RouterOS v6.25

Mon Jan 19, 2015 1:21 pm

What's new in 6.25 (2015-Jan-19 10:11):

*) certificates - fix SCEP RA operation and SCEP client when operating with RA;
*) ppp - report authentication failure cause like in v6.6;
*) ovpn server - added support for address lists;
*) improved boot times;
*) api - fixed missing return values of some commands;
*) ntp - fixed vulnerabilities;
*) mpls/vpls have improved per core balancing on CCRs;
*) fixed queue tree no-mark matching (was broken since 6.24);
*) fixed nested simple queues (was broken since 6.24);
*) fixed occasional crash when ipv6 was used;
*) fixed route cache overflow (ipv4/ipv6 stops working) if ipsec is used;
*) fixed Omnitik upgrade from v5 where wireless config was not correctly saved
*) fixed Webfig Design Skin where some skin changes were not saved
*) WPS support added to CM2 wireless package

Simply click “Check for updates” in QuickSet, Webfig or Winbox packages menu. It should also work from v5

honzam · Mon Jan 19, 2015 2:18 pm

*) improved boot times;

More info about that? It is improvement for all routerboards?

Mon Jan 19, 2015 2:42 pm

*) improved boot times;
More info about that? It is improvement for all routerboards?

all devices have faster boot time, but on x86 it will be not so easy to see. more significant on devices that previously booted longer

santa · Mon Jan 19, 2015 2:54 pm

*) ovpn server - added support for address lists;

Any details about this one?

DjM · Mon Jan 19, 2015 3:13 pm

*) ntp - fixed vulnerabilities;

Any details on this point, please?
- Is the fix related to NTP server?
- Which bugs were fixed?

Thank you

mars · Mon Jan 19, 2015 3:26 pm

does upgrade from thedude not work anymore

Mon Jan 19, 2015 3:45 pm

Any mention about ethernets behaviour improvement on rb133? Why not to note all changes that were done in each version?

Mon Jan 19, 2015 4:00 pm

*) api - fixed missing return values of some commands;

Could you give at least one example of a command that was previously affected?

santa · Mon Jan 19, 2015 4:03 pm

Will the new NTP package be integrated with standard upgrade package?

thegreatone · Mon Jan 19, 2015 4:04 pm

For X86 with upgrade directly from System->Packages I was not able to access the router from Public IP, WAN connected via PPPoE. But I was able to access from neighbor router with mac-telnet. Rebooted and still can't access the router from public IP address.

UPDATE: I disabled the IP adress that was mannualy set to WAN interface and I was able to access the router with Public IP address.

Also there is an warning in the log, it says

system,warning omitting package openflow-6.6: newer package openflow-6.25 is already installed

Mon Jan 19, 2015 4:24 pm

*) ntp - fixed vulnerabilities;
Any details on this point, please?
- Is the fix related to NTP server?
- Which bugs were fixed?
Thank you

we simply upgraded our NTP to avoid one of the problems described here: https://ics-cert.us-cert.gov/advisories/ICSA-14-353-01A

Also there is an warning in the log, it says

please delete the extra openflow package from your device, you have a very old 6.6 version in there that will not install

does upgrade from thedude not work anymore

RouterOS changed package format in around 6.18, but Dude was not updated, so it will not work properly until new Dude

Will the new NTP package be integrated with standard upgrade package?

Sorry but I don't understand what you mean. When you upgrade RouterOS, all installed packages are upgraded too

santa · Mon Jan 19, 2015 4:29 pm

Will the new NTP package be integrated with standard upgrade package?
Sorry but I don't understand what you mean. When you upgrade RouterOS, all installed packages are upgraded too

OK, so I have to check this again. I was pretty sure, that after upgrading from 6.24 to 6.25rc there was no package ntp installed. I will let you know.

Mon Jan 19, 2015 4:30 pm

Will the new NTP package be integrated with standard upgrade package?
Sorry but I don't understand what you mean. When you upgrade RouterOS, all installed packages are upgraded too
OK, so I have to check this again. I was pretty sure, that after upgrading from 6.24 to 6.25rc there was no package ntp installed. I will let you know.

NTP client is built into RouterOS and there is no separate package. NTP package is only needed for NTP server

santa · Mon Jan 19, 2015 4:37 pm

Yes, this is a small misunderstanding. I am speaking about NTP server package, of course. I am just wondering, if it will be integrated into the standard upgrade package.

I've noticed, that after upgrading ROS, I have to install NTP server package once again. Maybe I messed something with that

. I will test this once again.

mars · Mon Jan 19, 2015 4:43 pm

well ros 6.24 still worked fine with thedude upgrading

so when will the dude be upgraded then?

Mon Jan 19, 2015 4:55 pm

Yes, this is a small misunderstanding. I am speaking about NTP server package, of course. I am just wondering, if it will be integrated into the standard upgrade package.

I've noticed, that after upgrading ROS, I have to install NTP server package once again. Maybe I messed something with that . I will test this once again.

NTP Server package is not included into the standard package. So you have to install it with every upgrade. It is only needed on NTP-Servers which are quite seldom beasts

). It would be wasteful to put it onto every ROS-Device.

noyo · Mon Jan 19, 2015 5:39 pm

*) api - fixed missing return values of some commands;
Could you give at least one example of a command that was previously affected?

more details

boscolee · Mon Jan 19, 2015 5:43 pm

Hello,

After upgrade to 6.24, my router is changed to bridge mode.

