2827
В данном канале будут размещаться публикации, заметки и решения на оборудовании Mikrotik. Welcome!
Ну что, любители BDSM OVPN, дождались?
7.14beta3 changelog:
*) ovpn - added support for pushing routes;
Кроме этого, есть и ещё несколько интересных изменений. Прочитать можно тут
Уже 7.13rc4, а конца бета-тесту не предвидится...What's new in 7.13rc4 (2023-Dec-12 15:16):
*) certificate - fixed CRL updating;
*) console - improved stability when removing script (introduced in v7.13beta3);
*) defconf - fixed configuration for Audience with "wifi-qcom-ac" package;
*) defconf - improved wifi interface detection after upgrade;
*) ethernet - improved system stability for L009 and hAP ax lite devices;
*) sfp - improved link establishment for SFP copper modules;
Не совсем про микротик, но однажды я на нём тоже пытался решить эту задачу. От статьи получил огромное удовольствие, к прочтению строго обязательно. Автору огромное F.
/channel/linkmeup_podcast/7780
Вышла 7.11
Из интересного:
*) BTH так и не включили
*) certificate - removed request for "passphrase" property on import;
*) console - added ":convert" command;
*) console - added default value for "rndstr" command (16 characters from 0-9a-zA-Z);
*) container - added IPv6 support for VETH interface;
*) firewall - added warning when PCC divider argument is smaller than remainder;
*) graphing - added paging support;
*) health - added more gradual control over fans for CRS3xx, CRS5xx, CCR2xxx devices;
*) system - increased maximum supported CPU core count to 512 on CHR and x86;
*) system - reduced RAM usage for SMIPS devices;
*) netwatch - added "src-address" property;
*) profile - added "container" process classifier;
*) rose-storage - added "scsi-scan" command (CLI only);
*) rose-storage - added disk stats for ramdisks;
*) route - added comment for BFD configuration (CLI only);
*) user - added "sensitive" policy requirement for SSH key and certificate export;
*) webfig - added option to enable wide view in item list;
*) wifiwave2 - added "steering" parameters and menu to set up and monitor AP neighbor groups (CLI only);
*) wifiwave2 - added more information on roaming candidates to BSS transition management requests (802.11v) and neighbor report responses (802.11k);
*) wifiwave2 - added option to filter frames captured by the sniffer command (CLI only);
*) winbox - added missing status values for Ethernet and Cable Test;
*) winbox - added warning about non-running probe due to "startup-delay";
*) winbox - rename "Group Master" property to "Group Authority" under "Interface/VRRP" menu;
Changelog RouterOS 7.11
А тем временем пару дней назад RouterOS v6.49.8 переехала в long-term ветку. Сейчас пятница, вечер, самое время... Ну вы поняли 😜
Читать полностью…
Мааааленький апдейт на 7.10 завезли. Теперь 7.10.1. Не забудьте обновиться в пятницу вечером 😉What's new in 7.10.1 (2023-Jun-27 12:03):#RouterOS #stable
*) ovpn - fixed OVPN server peer-id negotiation;
*) webfig - use router time zone for date and time;
🔥️️️CVE-2023-32154 (IPv6)
What's new in 7.9.1 (2023-May-19 15:11):
!) ipv6 - fixed DNS server processing by IPv6/ND services (CVE-2023-32154);
Подъехал долгожданный апдейт бюджетной лошадки RB2011 → L009
https://mikrotik.com/product/l009uigs_2haxd_in
https://mikrotik.com/product/l009uigs_rm
Приплыл релиз 7.9
130 строк ченджлога, из них 47 фиксов. Подробнее здесь.
Что нового в RouterOS 7.6beta10 (2022-Sep-29 20:02):
Important note!!!
Version is not recommended for devices where VXLAN interfaces are already configured.
