v6.47 [stable] is released!

emils · Tue Jun 02, 2020 2:28 pm

RouterOS version 6.47 has been released in public "stable" channel!

Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 6.47 (2020-Jun-02 07:38):

Important note!!!

- The Dude server must be updated to monitor v6.46.4 and v6.47beta30+ RouterOS type devices.
- The Dude client must be manually upgraded after upgrading The Dude server.
- The Dude requires "winbox" policy instead of "dude" to monitor v6.46.4 and v6.47beta30+ RouterOS type devices.
- Make sure LTE APN Profile name does not match any of the DHCP server's names if LTE passthrough is used.

MAJOR CHANGES IN v6.47:
----------------------
!) dns - added client side support for DNS over HTTPS (DoH) (RFC8484);
!) socks - added support for SOCKS5 (RFC 1928);
!) user - enable "winbox" policy for groups with "dude" policy automatically on upgrade;
----------------------

Changes in this release:

*) api - added ECDHE cipher support for "api-ssl" service;
*) bonding - improved slave interface MAC address handling;
*) bonding - prefer primary slave MAC address for bonding interface;
*) branding - do not ask to confirm configuration applied from branding package;
*) branding - fixed identity setting from branding package;
*) branding - improved branding package installation process when another branding package is already installed;
*) bridge - added logging debug message when a host MAC address is learned on a different bridge port;
*) bridge - added warning message when a bridge port gets dynamically added to VLAN range;
*) bridge - correctly remove disabled MSTI;
*) bridge - improved hardware offloading enabling/disabling;
*) certificate - added "skid" and "akid" values for detailed print;
*) certificate - allow dynamic CRL removal;
*) certificate - disabled CRL usage by default;
*) certificate - do not use SSL for first CRL update;
*) chr - added support for file system quiescing;
*) chr - added support for hardware watchdog on ESXI;
*) chr - enabled support for VMBus protocol version 4.1;
*) chr - improved system stability when running CHR on Hyper-V;
*) crs3xx - correctly remove switch rules on CRS317-1G-16S+ and CRS309-1G-8S+ devices;
*) crs3xx - fixed "ingress-rate" property on CRS309-1G-8S+, CRS312-4C+8XG, CRS326-24S+2Q+ devices;
*) crs3xx - fixed hardware offloaded bonding on Ethernet interfaces for CRS354 devices;
*) crs3xx - improved 10G interface initialization on CRS312 devices;
*) crs3xx - improved switch host table updating;
*) crs3xx - show correct switch model for netPower 15FR device;
*) defconf - fixed default configuration initialization if power loss occurred during the process;
*) dhcpv4 - added end option (255) validation for both server and client;
*) dhcpv4-client - improved stability when changing client while still receiving advertisements;
*) dhcpv4-server - disallow zero lease-time setting;
*) dhcpv6-client - improved error logging when when renewed address differs;
*) dhcpv6-server - do not require "server" parameter for bindings;
*) dhcpv6-server - fixed MAC address retrieving from DUID when timestamp is present;
*) discovery - do not send discovery packets on inactive bonding slave interfaces;
*) discovery - do not send discovery packets on interfaces that are blocked by STP;
*) disk - improved disk management service stability when receiving bogus packets;
*) disk - improved recently created file survival after reboots;
*) dns - added support for exclusive dynamic DNS server usage from IPsec;
*) dns - added support for forwarding DNS queries of static entries to specific server;
*) dns - added support for multiple type static entries;
*) dot1x - added "radius-mac-format" parameter;
*) dot1x - added hex value support for RADIUS switch rules;
*) dot1x - added range "dst-port" support for RADIUS switch rules;
*) dot1x - added support for lower case "mac-auth" RADIUS formats;
*) dot1x - fixed "reject-vlan-id" value range;
*) dot1x - fixed dynamically created switch rule removal when client disconnects;
*) dot1x - fixed port blocking when interface changes state from disabled to enabled;
*) dot1x - improved Dot1X service stability when receiving bogus packets;
*) dot1x - improved debug logging output to "dot1x" topic;
*) dot1x - improved value validation for dynamically created switch rules;
*) email - added support for multiple "to" recipients;
*) ethernet - fixed interface stopping responding after blink command execution on CCR2004-1G-12S+2XS;
*) fetch - fixed "User-Agent" usage if provided by "http-header-field";
*) graphing - improved graphing service stability when receiving bogus packets;
*) health - added "gauges" submenu with SNMP OID reporting;
*) health - improved stability for system health monitor on CCR2004-1G-12S+2XS;
*) hotspot - updated splash page design ('/ip hotspot reset-html' required);
*) ike1 - added error message when specifying "my-id" for XAuth identity;
*) ike1 - added support for "UNITY_DEF_DOMAIN" and "UNITY_SPLITDNS_NAME" payload attributes;
*) ike1 - do not try to keep phase 2 when purging phase 1;
*) ike1 - improved policy lookup with specific protocol;
*) ike1 - improved stability when performing policy lookup on non-existant peer;
*) ike2 - added support for "INTERNAL_DNS_DOMAIN" payload attribute;
*) ike2 - added support for RADIUS Disconnect-Request message handling;
*) ike2 - added support for RFC8598;
*) ike2 - allow initiator address change before authentication;
*) ike2 - fixed authentication handling when initiator disconnects before RADIUS response;
*) interface - improved system stability when receiving bogus packets;
*) interface - increased loopback interface MTU to 65536;
*) ipsec - added "split-dns" parameter support for mode configuration;
*) ipsec - added "use-responder-dns" parameter support;
*) ipsec - allow specifying two peers for a single policy for failover;
*) ipsec - control CRL validation with global "use-crl" setting;
*) ipsec - do full certificate validation for identities with explicit certificate;
*) ipsec - fixed minor spelling mistake in logs;
*) ipsec - improved IPsec service stability when receiving bogus packets;
*) ipsec - place dynamically created IPsec policies by L2TP client at the begining of the table;
*) kidcontrol - ignore IPv6 multicast MAC addresses;
*) l2tp - added "src-address" parameter for L2TP client;
*) l2tp - added "use-peer-dns" parameter for L2TP client;
*) l2tp - improved dynamically created IPsec configuration updating;
*) l2tp - use L2TP interface when adding dynamic IPsec peer;
*) lcd - fixed LCD service becoming unavailable on devices without LCD screen;
*) lcd - improved general system stability when LCD is not present;
*) led - fixed minor typo in LED warning message;
*) log - added logging entry when changing user's password;
*) log - added tunnel endpoint address to establishment and disconnect logging entries;
*) log - made startup script failures log as critical errors;
*) lte - added support for Huawei K5161 modem;
*) lte - added support for NEOWAY N720;
*) lte - added support for multiple passthrough APN configuration;
*) lte - do not allow running "scan" on R11e-4G;
*) lte - fixed "allow-roaming" setting when using LTE network mode on R11e-LTE;
*) lte - fixed "band" parameter persistence after disable/enable;
*) lte - fixed "ecno" and "rscp" value reporting on R11e-LTE6;
*) lte - fixed VLAN interface passthrough support;
*) lte - fixed multiple APN reactivation after deactivation by operator;
*) lte - improved stability during firmware upgrade;
*) lte - made "mac-address" parameter read-only;
*) lte - show "phy-cellid" value only in LTE mode;
*) netinstall - removed "Flashfig" from Netinstall;
*) netinstall - removed "Make Floppy" from Netinstall;
*) netinstall - signed netinstall.exe with Digital Signature;
*) netwatch - improved Netwatch service stability when invalid configuration values are passed;
*) ovpn - added "use-peer-dns" parameter for OVPN client;
*) port - removed serial console port on hEX S;
*) ppp - added "Acct-Session-Id" attribute to "Access-Request" messages;
*) ppp - added support for ZTE MF90;
*) ppp - fixed minor typo when running "info" command;
*) ppp - removed "comment", "set" and "edit" commands from "PPP->Active" menu;
*) pptp - added "use-peer-dns" parameter for PPTP client;
*) profile - added support for CCR2004-1G-12S+2XS;
*) proxy - increased minimal free RAM that can not be used for proxy services;
*) qsfp - added support for FEC mode (fec74), with the FEC mode disabled by default;
*) quickset - do not show "SINR" field in Quick Set when there is no data;
*) quickset - fixed invalid configuration applying when performing changes during LTE modem initialization process;
*) quickset - removed "EARFCN" field from Quick Set;
*) quickset - removed "LTE band" setting from Quick Set;
*) quickset - show "Antenna Gain" setting on devices without built-in antennas;
*) quickset - use "station-wds" mode when connecting to AP with RouterOS flag;
*) route - improved system stability after reboot with large amount of VLAN interfaces with PPPoE servers attached;
*) routerboard - added "hold-time" parameter to mode-button menu;
*) routerboard - added "reset-button" menu - custom command execution with reset button;
*) routing - improved IGMP-Proxy service stability when receiving bogus packets;
*) routing - improved routing service stability when receiving bogus packets;
*) sfp28 - added support for FEC modes (fec74 and fec91), with fec91 mode already enabled by default;
*) sniffer - allow setting port for "streaming-server";
*) snmp - added "dot1qTpFdbTable" OID reporting for Q-BRIDGE-MIB;
*) snmp - changed "upsEstimatedMinutesRemaining" reported value from seconds to minutes;
*) snmp - fixed "dot1dBasePort" index offset for BRIDGE-MIB;
*) snmp - improved OID policy checking and error reporting on "set" command;
*) snmp - improved stability when polling MAC address related OID;
*) ssh - improved SSH service stability when receiving bogus packets;
*) supout - added "dot1x" section to supout files;
*) supout - improved UPS information reporting;
*) switch - correctly display switch statistics when all switch ports are disabled on RTL8367 switch chip;
*) switch - correctly enable and disable CPU Flow Control on RB3011UiAS;
*) switch - made "auto" the default value for "vlan-id" parameter when creating a new static host entry;
*) system - correctly handle Generic Receive Offloading (GRO) for MPLS traffic;
*) system - improved driver loading speed on startup;
*) tr069-client - added LTE firmware update functionality support;
*) tr069-client - added additional LTE information parameters;
*) tr069-client - added additional wireless registration table parameters;
*) tr069-client - added interface type parameter support;
*) tr069-client - added multiple simultaneous session support for diagnostics test;
*) tr069-client - added total connection tracking entries parameter;
*) tr069-client - removed warning log message when not using HTTPS;
*) traffic-flow - added "postDestinationMacAddress" parameter support for IPFIX and NetFlow v9;
*) upgrade - fixed space handling in package file names;
*) ups - added battery info for APC SmartUPS 2200;
*) ups - improved compatibility with APC Smart UPS 1000 and 1500;
*) user - improved user management service stability when receiving bogus packets;
*) w60g - fixed link status logging;
*) w60g - improved rate selection in low traffic conditions;
*) w60g - use "arp" and "mtu" parameters from master interface when creating a new station;
*) webfig - fixed 5 GHz wireless interface "frequency" parameter value list on Audience;
*) webfig - fixed WinBox download link;
*) webfig - fixed skin usage from branding package;
*) webfig - updated icon design;
*) winbox - added "Rate" parameter for switch ACL rules;
*) winbox - added "auth-info" parameter under "Dot1X->Active" menu;
*) winbox - added "auth-types", "comment", "mac-auth-mode" and "reject-vlan-id" parameters for Dot1X server;
*) winbox - added "auto-erase" option to "Tool/SMS" menu;
*) winbox - added "bus" parameter for "USB Power Reset" command on NetMetal ac^2;
*) winbox - added "bus" parameter for "USB Power Reset" command on RBM33G;
*) winbox - added "comment" parameter and "dynamic" flag support under "Switch->Rule" table;
*) winbox - added "comment" parameter for Dot1X client;
*) winbox - added "region" parameter for W60G interfaces;
*) winbox - added "skip-dfs-channels" parameter to wireless interface menu;
*) winbox - added comment support for "Switch->VLAN" menu;
*) winbox - added enable and disable buttons for "MPLS->MPLS Interface" table;
*) winbox - added support for inline bar graphs for LTE signal values;
*) winbox - aligned all "IP->Traffic Flow->IPFIX" check boxes in single line (WinBox v3.22 required);
*) winbox - allow setting "Primary" parameter for "balance-tlb" bonding interfaces;
*) winbox - allow to specify any Ethernet like interface under "Tool/WoL" menu;
*) winbox - do not allow to enter empty strings in "caps-man-names" and "common-name" parameters;
*) winbox - fixed "BGP Origin" value display under "IPv6->Routes" menu;
*) winbox - fixed "Data Rate" checkbox alignment (WinBox v3.22 required);
*) winbox - fixed "Tx/Rx Signal Strength" value presence for 4 chain interfaces;
*) winbox - fixed WDS usage when connecting to RouterOS access point using QuickSet;
*) winbox - fixed bonding type interface support for "Switch->Host" table;
*) winbox - fixed dates and times in interface link up/down properties (WinBox v3.24 required);
*) winbox - fixed wireless interface "HT" tab setting presence when "band=5ghz-n/ac";
*) winbox - fixed wireless sniffer parameter setting;
*) winbox - limit number of simultaneous WinBox sessions to 5 for users without "write" permission;
*) winbox - made "yes" the default value for "Inject Summary LSAs" parameter when creating a new NSSA or STUB area;
*) winbox - removed duplicate "join-eui", "dev-eui", "counter", "chain", "size" and "payload" parameters under "LoRa/Traffic";
*) winbox - renamed "Routerboard" to "RouterBOARD" under "System/RouterBOARD" menu;
*) winbox - show "Hardware Offload" parameter for bonding interfaces;
*) winbox - updated icon design;
*) wireless - added "russia 6ghz" regulatory domain information;
*) wireless - enabled unicast flood for DHCP traffic on ARM architecture access points;
*) wireless - fixed Nstreme wireless protocol performance decrease;
*) wireless - improved management service stability when receiving bogus packets;
*) wireless - updated "egypt" regulatory domain information;
*) wireless - updated "russia4" regulatory domain information;
*) www - added "tls-version" parameter in "IP->Services" menu;

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after some problem has appeared on device

Please keep this forum topic strictly related to this particular RouterOS release.

santyx32 · Tue Jun 02, 2020 2:53 pm

Working fine in my AC2, maybe next beta is ROS7 based?

korsar182 · Tue Jun 02, 2020 3:18 pm

*) ipsec - allow specifying two peers for a single policy for failover;

Oh wow, that's a killer feature I've been waiting for years!