2015-01-19_23-35-18.jpg

I have disabled the bridge-local in interface (this interface is enable before 6.24), then it have switched to router mode. But, it cannot show the IP address for WAN when it is set automatic.

2015-01-19_23-35-04.jpg

Mon Jan 19, 2015 6:56 pm

Not working link?
http://www.mikrotik.com/download/share/ ... latest.zip

honzam · Mon Jan 19, 2015 7:01 pm

Not working link?
http://www.mikrotik.com/download/share/ ... latest.zip

Now there is no RC build (6.26rc). Wait few days...

Mon Jan 19, 2015 7:42 pm

Why not improve wireless ac?

taknamecom · Mon Jan 19, 2015 8:31 pm

I Have problem with HOTSPOT TX rate

clients that there is no TX traffic and the radius server is not getting information about the TX traffic.

Mon Jan 19, 2015 9:01 pm

After upgrade of RB750's and RB751U-2HnD all those devices have lost administrative mac address set to the bridges. So be careful if you rely on it!

RB133, RB433, RB532A seems good so far (did not loose administrative mac address).
Planning to test RB411, SXT's, Omnitiks (not time now). So far it seems that laboratory devices run well.

Hassan1 · Mon Jan 19, 2015 9:31 pm

*) api - fixed missing return values of some commands;
Could you give at least one example of a command that was previously affected?

+1

I hope they added the "end-time" and "till-time" values

NathanA · Mon Jan 19, 2015 9:36 pm

*) improved boot times;
More info about that? It is improvement for all routerboards?
all devices have faster boot time, but on x86 it will be not so easy to see. more significant on devices that previously booted longer

More specifically and accurately, this is a fix for a minor regression that occurred in 6.14. Prior to 6.14, boot times were relatively fast. When 6.14 was released, something caused this to slow down dramatically. The fix in 6.25 restores boot times to what they previously used to be before 6.14. It does not make boot times faster than ever before.

-- Nathan

Basdno · Mon Jan 19, 2015 11:16 pm

Any mention about ethernets behaviour improvement on rb133? Why not to note all changes that were done in each version?

RB133 Isnt officialy supported in RouterOS v6.x as stated on Mikrotiks downloadpage:

"RB111, RB112, RB133C, RB150 devices are not supported in v6, please use v5."

Mon Jan 19, 2015 11:19 pm

RB133 Isnt officialy supported in RouterOS v6.x as stated on Mikrotiks downloadpage:

"RB111, RB112, RB133C, RB150 devices are not supported in v6, please use v5."

RB133 and RB133C are different beasts.

Mon Jan 19, 2015 11:28 pm

Yeah. Totally different. Rb133 is surely supported, no doubt about it. I am really impressed by people not following the forum but throwing such judgements. Anyway the ethernets were somehow corrected on my request by mikrotik but they didn't mentioned that in the release notes/changelog. Therefore my question, if anyone doesn't understand.

Basdno · Mon Jan 19, 2015 11:52 pm

RB133 Isnt officialy supported in RouterOS v6.x as stated on Mikrotiks downloadpage:

"RB111, RB112, RB133C, RB150 devices are not supported in v6, please use v5."
RB133 and RB133C are different beasts.

Cosmetically different beasts then, differences only is in amount of Memory and numbers of MiniPCI slots as far as I remember.

But it is entirely possible I might have misunderstood, and either way that they OFFICIALY doesnt support them doesnt necesserily mean that it dosesnt work!

But I would anyway not have relied on either type of board on anything critical in a production envirnoment now anymore.
All 133/133c boards I ever had ended up getting slower and slower and slower for no apparant reason, till just logging in used all the CPU for minutes at a time. If I were lucky I got in, but if I was unlucky it disconnected and I had to start all over and hope for the best.
And for every upgrade of RouterOS I did it just got worse.

Needless to say all but a very few of my 133/133c boards have long been replaced with newer boards.

(However thinking back on it now it is actually possible that the normal 133 boards behaved a little better then the 133c, but in the end they all got the same treatment. Exchange!

)

Mon Jan 19, 2015 11:57 pm

And the memory is the reason why 133c is not supported by v6 while 133 is.

Basdno · Tue Jan 20, 2015 12:12 am

And the memory is the reason why 133c is not supported by v6 while 133 is.

OK, My bad! Sorry!

And btw THANK YOU for this signature line:
"If you dislike new "modern" forum look (or you want to give me karma but missing karma functionality), you can set the subsilver2 board style here:http://forum.mikrotik.com/ucp.php?i=prefs&mode=personal . "

You brought back my good old familiar Mikrotik Forum look, like its supposed to be!

U get a Karma + from me for that!
I didnt totaly hate the new look, but I DEFINITELY liked the old look ALOT better! And now its back!
I thought they had changed platform, so didnt even think to look for a style setting.