Changes in this release: *) bgp - improved session establishment speed after bootup;
*) bonding - fixed ARP monitor packets with bond's MAC address;
*) bonding - improved interface stability on slave configuration changes;
*) bonding - reduce "actual-mtu" according to interface "l2mtu";
*) capsman - fixed RADIUS accounting when EAP is used;
*) certificate - improved certificate management, signing and storing processes;
*) dhcpv4-server - fixed RADIUS accounting for local leases;
*) dns - added "match-subdomain" option for static entries (CLI only);
*) interface - added warning when interface has configured "mtu" higher than "l2mtu";
*) ipsec - added "invalid-packets" counter for Installed SA's menu;
*) ipsec - fixed packet processing by hardware encryption engine on MMIPS devices;
*) lte - added periodic IPv6 RS to trigger IPv6 adress acquisition for non-MBIM modems;
*) lte - added support to perform FOTA upgrade from local file for EG12-EA, EG18-EA, RG502Q-AE, EG06-A, EP06-A modems;
*) lte - fixed re-attaching on PS detach for MBIM modems;
*) macsec - added configuration support with VLAN, ARP, DHCP and bridge tagging/untagging;
*) macsec - added logging support with "debug" and "dot1x" topics;
*) macsec - added support for MTU and L2MTU;
*) macsec - improved interface stability;
*) macsec - improved system stability for TILE and RB5009 devices;
*) mac-telnet - respect interface MTU setting when sending packets for MAC-Telnet and MAC-WinBox;
*) ospf - fixed transmit of LSA/ACK's on p2p interfaces;
*) ovpn - added IPv6 support;
*) ovpn - added VRF support for client;
*) ppp - improved service stability when multiple users disconnect simultaneously;
*) qsfp - added interface temperature warnings and shutdown;
*) rip - fixed passwordless MD5 authentication;
*) route-filter - fixed filtering for multiple community routes;
*) route-filter - fixed memory allocation when moving entries;
*) routerboard - return router's short name in "model" parameter;
*) serial - added support for newer PL2303 serial controllers;
*) sstp - added VRF support for client;
*) supout - added tr069-client section;
*) supout - removed duplicate "bridge-controller" section;
*) user-manager - use "Class" attribute to associate user's accounting session;
*) vxlan - added IPv6 support for remote VTEPs (only IPv4 or IPv6 will be used at the same time, use "vteps-ip-version" property on VXLAN interface to change the version);
*) webfig - fixed unsetting of "endpoint-address" parameter under "WireGuard/Peers" menu;
*) winbox - added icon for TR069-client menu;
*) winbox - added "L3 HW Settings" under "Switch" menu;
*) winbox - added quick filtering option for route list;
*) winbox - added "Reset Traffic Counters" button for all interfaces;
*) winbox - added "to-ports" and "to-addresses" parameters for "netmap" action under "IPv6/Firewall/NAT" menu;
*) winbox - changed "uptime" parameter format when using the wifiwave2 package;
*) winbox - do not show unavailable features on SMIPS devices;
*) winbox - fixed maximum allowed value for VRRP's "priority" parameter;
*) winbox - fixed "Session Uptime" value under "Routing/BGP" menu;
*) winbox - show "F" flag for failed entries under "Interfaces/VRRP" menu;
*) winbox - show "System/Health" only on boards that have health monitoring;
*) wireless - fixed missing wireless interface on some RB921GS-5HPacD devices;
What's new in 7.6beta8 (2022-Sep-21 09:20):
Important note!!!
Version not recommended on TILE and RB5009 devices if MACsec is used;Changes in this release:
*) bgp - added support for BGP advertisement displaying (CLI only);
*) certificate - fixed SHA1 certificate name lookup;
*) dhcpv4-server - fixed matcher functionality;
*) ethernet - added "5Gbps" option for speed setting;
*) firewall - fixed usage of "netmap" action for IPv6 source NAT (CLI only);
*) lte - added periodic IPv6 RS to trigger IPv6 adress acquisition for non-MBIM modems;
*) macsec - fixed interface after Ethernet link down;
*) macsec - fixed interface statistics and missing properties;
*) macsec - fixed interface status;
*) macsec - fixed multiple interface creation on different Ethernet ports
*) macsec - removed interface from SMIPS devices;
*) ospf - added SHA hashing for authentication;
*) queue - improved stability for CAKE type queues;
*) snmp - improved retrieval of routing related OID's;
*) sstp - added IPv6 support (CLI only);