Tue Jun 02, 2020 3:35 pm

The proper word coming to my mind is: IMPRESSIVE

list of changes.

msatter · Tue Jun 02, 2020 4:12 pm

*) ike2 - added support for RFC8598;

Split DNS Configuration for IKEv2.

osc86 · Tue Jun 02, 2020 5:09 pm

jun/02/2020 16:05:59 system,error,critical error while running customized default configuration script: no such item
jun/02/2020 16:05:59 system,error,critical

Got this on a HAPac², boot time was increased too (about 2 minutes)
EDIT:
IMO it's a bit confusing that wifi, vlan and tunnel interfaces share the same icon. They could've changed this with the new icon set.

wuffzack · Tue Jun 02, 2020 6:20 pm

System Health on CRS354-48G-4S+2Q+ now shows a higher CPU temperature than before with 6.46.x.
It shows 89 C (was 79 C before).
CPU load is minimal (around 1-5%).
Fan Speed the same as before.
Wrong / different temperature measurement?

mirolm · Tue Jun 02, 2020 6:25 pm

Upgraded 3 mikrotiks - 1 x Hex S, 2 x Hap AC^2

On one of the Hap AC^2 got the above message too:

16:59:08 system,info router rebooted 
16:59:14 system,error,critical error while running customized default configuration script: no such item 
16:59:14 system,error,critical 
16:59:19 bridge,info hardware offloading activated on bridge "bridge" ports: ether3-local,ether1-local,ether2-local,ether4-local,ether5-local

dakotabcn · Tue Jun 02, 2020 6:37 pm

Code: Select all
jun/02/2020 16:05:59 system,error,critical error while running customized default configuration script: no such item
jun/02/2020 16:05:59 system,error,critical
Got this on a HAPac², boot time was incereased too (about 2 minutes)

same error in RB4011 WIFI, if reboot the same message is logged
other problem: L2TP+IPSEC after update, no connect anyone, reboot and works fine, the site2site IKEV2 no is affected

freemannnn · Tue Jun 02, 2020 7:39 pm

*) hotspot - updated splash page design ('/ip hotspot reset-html' required);

i fancy the updated hotspot login page.

ErfanDL · Tue Jun 02, 2020 7:54 pm

after upgrade 2011Ui:

error while running customized default configuration script: no such item

and:

110.PNG

roe1974 · Tue Jun 02, 2020 8:00 pm

Same was allready with 6.46.5 (script list)

pe1chl · Tue Jun 02, 2020 8:18 pm

An IPsec tunnel that was configured in 6.46.2 with both policy and peer "disabled" was incorrectly converted when upgrading to 6.47.
After the upgrade the policy listed "unknown" as the peer and in the /export it had peer=*FFFFFFFF in the policy entry.

To fix it I temporarily enabled the peer in Winbox 3.21, went to the policy and enabled it as well, doubleclicked on the entry with the
intent of changing the peer (policy became colored red). This caused Winbox to hangup.
Closing and re-opening Winbox made it hang again at the same place.

Connected via SSH and issued a set command to set the peer back to the correct value, now it looks again OK in Winbox. Disabled it again.

However, Winbox still hangs with doubleclick on any IPsec policy! in SSH, things look fine and the (enabled) policies work OK.

pe1chl · Tue Jun 02, 2020 8:19 pm

after upgrade 2011Ui:
Code: Select all
error while running customized default configuration script: no such item
and:
110.PNG

It was reported in the 6.47rc topic and there was a reaction from MikroTik but apparently it was ignored before releasing it as stable.

templeos · Tue Jun 02, 2020 8:31 pm

And seems like the DoH log spam wasn't fixed that was reported during the betas. You need to tone them down a bit because this is ridiculous. I know that it stops after connection is reestablished but is it necessary to have the DoH server connection error: Network is unreachable entry for 2-7 times per second? Just look at it:

log_spam.png

Werlock · Tue Jun 02, 2020 8:33 pm

error while running customized default configuration script: no such item

need to reset and load the config back

pe1chl · Tue Jun 02, 2020 8:45 pm

need to reset and load the config back

Why? Was the config gone? In my case it wasn't! And this error is always logged, it seems.

Tue Jun 02, 2020 8:51 pm

If you experience a version related issue, then please provide a supout file from your router to support@mikrotik.com.

We added an error message in this RouterOS release that is printed out if configuration script provides an error. Most likely, there was a problem with the script all the time, simply now you get notified about it.

Werlock · Tue Jun 02, 2020 8:53 pm

need to reset and load the config back
Why? Was the config gone? In my case it wasn't! And this error is always logged, it seems.

at least my hap ac helped
the config remained in place. I just saved it. then reset the router and downloaded back

obscurus · Tue Jun 02, 2020 9:39 pm

Doh! but how i can config it? no wiki page

HZsolt · Tue Jun 02, 2020 9:42 pm

https://jcutrer.com/howto/networking/mi ... over-https --> DoH configuration on MikroTik router

mada3k · Tue Jun 02, 2020 9:45 pm

Impressive amount of fixes and features.

pe1chl · Tue Jun 02, 2020 9:54 pm

If you experience a version related issue, then please provide a supout file from your router to support@mikrotik.com.

We added an error message in this RouterOS release that is printed out if configuration script provides an error. Most likely, there was a problem with the script all the time, simply now you get notified about it.

In my RB2011 the messages were like this:
jun/02/2020 18:48:28 system,info,critical Firmware upgraded successfully, please reboot for changes to take effect!
jun/02/2020 18:48:36 system,error,critical,,, error while running customized default configuration script: no such item
jun/02/2020 18:48:36 system,error,critical,,,

Note that this router does not have and never had a "customized default configuration script".
Maybe this error message is normal and indicates the script does not exist?
However, on 2 other routers I updated this message does not appear.
Is it depending on the history of the router? (e.g. the first firmware version that was installed on it)

Jotne · Tue Jun 02, 2020 10:16 pm

My hope.
6.46 - > long term
6.47 - > stable
6.48.. no, no more 6 series
7.01 - > testing

jvanhambelgium · Tue Jun 02, 2020 10:42 pm

Upgrade on my RB3011 went smooth, coming straight from 6.46.4 or something.

amokkatmt · Tue Jun 02, 2020 11:26 pm

SMB is not working for me, log says
"
... dialect: SMB 2.002
session setup GSS error: 0x90000
"
On 6.47beta53 it works fine.

bpwl · Wed Jun 03, 2020 12:27 am

Winbox missing "antenna gain" setting for wireless. Lost the most practical way to reduce transmit power. It is/was in the WIKI, it is in many MUM presentations.
"Antenna gain" can be found in the CLI. But it is even not in the export, only "export verbose".

It was back in 6.46.6 ..... gone again ....

Klembord-2.jpg

usern · Wed Jun 03, 2020 12:49 am

DoH server connection error: Network is unreachable entry for 2-7 times per second

I had same issue with quad 9 DoH, but when I started to use 1.1.1.2 DoH, then it has worked much better. So far no DoH related connection issues in the log.

pe1chl · Wed Jun 03, 2020 12:54 am

Winbox missing "antenna gain" setting for wireless. Lost the most practical way to reduce transmit power.

It is also the most practical way to increase transmit power beyond the legal limit while operating in the regulatory-domain mode.
That is probably why it is now gone.

mbovenka · Wed Jun 03, 2020 1:08 am

It is also the most practical way to increase transmit power beyond the legal limit while operating in the regulatory-domain mode.
That is probably why it is now gone.

Why? It's easy to reject settings that would result in an illegal ERP.

diablothebest · Wed Jun 03, 2020 1:09 am

Telegram can't connect to new SOCKS5 server.
No errors in log, I'm trying to connect to local IP of the router, no FW blocks.
I can see start session from mobile phone on Connections winbox screen.
But no luck....

bpwl · Wed Jun 03, 2020 1:17 am

Winbox missing "antenna gain" setting for wireless. Lost the most practical way to reduce transmit power.
It is also the most practical way to increase transmit power beyond the legal limit while operating in the regulatory-domain mode.
That is probably why it is now gone.

With the newer releases setting something lower than the built in antenna gain is not possible.(Even not with the CLI)
If it is an external antenna either the GUI line will be back (I don't have such a device right now) , or the gain will be at "0" (how would the AP know the gain?) That is really beyond the legal limit.
Bizar twist in the head of the developers. (Like the way they handle "outdoor" frequencies in regulatory domain lists. Outdoor freq are not forbidden indoor, but MKT does.)

[admin@MktOmnitik] > interface wireless set antenna-gain=7
numbers: 0
failure: minimal antenna-gain for this country is 8

[admin@MktwAPac] > interface wireless set antenna-gain=1
numbers: 0
failure: minimal antenna-gain for this country is 2

[admin@hAPac2] > interface wireless set antenna-gain=1
numbers: 0
failure: minimal antenna-gain for this country is 3

w0lt · Wed Jun 03, 2020 1:27 am

I have installed ROS 6.47 on all my routers with great success. It seems to be working just fine. However, one quirk has popped up in my "ChangeIP DDNSScript". It now displays the following error.:

Screen Shot 2020-06-02 at 5.24.57 PM.png

I have not changed a thing in the script and it has been working fine through ROS 6.47RC2.

Thoughts?

-tp

bpwl · Wed Jun 03, 2020 1:29 am

Winbox missing "antenna gain" setting for wireless. Lost the most practical way to reduce transmit power.
It is also the most practical way to increase transmit power beyond the legal limit while operating in the regulatory-domain mode.
That is probably why it is now gone.
With the newer releases setting something lower than the built in antenna gain is not possible.(Even not with the CLI)
If it is an external antenna either the GUI line will be back (I don't have such a device right now) , or the gain will be at "0" (how would the AP know the gain?) That is really beyond the legal limit.
Bizar twist in the head of the developers. (Like the way they handle "outdoor" frequencies in regulatory domain lists. Outdoor freq are not forbidden indoor, but MKT does.)

[admin@MktOmnitik] > interface wireless set antenna-gain=7
numbers: 0
failure: minimal antenna-gain for this country is 8

[admin@MktwAPac] > interface wireless set antenna-gain=1
numbers: 0
failure: minimal antenna-gain for this country is 2

[admin@hAPac2] > interface wireless set antenna-gain=1
numbers: 0
failure: minimal antenna-gain for this country is 3

-----------------------------------------------------
Little experiment (test your knowledge)
-----------------------------------------------------
- set not to regulatory domain
- set low antenna gain (lower than built in)
- ask someone to set regulatory domain and country to the legal values

Klembord-2.jpg

jenechka · Wed Jun 03, 2020 4:00 am

Снимок.JPG

hap ac2

anav · Wed Jun 03, 2020 4:47 am

bridge - improved hardware offloading enabling/disabling;

I am curious about this one?

vecernik87 · Wed Jun 03, 2020 5:07 am

It seems to me that DNS FWD does not work if there is DoH set up. I can imagine people who want to FWD their internal domain zones while securing all external/public requests.
(If you want to test it, remember to flush cache before every request)

Even with this little hiccup, I think it is a great upgrade for DNS system in RouterOS. Developers, please accept my huge gratitude for this. Thanks!
(No, seriously, +1000 internetz for you and +2 internetz for Normis just because he is a nice guy)

Institor · Wed Jun 03, 2020 5:11 am

system,error,critical error while running customized default configuration script: no such item

Same error here on HAP ac lite.
Antenna-Gain is lost in winbox, very bizarre decision, while superchannel setting still exists.
Bring back antenna-gain!

shmichael · Wed Jun 03, 2020 6:08 am

I have installed ROS 6.47 on all my routers with great success. It seems to be working just fine. However, one quirk has popped up in my "ChangeIP DDNSScript". It now displays the following error.:

Screen Shot 2020-06-02 at 5.24.57 PM.png

I have not changed a thing in the script and it has been working fine through ROS 6.47RC2.

Thoughts?

-tp

When I try to update the address on changeip.com, I also get this error. The address is not updated.

nexusds · Wed Jun 03, 2020 7:23 am

Upgraded a number of switches and routers without issue except (so far) a RB3011UiAS. this one used interface lists for bridges and rules pointing to lists.

the bridges seemed to act fine and dhcp client setup to WAN bridge. IP was obtained but NAT rule pointing to 'WAN' interface list did not work (even tried using blanket all packets/source IP, etc). had to break out interface from bridge and setup dhcp client to singular interface and adjust NAT rule to singular interface. i have a supout file from when it was not working.

Paco · Wed Jun 03, 2020 7:29 am

system,error,critical error while running customized default configuration script: no such item
system,error,critical

Same here, after update to 6.47 my RB4011iGS+5HacQ2HnD-IN and cAP Ac..
Antena gain was gone..

Jotne · Wed Jun 03, 2020 7:57 am

system,error,critical error while running customized default configuration script: no such item
system,error,critical
Same here, after update to 6.47 my RB4011iGS+5HacQ2HnD-IN and cAP Ac..
Antena gain was gone..

See this post
viewtopic.php?p=797466#p797466
MT

We added an error message in this RouterOS release that is printed out if configuration script provides an error. Most likely, there was a problem with the script all the time, simply now you get notified about it.

It may be that you all have a script that gives error, but RouterOS has not displayed it before. Try to disable all script and see if message goes away.

Institor · Wed Jun 03, 2020 8:42 am

It may be that you all have a script that gives error, but RouterOS has not displayed it before. Try to disable all script and see if message goes away.

It's strange.

/system default-configuration print

shows no default config script whatsoever. It's gone.
So it seems that default configuration has been erased by this update. I wonder, what happens now if i try to reset to default config....

fs0c13ty · Wed Jun 03, 2020 9:00 am

Hi.
after this release, I've got a massive write sector on my devices.
i also have this problem with previous versions with different boards.
what did you(Mikrotik company) do on this release to increase flash write cycle? Is it a thing like Apple put a while(true) to increase battery usage just for selling their new products and make the previous devices useless?
if it is a result of some operation i want it to stop.
does dns caches store on disk?

i also stop dhcp store on disk.
disable all graph and set the store time to 24h
no log on disk.
no proxy.
no ip accounting.