Anyway thx, and sorry Normis for straying away from subject. I am looking forward to testing ROS v6.25 in coming days too in my lab setup. Maybe this is the one?!

scampbell · Tue Jan 20, 2015 2:23 am

What's new in 6.25 (2015-Jan-19 10:11):

*) WPS support added to CM2 wireless package

Is there any documentation on this please. I can see some new settings on WLAN1 Interface but not under CAPsMAN2 (CM2) package as indicated ?

pants6000 · Tue Jan 20, 2015 9:12 am

*) improved boot times;

Reboot dropped from 42 to 32 seconds on my RB951Ui! Sweet!

Tue Jan 20, 2015 9:37 am

It does not make boot times faster than ever before.

-- Nathan

actually it does. it fixes the regression + makes it faster than ever before.

Tue Jan 20, 2015 9:41 am

What's new in 6.25 (2015-Jan-19 10:11):

*) WPS support added to CM2 wireless package

Is there any documentation on this please. I can see some new settings on WLAN1 Interface but not under CAPsMAN2 (CM2) package as indicated ?

install and enable cm2 package, reboot, you will see new "WPS mode" setting for wireless. This will be default for new HomeAP devices. Once this is enabled, "WPS accept" appears in QuickSet and in Wireless menu. Notice that wireless needs password to use WPS, otherwise people can just connect with no password.

When password is set and WPS is enabled, Windows laptops and Android phones can choose "WPS" when connecting. This means they will be able to connect when you push this button, they will not need a password. New RouterBOARD devices will have WPS button on the case also. This is a feature that many home APs have

honzam · Tue Jan 20, 2015 9:49 am

This is a feature that many home APs have

Yes, but we disable WPS on all routers. WPS is not secure! And it is vulnerable:
http://www.howtogeek.com/176124/wi-fi-p ... isable-it/
http://www.engadget.com/2014/08/31/wifi ... etup-flaw/

Tue Jan 20, 2015 10:00 am

This is a feature that many home APs have
Yes, but we disable WPS on all routers. WPS is not secure! And it is vulnerable:
http://www.howtogeek.com/176124/wi-fi-p ... isable-it/
http://www.engadget.com/2014/08/31/wifi ... etup-flaw/

Those links describe the PIN method, we only use the button method, it doesn't have such problems.

NathanA · Tue Jan 20, 2015 10:39 am

actually it does. it fixes the regression + makes it faster than ever before.

Interesting. I timed 6.13 vs. 6.25 on a 450G, and boot times are exactly the same for me.

-- Nathan

Tue Jan 20, 2015 10:42 am

actually it does. it fixes the regression + makes it faster than ever before.
Interesting. I timed 6.13 vs. 6.25 on a 450G, and boot times are exactly the same for me.

-- Nathan

I can just repeat what the developers promise me, also the difference will be bigger on slower boards.

ufm · Tue Jan 20, 2015 10:57 am

Hi!

BTW, need fix year in cli:

> "MikroTik RouterOS 6.25 (c) 1999-2014"

ufm · Tue Jan 20, 2015 11:01 am

Hi!

In 6.25 increased lost of generated netflow packets.

skillful · Tue Jan 20, 2015 12:53 pm

Auto upgrade not working; displays error message - "Couldn't perform action: don't know which is system package (6)" in Winbox window

avenn · Tue Jan 20, 2015 1:11 pm

Hi,

Any fixes/improvements for CAPsMAN2? Such as addition of scanlist?

Regards

Aidan

ufm · Tue Jan 20, 2015 1:45 pm

Hi!

Additional to Ticket#2014122166000217

When the number of PPPoE sessions on the device becomes more 1000 - when you turn off the one PPPoE session on all other sessions observed packet loss.

Tue Jan 20, 2015 1:45 pm

Hi!

Additional to Ticket#2014122166000217

When the number of PPPoE sessions on the device becomes more 1000 - when you turn off the one PPPoE session on all other sessions observed packet loss.

what do you mean by "turn off" this session ?

ufm · Tue Jan 20, 2015 1:53 pm

Hi!

Additional to Ticket#2014122166000217

When the number of PPPoE sessions on the device becomes more 1000 - when you turn off the one PPPoE session on all other sessions observed packet loss.
what do you mean by "turn off" this session ?

logoff by user, as examle. Or kick by hand in mikrotik interface.

ufm · Tue Jan 20, 2015 2:25 pm

Hi!

Additional to Ticket#2014122166000217

When the number of PPPoE sessions on the device becomes more 1000 - when you turn off the one PPPoE session on all other sessions observed packet loss.
what do you mean by "turn off" this session ?

https://ufm.su/public.php?service=files ... 3dadd35243 - Video for example

jdog · Tue Jan 20, 2015 3:42 pm

ufm

What model routerboard are you using?

We have a few units with 100+ PPPoE, I am worried to experiment with this.

Do you use RADIUS as well?

Tue Jan 20, 2015 3:48 pm

ufm

What model routerboard are you using?

Just watch his video. You'll see in the end that he's using CCR1036-8G-2S+.

jdog · Tue Jan 20, 2015 3:51 pm

Oops! Thanks!

Krisken · Tue Jan 20, 2015 4:03 pm

Is there yet any news about BGP peer status in SNMP so we can monitor BGP sessions?
How about BGP4-MIB?

siscom · Tue Jan 20, 2015 4:29 pm

Hi,

We upgraded our Routerboard CCR1036 with V6.25 from V6.19 (Firmware was also upgraded). Upgrade was done mainly to solve packet discards on the interfaces.

