Feature requests

luqasz · Wed Feb 19, 2014 7:43 pm

ssh-rsa encoding for ssh client

this is an exact error message on cisco switch when i try to log in with ssh client on ros 6.10

SSH2 0: hostkey algo not supported: client ssh-dss, server ssh-rsa

luqasz · Wed Feb 19, 2014 7:46 pm

kerberos support for ssh logging.
i may be bombarded her to use radius with user-manager. problem is that radius is not as secure as kerberos. if you want to have same password for winbox and ssh you have to store and send passwords in plain-text !!!

don't you think that is a security hole ?

luqasz · Wed Feb 19, 2014 7:49 pm

it is verry simple to crack local user password once you have access to binnary backup for example.
Store them in sha or blowfish.
If you do this they can be exportable via /export. Also please note that importing them would be a really nice feature.

as a side note please read this and THIS.

please read my post again, because you completely missed my point. I said - why even bother encrypting it? it will just take a little more time to read. Better deal with your other security hole - why can somebody take your router and do what he pleases?

Are really so ignorant ? Why even bother ?

luqasz · Wed Feb 19, 2014 7:55 pm

/ip firewall connection
25    tcp      212.77.100.128:80     91.xxx.xxx.xxx:52378  established 2h47m39s

issuing below command:

print where src-address=212.77.100.128

will not print src addres becouse you have to write it with port. what if you do not know the port or you are just not interested in it ?

under winbox you can filter it by src-address and it works. why there are differences in console experience and winbox ?

-----------------------------

ok scratch this one. i have figured out to use scripting

/ip firewall connection print where src-address~"212.77.100.128"

luqasz · Wed Feb 19, 2014 8:10 pm

prefix lists for bgp, ospf etc. not only rip. once done you can store prefixes in some separate place making filters refer to them and resulting in more clear configuration

luqasz · Wed Feb 19, 2014 8:12 pm

/routing bfd interface> disable 0
failure: cannot disable 'all' interface config

remove all interface as a default configuration. you just do not use it always.

luqasz · Wed Feb 19, 2014 8:17 pm

if you set an ethernet/sfp interface as disabled link is still up. how about phisically (elecrically) disable it as well. just like a decent switch does

luqasz · Wed Feb 19, 2014 8:19 pm

if you want to find a mac address on a bridge host table you have to write it case sensitive. how about accepting it in case insensitive ?
This may be for some people a cosmetic feature but still noce one.

luqasz · Wed Feb 19, 2014 8:26 pm

/file mv,cp,mkdir

it is in my opinion self explanatory....

luqasz · Wed Feb 19, 2014 8:50 pm

simply show loopback interface in interface lists.
then you will be able to add addresses to it and not make a dirty empty bridge hack.

nickjail · Wed Feb 26, 2014 8:52 pm

Hi!

Need snmpget, snmpwrite, snmpwalk tools to monitor and control status of remote network hardware via router. For example, monitor UPS via snmp, reboot hardware and so on.
Yes, ups package already exist but it capable with APC only and interface cable lenth is limiting factor...
Really need. Thx!

Diamond · Thu Feb 27, 2014 11:27 am

Often MAC or IP address should copy manually from winbox. I suggest to make "cell copying" command for more convenient work...

mishaM · Thu Feb 27, 2014 4:01 pm

Hi all,

this feature will be good:
on CLI -> command alias support , (make group of line commands to one command )

make poe monitor oids( for 750 up ) or support on api monitor function.

mishaM · Fri Feb 28, 2014 8:08 am

also on CLI insert privileged modes ( enable ,config ..etc) will be good

markom · Fri Feb 28, 2014 10:33 am

mikrotik as LNS server with LAC support and l2tp secret tor tunnel.

vortex · Fri Feb 28, 2014 12:12 pm

HFS+ formatted storage, AFP, Spotlight indexing, Time Machine support, SMB 2.0

Working Bonjour (mDNS) intra-router (not inter) routing across subnets with example

vortex · Fri Feb 28, 2014 12:18 pm

Suricata on CCR

nosovk · Sat Mar 01, 2014 9:16 pm

hyper-v nic support!

nickjail · Sun Mar 02, 2014 8:58 pm

Please add support of receiving SNMP Traps and run scripts on this events

Mon Mar 03, 2014 2:34 am

Suricata on CCR

Rumor has it

IlCarletto · Thu Mar 06, 2014 1:05 pm

set the syslog remote address as fqdn or domain name and not only IP.

abstract · Wed Mar 26, 2014 2:06 pm

We tried CAPsMAN this week. It seems us a good tool, We haven't tried all features at the moment and we are planning to use it without SSL certificates exchange in an hotel in the next week.

We would like to suggest some enhancements for radio parameters managements.

The frequency provisioning does not permit to set the "auto" frequency value
The frequency provisioning does not permit to set the country value resulting in illegal frequency channel (in fact we cannot use the channels 2467 and 2472 that are permitted in italy)
Generally speaking it will be usefull having a greater control on CAP's radio parameters setting (country, power, frequency mode, antenna gain, DFS mode, etc...)
May result usefull let the CAP use its own radio parameters configuration, when implicit default provisioning rule is applied, or when configurations without radio parameters explicitly setted are used.

DShmelev · Sun Apr 13, 2014 2:37 am

Address lists of Address lists!
Urgent!

blackhold · Tue Apr 15, 2014 3:13 am

NAT64: Tayga

More info:
http://www.litech.org/tayga/
http://blackhold.nusepas.com/2014/04/nat64dns64/

it should be easy to implement, install tayga package (121kb) and configure twice firewall rules...

please, it is really important due ipv4 is out and now if you want to redirect users from a wisp you need to use policy routing and you need IPv4 inside your network to make it work.

thanks you much!

markom · Tue Apr 15, 2014 11:46 am

ADSL capable RB.

jmetcalf · Tue Apr 15, 2014 11:47 pm

I would love to get a url-server/filter command implementation what Cisco provides. (Do a search for "PIX/ASA URL Filtering" for an example of what I am referring to).

The basic idea being any website being accessed first does a quick hand-off to the filter server for a yes/no response. If yes is returned then the router allows the access to continue. If a No response is returned than the Router passes you back to the url-filter server for a block reason.

I realize that you can proxy, but this feature would open up RouterOS to the possibility alternate content control without the need of proxy servers.

Just a thought.

blackhold · Thu Apr 17, 2014 2:18 pm

IPv6 policy routing - really important if nat64:tayga will not be implemented yet

blackhold · Thu Apr 17, 2014 3:17 pm

winbox: group connections by categories

cdiedrich · Thu Apr 17, 2014 3:29 pm

Next feature request for Access Points (Like metal, BaseBox, etc) and their LEDs:

It'll be just fantastic for us to be able to not only add wireless signal strength to LED1-LED5 (which is somehow pointless when they're configured as access point) but alternativly CPU load and/or bandwidth utilization (in % of the theoretical configured maximum)... THIS would really help us a big deal.

Thanks,
-Chris

brauser · Thu Apr 17, 2014 6:11 pm

Some features have already been requested before, to better manage this, you can register on the Wiki and cast your vote there:

http://wiki.mikrotik.com/wiki/MikroTik_ ... e_Requests

Of course, in addition, it would be great if you also posted a message here, explaining why you need that particular feature. And as usual - search before you post, maybe a topic exists already.

normis,

Wiki link is down, there is some other specific place to do feature request or here's the right/official place?
My feature request would be to have an option to turn on/off (checkbox) dynamic mode on "/ip pool" so we can have the opposite behaviour of:

Note: Whenever possible, the same ip address is given out to each client (OWNER/INFO pair).

Better if it could be possible for each pool

It would be very appreciated by many. Big thanx!

ofendt · Fri Apr 25, 2014 1:22 pm

Would be perfect in IP/ROUTES Check-Gateway to be able to specify an IP-Adress other the the default Gateway.

In Germany we get more - and more proconfigured AVM Fritzboxes as a DSL Connecting-Point.

The box is always Pingable - even if the connection behind is down. Script is possible but complicated.

