule enable/disablefirewall - fixed strip-ipv4-options always passthroughfirewall - hide hw-offload setting from devices that do not support itfirewall - improved system stability and memory allocation when using firewall servicesfirewall - make hw-offload=yes default setting in /ip/firewall/filter menufirewall - use the highest TTL as timeout value for domain address list entries if multiple domain names resolve to same IPhealth - upgraded fan controller firmware to latest versionhotspot - added TOTP support for local hotspot usershotspot - improved system stabilityhotspot - prevent service from starting unnecessarily in the background on export/print commandsike2 - adapt rekey procedure for compatibility with Libreswaniot - added LoRa Round Trip Time monitoring supportiot - added Modbus rx-switch-offset parameter which helps offset Rx windowiot - added mqtt disconnect/connect GUI optionsiot - added support for Modbus port baud-rates from 9600 to 115200iot - changed LoRa packet's timestamp format, which fixes duty cycle issues for some serversiot - improved Modbus multi-write registers handlingip-service - do not duplicate entries for containers running in same netnsip-settings - limit IPv4/IPv6 max-neighbor-entries maximum valueippool6 - added "Valid Lifetime" and "Preferred Lifetime" options and use them when constructing IPv6 addressippool6 - fixed minor memory leakippool6 - log address removalippool6 - take into account "subnet-id" when specified on addressipsec - fixed CHACHA20 typo in log messagesipsec - support Post-Quantum Pre-shared Key (PPK) with QKD integration (CLI only)ipv6 - added "none" option for IPv6/ND/Prefix when advertising just options, not prefixipv6 - added "self" option for IPv6/ND DNS advertise settingsipv6 - allow to specify on which interfaces to accept Router-Advertisementsipv6 - do not disable/enable Router-Advertisements functionality based on IPv6/ND configurationipv6 - initialize RA receiving when enabled and without any other IPv6 configurationipv6 - properly remove SLAAC installed route when prefixes expireipv6 - remove SLAAC installed DNS server and route on expireisis - improved stabilityisis - improved system stability when changing passive flagisis - improved system stability when receiving a hello packetl3hw - added per-VLAN "l3-hw-offloading" setting and "H" flag for /interface/vlan menul3hw - display warning when partial offloading is active (suggest users to use suppress-hw-offloading to control which routes get HW offloaded and which are CPU processed)l3hw - fixed issue with IPv4 ARP and IPv6 neighbor resolve for CRS812l3hw - fixed partial offloading with /31 routesl3hw - fixed per-VLAN counters when packets are going through CPUl3hw - fixed VLAN and VXLAN counters for CRS520 devicel3hw - improved stability and performance during L3HW enable with many routesl3hw - improvements and optimizations for IPv4 /32 and IPv6 /128 route offloadingl3hw - prioritize local IP address over ARP/neighbor entry with same IP (fixes incorrect packet flow)log - fixed ISO8601 time formatlog - fixed memory leaklog - fixed remote logging on remote-protocol configuration changelog - fixed unnecessary file creation when configuring a disabled log action with "target=disk"log - hide irrelevant log action parameterslog - limit firewall log prefix lengthlog - limit log socket buffer memory sizelte - added "force-delete" command to allow deletion of active eSIM profileslte - added additional logging for error reported by modem during APN profile setuplte - added command to send out EUICC generated notifications manuallylte - added confirmation prompt when deleting eSIM profilelte - added support for additional D-Link DWM-222 variation (vendor-id="0x2001" device-id="0x7e46")lte - added support for additional Huawei E3372-325 variation (vendor-id="0x3566" device-id="0x2001")lte - added support for R11e-LTE6 v039 firmware release and availability notificationlte - ask for user confirmation before installing eSIM profilelte - clear SIM not present error when performing modem FW upgradelte - discontinued support for RBSXTLTE3-7, further versions will use v7.20 LTE firmware packagelte - do not retry activation for IPv4 and IPv6 APNs on QMI modems if only one address family is assignedlte - fixed cases where LTE monitor could show abnormalitieslte - fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20)lte - fixed MTU inheritance from master interface in multi-APN setupslte - fixed MTU setting for AT modemslte - fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17lte - force sms-protocol to AT for FG621-EA modemlte - improved AT modems at-chat control channel handling after modem has closed AT channel unexpectedlylte - improved modem recovery for Chateau 5G and Chateau 5G R16lte - improved stability for FG621-EA modemlte - improved system stability when receiving SMS messageslte - provide firmware download URL when no LTE package installed on "SXT LTE3-7"lte - relay EUICC generated notifications after profile enable/disable/remove/provisionlte - rework multiapn support for AT modemslte - unify "SIM not present" status for all modemsmacsec - added initial support for hardware-offloaded support (available only on QCA8081 PHY: RB5009, hAP ax3, Chateau ax ether1 port)media - fixed console autocomplete for path parametermpls - fixed LDP filter upgrade from v6 where neighbor parameter is not specifiedmpls - fixed