We have, after a few hours, suddenly lost our bridges inside the bridge configuration, but not the bridge ports which are showing 'unknown' as the interface they should be bound too. Subsequently, some firewall rules are now RED since they depend on these bridge interfaces.

Have checked via terminal to see if the config is a winbox issue but bridges also do not show. Also checked output from an 'export file' command with the same result.

Anyone seeing this?

Ticket submitted [Ticket#2015012066000425]

Rgds,
Mark

ufm · Tue Jan 20, 2015 4:39 pm

ufm

What model routerboard are you using?

We have a few units with 100+ PPPoE, I am worried to experiment with this.

Do you use RADIUS as well?

CCR1036-8G-2S+
I have about 1200~1500 PPPoE sessions on router.
Yes, authorization by the radius.

I think this problem becomes noticeable with a large number of sessions.

StubArea51 · Tue Jan 20, 2015 7:18 pm

Just installed 6.25 in the IPA Area 0.0.0.51 development lab ( Flowood, MS) and seems to be running fine. Boot times do seem to be improved...Thanks MT!

Equipment we have tested in the dev lab (will update the list as we test more):

RB2011UiAS
RB951G-2HnD
RBcAP2n
RBmAP2n

mickaelmonsieur · Tue Jan 20, 2015 7:47 pm

Hello,
For me, the 6.25 contains a major bug.
I upgraded 2 CCR1036 this afternoon, and bandwith test tool no longer works, it displays 0bps ... After downgrade to 6.24, the tool works.

dzikis · Wed Jan 21, 2015 12:41 am

Hi dudes
I have got problem with booting my ccr with 6.25. After sending to device 6.25 firmware i reboot device and i had info on lcd about booting kernel from nand only.
I disconected device from power suplay and it works now.
Where was / is problem ?
Jakub

nkourtzis · Wed Jan 21, 2015 10:50 am

Hi,

We upgraded our Routerboard CCR1036 with V6.25 from V6.19 (Firmware was also upgraded). Upgrade was done mainly to solve packet discards on the interfaces.

We have, after a few hours, suddenly lost our bridges inside the bridge configuration, but not the bridge ports which are showing 'unknown' as the interface they should be bound too. Subsequently, some firewall rules are now RED since they depend on these bridge interfaces.

Have checked via terminal to see if the config is a winbox issue but bridges also do not show. Also checked output from an 'export file' command with the same result.

Anyone seeing this?

Ticket submitted [Ticket#2015012066000425]

Rgds,
Mark

Same here, on ONE of our two Omnitiks. Wlan interface became "unknown". For an unknown reason, it was changed to "wlan2" on a previous upgrade, and it was reverted to wlan1, thus becoming unknown.

N.

erreferre · Wed Jan 21, 2015 12:56 pm

Previously to v6.25, we had installed 6.21.1 a lot of RB450G had problems with dhcp and dns processes, and the CPU take 100%.
After upgrade to v6.25, most of the problems disappeared, but now we have a few RB450G with ssh process take all CPU. We don't have "idle" process in these RB450G, and the CPU is 100% all the time.

[xxx@XXX] > tool profile
NAME CPU USAGE
snmp all 0%
spi all 0%
ethernet all 1.5%
console all 0.5%
ssh all 74.5%
dns all 7.5%
firewall all 1%
networking all 1%
hotspot all 0.5%
winbox all 0%
logging all 0%
management all 8%
dhcp all 0%
profiling all 0%
queuing all 2%
web-proxy all 3%
telnet all 0.5%
unclassified all 0%

Wed Jan 21, 2015 1:00 pm

boscolee,
Please provide us with more details about your problem.
What configuration did you have at 6.24? How did you apply it?
We are try to repeat your issue.

taknamecom,
Do you have the particular problem in the previous versions?
Do you have bridge in your setup?

jarda,
more information is required about your problem.
I have upgraded RB751 from 6.24 to 6.25, admin-mac-address stayed on the router.

siscom, thank you very much for the file.
We are working on your problem.

mickaelmonsieur, please provide us with more information, how you were using bandwidth test on your router.

nkourtzis, please contact MikroTik support (support@mikrotik.com) with support output file, when problem is present.

nkourtzis · Wed Jan 21, 2015 1:25 pm

boscolee,
Please provide us with more details about your problem.
What configuration did you have at 6.24? How did you apply it?
We are try to repeat your issue.

taknamecom,
Do you have the particular problem in the previous versions?
Do you have bridge in your setup?

jarda,
more information is required about your problem.
I have upgraded RB751 from 6.24 to 6.25, admin-mac-address stayed on the router.

siscom, thank you very much for the file.
We are working on your problem.

mickaelmonsieur, please provide us with more information, how you were using bandwidth test on your router.

nkourtzis, please contact MikroTik support (support@mikrotik.com) with support output file, when problem is present.

On this unit, requesting a supout takes forever and seems to trigger the watchdog due to very high cpu utilization during the creation of the supout file.

Wed Jan 21, 2015 3:56 pm

nkourtzis,

mail remote access to support for your device, it will be fine too,

Wed Jan 21, 2015 4:18 pm

Sergejs, I cannot provide more info as I filled again the missing administrative mac addresses to the bridges.

noyo · Wed Jan 21, 2015 5:42 pm

@normis @sergejs why do not you want to provide a detailed list of changes RouterOS?
Each of your change, results have faults in my scripts.