---

And by the way...
Optical nice (something like UNIFI with hidden cables) RB with (RB95xxx) with 2,4 AND 5 GHz would be perfect.

And... don't forget the perfect DUDE. Its still in beta and send's me email's even if the server is down for only some seconds.
Would be perfect to give a time-limitt (if down 1 minute...)

Thanks. RB is "nearly" perfect - good stuff.

Fri Apr 25, 2014 1:41 pm

Would be perfect in IP/ROUTES Check-Gateway to be able to specify an IP-Adress other the the default Gateway.

It should already be possible using so called "Recursive routes".
Read more about it here. I seem to have seen an example somewhere in the wiki as well, but can't find it at the moment.

Chupaka · Mon Apr 28, 2014 6:17 pm

I seem to have seen an example somewhere in the wiki as well, but can't find it at the moment.

http://wiki.mikrotik.com/wiki/Advanced_ ... _Scripting

quux · Sun May 11, 2014 4:31 pm

I hope the title says it all.

We bought the CRS125-24G-1S-2HnD for the express purpose of getting IPv6 running properly on our network. Getting everything up and running, only to find that we could not advertise local DNS servers via RAs, was very disappointing! I am however very impressed by the device and by RouterOS in all other respects.

If anyone knows a clean way to do this from Windows, feel free to reply here or email me directly. I'll be very thankful!

In the meantime I'll hope this feature comes to RouterOS!

andryan · Thu May 22, 2014 12:23 pm

More /ip ssh settings: TCPKeepAlive, ClientAliveInterval, and ClientAliveCountMax.

otgooneo · Tue May 27, 2014 6:01 am

Please implement logging possibility when bridge port interface role changes. If something happen in my STP enabled network, I can`t see where was an issue and which of my routerboard changed it`s port state. Furthermore debug log should show BPDU message detail logs. But now even debug log can`t show nothing regarding bridge interface role changes.

wisp625 · Sun Jun 01, 2014 11:26 pm

Feature request: would be nice if there was a VoIP implementation section and a POE out port as a WAN port so we could have a customer router provide power for the radio and be able to plug a telephone into it as well. A lot of Wisps are looking for this as a solution.

Valerio5000 · Thu Jul 03, 2014 1:58 am

I realize that my request is not "technical" but it is possible to integrate a DLNA server for example nell'RB951 with USB that is proposed as a router at home?

joncolby · Fri Jul 04, 2014 6:00 am

Please add Dynamic V-Lan Assignment so we can run 3rd Party Network Access Control Software like Packetfence Please.

digidax · Wed Jul 23, 2014 4:41 pm

If I have opened a firewall rule, a Button to clone this rule.

I have a lot of INPUT rules, which are only different by the src IP Address.
So I can clone the rule, change the SRC IP and apply the rule.
Webmin (www.webmin.com) have it implemented for the firewall settings.

thanks
Frank

Chupaka · Wed Jul 23, 2014 5:05 pm

If I have opened a firewall rule, a Button to clone this rule.

you mean, 'Copy' button, which is there for may years already?..

Utomo · Sun Jul 27, 2014 6:23 am

Some features have already been requested before, to better manage this, you can register on the Wiki and cast your vote there:

http://wiki.mikrotik.com/wiki/MikroTik_ ... e_Requests

Of course, in addition, it would be great if you also posted a message here, explaining why you need that particular feature. And as usual - search before you post, maybe a topic exists already.

The pages already deleted

My Feature request:
1. Utilize the USB for NAS and Cache.
so we can connect a Hard disk and use as NAS and cache (to save bandwidth)
2. Support PHP please. so we can run the PHP script on Mikrotik Router.
Now the memory size already big enough and also the Processor also fast enough.
By allowing PHP Script it will make the Router more flexible and powerful.

And also Better WEB UI / More user friendly.

Thank you .

Davis · Mon Jul 28, 2014 9:21 pm

I want to suggest adjustable boot-delay (under /system routerboard settings), up to 255 seconds, for all RouterBOARDs.
This would allow some safety against bricking by repeated power loss (i.e. in case electrician connects power only for a few seconds router won't yet start to boot and there would be no risk of data corruption due to power loss during boot).

LarryPotter · Fri Aug 08, 2014 9:48 am

Would NETCONF be of use to anyone else?

hzdrus · Fri Aug 08, 2014 1:40 pm

We find inability to trigger commands/scripts based on events to be very limiting, especially in MPLS VPN deployment.

The following is necessary:
1) Ability to specify inside RADIUS reply which commands/scripts to execute (e.g. similar to Cisco-AVPair)
2) Logging target to send every new log line to a script (so there is no need to use a hack with scheduler executing a script every N seconds)

rsaf · Tue Aug 19, 2014 3:22 pm

Somethink lie RB951Ui-2HnD or RB951G-2HnD with SFP slot. We really need:
-single SFP slot for optical UPLINK
-SFP slot in confiurable VLAN aware switch (we have trunk on optical uplink with IPTV in separate vlan and we need to pass IPTV to one or two ethernet ports)
-at least 5 ports (5 ethernet ports and 1 sfp port will be much better)
-integrated 2.4GHz wifi
-one type with plastic case (like RB260GS) with integrated wifi antennas
-second type "board only" with U.FL antena connectors - we have own design of metal wall-mount case in which we can splice optical cable and put optical CPE (switch or mediaconverter) in it, we can put bare board in this case and use pigtails to pass antennas outside this box
-maybe mikrotik can design their own wallmount box where optical cable can be spliced and integraded routerboard in this box...

whippy · Tue Aug 26, 2014 4:32 am

Followed the link to the wiki - doesn't look like anyone's using it though...

CAPsMAN extended to allow other interface types to be assigned to datapaths.

skibi82 · Tue Aug 26, 2014 12:19 pm

Give MACVLAN to add the power to create Virtual interfaces.
Useful for testing or the separation of traffic.

Komerad · Tue Aug 26, 2014 10:57 pm

- All openvpn features.
- Auto dns lookup when non ip value is entered. Would be very handy to have router os to accept domain names for more features.
- Make adressess list true lists that can hold all kind of unique ip adresses or even hostnames in a list. Not just ranges.
^- and/or make it possible to add more sources and destinations at certain places. (Like mangle.)

xhaos · Wed Aug 27, 2014 9:22 am

Expand graphing, to show wireless connection statistics such as SnR, CCQ, Rx/Tx for AP clients and for p2p connections

Wed Aug 27, 2014 11:27 am

Please, create universal versatile graphing that allows user to set whatever value that is readable in ROS to be graphed. Combined graphing (e.g. CPU, memory and number of connected clients together in one graph) would be something extra!

And please, ensure that power loss, reboot or ROS upgrade will not erase old graphs. It is still unsolved bug that emmerges very often still in 6.18 (contemporary latest).

Wed Aug 27, 2014 11:42 am

Please, create universal versatile graphing that allows user to set whatever value that is readable in ROS to be graphed. Combined graphing (e.g. CPU, memory and number of connected clients together in one graph) would be something extra!

And please, ensure that power loss, reboot or ROS upgrade will not erase old graphs. It is still unsolved bug that emmerges very often still in 6.18 (contemporary latest).

we already have it, it is called SNMP

Wed Aug 27, 2014 2:40 pm

Normis,

you know very well that this is not the requested functionality - getting values via snmp takes time and resources, what is worse, it needs active connection to the device. I talk about autonomous graphing that will work within the ROS even if the device is disconnected from the network.

At least, I wish the graphs were stop disappearing. Finaly. Some day.

And anyway - are you working on speeding up usb storage opertions and usb storage reliability? It is tragical and too much CPU time hungry.

AlexS · Sat Aug 30, 2014 9:54 am

I would like a graceful BGP and OSPF shutdown

when I reboot my router it doesn't bring down the OSPF and BGP connections and I have to wait for its peers to realize its dead

That can take a while.

and you can't just stop the BGP / OSPF instances as they will not restart on reboot !

roadracer96 · Sun Aug 31, 2014 3:54 am

Both of my other brands of firewalls and routers support graceful ospf/bgp restart. It's very nice when you are making a change to the routing process but don't want to dump all routes.