Capture.PNG

Annotation 2020-06-03 093000.png

Annotation 2020-06-03 092808.png

nexusds · Wed Jun 03, 2020 9:28 am

CRS326-24S+2Q+
- seems fine overall, but couple of ports connect to IScsi ports @ 10G to MSA 2040. keep flapping at random times using MW-S-+DA003 (use this for all connections except Q+ for this switch and never had an issue before). will try hard-coding to 10G and see how that goes (luckily not used at the moment but normally would be be a very bad issue).. no other ports flapping.

Grant · Wed Jun 03, 2020 9:31 am

after this release, I've got a massive write sector on my devices.

I confirm quantity of sector writes is constantly fast increasing

ementat · Wed Jun 03, 2020 9:55 am

https://jcutrer.com/howto/networking/mi ... over-https --> DoH configuration on MikroTik router

It is possible to use DoH only with "Verify DoH Certioficate" unchecked, or unchecked "Use CRL". Mikrotik is logging "DoH server connection error: SSL: handshake failed: unable to get certificate CRL (6)". I am using Cloudflare DoH, so installed DigiCertGlobalRootCA, but Mikrotik is telling me that CRL for this cert is invalid.

dvm · Wed Jun 03, 2020 9:59 am

I've got a massive write sector on my devices.

I can confirm this too (hAP ac lite, hAP ac^2).
ROS 6.45.9 - uptime: 32m58s, write-sect-since-reboot: 167
ROS 6.46.6 - uptime: 33m4s, write-sect-since-reboot: 228
ROS 6.47 - uptime: 31m28s, write-sect-since-reboot: 2416
The configuration has not been changed. No actions were performed after reboots, except /system resource print.
Possibly the cause is *) disk - improved recently created file survival after reboots;?

krafg · Wed Jun 03, 2020 10:08 am

Updated 2x BaseBox2, 1x BaseBox5, 1x PowerBox Pro and 1x LtAP LTE kit without issues.

On LtAP CPU usage downs from 11 - 12% to 0 - 1% that are normal values. Fixed wireless. OK!

Antenna gain only available on my BaseBoxes (in my case). OK! (to me).

Regards.

fs0c13ty · Wed Jun 03, 2020 10:12 am

if this is temporal thing after upgrade to 6.47, I am ok with this but if any config changes consumes hundreds of write sector i serious insist to make this feature as a option in next release.
i want to loose my configuration on unexpected power cut than repairing my RouterBoard.

Caci99 · Wed Jun 03, 2020 10:26 am

!) dns - added client side support for DNS over HTTPS (DoH) (RFC8484);

Does this mean we will see the end of filtering via DNS anytime soon?

ErfanDL · Wed Jun 03, 2020 11:04 am

I confirm quantity of sector writes is constantly fast increasing

sec.PNG

ofer · Wed Jun 03, 2020 11:05 am

Updated HapACx3 from 6.46.6 -> 6.47 - I haven't encountered any issues.
Updated HapAC Lite x3 from 6.46 -> 6.47 - No issues so far.

pe1chl · Wed Jun 03, 2020 11:24 am

I updated 3 different routers and have not encountered "sector write issues".
Sure the sector write count is at 2500 or so after updating a router without config changes, but it is not increasing and I am not alarmed by such numbers.

pe1chl · Wed Jun 03, 2020 11:32 am

It seems to me that DNS FWD does not work if there is DoH set up. I can imagine people who want to FWD their internal domain zones while securing all external/public requests.

Indeed it is silly. One would expect the DoH to be implemented just like all other external resolvers, that is:
- incoming DNS requests to the router are first looked up in the cache/static table
- when not found, a request is made to the configured external resolver (either via DNS or DoH)
- the result is stored in the cache table and returned to the client.

However, it appears the DoH function was implemented as a completely separate handling of the incoming DNS packets...
This makes it impossible to use the DNS resolver (which was improved this release! it can now also serve other static records!) in combination with an external DoH service.
That fact was discussed in the RC topic but apparently there was no more time to fix the code and the "stable" version had to be rushed out...

eddieb · Wed Jun 03, 2020 11:39 am

updating to 6.47 went smooth ... from 6.46.5 to 6.47 done thru the dude

No problems so far Still running OSX 10.14.x to be able to run the 32bit Dude in Dude4Mac 6.47.

MTeeker · Wed Jun 03, 2020 11:57 am

SMB is not working for me, log says
...

1+
SMB also broken on my R493G rig running 6.47. Can't access NAS on LAN behind router.

[EDITTED]
SMB is working fine and not 'broken' on my RB493G. An item, previously misconfigured from bridge, was added and it allows LAN access. Thanks.

HZsolt · Wed Jun 03, 2020 12:00 pm

Will we ever be able to use multiple DoH Servers? Not just one.
https://github.com/curl/curl/wiki/DNS-over-HTTPS

amokkatmt · Wed Jun 03, 2020 1:46 pm

SMB is not working for me, log says
...
1+
SMB also broken on my R493G rig running 6.47. Can't access NAS on LAN behind router.

Probably not the same. I meant "IP/SMB|, server of router itself.

obscurus · Wed Jun 03, 2020 2:33 pm

adguard doh dns does not work with many errors on log.
1.1.1.1 doh - working now well
8.8.8.8 doh - working now well

0012nish · Wed Jun 03, 2020 2:49 pm

Sim-card lost after upgrading.
v6.47

v6.45.9

dvm · Wed Jun 03, 2020 2:54 pm

*) netinstall - signed netinstall.exe with Digital Signature;

Netinstall 6.47 is still missing from the software download page.

Chisee · Wed Jun 03, 2020 2:55 pm

Hi,

today i upgraded my router and 5 acces points.
After updating in winbox only the router is visible under the "Neighbors" tab, the acces points are gone. If I enter the IP address, it will connect without any problems.

Does anyone know a solution for this?

router:
CCR1009-7G-1C-1 S +

acces point:
RBWAPG-5HACT2HND

pe1chl · Wed Jun 03, 2020 3:06 pm

!) dns - added client side support for DNS over HTTPS (DoH) (RFC8484);
Does this mean we will see the end of filtering via DNS anytime soon?

This is not related to the support of DoH in the router. However, you are right that in the future your clients will no longer use your DNS resolver nor can you catch their attempts to use an external DNS resolver and dst-nat them to your own resolver.
The situation is similar to filtering or priotitising websites via L7 matches: this level of control over your network will disappear.

llubik · Wed Jun 03, 2020 3:42 pm

I can't update to 6.47
I have 2 x hapac2 a problem. . . on both ladies check for updates, and dotan stable on one 6.47, on the other 6.46.3, long term on one 6.45.9, on the other 6.45.8, testing on one 6.47rc2, on the other 6.47beta35. . . Where is the problem? why am I getting lower versions on the second one? (fw of course updated to the appropriate version)
Now I updated from 6.44, gradually to 6.45.8 longter and then to stable 6.46.3,. . . I thought because of the sequence of steps. . . but he doesn't offer it to me anymore. . .

why doesn't it offer on the second 6.47?

pendie · Wed Jun 03, 2020 3:55 pm

I've got a massive write sector on my devices.
I can confirm this too (hAP ac lite, hAP ac^2).
ROS 6.45.9 - uptime: 32m58s, write-sect-since-reboot: 167
ROS 6.46.6 - uptime: 33m4s, write-sect-since-reboot: 228
ROS 6.47 - uptime: 31m28s, write-sect-since-reboot: 2416
The configuration has not been changed. No actions were performed after reboots, except /system resource print.
Possibly the cause is *) disk - improved recently created file survival after reboots;?

I also returned to 6.45.9 for writing which is useless 6.47

buset1974 · Wed Jun 03, 2020 4:21 pm

on 6.47
system - auto-upgrade still problem since 6.46 please fix it.
i've report this many times.

thx

Paternot · Wed Jun 03, 2020 4:31 pm

after this release, I've got a massive write sector on my devices.

I confirm quantity of sector writes is constantly fast increasing

I can confirm this too. Don't know what causing this.

denisnk · Wed Jun 03, 2020 4:37 pm

Got the same problem with sector writes value on my hAp ac^2 on v6.47.
Two screens just to compare (v6.47 vs v6.46.6). Returned to v6.46.6 until it'll be fixed.

6.47.png

6.46.6.png

JohnTRIVOLTA · Wed Jun 03, 2020 4:56 pm

Same problem with sector writes value - RB433AH :

Paternot · Wed Jun 03, 2020 5:18 pm

I updated 3 different routers and have not encountered "sector write issues".
Sure the sector write count is at 2500 or so after updating a router without config changes, but it is not increasing and I am not alarmed by such numbers.

I have this problem, with 2 AP. They don't have dynamic IP. They don't have DHCP servers. They are not used as DNS to the clients. I am not using CapsMAN. This is as barebones as I can get: just a dumb AP. Cloud is disabled too, and I didn't installed any extra package - just using the default ones. No scripts whatsoever too.

System status at 11:09

/system resource print
                   uptime: 8h43m38s
                  version: 6.47 (stable)
               build-time: Jun/02/2020 07:38:00
         factory-software: 6.29.1
              free-memory: 22.9MiB
             total-memory: 64.0MiB
                      cpu: MIPS 24Kc V7.4
                cpu-count: 1
            cpu-frequency: 650MHz
                 cpu-load: 4%
           free-hdd-space: 3000.0KiB
          total-hdd-space: 16.0MiB
  write-sect-since-reboot: 14126
         write-sect-total: 2127269
               bad-blocks: 0%
        architecture-name: mipsbe
               board-name: hAP ac lite
                 platform: MikroTik

System status at 11:13:

/system resource print
                   uptime: 8h47m36s
                  version: 6.47 (stable)
               build-time: Jun/02/2020 07:38:00
         factory-software: 6.29.1
              free-memory: 23.0MiB
             total-memory: 64.0MiB
                      cpu: MIPS 24Kc V7.4
                cpu-count: 1
            cpu-frequency: 650MHz
                 cpu-load: 2%
           free-hdd-space: 3000.0KiB
          total-hdd-space: 16.0MiB
  write-sect-since-reboot: 14409
         write-sect-total: 2127552
               bad-blocks: 0%
        architecture-name: mipsbe
               board-name: hAP ac lite
                 platform: MikroTik

If I keep looking at the counter, it increases by 5 writes. Stops a while, then do about 10 or 12 jumps of 5 writes. This AP doesn't write its logs to disk, and I set the graphic generator to write only every hour. These jumps occur in less than a minute.

Yes, I'm sending a supout now.

WeWiNet · Wed Jun 03, 2020 5:26 pm

Sector writes also pretty high on my WAP-R ac (its ~ 3 weeks old device).
25% sector writes of total after today upgrade & reboot!
Should I down-grade to avoid memory corruption???

Sector_Writes (2).png

nescafe2002 · Wed Jun 03, 2020 5:38 pm

on 6.47
system - auto-upgrade still problem since 6.46 please fix it.
i've report this many times.

If you haven't submitted this issue to MT support via mail or help.mikrotik.com, it will never be fixed.

Forum post != bug report.

Also, multiple forum posts != bug report. Posting this repeatedly is just plain annoying.

WeWiNet · Wed Jun 03, 2020 6:41 pm

In addition to heavy write cycle, also FLASH memory leakage!
All my available FLASH memory is gone on WAP R ac after upgrading to 6.47 from 6.46.6
Now need to do a NETINSTALL (hate that!)

PS: Note that 2 x reboot added another 40% write cycles (10.000) of total 35.000 since. And this within 30 minutes!! ... not bad!

6.47_issues (2).png

mirolm · Wed Jun 03, 2020 7:19 pm

I can second that on my routers:
- hEX S - uptime 1h 02:14:00 Sector writes since reboot: 4971
- hAP ac^2 - uptime 1h 02:14:00 Sector writes since reboot: 16 313
- hAP ac^2 - uptime 1h 02:14:00 Sector writes since reboot : 15 364

On all 3 routers this numbers rise with 1-6 every second...

This are really high numbers and need to be fixed. Downgraded back to 6.46.6 till this is fixed.

faxxe · Wed Jun 03, 2020 7:20 pm

Damn, whats going on here?
95000 in 24hours.
whats the best way to go back?

-faxxe

SnkB · Wed Jun 03, 2020 7:36 pm

Here in my hEX S it increased rapidly!
Short uptime and is at 87k +
13h uptime
This must be corrected !!

Wakko · Wed Jun 03, 2020 7:51 pm

Today I updated two home routers: RB450G and RB850Gx2. The first one was updated from 6.45.8 to 6.47 without any problems. And during the RB850Gx2 update was in progress – my UPS APC SC420 just shut down and power off all the network hardware that is connected to it. This UPS is connected by a cable to the RB850Gx2 router. I suspect that the router sent the shutdown command.

Снимок экрана 2020-06-03 в 19.17.28.png

tricyclevent · Wed Jun 03, 2020 8:04 pm

hEX update ok
unable to update hAP lite: not enough memory

nmt1900 · Wed Jun 03, 2020 8:22 pm

Well... 42 thousand writes in 22 hours. At least there's no problem with devices which do not display NAND writes

osc86 · Wed Jun 03, 2020 8:25 pm

almost 25000000 Sector writes.. what are you doing to your flash memory?

tricyclevent · Wed Jun 03, 2020 9:16 pm

I bought it november 2016. We have a normal usage i think... just for our private home network. Never had any problems, works like a charm... I have no idea what these numbers mean...

pe1chl · Wed Jun 03, 2020 10:20 pm

almost 25000000 Sector writes.. what are you doing to your flash memory?

I have 35 683 586 here. That happened when I had the "/tool graphing" running for some interfaces and resources, with the "store on disk" option on.
After I found this I have removed the "store on disk" on all items and this problem went away.
But my router (2011) still works OK so I am not so worried about 500 writes, as some others are.