Get email alerts for longer in this case one does not suit me.

sorry for my english

MadriSX · Wed Jan 21, 2015 6:24 pm

Hi,

After updating all my SSTP VPN clients with Windows 8 / 8.1 doesn´t work anymore, error 619 appears and I can not fix it like I did in previous Router OS releases, any idea?

Thanks.

THG · Wed Jan 21, 2015 10:42 pm

Are you going to fix this issue? TCP traffic through the Ethernet interface shows over 80 percent more than the VLAN interface. UDP shows the correct speed on both interfaces and the issue appears only in the X86 version of RouterOS.

dynek · Wed Jan 21, 2015 10:58 pm

Just updated RB450G from 6.19 to 6.25 it never rebooted so I helped it reboot and now it seems to boot OK (one beep and abt 30 seconds later two beeps) but I'm not assigned an IP anymore, none of my devices is.
If I try to set an IP manually, it doesn't work either.

I tried to connect to ether1 with ip 192.168.88.2, no luck either.

Last time I updated I had the same issue, don't think I'll update next time if I can't get the device back on the track...

What should I do ? Reset it and upload backup of configuration ?

1st edit:
So I went for the reset using the internal reset pins, it made the "weird" beep and rebooted.
But even like this I can't reach 192.168.88.1 on ether1

2nd edit:
Oh and now each time I boot it does the weird beep to say "I'm resetting everything" - what is going wrong, all of this just for an update... really guys....

3rd edit:
com port is showing, shit:
-/-#��59!#7�!�5#5�544y=��-#1�;!!��y=�T��=#!=��q��}U�35#9

dynek · Thu Jan 22, 2015 12:55 am

Try Netinstall to recovery device firmware.

I have netinstall working with wine on OS X. Great stuff.
However, even selecting "Apply default config" doesn't give me 192.168.88.1 on ether1.
And the RB450G still makes this "I am resetting everything" sound each time I put power.

dynek · Thu Jan 22, 2015 2:17 am

OK so if that's of interested for you guys @ Mikrotik, I flashed back 6.19 and the router started working again. What a waste of time.

Any explanation as to why 6.19 -> 6.25 breaks everything ?

Finally I flashed each version from 6.20 to 6.25 and it worked. Also I first did a /system routerboard upgrade cause it was running 3.10 and 3.18 was there to be flashed.

Thu Jan 22, 2015 8:37 am

Did you connect by mac address to proove what is wrong? Or how did you "try to set ip manually"?

Thu Jan 22, 2015 8:40 am

Do you have DHCP client on bridge? If so, it might loose administrative mac address so then it could be impossible to get ip from DHCP server, as I realised by update from 6.24 to 6.25.

Thu Jan 22, 2015 9:06 am

@normis @sergejs why do not you want to provide a detailed list of changes RouterOS?
Each of your change, results have faults in my scripts.

Get email alerts for longer in this case one does not suit me.

sorry for my english

please clarify what has changed that caused your script not to work. there are no changes to email

noyo · Thu Jan 22, 2015 9:23 am

@normis @sergejs why do not you want to provide a detailed list of changes RouterOS?
Each of your change, results have faults in my scripts.

Get email alerts for longer in this case one does not suit me.

sorry for my english
please clarify what has changed that caused your script not to work. there are no changes to email

No, I want a detailed list of changes to be able to react before!

Thu Jan 22, 2015 9:28 am

there are no other changes apart from the changelog. LIke I said, nothing that could have changed email behavior.

andris · Thu Jan 22, 2015 9:55 am

After update to 6.25 could not connect to sstp server from W8.1 client.
Had to downgrade to 6.24 and sstp connection worked again.
Is there any changes in sstp also?
RB951G-2HnD

keema · Thu Jan 22, 2015 11:02 am

After update to 6.25 could not connect to sstp server from W8.1 client.
Had to downgrade to 6.24 and sstp connection worked again.
Is there any changes in sstp also?
RB951G-2HnD

Same here. Fantom changes....

Thu Jan 22, 2015 11:46 am

sstp has no changes, I checked the commit log. it could be effect of something else. please send debug log output to support, and some more info - error message etc.

andris · Thu Jan 22, 2015 1:25 pm

sstp has no changes, I checked the commit log. it could be effect of something else. please send debug log output to support, and some more info - error message etc.

Sent debig logs to support.