AlexS · Mon Sep 01, 2014 12:21 am

Sorry miss understanding

I mean shutdown of the router not ospf/bgp processes

roadracer96 · Mon Sep 01, 2014 5:38 am

That isn't graceful restart. Graceful restart means "hold your routes until I come back, wait up to x seconds for me to finish my operation then update routes after we reestablish adjacency". The change you requested is best handled with bfd.

AlexS · Mon Sep 01, 2014 6:18 am

That isn't graceful restart. Graceful restart means "hold your routes until I come back, wait up to x seconds for me to finish my operation then update routes after we reestablish adjacency". The change you requested is best handled with bfd.

I would have to disagree.

By using BFD (i looked at it, it just makes convergence faster. Good, doesn't work for me as 1 device doesn't do BFD ..)

A graceful shutdown, would do a graceful shutdown of OSPF/BGP, which would mean removing them from the network, not just turning it off.

when I work on a OSPF node, i usually disable the ospf instance, leave it for a bit till all the routes have been recalced. then I can reboot as need.

roadracer96 · Mon Sep 01, 2014 6:29 pm

BFD detects when the peer goes away based on the interval of the BFD messages x multiplier.. So .25 second message X 3 multiplier = .75 second detection time. If OSPF is shut down on an interface, BFD will get shut down and in .75 seconds, the routes on the other end will get dropped.

Graceful restart is an rfc defined here: http://tools.ietf.org/html/rfc3623

It lets you take the OSPF process on a router offline for reconfiguration or some other reason and it notifies the remote peers to NOT drop routes for a default of 120 seconds. This is helpful if you need to make a change to the OSPF processes but still want to forward traffic through the router while the reconfiguration takes place.

If Im hearing you right, you want the remote peers to drop routes FASTER when you stop the ospf process on a router or reboot the router (faster than the ospf hello intervals). This would be BFD. So yes, BFD does speed up convergence. The second a router goes offline, everything needs to reconverge. BFD makes this happen faster.

pochbba · Mon Sep 08, 2014 9:38 pm

Hi there Normis,

I would really appreciate having an save file/export ping/traceroute log function of each individual winbox ping/traceroute test.

Sometimes it comes handy when doing small tests and keeping them logged.

I know there are several 3rd party applications that actually do this. But having it integrated on ROS would make my life easier.

Regards

Trekkie · Mon Sep 08, 2014 10:17 pm

Is OVPN Client side LZO Compression and UDP support somewhere out there in plan? the wiki link is missing.

xhaos · Tue Sep 09, 2014 10:21 am

It would be very useful, to be able to setup a queue with target not only the interface name, but the interface's ingoing / outgoing /both direction.

for example I wish to configure mangle for internet QoS. Now we have to configure different mangle marking for incoming and outgoing traffic. But it would be much simpler, easier and fault-proof, if we could just mark the QoS priority markings in mangle and could have different queues for each traffic direction.
RouterOS as is, works perfectly for symmetric ethernet environments. But since we can use it for adsl router or even asymmetric wireless links, I think routerOS could provide some better tools.

Chupaka · Tue Sep 09, 2014 3:00 pm

you mean, simple queues? but they create up to three (upload, download and total) queues - why don't you use them all?..

Zorro · Thu Sep 11, 2014 1:26 am

is anyway to have native Zabbix support by RouterOS in frsbl future of it ?
also would personally welcome more updated/actual Active queues in RouterOS to handle/combat/prevent Network congestion. rather than static/notorious RED algo/type present already, which unsuable for production for number of reasons.
for example, RRED would be nice. aswell as other adaptive, attack/flooding-proof variants of AQM.
also bout moving RouterOS from vanilla Linux kernels to Zero Overhead Linux gossips - is actually such plans, yet ?
(this thing http://www.tilera.com/sites/default/fil ... aper_0.pdf meant, to be exact/specific)
also finishing/completing BFG routing implementation (auth and echo ?) also may be handy.

Ciambot · Fri Sep 12, 2014 10:18 am

Request:
RFC 5185 OSPF Multi-Area Adjacency

bds1904 · Fri Sep 12, 2014 4:49 pm

Enable the openvpn client to accept an ipv6 address as a valid target address

taduikis · Wed Sep 17, 2014 10:46 am

Add some planned upgrade feature, that gets done upon next RouterOS start, no matter if shutdown/reboot was graceful or not. This of course should be voluntarily and separately triggered with required packages being uploaded in advance. It does add some risks of course, but I bet some people would/might be willing to take them.

I know this could be done at some level using v6 partitioning or achieved with scripts, but either way, having such function that you can choose not to use if you don't want, is still better, IMO.

namake · Fri Jan 23, 2015 11:21 am

Normis, can you add support of vmxnet adapters (that vmware esxi provide to virtual machines) ?

wagguRQ · Sun Feb 01, 2015 11:09 am

I would like that you will add a counter of errors (crc,drop,oversitse,collisions, e.t.c.).
It is desirable that you will add the iperf with the standard features, as well as the possibility
of using as a client or server. This tool needed for monitoring and diagnostic as well as will use
in a bundle with iperf which was installed on radios from the Ubiquiti Networks.

erlt · Sat Feb 14, 2015 9:37 am

MAC Address List . This is very useful especially in a topology where there are multiple subnets.

Buzz · Sun Feb 15, 2015 1:54 am

I need to show comments from users section at active tab in hotspot (comments r missing in active tab) , because my users are login with their mac address (MAC login method) so they appear in the active tab only with their mac not with there name nor their comments , it will be more easy if these mac address appear with their comment to easily know who is online

by the way if you comment any record in ip binding the comments will appear in hosts tab with this comment

thank u in advance

bronx · Sun Feb 15, 2015 8:55 pm

Add a command in script that allow us to read string from console and save it in one variable.

It's allow us to create user interactive script, useful on setup

remkolodder · Mon Feb 16, 2015 12:52 pm

Hi,

I would like to request a feature to extend the OpenVPN possibilities.
I would like to run multiple OpenVPN instances on the mikrotik. One for my incoming clients, and a few for peer2peer vpn links between servers.

Setup:
Clients: share some IP space on IPv4 and IPv6 front, /27 and /64.
P2P links: use unique /30's between eachother. Used as connection point to offer OSPF routing over the links (and traffic).

micromaxi · Mon Feb 16, 2015 7:39 pm

Please, create universal versatile graphing that allows user to set whatever value that is readable in ROS to be graphed. Combined graphing (e.g. CPU, memory and number of connected clients together in one graph) would be something extra!

And please, ensure that power loss, reboot or ROS upgrade will not erase old graphs. It is still unsolved bug that emmerges very often still in 6.18 (contemporary latest).

I would love to see uptime graph added to the graphing section. That way we dont have to run an extra snmp machine.

JanezFord · Tue Feb 17, 2015 8:24 pm

Please add ability to set WMM, HW Protection Mode, Preamble Mode, HW Retries, Adaptive noise immunity and other advanced mode parameters with CAPsMAN (v2) ... capsman is supposed to be used as controller in hotels, conference centres and similar scenarios and these options are useful in highly congested areas.

JF

pants6000 · Wed Feb 18, 2015 3:22 am

I've got some:

Configurable view of ip/firewall fields in webfig like in winbox (I really could use to see the "address list" fields in the list!)

text config export from webfig's file menu

per-interface RPF & RPF logging

"safe mode by default" option so I can *never* be locked out of a remote router (unless I want to turn safe mode off, of course)

configurable COS/DSCP mapping

spippan · Wed Feb 18, 2015 2:40 pm

I would be nice that in /ip service I could set more ip address or one addres-list

erm, you actually can do this (not with ACLs but with multiple IPs)

Rudios · Wed Feb 18, 2015 3:01 pm

I would be nice that in /ip service I could set more ip address or one addres-list
erm, you actually can do this (not with ACLs but with multiple IPs)

Why not just block unwanted access by firewall?

pants6000 · Tue Feb 24, 2015 8:34 pm

PPTP/PPPOE interfaces (all PPP? more?) are disconnected then re-connected when clicking "OK" on their /webfig/#Interfaces.Interface page, even if nothing has changed. It probably shouln't do that.

grisina · Wed Feb 25, 2015 10:44 am

For ease of use and functionality i would suggest to use TheDude for this - just remove probes, so no additional load anywhere, just network device map, where you can create device groups and operate with them (upgrade devices, for example). And if required, you can monitor your key routers in the network.