update of LDP Address message when local addresses changempls - properly renew services when LDP transport address changes its statenetinstall - fixed install with old RouterBOOTospf - changed nssa-translator default value from no to candidateospf - fixed OSPF interface "Standby" state detectionospf - improved stabilityospf - show interface as separate prop for interface and neighborovpn - fixed OVPN server handling on reboot (introduced in v7.20)ovpn - improved system stability when using cipher=blowfish128ovpn-server - added support for pushing IPv6 routespoe-out - added input name hint to poe max-power settingspoe-out - added LED blink on error for RB5009poe-out - firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces)poe-out - fixed CRS354 misreporting approved LLDP powerpoe-out - improved firmware update stabilitypoe-out - improved power-on mechanism for 802.3at capable boardsport - added comment for /port/remote-access (CLI only)port - added support for additional baudrates for USB to serial adaptersport - do not show serial port for ATL 5G R16port - fixed displaying "baud-rate=auto" on x86port - fixed export for default serial port nameport - give "gps" prefix for R11e-LR8G and R11e-LR9G GPS portsppp - added multi-APN support to ppp-client dialerppp - added setting to set BG77 modem cellular connection mode (auto lte-m nb-iot) (CLI only)ppp - improved service stability when using IPv6 with DHCP and RADIUS accountingqos-hw - added "default" flags to default entriesqos-hw - added "mirror-profile" which allows to select profile (traffic-class) for mirrored trafficqos-hw - always show usage and PFC counters, even when they are zeroqos-hw - fixed counters for ports that are configured with "offline" tx-managerqos-hw - fixed profile add/remove for CRS812qos-hw - fixed shared-pools for CRS812qos-hw - remove unnecessary "offline" tx-manager for CRS812 (not supported by hardware)queue - improved system stability when using SFQ kind of queuesroute - added options in /routing/settings to adjust check-gateway=ping timersroute - fixed SNMP output for ECMP routes having interface gatewaysroute - hide suppress-hw-offload setting from devices that do not support itroute - improved stabilityroute - improved system stability with multicast routingroute - make check-gateway=ping work on p2p interface gatewaysroute - removed /routing stats mem-blocksrouterboot - fixed boot MAC for CRS305-1G-4S+ and CRS328-4C-20S-4S+ switches ("/system routerboard upgrade" required)sfp - expose sfp-cmis-module-state to monitorsfp - filter out non-breakout modes for breakout modulessfp - fixed "sfp-tx-fault" state indication for CRS520-4XS-16XQsfp - fixed combo-mode change for CRS326-4C+20G+2Q+sfp - fixed missing link up/down notifiessfp - improved initialization and linking for 25G DAC on CRS812sfp - improved system stability with some GPON modules for CRS418, CCR2004 and CCR2116 devicessfp - recognize 40G Active Cable (XLPPI)sfp - remove 40G-baseCR4, 40G-baseSR4-LR4 from sfp-supported list for qsfp28-x-3 interfacessnmp - added lldpLocChassisId OIDsnmp - count only "bound" leases for mtxrDHCPLeaseCount OIDsnmp - make lldpLocPortId and lldpLocPortDesc OIDs information consistent with LLDP TLVssocksify - improved system stability when using Socksify servicessh - added support for ED25519-SK keysssh - improved logging of failed login attemptsssh - refactored SSH service internal processesssh - renamed User SSH keys "key-owner" field to "info"ssh - replaced "always-allow-password-login" with "password-authentication" in SSH settingssupout - added info log entry when autosupout.rif is generatedswitch - added dynamic "copy-to-cpu" ACL rule for loop-protectswitch - automatically add local bridge MAC to switch FDBswitch - fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switchesswitch - improved HW bond load balancing by adding MPLS labels to transmit hash for 98DXxxxx, 98CXxxxx switchesswitch - improved stability on MediaTek switch chipsswos - fixed "allow-from" setting for MIPSBE devicessystem - added disks to /system/resource/hardware listsystem - detect policy mismatch sooner if script is executed internally by some other servicesystem - fixed local update package filename generationsystem - fixed network header offset for interfaces with MAC (fixes VRRP Tx on IGMP snooping bridge)system - fixed potential configuration loss when available disk space was insufficientsystem - fixed saving panic logs to autosupout.rif for ARM CRS3xx devicessystem - improved system stability when processing different kinds of listssystem - improved system stability when processing GRE packets on TILE devicessystem - improved system stabilitysystem - limit number of interface-lists to 244tr069-client - added LTE link recovery timer settingtr069-client - allow disabling Device.WiFi.AccessPointtr069-client - expose 5G NR signal metrics for the Chateau R17 axtraffic-generator - added support for injecting pcapng filesundo - do not show internally issued commands in /system/historyundo - show console commands in WinBox/WebFig for /system/history entriesups - fixed board hibernation shutdownusb - fixed cases where USB bus order could change on D53 devicesusb - LTE modem and USB-Serial Controller enumeration fixusb - support video capture devices for arm64 and x86, for passthrough to containersuser-manager - added RadSec supportveth - add container-mac-address settingveth - added default print brief table modeveth - added dhcp setting that allows to auto-configure IPv4 address, works when VETH is bridged with other interfaces and there is a DHCP server running somewhere on that networkveth - complain immediately when VETH gateway not reachable, more detailed error message when network setup failsveth - fixed IP address not appearing in the app menu when VETH uses DHCPveth - fixed VETH interface not getting an IP address in a vlan-aware bridge containing multiple DHCP serversveth - show only when container package installedvrf - added read-only property to IPv4/IPv6 addresses, ARP and IPv6 neighborvrf - allow setting comment on default "lo" interfacevrrp - do not show "ttl not 255" warning when received VRRP VRID does not match with configured VRIDvrrp - fixed gratuitous ARP being sent after VRRP is disabled (fixes packet forwarding on HW offloaded bridge after VRRP is disabled)w60g - fixed possible memory leak when an interface is disabledwebfig - added a hint for Undo/Redo buttonswebfig - added Apps menu to loginwebfig - added capability to check/uncheck entry tree in skin designerwebfig - added Copy capabilitywebfig - added missing PPP types to Skin Designerwebfig - added TCP State column for connection tracking tablewebfig - check if device is still reachable before disconnect on errorwebfig - fixed container config memory high inputwebfig - fixed issue where routes and PIM table did not loadwebfig - fixed issue where Torch stops runningwebfig - fixed name and title store in skinswebfig - fixed new item window name when using skinswebfig - improved mikrotik_logo.svgwebfig - improved service stability after deleting a skinwebfig - increase graph width for better scalingwebfig - increase maximum number size in formswebfig - make close button as a button instead of linkwebfig - make combobox accessible to screen readerswebfig - remember last user in login pagewebfig - turn off auto-capitalize and auto-correct for on-screen keyboardswifi - added "CAP" information field on interfaces viewwifi - added CAPsMAN forwarding support (datapath.traffic-processing=on-capsman)wifi - added configuration parameters relevant to the upcoming WiFi 7 productswifi - enable configuration of "3gpp-info-raw" and "realms-raw" interworking parameterswifi - fixed issue when trying to use interface as bonding slavewifi - fixed multi-passphrase usage in combination with access-listwifi - fixed possible duplicate values for WPA3 authentication types in scan resultswifi - fixed possible memory leak when failing to start AP on chosen channelwifi - fixed some CAPsMAN settings to be optionalwifi - improved formatting of FT request action frameswifi - improved interface stability when encountering authentication failureswifi - improved stability when capturing data at high rates with wifi snifferwifi - increased accounting interval, maximum client entry count for 2.4GHz probe response delay featurewifi - rename ft-wpa2-eap authentication type to "ft-eap"wifi - split access-list time property in days and timewifi-mediatek - added Superchannel regulatory profilewifi-qcom - added Unsolicited BSS Transition Management Request supportwifi-qcom - improved default RTS/CTS policy for CPE station radioswifi-qcom - multicast-enhance will no longer apply for station mode configured deviceswifi,wireless - include "Event-Timestamp" in RADIUS accounting messageswinbox - added "Last Status" and "Last Address" fields in "Tools/Email" menuwinbox - added file selector for BTH fileswinbox - added Forwarding Table in "MPLS" menuwinbox - added missing "SM-DP+ Oid" LTE eSIM provisioning fieldwinbox - added Sessions tab in "Routing/RPKI" menuwinbox - added support for new settings and fixed several existing oneswinbox - Bandwidth test, Speed test, Ping, Traceroute tools use RouterOS DNS service to resolve domain nameswinbox - fixed "Too many entries" not showing in WinBox v4winbox - fixed Disk iscsi/smb configurationwinbox - fixed Disk NVMe-TCP configurationwinbox - fixed Dude/Tools appearance after Apply actionwinbox - fixed graphs in some forms with big numberswinbox - fixed Keepalive Time format in "Routing/BGP" menuswinbox - fixed Preshared Key "auto" and "none" options for WireGuard Peerwinbox - fixed switch QoS monitor for mirror propertieswinbox - hide certificate "Issuer" field for certificate templatewinbox - hide IPv6 addresses for IP neighbors that no longer have themwinbox - make multiple address fields requiredwinbox - make separate inputs for WiFi Interworking "Authentication Types" and "Connection Capabilities" fieldswinbox - make VETH gateway fields not requiredwinbox - move VRF from Ethernet to generic Interface tablewinbox - removed "Add" for dynamic DNS serverswinbox - reorder BGP and OSPF tabs in logical orderwinbox - restore route max object 10000 limitwinbox - show "Trusted" field for certificate templatewinbox - show warnings in "Routing/BGP" menuswinbox - show warnings in Disk menuwinbox - updated and shortened window titles (e.g. Address List -> Addresses)wireguard - added VRF option (CLI only)wireguard - allow to add AllowedIPs configuration for client configuration templatewireless - added last-ip parameter for the CAPSMAN registration-table tabwireless - improved system stability when stopping scan processwww - added option to disable individual web services in /ip/service/webserver and IP>Services>Web Serverwww - handle escaped characters in resource IDs and names for REST API requestswww - process REST API requests only after user authentication is completedwww - removed ability to publish directories via "/files" www service