MadriSX · Thu Jan 22, 2015 2:35 pm

Jan/22/2015 13:33:46 sstp,packet SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1
Jan/22/2015 13:33:46 sstp,packet SSTPCORRELATIONID: {93C5D5D6-EA3C-4A6E-A7AB-9D9535EDA8C0}
Jan/22/2015 13:33:46 sstp,packet Content-Length: 18446744073709551615
Jan/22/2015 13:33:46 sstp,packet Host: vrpv.******.***
Jan/22/2015 13:33:46 sstp,packet
Jan/22/2015 13:33:46 sstp,packet
Jan/22/2015 13:33:46 sstp,packet sending
Jan/22/2015 13:33:46 sstp,packet HTTP/1.1 200
Jan/22/2015 13:33:46 sstp,packet Content-Length: 18446744073709551615
Jan/22/2015 13:33:46 sstp,packet Server: MikroTik-SSTP
Jan/22/2015 13:33:46 sstp,packet Date: Thu, 22 Jan 2015 12:33:46 GMT
Jan/22/2015 13:33:46 sstp,packet
Jan/22/2015 13:33:46 sstp,packet
Jan/22/2015 13:33:46 sstp,packet recv control packet type: connect request
Jan/22/2015 13:33:46 sstp,packet 10 01 00 0e 00 01 00 01 00 01 00 06 00 01
Jan/22/2015 13:33:46 sstp,packet sent control packet type: connect ack
Jan/22/2015 13:33:46 sstp,packet 10 01 00 30 00 02 00 01 00 04 00 28 00 00 00 03
Jan/22/2015 13:33:46 sstp,packet a4 a9 51 57 e1 e2 c4 91 7f 8f b0 8e 24 82 98 0c
Jan/22/2015 13:33:46 sstp,packet a3 76 90 bd 11 32 5c 8c c6 71 af fa e8 52 f3 8d
Jan/22/2015 13:33:46 sstp,ppp,debug : LCP lowerup
Jan/22/2015 13:33:46 sstp,ppp,debug : LCP open
Jan/22/2015 13:33:46 sstp,ppp,debug,packet : sent LCP ConfReq id=0x1
Jan/22/2015 13:33:46 sstp,ppp,debug,packet <magic 0x25a908fb>
Jan/22/2015 13:33:46 sstp,ppp,debug,packet <auth mschap2>
Jan/22/2015 13:33:46 sstp,ppp,debug : LCP lowerdown
Jan/22/2015 13:33:46 sstp,ppp,debug : LCP lowerdown
Jan/22/2015 13:33:46 sstp,ppp,debug : LCP down event in starting state

agrisvv · Thu Jan 22, 2015 10:58 pm

i confirm the same sstp bug!
http://forum.mikrotik.com/viewtopic.php ... 71#p465042

ebreyit · Thu Jan 22, 2015 11:06 pm

i confirm the same sstp bug!
http://forum.mikrotik.com/viewtopic.php ... 71#p465042

I can also confirm issue with windows 8.1 sstp vpn clients following upgrade to 6.25. Error 619 reported by windows vpn client when trying to connect.

Immediate downgrade back to 6.24 solved the issue. Windows 7 and server 2008 sstp clients unaffected.

This was on a CCR with Valid Wildcard SSL Certs.

ch36mikrot · Fri Jan 23, 2015 4:42 am

So can I. (comfirm this issue)
Now All I can do is just downgrade the firmware of my RB750GL to 6.24, and it works well as usual.
I checked the log. There is no record about SSTP login.
The client (Windows 8.1) just shows error message "Error 619'

i confirm the same sstp bug!
http://forum.mikrotik.com/viewtopic.php ... 71#p465042
I can also confirm issue with windows 8.1 sstp vpn clients following upgrade to 6.25. Error 619 reported by windows vpn client when trying to connect.

Immediate downgrade back to 6.24 solved the issue. Windows 7 and server 2008 sstp clients unaffected.

This was on a CCR with Valid Wildcard SSL Certs.

niamul · Fri Jan 23, 2015 3:50 pm

after upgrading to 6.25 on my ccr1016-12g we are seeing higher cpu usage and lower bandwidth consumption.
we have simple queues, dhcp and pppoe running and dns cache. cpu usage hitting 85 to 90%
bandwidth consumption dropped from 700mbps to ~550mbps on the same config as before

has some config changed somewhere that i should look into?
we have 3 mangle rules and about 10 nat rules. firewall only has drop rules and thats about 8 of them.
i'd gladly provide more info when required.

thank you
niamul

steen · Fri Jan 23, 2015 10:32 pm

Major bug!

It is not possible to upgrade devices using "The Dude", we manage all our network through "The Dude", how come ?

Please explain why this now happened and when we can expect it work again ?

Without having the dude doing upgrade work, we are almost dead in water, it will take us forever to sit manually and upgrade devices one by one, we are back to very basic home user type of upgrading like in old days when we had only 3-4 routers out there.

Please come back with a solution on this quickly.....

dcavni · Sat Jan 24, 2015 12:53 pm

When i check the "Vpn Acess" option in "Quick set" menu and press "Apply" the option doesn't stay checked. VPN still works afterwards, just the option isn't checked. RB2011UiAS-2HnD.

mars · Sat Jan 24, 2015 2:03 pm

Major bug!

It is not possible to upgrade devices using "The Dude", we manage all our network through "The Dude", how come ?

Please explain why this now happened and when we can expect it work again ?

Without having the dude doing upgrade work, we are almost dead in water, it will take us forever to sit manually and upgrade devices one by one, we are back to very basic home user type of upgrading like in old days when we had only 3-4 routers out there.

Please come back with a solution on this quickly.....

+1

mars · Sat Jan 24, 2015 2:06 pm

well ros 6.24 still worked fine with thedude upgrading

so when will the dude be upgraded then?