Wed Feb 25, 2015 11:45 am

Please add ability to set comment for dynamically added entries in address list.
This feature let for e.g. make script which resolves blocked IP addresses to their FQDN and puts it into comment field.

peper · Fri Feb 27, 2015 3:42 am

There are couple of threads where users request feature to link scripts to firewall rules.
Those requests are logically rejected by developers cause this opens a pretty straightforward way to DDOSisng devices.

But there are other posts (in this thread inclusive) to link scripts to VPN events.
IMHO, this idea makes a lot of sense and is not open for DDOS attacks.
The need to use Scheduler or Netwatch for such simple task as "wake up my computer when I connect externally with VPN" is not very cool.

I've seen some requests to implement in ROS more global event triggering mechanism. It would be nice-to-have, but pretty sure, that it requires a huge development (and testing!) effort in comparison with enabling scripts for couple of selected objects, requested more often than others.

kraic · Fri Feb 27, 2015 9:54 am

background scan please

JOFO · Fri Feb 27, 2015 8:58 pm

Could you please add latest drivers for Realtek RTL8111 ethernet controller? With actial ROS v6.27 it's randomly freezing eth interface. It's in the iface list, but no traffic can pass through.. Only reboot resolves this state, but only for short time (sometimes it's 3 days, sometimes it crashes after couple of hours). It's useless with such behavior..

Sat Feb 28, 2015 12:39 am

Ability to specify which prefix from-pool to use on a specific interface.

Suppose ISP assigns a /60 and I want to specify WHICH of my /64s goes to which interface....
Currently, Mikrotik ignores the bits 61-64 and chooses on its own which of the 16 prefixes to use.

In Cisco, prefix and pool are masked together, and I am spoiled by this feature:
e.g. Loop0 -> ipv6 address ISP1POOL ::ff:0:0:0:1/64

If ISP assigns /60 I would like an ability like this:
ISP --> 2001:db8:0:c000::/60 -> pool ISP
I want to be able to hard-code:
ether1 = ::1:0:0:0:1/64 from-pool ISP -> 2001:db8:0:c001::1
ether2 = ::2:0:0:0:1/64 from-pool ISP -> 2001:db8:0:c002::1
ether3 = ::3:0:0:0:1/64 from-pool ISP -> 2001:db8:0:c003::1
GuestBridge = ::f:0:0:0:1/64 from-pool ISP -> 2001:db8:0:c00f::1

With current behavior, if I disable ether2 and reboot, ether3 would get 2001:db8:0:c002::1

Mon Mar 02, 2015 8:32 pm

Please add ability to assign interface to DHCP network as now there is no possibility to define same subnets for different interfaces which are in different L2 domains defined by VLANs.
See this thread: http://forum.mikrotik.com/viewtopic.php ... 8b#p471529

spippan · Tue Mar 03, 2015 1:08 pm

I would be nice that in /ip service I could set more ip address or one addres-list
erm, you actually can do this (not with ACLs but with multiple IPs)

Why not just block unwanted access by firewall?

exactly ... IMHO also the way more serious and clean solution

i just wanted to point out, that if someone does not want to "struggle" with firewall rules, there is also a specific ACL("-like") option here

Garga220 · Wed Mar 04, 2015 5:04 pm

Is it possible to get OIDs for average CPU, like 5min average or 1h average to be used with different monitoring tools ?
Or maby some kind od print command to get average value?

roli · Thu Mar 12, 2015 12:47 pm

Functionality such as DNETMAP

Garga220 · Thu Mar 12, 2015 1:55 pm

Functionality such as DNETMAP

+1

avlipa · Thu Mar 12, 2015 8:49 pm

Could you please add Proxy support for the OpenVPN client on RouterOS?
Winbox utility doesn't have this option.

novaquadri · Fri Mar 13, 2015 12:56 pm

Please integrate some functions to measure parameters such as swr or return loss

avlipa · Mon Mar 16, 2015 10:55 pm

Please add TLS-AUTH in RouterOS OpenVPN Client. AFAIK there is no possibility to connect to OpenVPN Access Server software solution without this feature.

hossain2004a · Tue Mar 17, 2015 7:51 pm

I don't know if someone tell this before.
But is it possible when you shutdown/reboot the RB, the COUNTERS wouldn't reset at all and continue working?

dohmniq · Fri Apr 03, 2015 6:33 pm

New property for /ip firewall mangle rules:

tcp-length(integer[-integer]:0..65535; Default: ) Matches tcp packets with specified tcp payload length or length range in bytes.

Useful for prioritizing zero-length ack packets over other upstream traffic.

As a rough hack/work-around we can use:

packet-size=40-52

(most TCP 0-payload-length packets I've seen are either 40 or 52 bytes depending on TCP options)

karwos · Sat Apr 04, 2015 5:36 pm

Add new attributes to PCQ classifier:
dst-mac-addr, src-mac-addr

IP working only on plain IP packets (etherType=0x800),
when device working in bridge mode and passing VLAN, VLAN-in-VLAN, PPPoE packets - it's not properly placing packets in queue (they are bpassed).
Solution is to make few other checks on packet (need more clock cycles), so simplier will be to add src/dst hw addr policier ...

Chupaka · Mon Apr 06, 2015 8:19 pm

Functionality such as DNETMAP
+1

isn't it already here?.. just use 'action=netmap" in 'dstnat' chain...

Please add ability to set comment for dynamically added entries in address list.
This feature let for e.g. make script which resolves blocked IP addresses to their FQDN and puts it into comment field.

[admin@TestPlace] > /ip firewall address-list 
[admin@TestPlace] /ip firewall address-list> add list=mylist address=1.1.1.1 dynamic=yes comment="FQDN.HERE"
[admin@TestPlace] /ip firewall address-list> print where list=mylist 
Flags: X - disabled, D - dynamic 
 #   LIST                                                 ADDRESS                         TIMEOUT             
 0 D ;;; FQDN.HERE
     mylist                                               1.1.1.1                        
[admin@TestPlace] /ip firewall address-list>

IntrusDave · Tue Apr 07, 2015 6:44 am

MAC Address List . This is very useful especially in a topology where there are multiple subnets.

+1 on the MAC address Lists.

Even better would be MAC Address Lists with a wildcard option.

Buganah · Wed Apr 08, 2015 11:25 am

hi if it is possible to have the pppoe server listens to serveral interfaces instead of one interface ..
i have 7 vlans and i have to have 7 pppoe servers for each vlan interface it would be nice to have one pppoe server for 7 interfaces

tomaskir · Wed Apr 08, 2015 11:49 am

hi if it is possible to have the pppoe server listens to serveral interfaces instead of one interface ..
i have 7 vlans and i have to have 7 pppoe servers for each vlan interface it would be nice to have one pppoe server for 7 interfaces

Create a bridge, use split bridge horizon to isolate the ports, and create a PPPoE server on that bridge.

Zorro · Thu Apr 09, 2015 10:00 am

would be nice to had offline RouterOS wiki WITHIN routerboards and CCR. so consumers may configure it, to be ONLINE,to read online version of it, without throwing hair away or running panicking in circles.
wouldn't be much space in internal storage(flash is cheap as dirt, btw). even infrequently updated/obsolete/refernce version would help, but better it become part of ROS and keept up-to date with RoS itself, consitently/smoothly.
or had credit-card-sized CD-R disc with manul in html/pdf in it, but thats less cool/easy to use(and CD/DVD drives slowly become rare/uncommon in consumers desktops/portables).

and to fix ARP filtering(mysteriously work not always). and now bout NDP filtering its work?

how about ad-hoc routing protocols. batman, open garden alike non-propretary counterparts and etc variations.

grasshopper/stribot chiper for WiFi and VPN's (and for SSH and for rest stuff).