Paternot · Wed Jun 03, 2020 10:50 pm

But my router (2011) still works OK so I am not so worried about 500 writes, as some others are.

I'm not worried about "500 writes". I'm concerned with the fact that the writes more than quadrupled, with this new version. Same hardware, same config. Just an upgrade - from 6.46.4 to 6.47.

The same unit I posted above is now with 24155 writes after reboot. When I posted, it had 14409. We are talking about 1700 writes/hour. This would give me something like 40800 writes/day. That's about 14900000/year.

No, it's not the end of the world. But it IS much higher than this used to do, with version 6.46.4
I have a third AP, same hardware and config - but still at 6.46.4. Is is at 90321 rewrites since last reboot - 10 days ago. See? I went from about 10k writes/day to 41k writes/day. There is something weird here.

And it isn't the graphics. I set them to be written once per hour - and the counters increase slow and steadily.

teonok · Thu Jun 04, 2020 12:49 am

I have a problem with the DHCP Server. I have connected a TP LINK AP200 as a repeater/bridge of the wifi network of Mikrotik. The repeater connects ok, I can ping it and login to web interface. When a client connects to tp link wifi network it can't get IP. The mikrotik log says DHCP Server offering lease 192.168.88.114 for (mac of the client) to (mac of the TP LINK) without success. If I put static ip to the client and connect to TP link everything works ok. I downgraded to firmware 6.46.6 and it works fine.

kd2pm2 · Thu Jun 04, 2020 4:18 am

https://jcutrer.com/howto/networking/mi ... over-https --> DoH configuration on MikroTik router
It is possible to use DoH only with "Verify DoH Certioficate" unchecked, or unchecked "Use CRL". Mikrotik is logging "DoH server connection error: SSL: handshake failed: unable to get certificate CRL (6)". I am using Cloudflare DoH, so installed DigiCertGlobalRootCA, but Mikrotik is telling me that CRL for this cert is invalid.

I just did the same on my RB4011 and its working. Did you do the chain pem or just the root pem?

Thu Jun 04, 2020 7:00 am

osc86,mirolm,dakotabcn,ErfanDL,roe1974,pe1chl,Werlock,jenechka,Institor,Paco,Jotne - The issue will be resolved in the upcoming RouterOS releases. But there is nothing to worry about here. Simply default configuration script got generated incorrectly.
wuffzack,pe1chl - Please send two supout files from this router to support@mikrotik.com (one from v6.47 and one from the previous version that was installed on your router).
templeos - We will consider changing the topic of these messages, but I think that you would like to know if the DNS server is not reachable when someone tries to use it.
obscurus - We will update the manual as soon as possible.
amokkatmt,MTeeker,buset1974 - The issue will be resolved in the upcoming RouterOS releases.
bpwl,krafg - The antenna gain setting is not available there anymore for the routers that have a built-in antenna.
diablothebest, w0lt,shmichael,nexusds,ementat,0012nish,Chisee - Please send a supout file from this router to support@mikrotik.com.
vecernik87 - We will look into this.
fs0c13ty,Grant,dvm,ErfanDL,pe1chl,dvm,pendie,Paternot,denisnk,JohnTRIVOLTA,WeWiNet,mirolm,faxxe,SnkB,nmt1900,osc86,pe1chl - We are currently looking into this.
llubik - Please make sure that upgrade.mikrotik.com domain name on your router is resolved to these IP addresses 159.148.147.204, 159.148.172.226.
Wakko - There are no such changes in the RouterOS that might do such a thing automatically. If you experience the same issue again, then please provide supout file from your router to support@mikrotik.com.
tricyclevent - Make sure that there are no unnecessary RouterOS packages installed on your router and there are not too many files stored on this unit.
teonok - Usually this means that there is only traffic in one direction. DHCP server receives requests, replies to it, but does not ever receive an accept from the client (most likely reply was lost between the server and client).

llubik · Thu Jun 04, 2020 8:25 am

To Strods:
I verify, but then how is it possible that I updated from 6.44.x to 6.45.8 and then to stable 6.46.3 if he didn't have the correct IP ?
THX

Jotne · Thu Jun 04, 2020 8:43 am

My hAP ac2 did upgrade without problem to 6.47.
I guess you now that you have to select stable in channel to see the upgrade?

Thu Jun 04, 2020 9:19 am

For example, if there is some kind of a cache between your router and download servers, then it can cache old "LATEST.6" file and as a result you might see wrong version number here. Then router downloads ("upgrade.mikrotik.com/routeros/package" + LATEST.6 file contents) file.

dakotabcn · Thu Jun 04, 2020 10:11 am

Hello
I have a curious problem and it only happens to me with a router RB4011 without wifi: winbox via local connects perfectly, via VPN L2TP or does not connect (it remains in downloading descriptors) or when it accesses it does not load and it remains blank, with other routers in 6.46.6 does not happen, with a 4011 wireless version with 6.47 does not give this error

llubik · Thu Jun 04, 2020 10:14 am

But if someone had a long-term file somewhere in the cache, both stable and test?
long-term 6.45.8, stable 6.46.3 and tester 6.47beta35? I don't have any cache, only if the ISP had what it seemed to me probably, since there was no problem yet. . . Can I download eg 6.46.6 manually and upload to files-flash? Is my system updating after a reboot?

eworm · Thu Jun 04, 2020 10:35 am

It seems to me that DNS FWD does not work if there is DoH set up. I can imagine people who want to FWD their internal domain zones while securing all external/public requests.
(If you want to test it, remember to flush cache before every request)

I brought this topic up for beta and rc releases... Mikrotik's answer was that DoH is always preferred when configured.
In general that's a good idea, with this exception: I want to forward specific zones to dns servers in local network or vpn.

So please chance the priority list:

forwarding with FWD record
DoH
regular DNS

We want conditional forwarding of DNS queries AND DoH at the same time.

DeGlucker · Thu Jun 04, 2020 11:00 am

I have two routers at home, HAP AC2 and selfmade x86. After ROS upgrade to 6.47 I have faced with following problems:
HAP AC2: there were script errors in the log (fixed by clearing config and re-applying backup)
x86: no more discoverable by WinBOX. DHCP client on WAN interface is getting IP address too long, about several minutes.

eworm · Thu Jun 04, 2020 11:13 am

Just found another hiccup with DNS and DoH...

Let's assume I have a domain eworm.de (I do!

), which has A and AAAA records. My router has a record router.eworm.de, using *.router.eworm.de as local zone:

/ip dns static
add address=10.0.0.1 name=router.eworm.de
add address=10.0.0.10 name=host.router.eworm.de

This worked with RouterOS up to version 6.46.x:

$ dig +short A host.router.eworm.de @mt-6-46
10.0.0.10
$ dig +short AAAA host.router.eworm.de @mt-6-46

Last command does not give output, as NXDOMAIN is returned. Clients in my network just use the IPv4 address.

Now the same with RouterOS 6.47, same static records, DoH enabled:

$ dig +short A host.router.eworm.de @mt-6-47
10.0.0.10
$ dig +short AAAA host.router.eworm.de @mt-6-47
eworm.de.
2a01:4f8:13a:16c2::80

It does not find a record locally, so querying Doh. It finds a CNAME for eworm.de, then returns the AAAA address.
Nowadays clients prefer IPv6 if available, so my traffic goes to my public server instead of local host.

I would see this behavior correct, so fine with me - if I can work around. My idea was to add a catch-all NXDOMAIN at the end of static records:

/ip dns static
add address=10.0.0.1 name=router.eworm.de type=A
add address=10.0.0.10 name=host.router.eworm.de type=A
add regexp=".*\\.router\\.eworm\\.de\$" type=NXDOMAIN

But that's even worse: I get NXDOMAIN for all queries about *.router.eworm.de. Looks like regular expressions are handled first? IMHO this is a bad idea. More specific rules should match first. (Compared to routing: Would be a bad idea if default route is considered first!)

Currently thinking about a solution... I could keep the catch-all record, then convert all records to regular expression - probably a bad idea in terms of performance (and readability). Or I add two records for every address, simple A record (10.0.0.1) and AAAA record representing the IPv4 address (::ffff:10.0.0.1). I do not like both.

Mikrotik, I would like to see the default behavior changed. Either ...

use simple (non-regexp) records first or ...
apply the static list from top to bottom - regardless of whether it is simple or regexp

Please make the typical use cases work in combination with DoH!

bpwl · Thu Jun 04, 2020 11:18 am

bpwl,krafg - The antenna gain setting is not available there anymore for the routers that have a built-in antenna.

Hi Strods, a sad choice , but its your RouterOS.

Problem is not for me, I'll handle it using CLI, but will not advice this to newbies on this forum.. (Or they have to stay with 6.46.6 for a while).
You should check your MUM presentations, where people explain how to reduce the TXpower in the proper way (with antenna gain) better than setting it manually.
(Ron Touw, minute 37 : https://www.youtube.com/watch?v=pmtB3LlwquA)

We only have "poor mans band steering" with Mikrotik , and that's OK as we can play with the TXpower. That is explained by many to set the 2.4 GHz band 7 dBm lower than the 5 GHz radio.
And on Mikrotik the best and easy way to do that is adding 7 dBi tot the antenna gain on the 2.4 GHz WLAN interface.

So advice will now be: for the 2.4 GHz band,: "use regulatory domain, set the right country, look in Status for the dBm value (eg 17dBm). Now use "manual-TXpower", "no_country_set" (your TX power has risen to 25 dBm) , and manually set your TXpower as 'all rates fixed' to 17-7=10dBm. Don't be tempted to use the 25 dBm". You may need "Network analyzer" or "inSSIDer" , or any other wifi monitor to know what you are doing."

sohel07 · Thu Jun 04, 2020 11:51 am

This is the actual result of DoH. This build(6.47) is same as 6.47rc2. I'm fetching DoH connection error: idle timeout issue from both versions. This issue solves by rebooting router but not permanently. It starts after sometimes.

A.PNG

A1.PNG

a2.PNG

This will continue until reboot and start again this loop.

mgisbers · Thu Jun 04, 2020 11:59 am

I brought this topic up for beta and rc releases... Mikrotik's answer was that DoH is always preferred when configured.
In general that's a good idea, with this exception: I want to forward specific zones to dns servers in local network or vpn.

So please chance the priority list:

forwarding with FWD record

DoH

regular DNS
We want conditional forwarding of DNS queries AND DoH at the same time.

+1 !!!

pe1chl · Thu Jun 04, 2020 12:05 pm

wuffzack,pe1chl - Please send two supout files from this router to support@mikrotik.com (one from v6.47 and one from the previous version that was installed on your router).

Do you seriously expect us to keep an archive of supout files made before upgrading so we can send them to you in case there is a problem after upgrading??
I never saw that mentioned in upgrade instructions. I do have an export of the IPsec config for this tunnel as it was on 6.46.2 (before upgrade):

/ip ipsec profile
add dh-group=modp1536 enc-algorithm=aes-128 lifetime=8h name=modp1536 \
    nat-traversal=no
/ip ipsec peer
add address=x.x.x.x/32 comment=peername disabled=yes local-address=\
    x.x.x.x name=peer-peername profile=modp1536
/ip ipsec policy
add comment=peername disabled=yes dst-address=x.x.x.x/32 proposal=\
    modp1536 sa-dst-address=x.x.x.x sa-src-address=x.x.x.x \
    src-address=x.x.x.x/28 tunnel=yes

After upgrading to 6.47 this showed peer "unknown" in the policy and it had added peer=*FFFFFFFF
I presume the conversion went wrong because policy and peer were disabled during the upgrade.
Another tunnel with similar config which was enabled at that time got converted OK.

pe1chl · Thu Jun 04, 2020 12:08 pm

templeos - We will consider changing the topic of these messages, but I think that you would like to know if the DNS server is not reachable when someone tries to use it.

Consider rate-limiting the messages. Only print the message when it has not been printed within the last 10 or 60 seconds or so.

pe1chl · Thu Jun 04, 2020 12:21 pm

I brought this topic up for beta and rc releases... Mikrotik's answer was that DoH is always preferred when configured.
In general that's a good idea, with this exception: I want to forward specific zones to dns servers in local network or vpn.

I don't think it was a good idea. Probably the "MikroTik anwer" only described what was done in the actual implementation, not what should have been done.

IMHO the DNS resolver should take DNS (UDP/TCP port 53) requests from the clients, then:

- lookup the requested data in the static/cache table to find any static records or cached items.  if found, return them.
- when the found item is FWD, forward the query to specified server using DNS (UDP/TCP port 53)
- when not found, check the configuration:
  - when DoH is configured, forward the query over DoH.
  - when DoH is not configured, forward it to one of the configured DNS servers (as before DoH was added).
- when the reply is received, store it in the cache and return it to the client.

One could also state that when DoH is configured using a hostname and DNS servers are configured as well, the lookup of the DoH hostname should automatically be done using the DNS servers. But such "fallback" action may or may not be what you want for normal operation, maybe there should be a config checkmark for that.
("use DNS servers when DoH fails")

templeos · Thu Jun 04, 2020 12:55 pm

templeos - We will consider changing the topic of these messages, but I think that you would like to know if the DNS server is not reachable when someone tries to use it.
Consider rate-limiting the messages. Only print the message when it has not been printed within the last 10 or 60 seconds or so.

Totally agree. There's no need to have the same log a gazillion times. This pretty much happens with every DoH dns warning and error. Not the topic is the issue here. It's the amount of messages in the log.

diablothebest · Thu Jun 04, 2020 1:22 pm

cAP ac with 6.47 no brodcast 5G network, but in WinBox no errors. All seems fine.
Downgrade it to LongTerm - all now works fine.
Ideas?

td32 · Thu Jun 04, 2020 1:28 pm

cAP ac with 6.47 no brodcast 5G network, but in WinBox no errors. All seems fine.

most probably dfs channel, wait or set a non dfs one

HZsolt · Thu Jun 04, 2020 2:39 pm

I did not get IPv6 DNS Server's IP addresses with RA. Neither with LAN and neither with WLAN connections. I did disable IPv6 firewall, but nothing. 6.47 version of ROS.

SnkB · Thu Jun 04, 2020 2:43 pm

Here in my hEX S it increased rapidly!
Short uptime and is at 87k +
13h uptime
This must be corrected !!