+1

leetw302 · Mon Jan 26, 2015 6:00 am

in x86 base Terminal, exporting error.
Anyone same problem like this?

herbrico · Mon Jan 26, 2015 8:18 am

I have a same router RB2011UiAS-2HnD and for my stay checked.

bax · Mon Jan 26, 2015 12:11 pm

in x86 base Terminal, exporting error.
Anyone same problem like this?

for me command
/tool user-manager database save name=database

work normaly ... which command does you using ?

Mon Jan 26, 2015 12:30 pm

Thank you very much for your reports and help. At the moment there have been fixes introduced to 6.26rc version, that is available from our download page.

Note the latest rc contains improvements for queues on CCR boards, those who have queues on CCR and testing rc version. We will wait for your feedback on this.

bax · Mon Jan 26, 2015 12:57 pm

Thank you very much for your reports and help. At the moment there have been fixes introduced to 6.26rc version, that is available from our download page.

Note the latest rc contains improvements for queues on CCR boards, those who have queues on CCR and testing rc version. We will wait for your feedback on this.

Sergejs can you check this example :

/ip firewall layer7-protocol
add name=tftp regexp="^(\\x01|\\x02)[ -~]*(netascii|octet|mail)"

/ip firewall mangle
add action=mark-packet chain=prerouting comment=\
    "FTP - File Transfer Protocol " dst-address=!192.168.11.200 in-interface=\
    public layer7-protocol=ftp new-packet-mark=qos-5_in-wan1 passthrough=no
add action=mark-packet chain=postrouting dst-address=!192.168.11.200 \
    layer7-protocol=ftp new-packet-mark=qos-5_out-wan1 out-interface=public \
    passthrough=no

/queue tree
add name=WAN1_IN parent=global priority=1 queue=default
add limit-at=1M max-limit=12M name=qos-5_in packet-mark=qos-5_in-wan1 parent=\
    WAN1_IN priority=5 queue=default
add name=WAN1_OUT parent=global priority=1 queue=default
add limit-at=100k max-limit=1M name=qos-5_out packet-mark=qos-5_out-wan1 \
    parent=WAN1_OUT priority=5 queue=default

Explanations:
I trying to setup qos but some thing dont work.
My ftp server (192.168.11.200) is in my public zone and have same gateway like mikrotik 192.168.11.1
Im try to exclude my ftp server from bandwith limit for users behind mikrotik ... which is visible in ip firewall mangle rule , but this is not working ... is this some bug or just im doing something wrong ?
Thanks!

Mon Jan 26, 2015 1:18 pm

This does not have too much relation to the specific version.
I assume it is much better to use port and src/dst-addresses to filter FTP traffic, instead of layer7 rules.

padrecc · Mon Jan 26, 2015 1:38 pm

Thank you very much for your reports and help. At the moment there have been fixes introduced to 6.26rc version, that is available from our download page.

What about bug in SSTP VPN+Windows 8.1, is it fixed in latest rc?

Mon Jan 26, 2015 1:54 pm

We are aware of the problem, finally we repeated the problem.
Fix will be available very soon.

keema · Mon Jan 26, 2015 2:00 pm

We are aware of the problem, finally we repeated the problem.
Fix will be available very soon.

But Normis said many times, nothing was changed with SSTP....

Mon Jan 26, 2015 2:04 pm

We are aware of the problem, finally we repeated the problem.
Fix will be available very soon.
But Normis said many times, nothing was changed with SSTP....

Yes, but this doesn't mean some other feature is not interfering with it. You can see now, that Changelog is not a universal answer to all problems.

keema · Mon Jan 26, 2015 4:03 pm

We are aware of the problem, finally we repeated the problem.
Fix will be available very soon.
But Normis said many times, nothing was changed with SSTP....
Yes, but this doesn't mean some other feature is not interfering with it. You can see now, that Changelog is not a universal answer to all problems.

I already know that your changelog is far from anything universal

leetw302 · Tue Jan 27, 2015 3:29 am

Thanks for reply
i try export command
and try /tool user-manager database
it is same problem.

Image Capture URL : https://www.dropbox.com/s/iwgjw88ydvvj0 ... 9.png?dl=0

in x86 base Terminal, exporting error.
Anyone same problem like this?
for me command
/tool user-manager database save name=database

work normaly ... which command does you using ?

drk · Tue Jan 27, 2015 5:57 pm

Upgraded to 6.25.
SSTP problem exists in client mode also.
In 6.23 client worked like charm