*) switch - improved traffic forwarding at 5Gbps rate for 98DX8525, 98DX4310 switches;
*) tile - improved system stability when processing packets;
*) webfig - fixed hex input for "Host Uniq" field;
*) winbox - added "Active" prefix for current remote and local session ID fields for L2TP-Ether interfaces;
*) winbox - added "address-list" parameter under "IP/DNS/Static" menu;
*) winbox - added MACsec support;
*) winbox - added "type" and "status-report-request" parameters under "Tools/SMS" menu;
*) winbox - changed "uptime" parameter format when using the wifiwave2 package;
*) wireless - disallowed using "default" as scan list or channel names;
eter;
*) ptp - improved system stability on CRS devices;
*) quickset - removed PPTP and SSTP server addition for "VPN" checkbox;
*) rb5009 - fixed ether1 status reporting after system reboot;
*) route-filter - fixed "delete bgp-communities" command;
*) routerboard - added "reset-button" script feature for TILE devices;
*) sfp - fixed "eeprom" reading on single SFP port ARM devices;
*) sfp - fixed QSFP+ and QSFP28 interface disable when using breakout cable;
*) sfp - fixed unresponsive "sfp1" interface after disabling "ether1" on NetMetal devices;
*) sfp - improved combo SFP ports initialization handling on CRS312-4C+8XG, CRS328-4C-20S-4S+;
*) sfp - improved stability when using 2.5G optical modules in CCR2116, CCR2216 and CRS518;
*) snmp - fixed usage of VRF after system startup;
*) socks - fixed "dst-port" usage when checking access list;
*) ssh - added AES support for PEM decryption;
*) ssh - fixed importing of public keys;
*) ssh - fixed minor typo issue when importing public key;
*) sstp - fixed client stuck in "nonce matching" state;
*) switch - fixed ACL rules for 98DXxxxx switches with more than 28 ports (introduced in v7.3);
*) switch - removed limit for number of hardware-offloaded bonding interfaces;
*) swos - enabled SwitchOS support for CRS310-1G-5S-4S+;
*) swos - fixed SwOS upgrade procedure on CRS305-1G-4S+;
*) traceroute - added "do-not-fragment" parameter support (CLI only);
*) traceroute - increased packet size limit to 65535;
*) vrrp - added "sync-connection-tracking" compatibility with preemption-mode;
*) vrrp - fixed high CPU usage when "sync-connection-tracking=yes" and the backup router goes offline;
*) vrrp - fixed HW offloaded bridge MAC address learning when changing from VRRP master to backup;
*) vrrp - fixed initial connection tracking synchronization, a backup router now always receives all existing connections;
*) vrrp - improved connection tracking synchronization protocol (CTSYNC), the new protocol is incompatible with previous RouterOS versions with "sync-connection-tracking=yes";
*) webfig - allow to specify NTP server as domain name;
*) webfig - fixed displaying of grahs in status pages;
*) webfig - fixed floating point field's negative value in -0.*** format;
*) wifiwave2 - added "sae-pwe" parameter with hash-to-element mechanism for SAE PWE derivation;
*) wifiwave2 - added support for 802.11k;
*) wifiwave2 - disable wireless interface after wireless configuration reset;
*) wifiwave2 - fixed displaying of AKM in scan results;
*) wifiwave2 - fixed duplicated AKM in RSN message;
*) wifiwave2 - fixed group key update for client devices which connect via fast BSS transition;
*) wifiwave2 - fixed incorrect AKM usage for FT-WPA3-EAP-192;
*) wifiwave2 - fixed reassociation response sending for fast transition over DS;
*) wifiwave2 - fixed setting of "ft-nas-identifier" parameter;
*) wifiwave2 - fixed usage of Canada country setting on US locked devices;
*) wifiwave2 - improved default channel width selection for interfaces in station mode;
*) winbox - do not show previously attached LTE interfaces while establishing LTE connection;
*) winbox - enabled all filters by default under "Tools/Torch" menu;
*) winbox - fixed "Enable", "Disable" and "Comment" functions for L2TP-ether type interfaces;
*) winbox - fixed "Next Run" parameter displaying under "System/Scheduler" menu;
*) winbox - fixed "Type" and "Value" field displaying under "System/Health" sub-menu's;
*) winbox - show warning messages for BGP connection entries;
*) wireless - fixed interface initialization on x86 devices;
*) x86 - allow downgrading to RouterOS v6 only if it was previously installed;
*) x86 - fixed advertising of 2500M and 5000M link speeds on ixgbe driver;
Что нового в RouterOS 7.5 (2022-Aug-30 12:25):
Читать полностью…
Вышла новая стабильная версия 7.13.