Downgrading to 6.45.9 while the problem with sector recording is not resolved.
When the fix is released, I'll be back again.

jindranix · Thu Jun 04, 2020 2:53 pm

"Delegated-IPv6-Prefix" attribute for PPPoE still doesn't work... Please...

viewtopic.php?f=2&t=89443

pe1chl · Thu Jun 04, 2020 3:14 pm

I did not get IPv6 DNS Server's IP addresses with RA. Neither with LAN and neither with WLAN connections. I did disable IPv6 firewall, but nothing. 6.47 version of ROS.

I don't think there was a change in this functionality, do you know how (limited) it worked in previous versions?

rooneybuk · Thu Jun 04, 2020 3:47 pm

Memory just keeps increasing since upgrade on my 2011UiAS

2020-06-04 13_48_03-Window.png

kd2pm2 · Thu Jun 04, 2020 5:30 pm

This is the actual result of DoH. This build(6.47) is same as 6.47rc2. I'm fetching DoH connection error: idle timeout issue from both versions. This issue solves by rebooting router but not permanently. It starts after sometimes.
A.PNG

A1.PNG

a2.PNG

This will continue until reboot and start again this loop.

I was getting the same until I got the proper root cert imported for cloudflare-dns.com. Once the CRL's were udpated, it stopped. Been clean for almost a day now. And I dont use cloudflare-dns.com I actually use 1.1.1.1/dns-query instead so I dont have to do a local DNS lookup and dont have to have non-DOH addresses in my DNS settings...

roe1974 · Thu Jun 04, 2020 5:42 pm

where did you get the "the proper root cert for cloudflare-dns.com" ?
Richard

diablothebest · Thu Jun 04, 2020 5:47 pm

cAP ac with 6.47 no brodcast 5G network, but in WinBox no errors. All seems fine.
most probably dfs channel, wait or set a non dfs one

Ok! Thx you! Now upgrade to 6.47 again and check! Post here later....

Sob · Thu Jun 04, 2020 7:19 pm

@eworm: There's a difference whether queried name doesn't exist at all (NXDOMAIN, i.e. there are no records for it of any type) or only records of requested type don't exist (but records of other types do).

But otherwise you're right, DoH behaviour is terribly inconsistent with non-DoH, and it's not just support for FWD:

In previous RouterOS and in current RouterOS without DoH, when you add static record of *any* type, it in fact "blocks" *all* record types for the name. E.g. if <name> has A/AAAA/TXT in public DNS and you add only static A for <name> to router, then when you ask router for AAAA or TXT for <name>, it will say there's none (returns zero answers). To be honest, I never noticed this before and I'm not yet sure if it's correct/wanted or not. But when you use DoH, it doesn't happen anymore. When you add static A for <name>, it overrides only type A. Queries for other types are forwarded to DoH resolver and you get the behaviour you're seeing.

If the behaviour used by DoH is correct, then (aside from that it should be the same for both) you don't need NXDOMAIN, but something like (one of):

/ip dns static add name=<name> type=AAAA address=<some special value indicating that there's no data>
/ip dns static add name=<name> type=AAAA no-data=yes

Better the latter, because it would be useful for all record types. Perhaps also special "type=ALL no-data=yes" as fallback.

-

And about regexps, I never liked them in DNS. So far they were avoidable, but not anymore, and I think it's wrong decision. If I have local domain.tld, I want type=FWD to forward all subdomains, it's the most common and logical use case. Same for type=NXDOMAIN, it should automatically cover all subdomains, because if "domain.tld" doesn't exist, then "sub.domain.tld" can't either.

[*]apply the static list from top to bottom - regardless of whether it is simple or regexp

I don't think you want this. The nice thing about DNS is that it's hierarchical and searches can be optimized, so even when you have many records, it can be very fast. That's until you introduce non-DNS-like things like regexps, they ruin the simplicity, because it's another layer that requires different processing. They are useful, but they should be and extra tool and all simple configs should be possible without them.

Pea · Thu Jun 04, 2020 7:36 pm

where did you get the "the proper root cert for cloudflare-dns.com" ?
Richard

This is all you need:

/tool fetch url=https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem
/certificate import file-name=DigiCertGlobalRootCA.crt.pem passphrase=""
/ip dns set use-doh-server=https://1.1.1.1/dns-query verify-doh-cert=yes

rajo · Thu Jun 04, 2020 7:45 pm

Anyone else with a large number (over 130) of L2TP clients (only L2TP i.e. not L2TP/IPSec) notice that with 6.47, only a fraction (about 30 to 40) are able to connect to the router? I had to revert to 6.46.x to get my tunnels connected again.

tricyclevent · Thu Jun 04, 2020 7:58 pm

i have no idea how to make more free space...
hAP lite

Jotne · Thu Jun 04, 2020 8:12 pm

i have no idea how to make more free space...
hAP lite

Install an older smaller image, then upgrade to latest.

osc86 · Thu Jun 04, 2020 8:42 pm

Install an older smaller image, then upgrade to latest.

Can't really recommend this. The past has shown that constantly downgrading and upgrading between different versions can lead to a corrupted configuration or an unstable system.
The scripts used for converting the configuration are not perfect (like the ipsec issue pe1chl reported)
I've experienced this myself more than one time.
Better make a full backup of the current installation, netinstall the latest version and import the backup.

jetelina · Thu Jun 04, 2020 9:06 pm

Hi,
I have two devices CRS328-24P-4S+RM + hAP ac and I have upgraded to 6.47. All done via Winbox 3.24. Here are some bugs:
1. Previously the icon for disabled user was gray, currently is red. Should be gray. Happens on both devices.
2. When I exported my settings with command [code]export file=yyyy-mm-dd-export[/code] all ports are exported with [code]speed=100Mbps[/code], so the export looks like:
[code]
set [ find default-name=ether15 ] speed=100Mbps
set [ find default-name=ether16 ] speed=100Mbps
set [ find default-name=ether17 ] disabled=yes speed=100Mbps
set [ find default-name=ether18 ] disabled=yes speed=100Mbps
[/code]
- This is wrong, because I use 1Gbps. It is added by mistake and it may cause troubles when restoring backup. Happens on both devices.
3. I have downloaded certificates for DoH with commands
[code]
/tool fetch url=https://cacerts.digicert.com/DigiCertECCSecureServerCA.crt.pem
/tool fetch url=https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem
[/code]
- Then I have imported both of them.
- Then enabled DoH (DoH running fine)
- Then I have deleted DigiCertECCSecureServerCA and "autosupout.rif" was created wtin about 560 Kb. I think that something crashed.
4. I was not able to make Certificate Revovation List work
- Settings - Check CRL Download + Check Use CRL + Store RAM + Apply and whole DoH is down.
- There is error "DoH server connection error: SSL: handshake failed: unable to get certificate CRL (6)"
- I have imported only 2 certificates above. But CRL is using HTTP, so why it tries anything with SSL?
- I had there two links
Dynamic: http://crl3.digicert.com/DigiCertGlobalRootCA.crl (added with DigiCertECCSecureServerCA.crt.pem)
http://cacerts.digicert.com/DigiCertGlobalRootCA.crl (manual)

pe1chl · Thu Jun 04, 2020 9:46 pm

For example, if there is some kind of a cache between your router and download servers, then it can cache old "LATEST.6" file and as a result you might see wrong version number here. Then router downloads ("upgrade.mikrotik.com/routeros/package" + LATEST.6 file contents) file.

In my experience it sometimes happens that "System->Packages->Check for updates" does not work even though upgrade.mikrotik.com can be pinged.
E.g. yesterday one of the routers I wanted to upgrade (a CCR1009) displayed only the empty window where the release-notes would be displayed and the "latest version" field showed the 6.46.x version that it had last shown when I checked before (6.46.5 if I remember well).
I let it sit for a couple of minutes but no change. I then rebooted the router and checked again, this time it worked on first try. Download&Install went without trouble.

I have seen that before. Of course I am aware of issues with firewall or DNS setup that can cause problems, but that wasn't it (or reboot would not fix it). Also, when there is a connectivity issue there usually is an error message quite quickly (failure to lookup the hostname, failure to connect the upgrade server). That wasn't happening here.

pe1chl · Thu Jun 04, 2020 9:50 pm

Can't really recommend this. The past has shown that constantly downgrading and upgrading between different versions can lead to a corrupted configuration or an unstable system.

It is a known problem with hAP mini!
Basically it is just a toy. Nice for experiments, some niche applications like WiFi client for wired systems or similar, but not intended for complicated usage scenarios.
Netinstall new version and reset and start from scratch, when that "is a lot of work" it is time to think about a router with a little more resources.

That being said, I was able to update my hAP mini using the "separate packages" method:
- download "extra packages" file (all_packages-smips-6.47.zip)
- unzip
- use FTP to upload only the desired packages to the router (not the ones that have been disabled or are not part of the combined package)
- reboot the router using system->reboot.

Now it is at 6.47 with even 7.7MB free...

Jotne · Thu Jun 04, 2020 10:02 pm

2. When I exported my settings with command
Code: Select all
export file=yyyy-mm-dd-export
all ports are exported with
Code: Select all
speed=100Mbps
, so the export looks like:
Code: Select all
set [ find default-name=ether15 ] speed=100Mbps
set [ find default-name=ether16 ] speed=100Mbps
set [ find default-name=ether17 ] disabled=yes speed=100Mbps
set [ find default-name=ether18 ] disabled=yes speed=100Mbps
- This is wrong, because I use 1Gbps. It is added by mistake and it may cause troubles when restoring backup. Happens on both devices.

If you did search for this here on the forum, you would have found this viewtopic.php?t=100057
This is normal and has been like this for many years.

videolab · Thu Jun 04, 2020 10:10 pm

Antenna Gain? No accept Italy country

SnkB · Thu Jun 04, 2020 11:02 pm

fs0c13ty,Grant,dvm,ErfanDL,pe1chl,dvm,pendie,Paternot,denisnk,JohnTRIVOLTA,WeWiNet,mirolm,faxxe,SnkB,nmt1900,osc86,pe1chl - We are currently looking into this.

Any forecast for fixing this error in the high writing of the NAND sectors?
Thanks for listening!

Paternot · Thu Jun 04, 2020 11:15 pm

fs0c13ty,Grant,dvm,ErfanDL,pe1chl,dvm,pendie,Paternot,denisnk,JohnTRIVOLTA,WeWiNet,mirolm,faxxe,SnkB,nmt1900,osc86,pe1chl - We are currently looking into this.
Any forecast for fixing this error in the high writing of the NAND sectors?
Thanks for listening!

I got this answer from support:

"Thank you for your report. Our team is working on this. The issue will be resolved in the upcoming RouterOS releases."

patrickmkt · Thu Jun 04, 2020 11:59 pm

Yes OVPN with certificates works again.... I can at last reconnect with my remote routers...

anav · Fri Jun 05, 2020 12:55 am

fs0c13ty,Grant,dvm,ErfanDL,pe1chl,dvm,pendie,Paternot,denisnk,JohnTRIVOLTA,WeWiNet,mirolm,faxxe,SnkB,nmt1900,osc86,pe1chl - We are currently looking into this.
Any forecast for fixing this error in the high writing of the NAND sectors?
Thanks for listening!
I got this answer from support:

"Thank you for your report. Our team is working on this. The issue will be resolved in the upcoming RouterOS releases."

My Feedback was a bit different.
" Thank you for your report. As soon as the coder for this area of the firmware and the test designer, recover from their injuries, the updated patch work will begin and we expect it to be ready by the next release. Funny they always opt for the beating and not the cut in pay. In any case, we are aware of the problem and will have it fixed soonest.

nexusds · Fri Jun 05, 2020 4:02 am

another bug ... when going under IP/IPSec/Policy, and opening an existing one seems to exit winbox/crash winbox.

Fri Jun 05, 2020 6:11 am

dakotabcn - This does not seem to be related to v6.47. Please send supout file from this router to support@mikrotik.com.
llubik - Upgrade simply looks for upgrade.mikrotik.com/routeros/LATEST.6 file. Of course, you can download files from our download page, upload them to the router and reboot it.
DeGlucker - Problem with script error was already mentioned above. It will be fixed. Regarding the neighbor discovery issue, please provide supout file to support@mikrotik.com.
eworm - We will look into this.
sohel07,diablothebest,rajo - Please provide supout file from this router (generated while the issue is present) to support@mikrotik.com.
pe1chl - No, we do not. Since you were posting a problem report here in the forum, I did ask for a file (if you have one) and if you do not have one, thought that you might downgrade, generate file and upgrade again. Regarding the DoH logs, what to do if the server is not reachable once for a second? Administrators should know about it.
HZsolt - Did the same configuration work just fine on previous RouterOS versions?
rooneybuk - Did you make any changes after an upgrade (for example, enabled DoH or something else).
tricyclevent - Instead of using the RouterOS bundle package with disabled packages, you can install separate packages. Download them on our download page, upload to the router, and simply reboot it. Seems that you need to install only five packages, but currently there are ten installed on the router.
jetelina - Speed parameter shows the speed that is used if auto-negotiation is disabled. This was an old issue and the fact that you see this in the export shows that the issue is already resolved (100 Mbps shows in export since it does not default value anymore).
anav - I presume that this is a joke, but please do not post such messages. MikroTik did not provide such an answer to anyone in our support channel.
nexusds - I do not see such an issue. Maybe a specific policy is required. Please provide supout to support@mikrotik.com and name which policy did trigger this issue.

Everyone - DNS wiki page has been updated - https://wiki.mikrotik.com/wiki/Manual:I ... over_HTTPS
Everyone - I just wanted to remind you that if there is a new issue introduced in the concrete RouterOS version then please report this issue to support@mikrotik.com right away.

lordzar · Fri Jun 05, 2020 6:22 am

I have a situation where I have a central WAP (INTL) and 2 HAP's (US) as bridges. They USED to use the 5Ghz band and after the upgrade it all BROKE.

I correctly had frequency-mode set to regulatory-domain, but apparently Mikrotik removed countries from the definitions based on the hardware version (INTL vs US).