arm64 - allow enabling receive packet steering on /system/resource/irq/rps menu in order to overcome unbalanced CPU loadbgp - allow duplicate router-ids for eBGP sessions (RFC 6286)bgp - always advertise extended nexthop cap for all supported address familiesbgp - do not allow iBGP with non-equal ASNsbgp - fixed l2vpn-cisco decoding (introduced in v7.20)bgp - fixed occasional corruption of MPLS labels in BGP VPN update messagesbgp - fixed route refresh subcode 0 warningbgp - fixed selection of received BGP VPN routesbgp - implement RFC 9234 route leak prevention and detection using rolesbonding - added lacp-system-id and lacp-system-priority settingsbonding - fixed lacp-mode=passivebonding - improved stability for 802.3ad LACPbridge - expose more DHCP snooping warning logsbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20)bridge - fixed filter and NAT matching with "mac-protocol=length"bridge - fixed missing local MAC after changing protocol-mode settingbridge - fixed multicast packet receiving on bridge as multicast-router when HW offloading is usedbridge - fixed possible DHCP packet drop caused by the add-dhcp-option82bridge - fixed possible MVRP issues when STP topology changesbridge - fixed static host and MDB entry updates on VLAN add/removebridge - improved DHCP Option 82 values (circuit-id:"interface-name:vid", remote-id:"bridge MAC address")bridge - improved stability after failed protocol-mode=mstp changebridge - improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20)bridge - properly apply bridge MVRP settings on the flybth - added file-share link previewbth - fixed big file uploadbth - fixed file-share expire after rebootbth - make user private-key sensitivecertificate - added certificate "trust-store" parametercertificate - added option to configure built-in trust store (replaced "builtin-trust-anchors" parameter)certificate - added SHA384, SHA512 support for SCEPcertificate - allow ca-crl-host parameter for issued certificatescertificate - fixed incorrect appearance of "invalid-before" and "invalid-after" datescertificate - improved loggingcertificate - on certificate import, added the "issued" flag if the certificate store contains the imported certificate's CA and its private keycertificate - refactored Certificate internal processeschr - fixed guest OS type "Other Linux (64-bit)"console - added "mvrp" to mac-protocol settingconsole - added delimiter parameter to :toarray commandconsole - added fetch-changelog flag to check-for-updates commandconsole - added reset command to settings directoriesconsole - added sensitive flag to QR code in WireGuard "show-client-config"console - added show-sensitive option for print command, hide sensitive settings in print output by defaultconsole - changed file id formatconsole - do not allow to set value as empty for arguments that require selection of a specific list entryconsole - do not set values when "setup" command is interruptedconsole - fixed :convert from=num on MIPSBEconsole - fixed "special-login" setting incorrect channelconsole - fixed autocomplete in fullscreen editor to append tabs, spaces, etcconsole - fixed empty output in route menus when using "print where gateway"console - improved :toip command to get IPv4 address from IPv4 CIDR addressconsole - improved :toip6 command to get IPv6 addresses from IPv6 prefixesconsole - improved hints for address argumentsconsole - improved hints for DHCPv6console - improved printing visuals (column layout and paging)console - improved stabilityconsole - remove unnecessary commands from /ip/hotspot/active menuconsole - removed /quickset menuconsole - return error values for certain commands if action failed (e.g. /system/routerboard/upgrade)console - show fullscreen script editor completions above hintbarconsole - updated "Change your password" to "Change your password (Ctrl-C to skip)"console - updated copyright noticecontainer - add initial Bluetooth device supportcontainer - added "/app" menu for simple containerized app installation (requires "container" package and enabled "container" device-mode)container - added CPU usagecontainer - added hosts settingcontainer - added kill command to send signals (CLI only)container - added option to limit CPUs used by containerscontainer - added root dir sizecontainer - added run command to allow interactive mode (CLI only)container - added stop-time settingcontainer - added update command (CLI only)container - allow /tmp tmpfs to be unlimited in sizecontainer - allow app network to be any bridge interfacecontainer - allow to configure extra ENV variables directly in containercontainer - allow to disable/enable envs and mountscontainer - allow to specify mounts directly in containercontainer - calculate volume sizescontainer - convert container mounts setting to mountlists, old mount name becomes list name, list name can map to multiple mountscontainer - do not allow layer-dir to be within some containers root-dircontainer - enable relevant kernel features to support more container appscontainer - fixed error for starting container which consists of large number of layerscontainer - fixed extract issuescontainer - fixed VETH when using long