Wed Apr 15, 2015 3:53 pm

I don't think there should be wiki inside the devices or on enclosed cd as it cannot be updated on live so it would make big mess.

I would suggest to have wiki according the ros version together with the ability to show differences between two ros versions directly on wiki pages. It would be very helpful for migration of configurations and scripts that normally fail and need to be debugged many times after an update.

PtDragon · Fri Apr 17, 2015 1:45 pm

Please don't forget to add for VPN clients ability to use specific IP.
Please add good load balancing for VPNs(got lot of problems with it).

nickjail · Wed Jun 10, 2015 12:55 pm

Hi!

Need snmpget, snmpwrite, snmpwalk tools to monitor and control status of remote network hardware via router. For example, monitor UPS via snmp, reboot hardware and so on.
Yes, ups package already exist but it capable with APC only and interface cable lenth is limiting factor...
Really need. Thx!

pqatsi · Thu Jun 18, 2015 3:24 pm

Is OVPN Client side LZO Compression and UDP support somewhere out there in plan? the wiki link is missing.

OVPN Server+Client LZO+UDP+AES

dancms · Thu Jul 02, 2015 11:11 pm

Feature request:

Ability to specify boot-file-name on a per static lease basis. This would add much needed flexibility for rather than using the global setting at the 'ip dhcp-server networ' level where all clients receive the same file.

Chupaka · Fri Jul 03, 2015 1:59 am

Feature request:

Ability to specify boot-file-name on a per static lease basis. This would add much needed flexibility for rather than using the global setting at the 'ip dhcp-server networ' level where all clients receive the same file.

for now you should be able to create Network entry per IP with changed settings (just set address=x.y.z.h/32 netmask=24 or something)

dancms · Fri Jul 03, 2015 2:06 am

Creates a little more clutter than needed but good work around. Much appreciated!

jexem · Fri Jul 03, 2015 11:07 am

Hi!

It would be fine to Support UAPSD. All Voip Wifi Phones did support and need this to work. I think many People need this to integrate in Offices an Hospitality Sector. Also Power Drain of Smartphones should be better. Is there any Progress about this thing?

Thank you
Juergen

miasik · Sat Jul 04, 2015 11:24 am

Add method POST and custom headers(as curl -H) support to /tools fetch.
Need for Yandex API, for example.

dukejjjj · Mon Jul 06, 2015 4:07 am

hi

Can add Shadowsocks server & client ?

Bigfoot · Mon Jul 06, 2015 8:23 am

Hi

Can you add a Column with Src IP address in the Web Proxy Cache Contents.

Bigfoot

Bigfoot · Tue Aug 18, 2015 12:40 pm

Hi

On the Resource Graphs is possible to add voltage and temperature , UPS like the CPU, HDD & Memory on the resource graphs in web interface.

Bigfoot

agrevtcev · Tue Aug 18, 2015 6:06 pm

It would be nice to implement ECDSA certificates support. So we could finally mitigate IPSEC IKE UDP fragmentation issue, without sacrificing certificate security level, as cryptoanalysts say. Thanks alot.

UMarcus · Fri Sep 04, 2015 10:22 am

move -> http://forum.mikrotik.com/viewtopic.php?f=1&t=100178

Ivoshiee · Mon Sep 07, 2015 10:15 am

The ROMON tool should have an ability to discover IP-addresses as well.

mchoco · Mon Sep 07, 2015 5:09 pm

Provide a simple way to use switch chip to do wire-speed IP routing. Although the switch chips can only support limited routing rules, it can serve smaller setups well.

marrold · Mon Sep 07, 2015 6:21 pm

Ability to 'fetch' and save into variable without saving to file.

E.G -

$ curl ifconfig.co
45.212.4.56

vortex · Mon Sep 07, 2015 6:51 pm

Provide a simple way to use switch chip to do wire-speed IP routing. Although the switch chips can only support limited routing rules, it can serve smaller setups well.

This is interesting. Could you please elaborate?

ahmedramze · Sun Sep 13, 2015 12:38 pm

Hello

Please Can Add service name on PPP active to be able to sort users according to the port or re-sellers

sermik.PNG

mmmigoro · Mon Sep 14, 2015 9:13 am

Add option to set BGP origin in Action-Filters see: http://forum.mikrotik.com/viewtopic.php?f=14&t=98807

zoj · Mon Sep 14, 2015 2:41 pm

Add option to define in radius configuration tab, IP by which will be sending always request to Radius server

I have 30 IP's and MT always is sending request to radius server via first IP. Sometimes something is wrong and MT is trying send request via other IP.
Problem is that on radius server i have configured rules to only received radius request from one IP.

tomaskir · Mon Sep 14, 2015 3:39 pm

Add option to define in radius configuration tab, IP by which will be sending always request to Radius server

I have 30 IP's and MT always is sending request to radius server via first IP. Sometimes something is wrong and MT is trying send request via other IP.
Problem is that on radius server i have configured rules to only received radius request from one IP.

You can already do this...

/radius
add address=1.1.1.1 secret=123456 service=login src-address=10.0.0.100

zoj · Tue Sep 15, 2015 6:42 am

Add option to define in radius configuration tab, IP by which will be sending always request to Radius server

I have 30 IP's and MT always is sending request to radius server via first IP. Sometimes something is wrong and MT is trying send request via other IP.
Problem is that on radius server i have configured rules to only received radius request from one IP.
You can already do this...
Code: Select all
/radius
add address=1.1.1.1 secret=123456 service=login src-address=10.0.0.100

Thank you, so if I'm using ppp, my configuration should look like that:

add address=1.1.1.1 secret=passwd service=ppp,login src-address=212.121.121.121

1.1.1.1 - Radius IP
212.121.121.121 - IP address on MT which i would like use to send request to Radius server

That's mean that MT always sends request to Radius server by this IP ( 212.121.121.121), is it ?

gcsuri · Tue Sep 15, 2015 7:35 am

Hi All,

could you add a "skip" option to netwatch system, please?
So when netwatch pings a host and sometimes it has a timeout the host goes down immediately... and goes up on the next ping. It occurs because of a transmission timeout or something else but the host doesn't inaccessible.
If we had a "skip" option to be set to "3" for example then the system could skip 3 timeouts and the host doesn't get down on a simple ping timeout until it has 3 timeouts. When "skip" is "0" all goes the same than before.

thank you much!

Gabor

WirelessRudy · Tue Sep 15, 2015 1:22 pm

Hi All,

could you add a "skip" option to netwatch system, please?
So when netwatch pings a host and sometimes it has a timeout the host goes down immediately... and goes up on the next ping. It occurs because of a transmission timeout or something else but the host doesn't inaccessible.
If we had a "skip" option to be set to "3" for example then the system could skip 3 timeouts and the host doesn't get down on a simple ping timeout until it has 3 timeouts. When "skip" is "0" all goes the same than before.

thank you much!

Gabor

I second this! It has been asked before but it might serve to post this again. Same counts for `watchdog` feature. We should have the option to set the 'time' of a timeout and the amount of timeouts.
Now a single missing ping immediately reboots the router. At times this is not desirable....

Tue Sep 15, 2015 5:18 pm

Tue Sep 15, 2015 5:19 pm

I asked very long time ago for implementing full set of ping features to netwatch tool. This would solve all such particular requests at once.

zoj · Wed Sep 16, 2015 8:59 pm

Do you have a plan to add IPSec Road Warrior + AAA via Radius ?
I know that i can configure it on MT but it doesn't support Radius

jondavy · Sat Sep 26, 2015 11:08 pm

it would be interesting to show comments in the active dynamic PPPoE interfaces registered in Secrets
and also the comments registered in hotspot users to appear in Active users

as with the wireless tables

metricmoose · Thu Dec 03, 2015 10:02 pm

I would appreciate the ability to use multiple radius servers simultaneously. For example, having a Hotspot setup that can use the built-in Userman package as well as say, a FreeRADIUS server. Right now, if you add multiple radius servers, RouterOS will use the first one unless it times out or otherwise fails. If the first radius server replies to RouterOS telling it that the user wasn't found, then it will stop looking despite there being multiple entries for hotspot radius servers.

pants6000 · Fri Dec 04, 2015 7:32 pm

Being able to set the RADIUS source IP to an interface instead of an explicit IP address would be useful... for me, at least!