Из серьёзных изменений — работа с wireless-пакетами. Изучите ченджлог внимательно, чтобы потом не собирать выбитые зубы сломанными пальцами.
В двух словах: устройства с поддержкой 802.11ac wave2 теперь могут работать как wave2 даже с 16МБ внутренней памяти. Пакеты друг с другом конфликтуют, поэтому сразу определитесь, какой будете использовать, чтобы не бегать с нетинсталлом.
А тем временем RouterOS 6 понемногу живёт. В stable-ветке вчера была обнаружена 6.49.11What's new in 6.49.11 (2023-Dec-08 16:37):
*) console - display "End-User License Agreement" prompt after configuration reset;
*) defconf - use "WISP Bridge" default configuration mode for RBGrooveGA-52HPacn device;
*) poe-out - improved "auto-on" mode for devices with single PoE-out port;
*) pppoe-server - fixed connection count limit per license level;
*) wireless - fixed "wlan1" default name for RBSXTsqG-5acD and RBLDFG-5acD;
Лучше поздно, чем никогда. Новости уже пару дней: 7.12 зарелизили. Соотношение introduced/fixed стало значительно приятнее. Да и в целом фич больше, чем фиксов.
Читать полностью…
Идущий на бета-тест, приветствуют тебя!
Скриптописателям на ROS 7 смело ознакомиться.
https://habr.com/ru/articles/759564/
Релиз 7.11 маячит на горизонте. Появился уже второй релиз-кандидат.
What's new in 7.11rc2 (2023-Aug-03 10:50):Changes in this release:
*) certificate - fixed CRL link to the certificate if generated on an older version (introduced in v7.7);
*) console - improved stability when canceling console actions;
*) ike2 - fixed ECP521 DH group usage (introduced in v7.11 beta1);
*) lte - fixed R11e-LTE6 "EARFCN" reporting format (introduced in v7.11rc1);
*) ssh - fixed SSH key agreement when using ed25519 under server settings;
*) wireguard - fixed peer IPv6 "allowed-address" usage;
Довольно внушительный ченджлог для второй бетки у 7.11.
26 фиксов и 17 импрувов. Штош, пусть фиксят и импрувят, это хорошо.
Что нового в RouterOS 7.9.2 (2023-May-30 16:49):
*) routerboard - improved RouterBOOT stability for Alpine CPUs ("/system routerboard upgrade" required);
*) sfp - improved SFP interface handling for RB4011 device;
Наметилась 7.10. Из 87 записей ченджлога всего 30 фиксов, прогресс 😁
https://telegra.ph/v710beta5-testing-is-released-05-10
Также обновился винбокс.What's new in v3.38:
*) fixed connecting to wireless network from QuickSet when there was no password specified;
*) fixed date and time value representation in the User Manager;
*) fixed skin file reading;
🔥 winbox - added quick filtering option for route list;
Новый всепогодный ATL LTE18 kit
https://youtu.be/rJ28eF_GvYg
What's new in 7.6beta7 (2022-Sep-16 09:27):*) bgp - fixed reporting of session uptime;
*) branding - execute "autorun.scr" file when installing branding package;
*) certificate - restricted maximum retry attempt window for Let's Encrypt certificate to 60 minutes;
*) container - allow changing container related parameters while it is running;
*) health - improved voltage reading on RBmAP-2nD;
*) hotspot - fixed SSL usage on all HotSpot pages;
*) l3hw - improved connected host offloading on startup;
*) l3hw - improved connected IPv6 host offloading when routing table is nearly full for 98DX224S, 98DX226S, and 98DX3236 switch chips;
*) l3hw - made route offloading selection work only on unicast;
*) lte - added interface name in MTU debug logging message;
*) ospf - fixed checksum calculation;
*) ospf - improved logging when invalid configuration is detected;
*) route - fixed disappearance of inactive static routes after upgrade;
*) routerboard - set "Delete" as default key to enter booter menu ("/system routerboard upgrade" required);
*) sms - fixed handling of SMS send attempts on unsupported modems;
*) user-manager - accept any username for outer authentication;
*) user-manager - added "comment" parameter for batch user creation;
*) user-manager - added support for multiple accounting sessions;
*) user-manager - added variables to print profile name and end time in voucher templates;
*) user-manager - forced username verification against client's certificate for EAP-TLS;
*) webfig - fixed creation of new IPv6 routes;
*) winbox - changed order of tabs under "User Manager" menu;