interface namecontainer - general container service stability fixes and improvementscontainer - have per container layer-dir setting to be able to have separate layer stores for different sets of containerscontainer - made it possible to set timeout on /container/shellcontainer - make sure a working directory is created if it does not existcontainer - show detailed import status, helps understand long importscontainer - show image-id field (CLI only)container - shows app URL and "running" status only when port is opencontainer - store image import data (allows keeping container after netinstall)detnet - do not try detection on slave interfacesdetnet - fixed unnecessary process starting even when feature is not enableddhcpv4-client - don't stop client on unsuccessful client option value changedhcpv4-server - added "support-broadband-tr101" setting to pass additional Option 82 suboptions to RADIUS serverdhcpv4-server - added setting allowing to select client-id, MAC address and opt82 parameters for dynamic lease additiondhcpv4-server - allow creating static DHCPv4 leases for VETH interfacesdhcpv4-server - allow to set other gateway types not just IP for dhcp lease "routes" parameterdhcpv4-server - improved loggingdhcpv4-server - improved setup wizard prompts relating to DNSdhcpv4-server - respond with hlen 0 when htype is 8dhcpv4-server - send RADIUS Accounting Stop messages when interim-update is zerodhcpv6-client - do not show I flag for disabled clientdhcpv6-client - fixed misleading "couldn't acquire address, continue with prefix only" error when prefix is not even requesteddhcpv6-relay - added "about" error message optiondhcpv6-relay - enable configuration of options that are added to relayed DHCPv6 requestsdhcpv6-server - added accounting to use-radius setting, similar to DHCPv4 serverdhcpv6-server - attempt to extract MAC from DUID for dual-stack purposes when client uses DUID-EN type of DUIDdhcpv6-server - improved event logging messagesdhcpv6-server - improved service stability when receiving DHCP requests for PPP service clients without included IA_PDdhcpv6-server - include traffic usage statistics when accounting is stopped due to binding expiry and removaldiscovery - correctly report PoE dual signature per-pair classdiscovery - fixed MNDP IPv6 status reportingdiscovery - send out neighbor discovery immediately on IPv4/IPv6 changesdisk - added nvme-tcp-server-nqn setting to be able to explicitly configure NQN, will default to "nqn.2000-02.com.mikrotik:slot" for new configurationsdisk - allow only lowercase chars in iscsi-server-iqndisk - allow to have type=file devices without rose-storage (needed for file based swap)disk - allow to set smb-share only for type=smbdisk - consolidate client states into single field, as each item can be only one type of "client"disk - do not allow setting raid-master when have filesystemdisk - do not allow starting Btrfs replace when replace is suspendeddisk - do not delete partition configs on device remove and eject (fixes lost config with unstable hardware)disk - fixed iscsi clientdisk - fixed iscsi export disabledisk - fixed issue with double "/" in SMB share path for some clientsdisk - fixed SATA eject/scandisk - fixed SMB mount to be writable by containerdisk - fixed write RAID superblockdisk - improved cleanup order to avoid waiting for timeouts on shutdowndisk - improved RDS2216 SATA controllerdisk - improved system stabilitydisk - rename nvme-tcp client name to nqn everywhere symmetrically with serverdisk - show NVMe critical warningsdisk - unshare iscsi and nfs client/server ids, add iscsi-server-iqndisk - update interface type/speed after scandisk - use default label when nothing specified when formatting from WinBoxdns - added VRF support to ":resolve" commanddns - added VRF support to DNS serversemail - added "certificate-verification" parameteremail - return all errors to console when executed from consoleeoipv6,gre6,ipip6 - added "dont-fragment" setting to control packet fragmentation for packet sizes exceeding underlay interface MTUethernet - added "unsupported speed" warning for forced 1Gbps, 2.5Gbps, 5Gbps, 10Gbps baseT modesethernet - change default L2MTU 1518 to 1596 for RB5009ethernet - fixed 2.5G-baseT link-partner-advertising on RB5009, hAP ax3, Chateau ax devicesethernet - improved Ethernet port mapping to ensure a consistent and reliable interface order for wAP axethernet - improved system stability for RB912, RB911 devicesevpn - fixed Ethernet Segment (ES) routesfetch - added "http-percent-encoding" parameterfetch - fixed http headers appearance when received payload is emptyfetch - send http-data for any http methodfile - distinguish empty mount points from disksfile - improved error messages provided to GUIfile - improved stability and interoperability with WinBox and consolefirewall - added "h" flag indicating that firewall service helper is applied for particular connectionfirewall - added support for TOS/mask matching for raw rulesfirewall - clear relevant masqueraded connection tracking entries on IP address changefirewall - fixed "tls-host" not matching expected hostsfirewall - fixed hotspot value loss on rule enable/disablefirewall - fixed strip-ipv4-options always passthroughfirewall - hide hw-offload setting from devices that do not support itfirewall - improved system stability and memory allocation when using firewall servicesfirewall - make