Got everything running by switching the links to 2Ghz. 5Ghz is still broken.

I don't see a reason I shouldn't be able to use an INTL version and a US version together as long as you're properly using the settings for your region.

guipoletto · Fri Jun 05, 2020 6:36 am

The new icons are horrible.

Especially the fact that a lot of color tones were changed.
a lot of muscle memory trown out in the trash, now my brain always goes in to alarm mode navigating the menus. "this is different, what did i do wrong!?"

Reinis · Fri Jun 05, 2020 6:39 am

I have a situation where I have a central WAP (INTL) and 2 HAP's (US) as bridges. They USED to use the 5Ghz band and after the upgrade it all BROKE.

I correctly had frequency-mode set to regulatory-domain, but apparently Mikrotik removed countries from the definitions based on the hardware version (INTL vs US).

Got everything running by switching the links to 2Ghz. 5Ghz is still broken.

I don't see a reason I shouldn't be able to use an INTL version and a US version together as long as you're properly using the settings for your region.

What you mean by "all BROKE"? Could you please be more precise? Depending on what exact version you've upgraded from, regulatory settings could have changed.
You can use the command "/interface wireless info allowed-channels wlan" to check allowed channels with your current settings. If setting both sides identically still does not make a connection, please write an e-mail to support@mikrotik.com and provide supout.rif from AP and STA.

Jotne · Fri Jun 05, 2020 8:15 am

Everyone - DNS wiki page has been updated - https://wiki.mikrotik.com/wiki/Manual:I ... over_HTTPS

Just a comment to the Wiki that it does miss some information. When importing the certificate, you are asked for a password phrase. This is not mention in the Wiki and it not clear for me when to use this password.

And also, how do I know what DNS the router use to do the lookup?
Normal DNS 1.1.1.1 or using DoH cloudflare-dns.com. There are nothing in the logs telling you where the routers sends the DNS. I have allowed Remote Request, so if you do ask me, it could be both, since the router looks up cloudflare DNS using 1.1.1.1, why should it not look up remote request this way. It should be more clear what DNS system the router uses to look up remote request.

Pea · Fri Jun 05, 2020 8:26 am

No passphrase needed for this root CA cert.
And no other DNS needed when you use this Cloudflare url "https://1.1.1.1/dns-query" as it contains ip which is also included within the certificate.

/tool fetch url=https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem
/certificate import file-name=DigiCertGlobalRootCA.crt.pem passphrase=""
/ip dns set use-doh-server=https://1.1.1.1/dns-query verify-doh-cert=yes

Jotne · Fri Jun 05, 2020 8:37 am

I do think that is a better solution. It clear where DNS go, since you only have DoH configured. Wiki should at least be updated with that no password are needed.

Are there option to use other DoH than Cloudflare?

Fri Jun 05, 2020 10:07 am

Of course, use any DoH server. Just like you can use any DNS server or any ISP connection. We can't tell you what provider to use.

ErfanDL · Fri Jun 05, 2020 10:13 am

Of course, use any DoH server. Just like you can use any DNS server or any ISP connection. We can't tell you what provider to use.

what about local DOH server ? I have a cloudflare local DOH but not working with mikrotik.

msatter · Fri Jun 05, 2020 10:16 am

But if someone had a long-term file somewhere in the cache, both stable and test?
long-term 6.45.8, stable 6.46.3 and tester 6.47beta35? I don't have any cache, only if the ISP had what it seemed to me probably, since there was no problem yet. . . Can I download eg 6.46.6 manually and upload to files-flash? Is my system updating after a reboot?

This is more general information.
You can check if there is a 'hidden' update file present en then you can remove it by using "cancel".

/system package update print
channel: testing
installed-version: 6.47
latest-version: 6.47rc2
status: Downloaded, please reboot router to upgrade it

/system package update cancel

/system package update print
channel: testing
installed-version: 6.47
latest-version: 6.47rc2

This was to test the existence of the 'hidden' downgrade file and I set my channel back to stable.

msatter · Fri Jun 05, 2020 10:21 am

Of course, use any DoH server. Just like you can use any DNS server or any ISP connection. We can't tell you what provider to use.
what about local DOH server ? I have a cloudflare local DOH but not working with mikrotik.

What do mean by "local"? Is that a local program (client) running on a other device in your local network connection to Cloudflare?

ErfanDL · Fri Jun 05, 2020 10:33 am

Of course, use any DoH server. Just like you can use any DNS server or any ISP connection. We can't tell you what provider to use.
what about local DOH server ? I have a cloudflare local DOH but not working with mikrotik.
What do mean by "local"? Is that a local program (client) running on a other device in your local network connection to Cloudflare?

I'm using cloudflare DOH server on raspberrypi
https://blog.cloudflare.com/deploying-g ... d-pi-hole/
also there is a problem with cloudflare public gateway over DOH. An error that appears in the mikrotik log:

DoH server connection error: SSL: handshake failed: unable to get local issuer certificate (6)

llubik · Fri Jun 05, 2020 10:35 am

To msatter:
[l@MKT] > /system package update print
channel: stable
installed-version: 6.46.3
latest-version: 6.46.3
status: System is already up to date
[l@MKT] > /system package update cancel

[l@MKT] > /system package update print
channel: stable
installed-version: 6.46.3
latest-version: 6.46.3

THX, I will update manually, it doesn't cause any problem for me

Fri Jun 05, 2020 11:14 am

llubik - Did you try "/system package update check-for-updates"?

llubik · Fri Jun 05, 2020 11:48 am

channel: stable
installed-version: 6.46.3
latest-version: 6.46.3
status: System is already up to date

pe1chl · Fri Jun 05, 2020 12:00 pm

pe1chl - No, we do not. Since you were posting a problem report here in the forum, I did ask for a file (if you have one) and if you do not have one, thought that you might downgrade, generate file and upgrade again. Regarding the DoH logs, what to do if the server is not reachable once for a second? Administrators should know about it.
right away.

I would hope (and assume) that at MikroTik, you have ample resources to setup a router at 6.46.2 or similar, create an IPsec tunnel and set it to disabled, and then try the upgrade. For me to replicate that, I would either have to take down my network, or try the operation on a CHR which I first have to create. I assume you can create new CHR instances running a specified version in a few seconds.
Note that my report is merely to inform you of trouble I had when doing an upgrade, and not something that *I* need to have fixed, because *I* would ever encounter it again. But other customers might encounter it and *you* may be interested in looking at it and fixing it. If not, then there are more important issues to worry about.

W.r.t. the DoH, consider the following simple implementation:
- setup a global variable (or in the context of the DoH server once you implement multiple DoH servers) "last_connect_error_time" initialized to 0 at boot.
- when you get such a connection error, examine the variable. When (time_now - last_connect_error_time) > 60 seconds, log the error and then set last_connect_error_time = time_now.

With that, any new connection error will be immediately logged at the time it occurs, but further errors will not be logged until at least a minute passes.
So in an environment where you get hundreds of DNS requests per second (as we have in our network with hundreds of clients), the logs will not be overwhelmed but the problem will still be noticed.

HZsolt · Fri Jun 05, 2020 12:05 pm

dakotabcn - This does not seem to be related to v6.47. Please send supout file from this router to support@mikrotik.com.
llubik - Upgrade simply looks for upgrade.mikrotik.com/routeros/LATEST.6 file. Of course, you can download files from our download page, upload them to the router and reboot it.
DeGlucker - Problem with script error was already mentioned above. It will be fixed. Regarding the neighbor discovery issue, please provide supout file to support@mikrotik.com.
eworm - We will look into this.
sohel07,diablothebest,rajo - Please provide supout file from this router (generated while the issue is present) to support@mikrotik.com.
pe1chl - No, we do not. Since you were posting a problem report here in the forum, I did ask for a file (if you have one) and if you do not have one, thought that you might downgrade, generate file and upgrade again. Regarding the DoH logs, what to do if the server is not reachable once for a second? Administrators should know about it.
HZsolt - Did the same configuration work just fine on previous RouterOS versions?
rooneybuk - Did you make any changes after an upgrade (for example, enabled DoH or something else).
tricyclevent - Instead of using the RouterOS bundle package with disabled packages, you can install separate packages. Download them on our download page, upload to the router, and simply reboot it. Seems that you need to install only five packages, but currently there are ten installed on the router.
jetelina - Speed parameter shows the speed that is used if auto-negotiation is disabled. This was an old issue and the fact that you see this in the export shows that the issue is already resolved (100 Mbps shows in export since it does not default value anymore).
anav - I presume that this is a joke, but please do not post such messages. MikroTik did not provide such an answer to anyone in our support channel.
nexusds - I do not see such an issue. Maybe a specific policy is required. Please provide supout to support@mikrotik.com and name which policy did trigger this issue.

Everyone - DNS wiki page has been updated - https://wiki.mikrotik.com/wiki/Manual:I ... over_HTTPS
Everyone - I just wanted to remind you that if there is a new issue introduced in the concrete RouterOS version then please report this issue to support@mikrotik.com right away.

Dear strods!

Yes! Same configuration.

pe1chl · Fri Jun 05, 2020 12:08 pm

Of course, use any DoH server. Just like you can use any DNS server or any ISP connection. We can't tell you what provider to use.
what about local DOH server ? I have a cloudflare local DOH but not working with mikrotik.
What do mean by "local"? Is that a local program (client) running on a other device in your local network connection to Cloudflare?
I'm using cloudflare DOH server on raspberrypi
https://blog.cloudflare.com/deploying-g ... d-pi-hole/
also there is a problem with cloudflare public gateway over DOH. An error that appears in the mikrotik log:
Code: Select all
DoH server connection error: SSL: handshake failed: unable to get local issuer certificate (6)

Apparently you have not installed it correctly, or you have not configured the MikroTik router correctly.
When you make your own DoH server, of course you need to get a certificate for it, and you need to load the root certificate for that into the MikroTik just as described on the WiKi.

dioeyandika · Fri Jun 05, 2020 12:09 pm

hi this first post i made, i am trying using this new feature DoH DNS using Adguard DNS, seem everything work fine, but it seem using full DNS cache, i even tried to increasing the cache to 10000 KiB, it full in no time, i tried too flush the cache but it seem cache used still not decreasing, does this normal behavior for DoH DNS?

reso.JPG

dns static.JPG

cache.JPG

sert.JPG

Arrr8 · Fri Jun 05, 2020 12:13 pm

Just updated my hAP ac^2 to 6.47 and configured DoH. For some reason the DoH-options are missing in the web interface. Yet the DoH configuration does show up in CLI. Anyone else have this problem?

[admin@MikroTik] /ip dns> print
                      servers: 1.1.1.1
              dynamic-servers: 
               use-doh-server: https://cloudflare-dns.com/dns-query
              verify-doh-cert: yes
        allow-remote-requests: yes
          max-udp-packet-size: 4096
         query-server-timeout: 2s
          query-total-timeout: 10s
       max-concurrent-queries: 100
  max-concurrent-tcp-sessions: 20
                   cache-size: 2048KiB
                cache-max-ttl: 1w
                   cache-used: 193KiB

PashaT · Fri Jun 05, 2020 12:14 pm

I have a problem with the DHCP Server. I have connected a TP LINK AP200 as a repeater/bridge of the wifi network of Mikrotik. The repeater connects ok, I can ping it and login to web interface. When a client connects to tp link wifi network it can't get IP. The mikrotik log says DHCP Server offering lease 192.168.88.114 for (mac of the client) to (mac of the TP LINK) without success. If I put static ip to the client and connect to TP link everything works ok. I downgraded to firmware 6.46.6 and it works fine.

+1
Cisco management switch with all its clients have lost access to the internet. After downgrading to 6.46.6 and power cycle for Cisco issue was resolved.

ErfanDL · Fri Jun 05, 2020 12:54 pm

Of course, use any DoH server. Just like you can use any DNS server or any ISP connection. We can't tell you what provider to use.
what about local DOH server ? I have a cloudflare local DOH but not working with mikrotik.
What do mean by "local"? Is that a local program (client) running on a other device in your local network connection to Cloudflare?
I'm using cloudflare DOH server on raspberrypi
https://blog.cloudflare.com/deploying-g ... d-pi-hole/
also there is a problem with cloudflare public gateway over DOH. An error that appears in the mikrotik log:
Code: Select all
DoH server connection error: SSL: handshake failed: unable to get local issuer certificate (6)
Apparently you have not installed it correctly, or you have not configured the MikroTik router correctly.
When you make your own DoH server, of course you need to get a certificate for it, and you need to load the root certificate for that into the MikroTik just as described on the WiKi.

but I installed the certificate from the mikrotik DOH wiki tutorial !

kd2pm2 · Fri Jun 05, 2020 2:04 pm

what about local DOH server ? I have a cloudflare local DOH but not working with mikrotik.
What do mean by "local"? Is that a local program (client) running on a other device in your local network connection to Cloudflare?
I'm using cloudflare DOH server on raspberrypi
https://blog.cloudflare.com/deploying-g ... d-pi-hole/
also there is a problem with cloudflare public gateway over DOH. An error that appears in the mikrotik log:
Code: Select all
DoH server connection error: SSL: handshake failed: unable to get local issuer certificate (6)
Apparently you have not installed it correctly, or you have not configured the MikroTik router correctly.
When you make your own DoH server, of course you need to get a certificate for it, and you need to load the root certificate for that into the MikroTik just as described on the WiKi.
but I installed the certificate from the mikrotik DOH wiki tutorial !