18:46:25 sstp,ppp,info sstp-out1: initializing... 
18:46:25 sstp,ppp,info sstp-out1: connecting... 
18:46:25 sstp,packet sstp-out1 sending 
18:46:25 sstp,packet SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/
 HTTP/1.1\r 
18:46:25 sstp,packet Content-Length: 18446744073709551615\r 
18:46:25 sstp,packet Host: 123.123.123.123\r 
18:46:25 sstp,packet \r 
18:46:25 sstp,packet 
18:46:25 sstp,packet sstp-out1 recv 
18:46:25 sstp,packet HTTP/1.1 200 OK\r 
18:46:25 sstp,packet Content-Length: 18446744073709551615\r 
18:46:25 sstp,packet Date: Tue, 27 Jan 2015 15:46:25 GMT\r 
18:46:25 sstp,packet Server: Microsoft-HTTPAPI/2.0\r 
18:46:25 sstp,packet \r 
18:46:25 sstp,packet 
18:46:25 sstp,packet sstp-out1 sent control packet type: connect request 
18:46:25 sstp,packet 10 01 00 0e 00 01 00 01 00 01 00 06 00 01  
18:46:25 sstp,packet sstp-out1 recv control packet type: connect ack 
18:46:25 sstp,packet 10 01 00 30 00 02 00 01 00 04 00 28 00 00 00 02  
18:46:25 sstp,packet f6 79 08 34 51 fc b9 aa cd 5c 57 2f 51 dc 82 f9  
18:46:25 sstp,packet bc 1a d8 62 97 16 fc c7 0c c5 55 4a 99 c5 59 c6  
18:46:25 sstp,ppp,debug sstp-out1: LCP lowerup 
18:46:25 sstp,ppp,debug,packet  sstp-out1: sent LCP ConfReq id=0x55 
18:46:25 sstp,ppp,debug,packet    <magic 0x304a90b4> 
18:46:25 sstp,ppp,debug,packet    <mrru 1600> 
18:46:25 sstp,ppp,debug sstp-out1: LCP open 
18:46:25 sstp,ppp,debug sstp-out1: LCP lowerdown 
18:46:25 sstp,ppp,info sstp-out1: terminating... - terminated by remote peer 
18:46:25 sstp,ppp,debug sstp-out1: LCP lowerdown 
18:46:25 sstp,ppp,debug sstp-out1: LCP down event in starting state 
18:46:25 sstp,ppp,info sstp-out1: disconnected

elgrandiegote · Wed Jan 28, 2015 5:43 pm

*) ovpn server - added support for address lists;
Any details about this one?

What They Mean to "What They Mean to "ovpn server - added support for address lists;"

voljka · Thu Jan 29, 2015 5:31 pm

We are aware of the problem, finally we repeated the problem.
Fix will be available very soon.

ROS 6.26 RC16 - SSTP problem with Windows 8.1 Client not fixed. On Client error 619.
On router: see attachment

Mitar · Sat Jan 31, 2015 2:15 pm

I have identical problem with SSTP Server on RouterOS 6.25 , downgrade to 6.24 resolved the problem.

pukkita · Mon Feb 02, 2015 10:01 am

Tested 6.25.
On SXT G-5HPacD works incorrectly automatic start configuration file after the reset configuration. If a file .rsc contains any mention of the wlan interface - configuration is interrupted at the location in the file where it is mentioned about it. If you remove from the file rsc any mention of the wireless interface - configuration updates correctly.
Also on SXT G-5HPacD still does not work tab «Current TX Power» on the wlan interface and don't work spectral scan.

spectral scan/ history doesn't work yet on wireless-fp driver (used by AC).

Are you using these units in a PTP? Any advised ROS version / Wireless settings (If I recall correctly nstreme wasn't useable yet) for a reliable PTP Link with STX AC units?

OlegM · Mon Feb 02, 2015 1:20 pm

On ppp server (pptp) using torrent tumbled session (lost pumping).

voljka · Mon Feb 02, 2015 3:32 pm

routeros-mipsbe-6.26rc20 - SSTP client Windows 8.1 update 1 - works OK.

lcrhea25 · Tue Feb 03, 2015 12:04 am

Is there an answer yet to not being able to upgrade units from Dude? Upgrading will be a long painful task without being able to do it from dude now.

astounding · Tue Feb 03, 2015 8:39 pm

I use a script via CRON to periodically SSH into a bunch of MikroTik devices and do "/export compact" to archive device configurations. When there's a change, it email's me the diff.

PROBLEM:
One RB433AH device running RouterOS v6.25 serving DHCP on a LAN (ethernet port) to a group of users keeps reporting configuration changes (via my "/export compact" configuration diff-generator script). First I'll see this as the only change:

-add address=192.168.88.9 always-broadcast=yes comment="Device 7" \
-    mac-address=06:17:F6:E6:DA:41 server=lan_dhcp
+add address=192.168.88.9 comment="Device 7" mac-address=06:17:F6:E6:DA:41 \
+    server=lan_dhcp

Then anywhere from an hour to several hours later:

-add address=192.168.88.9 comment="Device 7" mac-address=06:17:F6:E6:DA:41\
-    server=lan_dhcp
+add address=192.168.88.9 always-broadcast=yes comment="Device 7" \
+    mac-address=06:17:F6:E6:DA:41 server=lan_dhcp

THEN this cycle will repeat again in some random short time period. This will happen 6-12 or so times in each 24-hour period.

Note the ONLY change is the appearance and disappearance of this parameter: always-broadcast=yes

No humans are logging in nor making changes via any mechanism. Therefore it MUST be the device's own behavior changing the configuration spontaneously, possibly in response or triggered by one or more DHCP clients' requests.

OBVIOUSLY THIS IS A BUG - I mean a device should ALWAYS retain a configuration that is identical without some administrative intervention UNLESS there is some WELL-DOCUMENTED feature that automatically changes device configuration in response to network events. In this instance, I see no such documented feature anywhere.

I don't know how to reproduce this bug, however.

ANY SUGGESTIONS?

Thanks!

Wed Feb 04, 2015 2:46 pm

Thank you very much for your help and report!
v6.26 is released,
http://forum.mikrotik.com/viewtopic.php?f=2&t=93710

Who is online