hw-offload=yes default setting in /ip/firewall/filter menufirewall - use the highest TTL as timeout value for domain address list entries if multiple domain names resolve to same IPhealth - upgraded fan controller firmware to latest versionhotspot - added TOTP support for local hotspot usershotspot - improved system stabilityhotspot - prevent service from starting unnecessarily in the background on export/print commandsike2 - adapt rekey procedure for compatibility with Libreswaniot - added LoRa Round Trip Time monitoring supportiot - added Modbus rx-switch-offset parameter which helps offset Rx windowiot - added mqtt disconnect/connect GUI optionsiot - added support for Modbus port baud-rates from 9600 to 115200iot - changed LoRa packet's timestamp format, which fixes duty cycle issues for some serversiot - improved Modbus multi-write registers handlingip-service - do not duplicate entries for containers running in same netnsip-settings - limit IPv4/IPv6 max-neighbor-entries maximum valueippool6 - added "Valid Lifetime" and "Preferred Lifetime" options and use them when constructing IPv6 addressippool6 - fixed minor memory leakippool6 - log address removalippool6 - take into account "subnet-id" when specified on addressipsec - fixed CHACHA20 typo in log messagesipsec - support Post-Quantum Pre-shared Key (PPK) with QKD integration (CLI only)ipv6 - added "none" option for IPv6/ND/Prefix when advertising just options, not prefixipv6 - added "self" option for IPv6/ND DNS advertise settingsipv6 - allow to specify on which interfaces to accept Router-Advertisementsipv6 - do not disable/enable Router-Advertisements functionality based on IPv6/ND configurationipv6 - initialize RA receiving when enabled and without any other IPv6 configurationipv6 - properly remove SLAAC installed route when prefixes expireipv6 - remove SLAAC installed DNS server and route on expireisis - improved stabilityisis - improved system stability when changing passive flagisis - improved system stability when receiving a hello packetl3hw - added per-VLAN "l3-hw-offloading" setting and "H" flag for /interface/vlan menul3hw - display warning when partial offloading is active (suggest users to use suppress-hw-offloading to control which routes get HW offloaded and which are CPU processed)l3hw - fixed issue with IPv4 ARP and IPv6 neighbor resolve for CRS812l3hw - fixed partial offloading with /31 routesl3hw - fixed per-VLAN counters when packets are going through CPUl3hw - fixed VLAN and VXLAN counters for CRS520 devicel3hw - improved stability and performance during L3HW enable with many routesl3hw - improvements and optimizations for IPv4 /32 and IPv6 /128 route offloadingl3hw - prioritize local IP address over ARP/neighbor entry with same IP (fixes incorrect packet flow)log - fixed ISO8601 time formatlog - fixed memory leaklog - fixed remote logging on remote-protocol configuration changelog - fixed unnecessary file creation when configuring a disabled log action with "target=disk"log - hide irrelevant log action parameterslog - limit firewall log prefix lengthlog - limit log socket buffer memory sizelte - added "force-delete" command to allow deletion of active eSIM profileslte - added additional logging for error reported by modem during APN profile setuplte - added command to send out EUICC generated notifications manuallylte - added confirmation prompt when deleting eSIM profilelte - added support for additional D-Link DWM-222 variation (vendor-id="0x2001" device-id="0x7e46")lte - added support for additional Huawei E3372-325 variation (vendor-id="0x3566" device-id="0x2001")lte - added support for R11e-LTE6 v039 firmware release and availability notificationlte - ask for user confirmation before installing eSIM profilelte - clear SIM not present error when performing modem FW upgradelte - discontinued support for RBSXTLTE3-7, further versions will use v7.20 LTE firmware packagelte - do not retry activation for IPv4 and IPv6 APNs on QMI modems if only one address family is assignedlte - fixed cases where LTE monitor could show abnormalitieslte - fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20)lte - fixed MTU inheritance from master interface in multi-APN setupslte - fixed MTU setting for AT modemslte - fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17lte - force sms-protocol to AT for FG621-EA modemlte - improved AT modems at-chat control channel handling after modem has closed AT channel unexpectedlylte - improved modem recovery for Chateau 5G and Chateau 5G R16lte - improved stability for FG621-EA modemlte - improved system stability when receiving SMS messageslte - provide firmware download URL when no LTE package installed on "SXT LTE3-7"lte - relay EUICC generated notifications after profile enable/disable/remove/provisionlte - rework multiapn support for AT modemslte - unify "SIM not present" status for all modemsmacsec - added initial support for hardware-offloaded support (available only on QCA8081 PHY: RB5009, hAP ax3, Chateau ax ether1 port)media - fixed console autocomplete for path parametermpls - fixed LDP filter upgrade from v6 where neighbor parameter is not specifiedmpls - fixed update of LDP Address message when local addresses changempls - properly renew services when LDP transport address changes its statenetinstall - fixed install with old RouterBOOTospf - changed nssa-translator default value from no to candidateospf - fixed OSPF interface "Standby" state detectionospf - improved stabilityospf - show interface as separate prop for interface and neighborovpn - fixed OVPN server handling on reboot (introduced in v7.20)ovpn - improved system stability when using cipher=blowfish128ovpn-server - added support for pushing IPv6 routespoe-out - added input name hint to poe max-power settingspoe-out - added LED blink on error for RB5009poe-out - firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces)poe-out - fixed CRS354 misreporting approved LLDP powerpoe-out - improved firmware update stabilitypoe-out - improved power-on mechanism for 802.3at capable boardsport - added comment for /port/remote-access (CLI only)port - added support for additional baudrates for USB to serial adaptersport - do not show serial port for ATL 5G R16port - fixed displaying "baud-rate=auto" on x86port - fixed export for default serial port nameport - give "gps" prefix for R11e-LR8G and R11e-LR9G GPS portsppp - added multi-APN support to ppp-client dialerppp - added setting to set BG77 modem cellular connection mode (auto lte-m nb-iot) (CLI only)ppp - improved service stability when using IPv6 with DHCP and RADIUS accountingqos-hw - added "default" flags to default entriesqos-hw - added "mirror-profile" which allows to select profile (traffic-class) for mirrored trafficqos-hw - always show usage and PFC counters, even when they are zeroqos-hw - fixed counters for ports that are configured with "offline" tx-managerqos-hw - fixed profile add/remove for CRS812qos-hw - fixed shared-pools for CRS812qos-hw - remove unnecessary "offline" tx-manager for CRS812 (not supported by hardware)queue - improved system stability when using SFQ kind of queuesroute - added options in /routing/settings to adjust check-gateway=ping timersroute - fixed SNMP output for ECMP routes having interface gatewaysroute - hide suppress-hw-offload setting from devices that do not support itroute - improved stabilityroute - improved system stability with multicast routingroute - make check-gateway=ping work on p2p interface gatewaysroute - removed /routing stats mem-blocksrouterboot - fixed boot MAC for CRS305-1G-4S+ and CRS328-4C-20S-4S+ switches ("/system routerboard upgrade" required)sfp - expose sfp-cmis-module-state to monitorsfp - filter out non-breakout modes for breakout modulessfp - fixed "sfp-tx-fault" state indication for CRS520-4XS-16XQsfp - fixed combo-mode change for CRS326-4C+20G+2Q+sfp - fixed missing link up/down notifiessfp - improved initialization and linking for 25G DAC on CRS812sfp - improved system stability with some GPON modules for CRS418, CCR2004 and CCR2116 devicessfp - recognize 40G Active Cable (XLPPI)sfp - remove 40G-baseCR4, 40G-baseSR4-LR4 from sfp-supported list for qsfp28-x-3 interfacessnmp - added lldpLocChassisId OIDsnmp - count only "bound" leases for mtxrDHCPLeaseCount OIDsnmp - make lldpLocPortId and lldpLocPortDesc OIDs information consistent with LLDP TLVssocksify - improved system stability when using Socksify servicessh - added support for ED25519-SK keysssh - improved logging of failed login attemptsssh - refactored SSH service internal processesssh - renamed User SSH keys "key-owner" field to "info"ssh - replaced "always-allow-password-login" with "password-authentication" in SSH settingssupout - added info log entry when autosupout.rif is generatedswitch - added dynamic "copy-to-cpu" ACL rule for loop-protectswitch - automatically add local bridge MAC to switch FDBswitch - fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switchesswitch - improved HW bond load balancing by adding MPLS labels to transmit hash for 98DXxxxx, 98CXxxxx switchesswitch - improved stability on MediaTek switch chipsswos - fixed "allow-from" setting for MIPSBE devicessystem - added disks to /system/resource/hardware listsystem - detect policy mismatch sooner if script is executed internally by some other servicesystem - fixed local update package filename generationsystem - fixed network header offset for interfaces with MAC (fixes VRRP Tx on IGMP snooping bridge)system - fixed potential configuration loss when available disk space was insufficientsystem - fixed saving panic logs to autosupout.rif for ARM CRS3xx devicessystem - improved system stability when processing different kinds of listssystem - improved system stability when processing GRE packets on TILE devicessystem - improved system stabilitysystem - limit number of interface-lists to 244tr069-client - added LTE link recovery timer settingtr069-client - allow disabling Device.WiFi.AccessPointtr069-client - expose 5G NR signal metrics for the Chateau R17 axtraffic-generator - added support for injecting pcapng filesundo - do not show internally issued commands in /system/historyundo - show console commands in WinBox/WebFig for /system/history entriesups - fixed board hibernation shutdownusb - fixed cases where USB bus order could change on D53 devicesusb - LTE modem and USB-Serial Controller enumeration fixusb - support video capture devices for arm64 and x86, for passthrough to containersuser-manager - added RadSec supportveth - add container-mac-address settingveth - added default print brief table modeveth - added dhcp setting that allows to auto-configure IPv4 address, works when VETH is bridged with other interfaces and there is a DHCP server running somewhere on that networkveth - complain immediately