Erfan DL I suspect that the pi's cloudflared app is not able to validate the cert info you are sending it because it does not know what to do with it. You may want to review the cloudflared documentation to see if its possible to set up cert validation handshake with the router. The cloudflare site probably knows what to do when it sees the router validate the cert but the pi may not

ErfanDL · Fri Jun 05, 2020 2:24 pm

What do mean by "local"? Is that a local program (client) running on a other device in your local network connection to Cloudflare?
I'm using cloudflare DOH server on raspberrypi
https://blog.cloudflare.com/deploying-g ... d-pi-hole/
also there is a problem with cloudflare public gateway over DOH. An error that appears in the mikrotik log:
Code: Select all
DoH server connection error: SSL: handshake failed: unable to get local issuer certificate (6)
Apparently you have not installed it correctly, or you have not configured the MikroTik router correctly.
When you make your own DoH server, of course you need to get a certificate for it, and you need to load the root certificate for that into the MikroTik just as described on the WiKi.
but I installed the certificate from the mikrotik DOH wiki tutorial !
Erfan DL I suspect that the pi's cloudflared app is not able to validate the cert info you are sending it because it does not know what to do with it. You may want to review the cloudflared documentation to see if its possible to set up cert validation handshake with the router. The cloudflare site probably knows what to do when it sees the router validate the cert but the pi may not

forget about Pihole. MikroTik has a problem with the cloudflare gateway over DOH. I installed the root certificate but it gives an error.

doh4.PNG

doh3.PNG

doh2.PNG

doh1.PNG

Fri Jun 05, 2020 2:32 pm

Could you please use "Post reply" button instead of quoting whole posts?
Is it so hard?
Do you think that such "quote escalation" helps to understand flow of discussion when you can just scroll one sentence back?

ErfanDL · Fri Jun 05, 2020 3:26 pm

Could you please use "Post reply" button instead of quoting whole posts?
Is it so hard?
Do you think that such "quote escalation" helps to understand flow of discussion when you can just scroll one sentence back?

OK sorry about that

WildRat · Fri Jun 05, 2020 4:22 pm

Everyone - DNS wiki page has been updated - https://wiki.mikrotik.com/wiki/Manual:I ... over_HTTPS

When I try to follow this instructions with Google DoH DNS and use only GlobalSign Root CA certificate I constantly get "server connection error: SSL: handshake failed: unable to get local issuer certificate (6)". To get DoH working I need to use all 3 certificate from dns.google

llubik · Fri Jun 05, 2020 4:40 pm

Something is wrong somewhere. Manually updated 6.46.3 to 6.46.6

[l@MKT] > /system package update print
channel: stable
installed-version: 6.46.6
latest-version: 6.46.3
status: New version is available
[l@MKT] > /system package update cancel

[l@MKT] > /system package update print
channel: stable
installed-version: 6.46.6
latest-version: 6.46.3

[l@MKT] > /system package update check-for-updates
channel: stable
installed-version: 6.46.6
latest-version: 6.46.3
status: New version is available

/system package update install
download 6.46.3 and instal . . .

eworm · Fri Jun 05, 2020 5:15 pm

To get DoH working I need to use all 3 certificate from dns.google

Depends on whether or not the server ships the intermediate certificate. Then looks like Google server does not.

pe1chl · Fri Jun 05, 2020 5:24 pm

Something is wrong somewhere. Manually updated 6.46.3 to 6.46.6

/system package update install
download 6.46.3 and instal . . .

This likely means your router has been hacked. It is advisable to do a clean netinstall.

nescafe2002 · Fri Jun 05, 2020 5:35 pm

Note that with the new static DNS record types you can forward both forward and reverse lookups:

E.g. server 192.168.100.1 is authoritative server for domain.lan and subnet 192.168.100.0/24:

/ip dns static
# For domain.lan
add forward-to=192.168.100.1 name="domain.lan" type=FWD
# For *.domain.lan
add forward-to=192.168.100.1 regexp="\\.domain\\.lan\$" type=FWD
# For 192.168.100.*
add forward-to=192.168.100.1 regexp="\\.100\\.168\\.192\\.in-addr\\.arpa\$" type=FWD

pe1chl · Fri Jun 05, 2020 5:57 pm

Note that with the new static DNS record types you can forward both forward and reverse lookups:

It is a bit of a pity that the DNS server first checks regexp and then checks literal entries...
I would like to have an entry like:

add regexp="[0-9]*\\.[0-9]*\\.168\\.192\\.in-addr\\.arpa" type=NXDOMAIN

so that reverse-lookups of RFC1918 addresses don't go to the internet DNS servers, but when I also have a static entry for some local things, the reverse for those no longer works.
It would be nice when it first checked for exact matches of static records before it tried the regexp.

nescafe2002 · Fri Jun 05, 2020 6:08 pm

DNS entries are processed sequentially, just move the regex entry to the bottom (order by # column) and it will be checked last.

Sorry, regex seems to evaluated before static entries, which is indeed not to be expected.

eworm · Fri Jun 05, 2020 6:15 pm

It would be nice when it first checked for exact matches of static records before it tried the regexp.

Exactly what I described above with my issue. So +1!

lordzar · Fri Jun 05, 2020 6:29 pm

I have a situation where I have a central WAP (INTL) and 2 HAP's (US) as bridges. They USED to use the 5Ghz band and after the upgrade it all BROKE.

I correctly had frequency-mode set to regulatory-domain, but apparently Mikrotik removed countries from the definitions based on the hardware version (INTL vs US).

Got everything running by switching the links to 2Ghz. 5Ghz is still broken.

I don't see a reason I shouldn't be able to use an INTL version and a US version together as long as you're properly using the settings for your region.
What you mean by "all BROKE"? Could you please be more precise? Depending on what exact version you've upgraded from, regulatory settings could have changed.
You can use the command "/interface wireless info allowed-channels wlan" to check allowed channels with your current settings. If setting both sides identically still does not make a connection, please write an e-mail to support@mikrotik.com and provide supout.rif from AP and STA.

My US HAP's connect to the INTL WAP.

WAP:
channels: 5180/20-Ceee/ac(30dBm),5745/20-Ceee/ac(30dBm),
5750/20-Ceee/ac(30dBm),5755/20-Ceee/ac(30dBm),
5760/20-Ceee/ac(30dBm),5765/20-Ceee/ac(30dBm)

HAP:
channels: 5180/20-Ceee/ac(28dBm)

Settings on all are: Freq=auto, fmode=regulatory-domain, country="united states 3" (although that NOW doesn't seem to be an option on the WAP)

llubik · Fri Jun 05, 2020 6:31 pm

[/quote]

This likely means your router has been hacked. It is advisable to do a clean netinstall.
[/quote]

do you mean netinstal or just Reset Configuration (hw reset and download default configuration)?

pe1chl · Fri Jun 05, 2020 6:48 pm

This likely means your router has been hacked. It is advisable to do a clean netinstall.

do you mean netinstal or just Reset Configuration (hw reset and download default configuration)?

A clean netinstall = download the netinstall program and the current RouterOS version, and re-install the router with format of the filesystem and default configuration.
If desired you can do a /export before you start and save it on your computer to have a guideline when reconfiguring (do not blindly import it, at least check what is there and you did not put there yourself).
Also, do not use "backup"/"restore".

pe1chl · Fri Jun 05, 2020 6:50 pm

DNS entries are processed sequentially, just move the regex entry to the bottom (order by # column) and it will be checked last.

Sorry, regex seems to evaluated before static entries, which is indeed not to be expected.

Indeed, unfortunately re-ordering does not work, I already had my in-addr.arpa regexp at the bottom of the list because I had the static entries in previous versions as well.

WildRat · Fri Jun 05, 2020 7:12 pm

To get DoH working I need to use all 3 certificate from dns.google
Depends on whether or not the server ships the intermediate certificate. Then looks like Google server does not.

Then it's better to reflect this in the manual to avoid future questions. Especially since Firefox allows you to save all required certificates at once:

bpwl · Fri Jun 05, 2020 9:31 pm

My US HAP's connect to the INTL WAP.

WAP:
channels: 5180/20-Ceee/ac(30dBm),5745/20-Ceee/ac(30dBm),
5750/20-Ceee/ac(30dBm),5755/20-Ceee/ac(30dBm),
5760/20-Ceee/ac(30dBm),5765/20-Ceee/ac(30dBm)

HAP:
channels: 5180/20-Ceee/ac(28dBm)

Settings on all are: Freq=auto, fmode=regulatory-domain, country="united states 3" (although that NOW doesn't seem to be an option on the WAP)

Is hAP set to Installation="indoor" instead of "any" ? Mikrotik does not allow outdoor frequencies if set to "indoor". Only "outdoor" and "any" are meaningful settings for Installation.
'Outdoor-only' frequencies do not exist, there are only "indoor-only" frequencies. But for some reason Mikrotik has this "outdoor-only" interpretation on outdoor allowed frequencies.
Rational: indoor-only frequencies disturb emergency services and other priority systems if used outdoor.

[admin@MktOmnitik] > interface wireless info country-info
country: united states3
ranges: 2402-2472/b,g,gn20,gn40(30dBm)
5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)/indoor
5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)/outdoor

With Mikrotiks interpretation, this list should have been
5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)/indoor
5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)

Sob · Fri Jun 05, 2020 9:48 pm

It would be nice when it first checked for exact matches of static records before it tried the regexp.

As I keep telling (to myself, it seems), regexps don't belong to DNS. I can't deny that they can be useful when you want to match things like <anything>.ads.<anydomain>.<tld> or something, but it's closer to hack than proper feature. Basic config should not require use of regexps. No regexps = no problem.

For example, if I configure forwarding in Unbound:

forward-zone:
  name: "168.192.in-addr.arpa"
  forward-addr: 10.0.0.1
  forward-first: no
forward-zone:
  name: "80.168.192.in-addr.arpa"
  forward-addr: 10.0.0.2
  forward-first: no
forward-zone:
  name: "1.80.168.192.in-addr.arpa"
  forward-addr: 10.0.0.3
  forward-first: no

Or BIND:

zone "168.192.in-addr.arpa" IN {
    type forward;
    forward only;
    forwarders { 10.0.0.1; };
};
zone "80.168.192.in-addr.arpa" IN {
    type forward;
    forward only;
    forwarders { 10.0.0.2; };
};
zone "1.80.168.192.in-addr.arpa" IN {
    type forward;
    forward only;
    forwarders { 10.0.0.3; };
};

It works exactly as expected, it uses longest match and PTR query for 192.168.0.1 goes to 10.0.0.1, for 192.168.80.10 to 10.0.0.2, for 192.168.80.1 to 10.0.0.3.

I can do the same (well, as long as I don't need extras like multiple target resolvers for redundancy) with ordered regexps, but it's kind of clumsy:

/ip dns static
add forward-to=10.0.0.3 regexp="^1\\.80\\.168\\.192\\.in-addr\\.arpa\$" type=FWD
add forward-to=10.0.0.2 regexp="^(.+\\.)\?80\\.168\\.192\\.in-addr\\.arpa\$" type=FWD
add forward-to=10.0.0.1 regexp="168\\.192\\.in-addr\\.arpa\$" type=FWD

MikroTik, please, can't we have the standard thing?

/ip dns static
add forward-to=10.0.0.1 name="168.192.in-addr.arpa" type=FWD
add forward-to=10.0.0.2 name="80.168.192.in-addr.arpa" type=FWD
add forward-to=10.0.0.3 name="1.80.168.192.in-addr.arpa" type=FWD

Just copy how others do it, they have been doing it for long time and it works. I'm all for innovations and new ways, but this thing with regexps is not better.

ddimans · Fri Jun 05, 2020 10:03 pm

Hello i get problem w 6.47

I am use ipsec

add auth-method=pre-shared-key-xauth disabled=yes generate-policy=port-override mode-config=cfg2 \
notrack-chain=output password=******* peer=peer1 policy-template-group=VPN_ipsec secret=\
******* username=*******

but i cant set my-id=key-id:****
and auto mode use for my-id my external ip address that wrong. coz i need key-id

i try set it in winbox and console

/ip ipsec identity> set my-id=key-id:****
numbers: 0
failure: XAuth must use auto my-id

and in previous version it work

bawolek · Fri Jun 05, 2020 10:57 pm

hello yesterday I was done upgrade CRS125-24G-1S-2HnD to 6.47 in home, after that upgrade - 3 time I had a freeze transmission on ethernet port. Everything works fine agin when i plug-out and plug-in ethernet cable. Maybe someone have the same problem/observations ?
Of corse I sent to Mikrotik supout.rif file from my routerboard.

jvanhambelgium · Fri Jun 05, 2020 11:08 pm

Some issues start to appear also here on my RB3011 since my 6.47 upgrade , ethernet-ports are flapping down/up.
So far only port3 / port5 and altough I upgrade already yesterday it only started just now...

I prepared a support-file and will deliver it to Mikrotik.

lordzar · Fri Jun 05, 2020 11:12 pm

My US HAP's connect to the INTL WAP.

WAP:
channels: 5180/20-Ceee/ac(30dBm),5745/20-Ceee/ac(30dBm),
5750/20-Ceee/ac(30dBm),5755/20-Ceee/ac(30dBm),
5760/20-Ceee/ac(30dBm),5765/20-Ceee/ac(30dBm)

HAP:
channels: 5180/20-Ceee/ac(28dBm)

Settings on all are: Freq=auto, fmode=regulatory-domain, country="united states 3" (although that NOW doesn't seem to be an option on the WAP)
Is hAP set to Installation="indoor" instead of "any" ? Mikrotik does not allow outdoor frequencies if set to "indoor". Only "outdoor" and "any" are meaningful settings for Installation.
'Outdoor-only' frequencies do not exist, there are only "indoor-only" frequencies. But for some reason Mikrotik has this "outdoor-only" interpretation on outdoor allowed frequencies.
Rational: indoor-only frequencies disturb emergency services and other priority systems if used outdoor.

[admin@MktOmnitik] > interface wireless info country-info
country: united states3
ranges: 2402-2472/b,g,gn20,gn40(30dBm)
5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)/indoor
5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)/outdoor

With Mikrotiks interpretation, this list should have been
5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)/indoor
5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)

You were correct SIR !!!! The wap was on ANY and the haps were on indoors. But why has it worked for years and now there are enforcing it?
Anyway... apparently I was going down the wrong trail with INTL vs US... although they did take the US definitions out of the 6.47 running on INTL.

Thanks again....

bpwl · Fri Jun 05, 2020 11:43 pm

You were correct SIR !!!! The wap was on ANY and the haps were on indoors. But why has it worked for years and now there are enforcing it?
Anyway... apparently I was going down the wrong trail with INTL vs US... although they did take the US definitions out of the 6.47 running on INTL.

Thanks again....