We have ROS boxen that speak RADIUS over a VPN to our freeradius servers; if I could set the RADIUS request source IP to the VPN interface, it would make for simpler "cookie cutter" config when rolling such things out or making changes.

omega-00 · Mon Dec 07, 2015 2:34 am

Being able to set the RADIUS source IP to an interface instead of an explicit IP address would be useful... for me, at least!

We have ROS boxen that speak RADIUS over a VPN to our freeradius servers; if I could set the RADIUS request source IP to the VPN interface, it would make for simpler "cookie cutter" config when rolling such things out or making changes.

If you're doing this as part of the deployment it's probably better (IMHO) to use part of the config script to determine the IP address for that interface and set it up because it's a once off, while your IP address on an interface could change (or an interface could have multiple IP's)

Zorro · Tue Dec 08, 2015 1:10 am

would be nice to had zorp in (future versions of?)ROS, cuz for 95% "Web Proxy" usage by networkers - its do Better. faster, low resource footpring, Way more secure, extendable/manageable, etc.

tr00g33k · Tue Dec 08, 2015 7:53 pm

It would be really great if you could add feature, that certificate is needed on client to directly connect to winbox from anywhere. We have a lot of client, and sometimes its realy annoying to always setup vpn, or always have to coonect to office and then to clients. It would be much easies, if i would have one certificate for all client, that I could connect directly to client via winbox securly.

Maybe anybody else opinion?

Chupaka · Tue Dec 08, 2015 11:07 pm

Use ssh with key, then forward WinBox port to local router

Zorro · Thu Dec 10, 2015 5:23 am

for primarily "emergency networking management" perhaps SSTP would b better choice because its more traversable, despite overhead, delays, IMHO.
otherwise, ROS support various things starting from IPIP and other stuff, which combined with (any kind of prefered)crypto would do trick.

p.s.
perhaps would make sense for mikotik - etend ipip to ipipv2 with gcm/eax/cwc/ocb-ciphers(aside cbc/xts legacy, ought to be deprecated soon)

poizzon · Sun Dec 13, 2015 9:33 pm

request for RFC 4578
https://tools.ietf.org/html/rfc4578

DHCP option, Arch type for PXE.

RouterOS, has everything for it, very useful for pc's with UEFI bios

odge · Mon Dec 14, 2015 10:59 pm

also would personally welcome more updated/actual Active queues in RouterOS to handle/combat/prevent Network congestion. rather than static/notorious RED algo/type present already, which unsuable for production for number of reasons.
for example, RRED would be nice. aswell as other adaptive, attack/flooding-proof variants of AQM.
also bout moving RouterOS from vanilla Linux kernels to Zero Overhead Linux gossips - is actually such plans, yet ?
(this thing http://www.tilera.com/sites/default/fil ... aper_0.pdf meant, to be exact/specific)
also finishing/completing BFG routing implementation (auth and echo ?) also may be handy.

AQM... codel and fq_codel... the power that this can add, to the power user, and to a wizard setup, would just be insane seller...

78mzm · Mon Dec 21, 2015 10:13 am

thenk you for sbjtect

sney · Mon Feb 08, 2016 9:05 pm

More verbose DNS lookups. Like you can do with dig on *nix systems. It would be immensely helpful for dns troubleshooting to get more than just an ip back, e.g. record types, responding server.

reitblatt · Fri Feb 12, 2016 10:18 pm

Layer 2 tunneling over GRE.

Right now only IP (Layer 3) over GRE is supported, and EoIP uses the GRE protocol number, but is actually a different protocol w/ a similar header layout. Linux already support for L2 GRE (gretap), so hopefully not too onerous development.

lormayna · Mon Feb 22, 2016 5:28 pm

PPPoE PADO Delay.
It would perfect to provide BRAS redundancy and load balancing when you have different backhauling with different latency and load.

omidkosari · Mon Feb 22, 2016 5:39 pm

http://forum.mikrotik.com/viewtopic.php ... 50#p235456
Umetered Content for PPPoE . 'Unmetered Content' services aren't counted against your monthly download inclusion

http://forum.mikrotik.com/viewtopic.php?t=59745

isolnet · Wed Feb 24, 2016 5:52 am

I think User Manager needs improvement....

andersonlich · Tue Mar 01, 2016 3:46 pm

Separated or dedicated vcpu at CCR to process control-plane and data-plane. Or maybe the next ccr platfrom has 2 socket CPU, which separated to process control-plane and data-plane.

I know it seems silly but please consider the benefit of it.

Florian · Wed Mar 23, 2016 12:59 pm

Hi.

Is this topic still read by the devs ?

Chupaka · Wed Mar 23, 2016 4:02 pm

devs don't visit this forum

andersonlich · Tue Mar 29, 2016 5:09 pm

We know that in mikrotik is able to do DHCP with radius. But the missing tool is the accounting request in DHCP is not available yet. Can we have this feature ?

dendzo · Fri Jun 17, 2016 2:49 am

Route availability base on an remote IP.

I would like to have route availability based on some other IP. Let's say you add a new option below Check Gateway that would be something like check another gateway (my gateway's gateway for example) or just any other IP like 8.8.8.8. And if that IP becomes unavailable over that specific route it can make it unreachable/inactive so other route with higher Distance can became in charge. Check Gateway option does not work when your provider puts router on your premises. And if provider's router loses connection to it's remote router, you still have your gateway (because you have a router on your premises) and so for you, gateway is reachable, but you actually don't have internet access and that route looks good.

It would help very much in regards to failover.

Fri Jun 17, 2016 5:43 am

Route availability base on an remote IP.
...
It would help very much in regards to failover.

You can do it using a recursive next hop/net watch.

teddyhsu · Mon Jun 20, 2016 11:52 am

Hi,

I need a sequence number for ip hotspot wall-garden and wall-garden ip list on winbox.
It can be very useful on debug wall-garden list issue.

Cha0s · Mon Jun 20, 2016 3:52 pm

Route availability base on an remote IP.

I would like to have route availability based on some other IP. Let's say you add a new option below Check Gateway that would be something like check another gateway (my gateway's gateway for example) or just any other IP like 8.8.8.8. And if that IP becomes unavailable over that specific route it can make it unreachable/inactive so other route with higher Distance can became in charge. Check Gateway option does not work when your provider puts router on your premises. And if provider's router loses connection to it's remote router, you still have your gateway (because you have a router on your premises) and so for you, gateway is reachable, but you actually don't have internet access and that route looks good.

It would help very much in regards to failover.

+1

I know that currently this can be achieved by using Netwatch and some scripting but it would be much easier if it were available directly on the route's properties.

Chupaka · Mon Jun 20, 2016 4:33 pm

I know that currently this can be achieved by using Netwatch and some scripting but it would be much easier if it were available directly on the route's properties.

it is available even without scripting: http://wiki.mikrotik.com/wiki/Advanced_ ... _Scripting

Cha0s · Mon Jun 20, 2016 4:39 pm

Thanks, I wasn't aware of that!

Still, it would be easier to just be able to define what IP to probe for a specific route, rather than having to create extra static routes and play with scope to achieve this (if I understand the wiki page correctly)

toodark · Tue Jun 21, 2016 12:35 pm

nginx package/service

I'd really like to have an nginx server inside (or at least as an add on package) in routeros. It opens up endless possibilities for application level based forwarding, reverse proxying, caching etc. I believe it's also useful for home users when they have only a single public ip: this way internal http based services could be easily mapped into a single ip.
I'm aware that one might achieves this by installing an openwrt meta package then install nginx into it, but I feel that would be a huge waste of resources.
thanks

Tue Jun 21, 2016 9:30 pm

Thanks, I wasn't aware of that!