when VETH gateway not reachable, more detailed error message when network setup failsveth - fixed IP address not appearing in the app menu when VETH uses DHCPveth - fixed VETH interface not getting an IP address in a vlan-aware bridge containing multiple DHCP serversveth - show only when container package installedvrf - added read-only property to IPv4/IPv6 addresses, ARP and IPv6 neighborvrf - allow setting comment on default "lo" interfacevrrp - do not show "ttl not 255" warning when received VRRP VRID does not match with configured VRIDvrrp - fixed gratuitous ARP being sent after VRRP is disabled (fixes packet forwarding on HW offloaded bridge after VRRP is disabled)w60g - fixed possible memory leak when an interface is disabledwebfig - added a hint for Undo/Redo buttonswebfig - added Apps menu to loginwebfig - added capability to check/uncheck entry tree in skin designerwebfig - added Copy capabilitywebfig - added missing PPP types to Skin Designerwebfig - added TCP State column for connection tracking tablewebfig - check if device is still reachable before disconnect on errorwebfig - fixed container config memory high inputwebfig - fixed issue where routes and PIM table did not loadwebfig - fixed issue where Torch stops runningwebfig - fixed name and title store in skinswebfig - fixed new item window name when using skinswebfig - improved mikrotik_logo.svgwebfig - improved service stability after deleting a skinwebfig - increase graph width for better scalingwebfig - increase maximum number size in formswebfig - make close button as a button instead of linkwebfig - make combobox accessible to screen readerswebfig - remember last user in login pagewebfig - turn off auto-capitalize and auto-correct for on-screen keyboardswifi - added "CAP" information field on interfaces viewwifi - added CAPsMAN forwarding support (datapath.traffic-processing=on-capsman)wifi - added configuration parameters relevant to the upcoming WiFi 7 productswifi - enable configuration of "3gpp-info-raw" and "realms-raw" interworking parameterswifi - fixed issue when trying to use interface as bonding slavewifi - fixed multi-passphrase usage in combination with access-listwifi - fixed possible duplicate values for WPA3 authentication types in scan resultswifi - fixed possible memory leak when failing to start AP on chosen channelwifi - fixed some CAPsMAN settings to be optionalwifi - improved formatting of FT request action frameswifi - improved interface stability when encountering authentication failureswifi - improved stability when capturing data at high rates with wifi snifferwifi - increased accounting interval, maximum client entry count for 2.4GHz probe response delay featurewifi - rename ft-wpa2-eap authentication type to "ft-eap"wifi - split access-list time property in days and timewifi-mediatek - added Superchannel regulatory profilewifi-qcom - added Unsolicited BSS Transition Management Request supportwifi-qcom - improved default RTS/CTS policy for CPE station radioswifi-qcom - multicast-enhance will no longer apply for station mode configured deviceswifi,wireless - include "Event-Timestamp" in RADIUS accounting messageswinbox - added "Last Status" and "Last Address" fields in "Tools/Email" menuwinbox - added file selector for BTH fileswinbox - added Forwarding Table in "MPLS" menuwinbox - added missing "SM-DP+ Oid" LTE eSIM provisioning fieldwinbox - added Sessions tab in "Routing/RPKI" menuwinbox - added support for new settings and fixed several existing oneswinbox - Bandwidth test, Speed test, Ping, Traceroute tools use RouterOS DNS service to resolve domain nameswinbox - fixed "Too many entries" not showing in WinBox v4winbox - fixed Disk iscsi/smb configurationwinbox - fixed Disk NVMe-TCP configurationwinbox - fixed Dude/Tools appearance after Apply actionwinbox - fixed graphs in some forms with big numberswinbox - fixed Keepalive Time format in "Routing/BGP" menuswinbox - fixed Preshared Key "auto" and "none" options for WireGuard Peerwinbox - fixed switch QoS monitor for mirror propertieswinbox - hide certificate "Issuer" field for certificate templatewinbox - hide IPv6 addresses for IP neighbors that no longer have themwinbox - make multiple address fields requiredwinbox - make separate inputs for WiFi Interworking "Authentication Types" and "Connection Capabilities" fieldswinbox - make VETH gateway fields not requiredwinbox - move VRF from Ethernet to generic Interface tablewinbox - removed "Add" for dynamic DNS serverswinbox - reorder BGP and OSPF tabs in logical orderwinbox - restore route max object 10000 limitwinbox - show "Trusted" field for certificate templatewinbox - show warnings in "Routing/BGP" menuswinbox - show warnings in Disk menuwinbox - updated and shortened window titles (e.g. Address List -> Addresses)wireguard - added VRF option (CLI only)wireguard - allow to add AllowedIPs configuration for client configuration templatewireless - added last-ip parameter for the CAPSMAN registration-table tabwireless - improved system stability when stopping scan processwww - added option to disable individual web services in /ip/service/webserver and IP>Services>Web Serverwww - handle escaped characters in resource IDs and names for REST API requestswww - process REST API requests only after user authentication is completedwww - removed ability to publish directories via "/files" www service
Source:
Tweakers.net