They are enforcing the regulator rules, step by step, update after update, because they have to, to keep their certification for FCC and CE. So suddenly from a specific version onward devices are bound to specific settings. (My SXTsq 5 ac's can only be set "outdoors" since some specific ROS version. But what if I use them indoor???). The same thing happened to the minimal antenna gain, what is a correct action. But they are not very systematic in their implementation and so the built-in frequency list and the logic interpreting that list is out of sync. (Either you allow outdoor freq for indoor installations, or you remove ALL the /outdoor tags in that list.)

Jotne · Sat Jun 06, 2020 12:00 am

No need to change the thread header. I may be better to start a new thread.

Sat Jun 06, 2020 8:14 am

pe1chl - What is the reason to believe that the router was hacked?
llubik - Please provide output of these commands - "tool fetch url="http://upgrade.mikrotik.com/routeros/LATEST.6" output=user", ":put [:resolve upgrade.mikrotik.com]".

nichky · Sat Jun 06, 2020 9:30 am

need more info about:

*) ipsec - allow specifying two peers for a single policy for failover;
*) ipsec - added "use-responder-dns" parameter support;
*) ipsec - added "split-dns" parameter support for mode configuration;

hsd75 · Sat Jun 06, 2020 9:48 am

Hello,

On my hAP ac I have a major issue with 6.47. I had to rollback to 6.46.6.
On 6.47, my SFP module is no longer detected. It is a module ONT SERCOMM FGS202.
It's my first regression whith Mikrotik

nescafe2002 · Sat Jun 06, 2020 10:00 am

hsd75, could you generate supout.rif of the device with sfp attached, preferably in both states (6.46.6/working vs 6.47/not working) and send them to support via mail or help.mikrotik.com?

hsd75 · Sat Jun 06, 2020 11:39 am

yep.
Done by mail.

alex_rhys-hurn · Sat Jun 06, 2020 12:13 pm

Hi all,

As I prepare the supout files and open a support ticket, I want to update you on my experience. EDIT: Supout.rif submitted by mail.

I upgraded to 6.47 on a CHR which acts as a test BGP router, it collects routes and we test filters with it.

The experience was not good.

everything works normally, but whenever you make a change to BGP that causes a refresh or update then winbox disconnects IMMEDIATELY.

To clarify, things that will trigger this include: enable/disable a bgp peer. Refresh a peer, resend routes, adjust a route filter, or make a new route filter, or drag and drop a route filter. Simply clicking enable on an already enabled route filter will do it too. Also a large number of route changes triggered by the remote peer will also cause it.

You can reconnect, and it will disconnect again IMMEDIATELY.

This behaviour continues until the BGP routing table has completed loading, so with a few routes (160) then its a few seconds, if its a full bgp feed of aroun 800k routes, then this takes about 2 minutes.

SSH is fine, this problem only seems to affect winbox.

I use winbox 64bit 3.24.

Alex

pe1chl · Sat Jun 06, 2020 12:48 pm

pe1chl - What is the reason to believe that the router was hacked?

Because there was that hack where "upgrade" would always install a fixed version even when it was lower, presumably to get back to a vulnerable version.
(a couple of scripts and changed DNS server which serves fake LATEST.6 file etc)
Dangerous to assume it can be fixed by reconfig.

Zetle · Sat Jun 06, 2020 12:57 pm

*) proxy - increased minimal free RAM that can not be used for proxy services;

hAP lite (RB941-2nD r2) Proxy appear to be UP but it's not working. I presume the little amount of RAM causes the issue ? Works fine with 6.46.6.
If that's the case it would be good to throw some error instead "working"

pe1chl · Sat Jun 06, 2020 1:40 pm

everything works normally, but whenever you make a change to BGP that causes a refresh or update then winbox disconnects IMMEDIATELY.

I don't experience this problem, but it can be helpful to know that winbox connections immediately fail when there is no valid route for the traffic.
I.e. unlike the classical recommendation for TCP where an "unreachable" condition during the connection setup would be handled quickly but an "unreachable" after the connection was successfully setup should be handled lazily (first try a couple of times before giving up), it fails as soon as the route is not there.

So maybe when your action results in all routes going away or flapping to another interface, this explains why your winbox connection fails.
I agree with you that it is inconvenient, I would like my winbox connections to survive a route rebuild or a router reboot on an intermediate router, but they don't.
(with SSH that problem does not occur)

llubik · Sat Jun 06, 2020 6:23 pm

pe1chl - What is the reason to believe that the router was hacked?
llubik - Please provide output of these commands - "tool fetch url="http://upgrade.mikrotik.com/routeros/LATEST.6" output=user", ":put [:resolve upgrade.mikrotik.com]".

[l@MKT] > tool fetch url="http://upgrade.mikrotik.com/routeros/LATEST.6" output=user
status: finished
downloaded: 0KiBC-z pause]
data: 6.46.3 1580208365

[l@MKT] > :put [:resolve upgrade.mikrotik.com]
13.33.44.253

I found an entry in DNS static (I entered it there a long time ago because they carried updates and I forgot - but it's interesting that up to version 6.46.3 it worked)
Big THX

shahani · Sat Jun 06, 2020 10:55 pm

Wow DoH saved me from internet censorship.
Thank you very much.

Please modify the ping tool in Winbox to use the router DNS correctly, Currently it uses the Windows DNS.

Jotne · Sat Jun 06, 2020 11:46 pm

Wow DoH saved me from internet censorship.

In your photo I can see that you are using DoH DNS with name, but there are no static or dynamic DNS to resolve its own DoH DNS name.
In MikroTiks wiki example they suggest that you add 1.1.1.1

I do use IP instead of name to skip the extra "needed" dns server.
https://1.1.1.1/dns-query

shahani · Sun Jun 07, 2020 2:58 am

In your photo I can see that you are using DoH DNS with name, but there are no static or dynamic DNS to resolve its own DoH DNS name.
In MikroTiks wiki example they suggest that you add 1.1.1.1

The DoH server IP is entered in the static table.
If a DNS server is added at the suggestion of Mikrotik,
When the VPN tunnel is not connected, the request for resolve DoH server name may be filtered.

sanic · Sun Jun 07, 2020 8:58 am

bpwl,krafg - The antenna gain setting is not available there anymore for the routers that have a built-in antenna.

This is a problem because you cannot use regulatory domain with your country, because antenna gain have to be set!

bpwl · Sun Jun 07, 2020 11:29 am

bpwl,krafg - The antenna gain setting is not available there anymore for the routers that have a built-in antenna.
This is a problem because you cannot use regulatory domain with your country, because antenna gain have to be set!

I'm worried quite a bit that not everyone will come to the forum to find out. If they only use the GUI the LHG 5 ac will remain at its default setting viewtopic.php?f=13&t=162077
Radio 25dBm , antenna at 24,5 dBi , antenna gain setting at "0". No GUI way to change it. Beam strength at 49,5dBm. (My microwave oven is set to 56dBm and max 59 dBm for cooking a meal. OK not in a spot and a lot of reflections inside)
I'm afraid you can loose an eye or even get burnt in that beam.

pe1chl · Sun Jun 07, 2020 12:26 pm

No, the antenna gain setting will not be left at 0, it will be set to the correct gain for the product you have. At least when there are no bugs.
The idea is that the user of the product can not set it to more than 30dBm EIRP (in most countries) as this is the max allowed power.
Of course it would be better when the user can still set it lower, but "fiddling with the gain" never was a reasonable way to do that.
There should just be a "dBm EIRP" setting in the wireless interface, that sets the radio output correspondingly (first subtract the fixed antenna gain of the product).
So, for a short link you might set it to 20dBm instead.

pe1chl · Sun Jun 07, 2020 12:27 pm

pe1chl - What is the reason to believe that the router was hacked?
Because there was that hack where "upgrade" would always install a fixed version even when it was lower, presumably to get back to a vulnerable version.
(a couple of scripts and changed DNS server which serves fake LATEST.6 file etc)
Dangerous to assume it can be fixed by reconfig.

Apparently he hacked it himself!! That makes it a bit less dangerous than when someone else changed that setting and possible was able to introduce bad firmware.

alex_rhys-hurn · Sun Jun 07, 2020 12:31 pm

I don't experience this problem, but it can be helpful to know that winbox connections immediately fail when there is no valid route for the traffic.
I.e. unlike the classical recommendation for TCP where an "unreachable" condition during the connection setup would be handled quickly but an "unreachable" after the connection was successfully setup should be handled lazily (first try a couple of times before giving up), it fails as soon as the route is not there.

So maybe when your action results in all routes going away or flapping to another interface, this explains why your winbox connection fails.
I agree with you that it is inconvenient, I would like my winbox connections to survive a route rebuild or a router reboot on an intermediate router, but they don't.
(with SSH that problem does not occur)

Hi, Thanks for the feedback and reminder that disappearance of routes would disconnect me. I should have been clear as follows:
I am connecting from my Out of Band Management Network
During this time, all pings continue to run
During this time my SSH session stays up
During this time my IGP (OSPF) continues to work, and pings from networks in the IGP remain operating, so I dont think I am losing the routing from the networks that Winbox connects from .

I should finally add, that my production routers running BGP as IXP and Full table borders as well as Route Reflectors all but one as CHR one as a CCR1036 running 6.46.6 do NOT exhibit this behaviour.

I remain convinced that this is a new behaviour in 6.47

Interesting that you cant replicate this, so let me go back and review my configs.

Any ideas?

Alex

pe1chl · Sun Jun 07, 2020 12:35 pm

It would be nice when it first checked for exact matches of static records before it tried the regexp.
As I keep telling (to myself, it seems), regexps don't belong to DNS. I can't deny that they can be useful when you want to match things like <anything>.ads.<anydomain>.<tld> or something, but it's closer to hack than proper feature. Basic config should not require use of regexps. No regexps = no problem.

I basically agree with that, but note that with reverse-DNS it is not so easy as you write when you do not have either /8 /16 or /24 subnet mask!
E.g. I often have networks with /22 subnet mask and it is not possible to set reverse DNS for them in this way.
It is possible of course to use 4 entries for each network but with some other subnet sizes it becomes cumbersome to do it this way.

As an aside: I would like to have "usage counters" for static DNS entries. Number of uses since last reboot is fine (so it can be in RAM, no need to write to flash).
It is helpful when debugging things and also when looking at old configs for which it is unclear if the static entries are still used at all.
Each lookup matching a specific static entry would increment the counter and it would be visible in the IP->DNS->Static window.

bpwl · Sun Jun 07, 2020 2:43 pm

No, the antenna gain setting will not be left at 0, it will be set to the correct gain for the product you have. At least when there are no bugs.
The idea is that the user of the product can not set it to more than 30dBm EIRP (in most countries) as this is the max allowed power.
Of course it would be better when the user can still set it lower, but "fiddling with the gain" never was a reasonable way to do that.
There should just be a "dBm EIRP" setting in the wireless interface, that sets the radio output correspondingly (first subtract the fixed antenna gain of the product).
So, for a short link you might set it to 20dBm instead.

I was just alarmed by Darmach that in his/her case it was found at 0. I don't know if he/she set it himself/herself.
viewtopic.php?f=13&t=162077#p798551
(Ron Touw advised to adjust via antenna gain,at MUM, because the allowed TXpower varies over the MCSes used.)
But I agree it is very confusing that way.
Once they fix the LHG 5 ac table, 20 dBm will be impossible. As it is already with "Regulatory minimum antenna gain for this country is 25dBi"

Sob · Sun Jun 07, 2020 8:45 pm

... with reverse-DNS it is not so easy as you write when you do not have either /8 /16 or /24 subnet mask!

True, that's another case where regexp can be useful. On the other hand, it should be much more efficient to find the result when there are only non-regexp entries. With those you can follow the hierarchy, check TLD first, then second level, etc. Regexp can be anything, so the whole thing needs to be evaluated, all regexp entries for every query.

pe1chl · Sun Jun 07, 2020 9:19 pm

... with reverse-DNS it is not so easy as you write when you do not have either /8 /16 or /24 subnet mask!
True, that's another case where regexp can be useful. On the other hand, it should be much more efficient to find the result when there are only non-regexp entries. With those you can follow the hierarchy, check TLD first, then second level, etc. Regexp can be anything, so the whole thing needs to be evaluated, all regexp entries for every query.

I think the RouterOS resolver currently is not walking the DNS name top-down like a full recursive resolver would do. It can only match the entire name or forward the query to another server to do the full resolving.
Of course it would be "easy" to incorporate one of the existing resolvers into RouterOS and then maybe add a function or two, but usually software maintainers stick to what they have until it is no longer feasible at all...
I am surprised that things work as they do now (regexps are evaluated before static names, DoH takes the entire resolver instead of being the primary server used by the resolver instead of plain DNS servers) but that probably can be explained by their existing code.

shahani · Sun Jun 07, 2020 10:05 pm

Solution to Error while running customized default configuration script: no such item
Whenever you see this error when using wireless devices while booting
It's possible you have changed the pre-written Wireless Interface name
To solve this issue First you have to change your Wireless Interface(s) name to the pre-set.
wlan1,wlan2,wlan3....
And finally you must Reboot your device, after this your problem will be solved forever And after that you can personalize and change their name.

There might be another problem for some of you in the scripts, In the "IP DNS Cache" The address field is changed to data And so you need to do modify your scripts in this field.
Example:
:set tmpAddress [/ip dns cache get $i address];
Change to:
:set tmpAddress [/ip dns cache get $i data];

eworm · Sun Jun 07, 2020 11:06 pm

To solve this issue First you have to change your Wireless Interface(s) name to the pre-set.
wlan1,wlan2,wlan3....
And finally you must Reboot your device, after this your problem will be solved forever And after that you can personalize and change their name.

That does the trick, thanks a lot for the hint!
Mikrotik, please change static interface name (wlan1, ...) to more flexible approach ([ find default-name=wlan1 ], ...) in default configuration.

GARCIADOEGOGERMAN · Mon Jun 08, 2020 2:49 am

Hello Goodnight!!!
Today I started to configure DoH on my Mikrotik.
I am seeing this behavior in the log every time I restart ...
Shouldn't DoH start working once you start the WAN interface and connect to the internet?
Shouldn't this behavior change?

Greetings and thanks!!!