Still, it would be easier to just be able to define what IP to probe for a specific route, rather than having to create extra static routes and play with scope to achieve this (if I understand the wiki page correctly)

Well, even with the option to ping some specific address (other than the GW) you would still need to create a /32 route that forces the test target via a particular interface, or else the route will flap as the GW points to failed link, ping fails, route changes to backup path, ping starts working (via backup), primary route re-activated, pings fail, etc etc etc.

freemannnn · Tue Jun 21, 2016 9:47 pm

I want a color like blue when queue is in burst mode

Cha0s · Tue Jun 21, 2016 10:12 pm

Well, even with the option to ping some specific address (other than the GW) you would still need to create a /32 route that forces the test target via a particular interface, or else the route will flap as the GW points to failed link, ping fails, route changes to backup path, ping starts working (via backup), primary route re-activated, pings fail, etc etc etc.

The idea is that for the 'ping address' you define on the route, the pings to it will always go through that route's gateway address/interface.
If that route's gateway/interface is unreachable/down then the 'ping address' shouldn't get routed via any other route (even if there is another route to it). Otherwise it would be useless apparently (as you described).

In terms of the linux kernel and its networking, yes, obviously there needs to be a /32 route to that 'ping address' via that gateway/interface, and I would also add a second 'unreachable' route with distance 2 so that it won't get routed via another less specific route when the first route is down.
But all that could be handled/abstracted by routeros iteself in the background and not shown in /ip route (that would be confusing otherwise).
And all that in a way that those /32s don't interfere with other traffic to that IP (ie different/hidden routing tables).

The end result would be less work for the end user/admin, less room for errors and a much cleaner/intuitive configuration.

It believe it shouldn't be that difficult to implement.
But I wouldn't really mind if it weren't (since it can be achieved by other means, as mentioned already).
I just find it a useful feature

Besides, many things were added over the years that could be implemented via scripting or other methods and simplified our lives. Just to name a few: dns names on vpn intefaces, interface lists, dynamic dns client, automatic tcp mss clamping on tunnels, automatic ipsec setup on tunnels, etc, etc, etc).
Did anybody object to those because they already had scripts for them?

I know I didn't (even if it took me a looong time to replace my already stable scripts to those new features - which are very useful of course!)

Wed Jun 22, 2016 3:56 am

Oh I'm ALWAYS in favor of making things 'just work right' via the usual config, especially overy scheduled scripts.

I think the suggestion is a good idea. I was simply adding to the other comment that a netwatch can accomplish the goal - noting that even specifying a remote ping target requires one more piece.

If implemented, I would expect to see a dynamic static /32 route in the routing table, and a dynamic secondary /32 blackhole.

parham · Wed Jun 22, 2016 11:58 am

I don't know if anyone requested adding DPI or User activity monitor but anyway can we have this feature Please.

Wed Jun 22, 2016 2:11 pm

I don't know if anyone requested adding DPI or User activity monitor but anyway can we have this feature Please.

RouterOS is for routing, DPI is part of a UTM or NGFW solution.

MikeFF · Thu Jun 23, 2016 12:21 am

I hope they can add two things for the new RouterOS versions

One, Is that the OVPN client could support UDP connections, this because the OpenVPN servers in Linux (used plenty in all over the world) use this as default, and it will be pretty good feature to choose one of those in the config

Two, support TLS connections trough OVP Client, ussing ta.key for authentication, this is a very good security feature that is used also in OpenVPN.
No hand shake, no risk to be hacked or steal the certificates.....

I hope you can consider my suggestions.

Thanks a lot

lavv17 · Fri Aug 26, 2016 1:07 pm

Some time ago the possibility to change dynamic simple queues was removed, so my script which adds "packet-marks" parameter stopped working.

Is it possible to create a template for the dynamic simple queues which are created for PPPoE users, so that I can specify some parameters like "packet-marks" or "queue" or "parent" there?

Chupaka · Fri Aug 26, 2016 1:56 pm

Some time ago the possibility to change dynamic simple queues was removed, so my script which adds "packet-parks" parameter stopped working.

what do you use them for?

Zorro · Sat Aug 27, 2016 5:47 pm

I don't know if anyone requested adding DPI or User activity monitor but anyway can we have this feature Please.
RouterOS is for routing, DPI is part of a UTM or NGFW solution.

i would call that bullshit.
you can't leave "bare naked" even backbone( even within private, isolated corporate network of), let alone border and etc. proportions are differ and hardware resources to cruch them, but generally thats Essential ANYWHERE. and anyone who underestimates that - will get hard/harsh lesson, im afraid.

lavv17 · Tue Aug 30, 2016 12:03 pm

Some time ago the possibility to change dynamic simple queues was removed, so my script which adds "packet-parks" parameter stopped working.
what do you use them for?

I want to exclude some traffic from the rate limitation (so called local traffic). I used to mark non-local traffic and add the packet mark to all dynamic queues. Now it is not working. Please advise.

Chupaka · Tue Aug 30, 2016 5:11 pm

Some time ago the possibility to change dynamic simple queues was removed, so my script which adds "packet-parks" parameter stopped working.
what do you use them for?
I want to exclude some traffic from the rate limitation (so called local traffic). I used to mark non-local traffic and add the packet mark to all dynamic queues. Now it is not working. Please advise.

create a queue for local traffic and put it on the top. it will catch all local traffic, and all the rest will be caught by 'personal' queues

p.s. if you won't set any limits on that queue, don't forget to change at least something (like queue type) for this queue to actually work

lavv17 · Mon Sep 05, 2016 11:26 am

create a queue for local traffic and put it on the top. it will catch all local traffic, and all the rest will be caught by 'personal' queues
p.s. if you won't set any limits on that queue, don't forget to change at least something (like queue type) for this queue to actually work

Cool! It seems to work. Much simpler and (as I suspect) faster. Thanks a lot!

Mon Sep 05, 2016 11:56 am

Fasttracking that traffic you want to be excluded from queues is much more efficient.
But keep the exclusion queue for the cases when some connections couldn't be fasttracked.

mpreissner · Mon Sep 05, 2016 5:46 pm

Please add support for EAP types on VPN connections as you do for wireless. Without EAP support, many security features such as NAP enforcement (using Microsoft NPS as RADIUS) won't work. Specifically, we need support for PEAP and EAP-MSCHAPv2 to get NAP working.

Also consider allowing the ability to set the NAS-Port-Type RADIUS attribute for VPN connections. Currently, ROS sends a NAS-Port-Type of Async for VPN connections. While this might be appropriate for a Dial-Up PPPoE, it is not appropriate for non-Dial-Up VPN connections, and would give us more flexibility in configuring access policies when using Microsoft NPS as a RADIUS server.

kimdobranski · Mon Sep 05, 2016 10:42 pm

When setting up a radius server, I *really,really,really* need these

1) having a secondary (or multiple) IP address in the event the first IP becomes unavailable or times out.

2) i would like the option of putting a DNS instead if an IP (ie. radius1.myradiusserver.com, radius2.myradiusserver.com) in the address field.

kimdobranski · Mon Sep 05, 2016 10:45 pm

Need the WAN MAC address of the ROUTER (not the client) available as a hotspot variable.

Chupaka · Tue Sep 06, 2016 12:20 am

1) having a secondary (or multiple) IP address in the event the first IP becomes unavailable or times out.

just add one more Radius Server entry with the same settings

DmitryAVET · Tue Sep 06, 2016 10:53 am

please add custom name for MAC-adresses and some detailed info about wireless client, like in ubnt unifi

lavv17 · Tue Sep 06, 2016 12:28 pm

Fasttracking that traffic you want to be excluded from queues is much more efficient.
But keep the exclusion queue for the cases when some connections couldn't be fasttracked.

I have turned off connection tracking for most connections (using raw table), so it won't be efficient in my case.

opteron · Tue Sep 06, 2016 5:04 pm

Hi There,

We are using a Supermicro 5018 MLNT4 (https://www.supermicro.com/products/sys ... -MLTN4.cfm) with onboard C2000 SoC I354 Quad Nic.
This nic is not supportes... PLEASE ADD THE DRIVERS !

mpreissner · Wed Sep 07, 2016 1:33 am

Hi There,

We are using a Supermicro 5018 MLNT4 (https://www.supermicro.com/products/sys ... -MLTN4.cfm) with onboard C2000 SoC I354 Quad Nic.
This nic is not supportes... PLEASE ADD THE DRIVERS !