*) wireless - fixed incorrectly applied ingress priority to non-wireless packets;
*) bgp - fixed remote refuse capability options, max prefix limit errors and administrative stop;
*) bgp - improved stability when "default-originate" is configured;
*) bridge - fixed "new-priority" value validation for NAT rules;
*) capsman - added randomized range option for "reselect-interval" parameter (CLI only);
*) certificate - fixed handling of empty AKID by SCEP client;
*) console - fixed automatic command completion with keypress;
*) container - added support for running Docker (TM) containers on ARM, ARM64 and x86 (containers created before v7.4 must be recreated);
*) defconf - fixed loading of default configuration on RB4011 with WifiWave2 package enabled;
*) dhcpv4-server - fixed removal of dynamic leases when server is removed;
*) dhcpv6-client - moved invalid lifetime logging message from "debug" to "error" topic;
*) dhcpv6-client - use /128 prefix for IA_NA addresses;
*) dhcpv6-relay - fixed relay forwarding (introduced in v7.1.5);
*) dhcpv6-server - improved stability when acquiring binding;
*) dns - added "address-list" parameter for static DNS entries (CLI only);
*) dns - added "match-subdomain" option for static entries (CLI only);
*) firewall - added support for RTSP helper;
*) health - fixed "temperature" and "power-consumption" readings on RB1100x4;
*) health - improved voltage reading on CRS112-8P-4S;
*) health - renamed "cpu-temperature" to "switch-temperature" on CRS312-4C+8XG, CRS326-24S+2Q+, CRS354-48P-4S+2Q+, CRS354-48G-4S+2Q+, CRS504-4XQ-IN, CRS518-16XS-2XQ;
*) hostpot - fixed Walled Garden functionality for HTTPS sites;
*) hotspot - automatically reject all HTTPS requests passing through HotSpot server for unauthorized users;
*) hotspot - improved stability when receiving bogus packets;
*) hotspot - limit maximum allowed connections based on free RAM resources;
*) hotspot - removed "https-redirect" option;
*) ike2 - allow sending certificate chain as initiator;
*) interface - fixed default interface naming on RB1100x2;
*) l3hw - fixed HW offloaded NAT;
*) leds - fixed default LED configuration for RBwsAP-5Hac2nD;
*) leds - fixed wireless LED functionality on LHGG;
*) lora - do not ignore negative sign for spoofed GPS coordinates;
*) lte - added at-chat and NMEA port support for Simcom modems, USB composition (device id - 0x9003);
*) lte - added at-chat support for Simcom modems, USB composition (device id - 0x9005);
*) lte - added "SIM not inserted" and "SIM failure" messages to "status" and "monitor" commands for AT modems;
*) lte - changed cell ID info display to short format for 3G connections;
*) lte - disallow empty APN name only for default entry;
*) lte - fixed AT channel for Sierra Wireless modems with device ID 0x9091;
*) lte - fixed LTE interface presence for Telit LN940;
*) lte - fixed UDP performance on MMIPS devices;
*) lte - improved antenna scan for Chateau devices with switchable antennas;
*) lte - improved configuration export when multiple LTE interfaces are present;
*) lte - modem dialer, do not reset dialing sequence if modem reply with error to user set init-string;
*) netinstall - fixed Netinstall procedure for ARM devices;
*) netwatch - automatically start migrated probes from previous RouterOS versions;
*) netwatch - changed ICMP default packet loss fail threshold to 85%;
*) ntp - fixed NTP server when "use-local-clock" is used;
*) ospf - fixed handling of external forwarding address;
*) ospf - improved stability when interface is being disabled during database exchange;
*) ovpn - fixed encryption key renewal process which caused periodic session disconnects;
*) ovpn - improved system stability when hardware acceleration is used on ARM64 devices;
*) ovpn - moved disconnected user logging message from "debug" to "info" topic;
*) ping - improved service stability;
*) port - added support for D-Link DWM-222 in serial/PPP mode (device id - 0xac01/0x7e3d);
*) port - added support for Huawei/ZTE K5006z in serial/PPP mode (device id - 0x1017/0x1018);
*) ppp - improved service stability under high load;
*) ppp - use /32 as default netmask if not specified for "routes" param
7.5 перешла в статус RC. Изменений много, читаем ченджлог
Читать полностью…