You're best bet there is to install a hypervisor on that server and run the CHR rather than the standard x86 ROS. Not only will you be able to use the onboard NICs, but you'll also be able to use more than 2GB RAM, and set up multiple instances so you can run in high availability.

That being said, you should have researched hardware compatibility before buying a server.

SystemErrorMessage · Mon Sep 12, 2016 1:25 am

DNScrypt for those filtering ISPs and for added DNS security.
Allowing the installation of software and user made libraries (perhaps java?)
Switch based STP variants and fixing route learning (all devices connected to CRS lose internet connectivity but not LAN when changing port router uses).

I know these have been asked for but for DNScrypt nothing is being said anything about despite a significant number of request (even consumer routers are using it).

Mikrotik needs to be ahead when it comes to network related features compared to what openwrt and consumer routers offer. Cant call yourselves a cisco alternative if its missing features. it doesnt need to come with printer and file sharing in the box (but software from others if can be installed can provide this feature).

joca · Mon Sep 12, 2016 4:07 pm

There is a possibility UPnP create firewall rules Only For Private ips ?

lavv17 · Mon Sep 12, 2016 4:12 pm

I'd like to have a new feature: "graceful reboot".

Things to do before actual reboot:
1. disconnect ppp users (while not accepting new ones)
2. transition vrrp to backup state
3. disable external bgp peers
4. wait for routing convergence

Without these, there is a time frame when traffic loops and/or goes to a black hole; ppp users experience an abnormal connection termination.
Currently I have a script to do it, but it would be better to have it in the RouterOS.

hoop-banger · Tue Sep 13, 2016 1:06 pm

This one is related to winbox. Please make internal taskbar in winbox that show opened windows.

Please see attached picture, taskbar is added in photo editor.

Staj · Wed Sep 14, 2016 8:49 am

DHCP Half-Bridge. LTE support is all well and good but without it, makes it hard to integrate into existing networks.

2dfx · Thu Sep 15, 2016 4:55 pm

Hi all!
What about grouping rules in Winbox like in Microsoft TMG?
It's will be a great features!

See "Web Access Policy Group"

ppereira · Thu Sep 15, 2016 6:27 pm

1) having a secondary (or multiple) IP address in the event the first IP becomes unavailable or times out.
just add one more Radius Server entry with the same settings

Hi guys,

Using it like this , the next radius server will be used only when the first did not answer.

There is a way to configure it to be distributed the radius events ... like i configure 4 radius server .. and all radius traffic be process / 4 ?
Client 1 -> radius 1
Client 2 -> radius 2
Client 3 -> radius 3
Client 4 -> radius 4
Client 5 -> radius 1 ....

got it ?

I´m not saying that the actual way it works is bad or good i´m just thinking that could be nice have this option.

SiB · Fri Sep 16, 2016 12:51 pm

Add more details into System > History like:

More details in Action, the "filter rule changed" is to short, enter the details of the rule
Action Tab should write about "Delete/Insert/Add/Move 5 rules" with description like chain/comment/etc.
If I work on SafeMode then the history entry should be have a flag SafeMode - I know what will be safe or drop

kimdobranski · Sat Sep 17, 2016 12:44 am

1) having a secondary (or multiple) IP address in the event the first IP becomes unavailable or times out.
just add one more Radius Server entry with the same settings

I created a second Radius Server with identical settings and changed the ip to an IP that is actually held by the same server, then i disabled the first entry, but mikrotik reports "Radius Server not responding". When i check the radius server logs, it show its authenticates correctly.

The radius server is set to listen on all ips and that is working, but for some reason the mikrotik is not receiving the response after the radius authenticates.

lavv17 · Mon Sep 19, 2016 3:08 pm

Hello!

Nice features to have:
1. IP firewall address lists could include one another (or firewall rules could match multiple lists at once, e.g. "src-address-list=list1,list2").
2. NAT parameter to-addresses could refer to an IP pool.

LeoCombes · Tue Sep 20, 2016 6:34 pm

DHCP accounting through Radius

Would be nice if the routerOS dhcp-server allow logging with radius accounting.
We use dhcp-server from mikrotik (no radius auth) and we need have a log of each IP we offer to each client and when, through radius.

NOTE: accounting != auth

Accounting send "log" for each IP address leased or unleased to Radius server, regardless if IP address is served from external radius server or internal mikrotik DHCP server.

http://forum.mikrotik.com/viewtopic.php?f=19&t=85721

payam124 · Fri Oct 14, 2016 3:56 pm

CloudFlare is about removing its API version 1 which allowed users to use get-only requests to modify settings.
I used an script + cloudflare free account to run my dynamic DNS

now in their new API, it is required to send header and ... https://api.cloudflare.com/#dns-records ... dns-record

it would be great if curl support become available

another reference: http://forum.mikrotik.com/viewtopic.php?t=108480

Harlong · Wed Oct 19, 2016 8:12 am

In any scripts for WAN failover, there's some difference for ipv4 and ipv6. When we test some host with /ping, we should know, what protocol (4 or 6) we use. For now, the only solution is to hardcode ipv4 or ipv6 addresses into script, hostnames can not be used, because we can not control, which address will be returned from :resolve.

So, it would be great, if :resolve command will have a parameter to resolve only ipv6(AAAA), only ipv4(A), or both(ANY).

Kevo · Mon Nov 07, 2016 12:13 am

Could we get a quickset mode for travel router. I'd like to have a mode that let's someone take a map lite and go to quickset and use it to log into the hotel wireless and have wireless repeater mode setup with an SSID they can log into for their devices. Ethernet could be setup with an option for local device access or hotel internet access if wired access exists in the room.

Right now there isn't really a mode that fits and it seems to require some manual config that is beyond the scope of what I would expect to train a traveling sales rep to deal with. Maybe there's a simpler method I'm overlooking. If so, someone please point it out to me.

Wyz4k · Tue Nov 08, 2016 4:59 am

Feature request: Wireless scan save-file should include all info

The current implementation of interface wireless scan 0 duration=5s save-file=temp.txt does not contain all of the information that you would see if you simply did a interface wireless scan 0 duration=5s.

More info: http://forum.mikrotik.com/viewtopic.php?f=1&t=114410

saaremaa · Wed Nov 09, 2016 7:39 pm

Support Radius attribute "Delegated-IPv6-Prefix"

soomanyquestions · Thu Nov 10, 2016 9:39 pm

It would be useful and cool to see aggregate statistics in the Graphing tool instead of just each individual interface. It should probably be quite easy to add cause all the data is allready there.

jiminneworleans · Thu Nov 10, 2016 10:58 pm

I'd like to see more buttons in general. Seriously though it would be nice to have a few simple firewall scripts one could choose upon first configuration based on common home or small office scenarios for the cloud routers. I find myself excessively concerned over imagined gaping holes in my firewall scripts.

tomasi · Sat Dec 03, 2016 11:14 pm

Is there any chance of a Zabbix agent .npk listening on port 10050?

lavv17 · Mon Dec 12, 2016 4:59 pm

Yet another feature request:

add netwatch options to send TCP port probes (e.g. check if port 80 is open on a server for load balancing)

rwf · Fri Dec 30, 2016 2:21 am

We operate a lot of hotspots, using an external AAA/RADIUS solution.
It needs a NASID from the Mikrotik, and unfortunately Mikrotik sets this using ROuter Identity field.

The problem is that this limits us to one hotspot per router which is a huge waste of resources. We sometimes have to put 3 routers at a location to run multiple hotspots.

Can it be added that we place the NASID in the Hotspot Profile, and if it is blank it uses the router identity instead. That way it performs as it does now, but those of us who need different NASIDs can choose to do so.

What do y'all think?

tri · Sun Jan 15, 2017 1:38 pm

hi

I'd like to see a dummy network interface like one available in generic Linux kernel (http://www.tldp.org/LDP/nag/node72.html).

If all physical interfaces are DHCP it might simplify things to be able to assign a static addresses to an internal interface to make routing and firewall rules simpler.