Echoing the experience. Upgraded from 7.1.5 to 7.2 and some OpenVPN clients using AES on some routers are broken. It does not matter which AES cipher is chosen... none of them work with OpenVPN after the upgrade.OpenVPN client broken with AES-256-CBC since upgraded to RouterOS 7.2 (from 7.1.5), switching to Blowfish 128 works.
Subject: RouterOS 7.2 - OpenVPN client with AES appears broken on some routers
OpenVPN client with AES appears to be broken on some routers in RouterOS 7.2. Configs worked just fine prior to upgrade from 7.1.5. Client logs show connecting… disconnected… connecting… disconnect… but no error message. Logs on OpenVPN server (also Mikrotik devices) show no errors. Setting cipher on client and server to blowfish128 will allow tunnel to connect and stay connected. Issue appears only with AES on the following routers:
MMIPS (RB750Gr3, RB760iGS) – OpenVPN AES client FAILED
ARM (RB4011iGS+) – OpenVPN client with AES WORKED
CHR – OpenVPN client with AES WORKED
MIPSBE - OpenVPN client with AES WORKED
POWERPC (RB1200) – OpenVPN client with AES WORKED
TILE (CCR1009-7G-1C-1S+) – OpenVPN client with AES WORKED
Original notes:
Started to test RouterOS 7.2 last night. Upgraded my home office router first (RouterBOARD 750G r3 s/n 6F3806195642) from 7.1.5 to 7.2. This router has several production VPN client connections of various types (L2TP/IPSEC, OpenVPN, SSTP, and Wireguard) to remote Mikrotik devices of various types.
My L2TP/IPSEC, SSTP, and Wireguard client connections worked properly after the upgrade, but my OpenVPN connections would not connect. Two of these were OpenVPN TCP client to RouterOS 7.1.5 CHR instances and one to a Mikrotik 760iGS running 6.49.5. If I use any of the AES ciphers, the connections just bounce (connected… disconnected… connected… disconnected…) with no error messages. If I set the cipher to blowfish128, the OpenVPN clients connect and operate properly.
I then upgraded some other test routers from 7.1.5 to 7.2: two CHR instances, an old RB1200, and an RB760iGS.
• The CHR instances have no problems to other RouterOS OpenVPN servers regardless of protocol (tcp or udp) and cipher.
• The RB1200 and the RB760iGS routers both fail in the same way my home office router fails. Switching the cipher to blowfish128 allows the VPNs to work.
It appears that there is some sort of issue with the OpenVPN AES cipher on certain RouterOS devices in 7.2
As a last test, I took a fresh RB760iGS router out of the box, upgraded it to 7.2, factory reset the config again (no-defaults=yes) added my test VPN configuration, and created the attached supout.rif file.
Please let me know if I can provide any additional information
/ip firewall mangle
chain=output action=mark-routing new-routing-mark=VXLAN src-address=1.1.1.1 dst-address=2.2.2.2
Upgrade winbox to 3.35.Just upgraded on my RB750GR3 and winbox does not open on Windows 10. Lucky the web interface still works fine.
Did you read the manual?Terminal is not working for me. Cannot copy paste anything, but i can write normally. On paste try, only characters are showing.......
Oh it has been changed again? I rarely use it because it is so confusing. I'm sure it did not work before.What are you talking about? CTRL+C and CTRL+V works in WinBox terminal.
In a terminal, CTRL+C is the interrupt command and should not be used as a copy (despite it is working in some cases).But the problem still persist: Control-C without selection EMPTY THE CLIPBOARD
There is a difference between "what keys does the commandline interface interpret" and "what keys can be used in terminal".Here you can find the list of terminal keys
https://help.mikrotik.com/docs/display/ ... ListofKeys
I've never used it (except by mistakenly hitting ctrl+v in terminal), nor I've ever needed it.Poll: has anyone here ever made useful use of "Hotlock mode" (the commandline feature where it automatically expands words as soon as they are unique within the current context)?
Has anyone used Hotlock mode except when enabling it by mistake, and questioning whether the router has gone insane when pasting text?
Does anyone think this feature has to be retained in the state it is now?
Yes, a 10 megabyte file downloading at dial-up speed. Same for me. I can envision a 30 year old PC hooked up to a US Robotics 28.8k modem sitting in the corner of an office serving firmware update files. :)90.1% now.
Wait, 90.2%
already wroted, nothing new,For terminal use
Ctrl + Insert - copy
Shift + Insert - paste
I know that has changed, but that does not mean hotlock mode is now suddenly useful, doesn't it?@pe1chl I understand that reading is overrated, but please look once more at the manual I provided above. hot lock mode is enabled by F7 for quite some time now (not by ctrl+v).
IMHO what is broken is that when it has expanded a certain word (e.g. you type pi and it expands it to ping) it also adds a space and the next input you type is added as new input.can you elaborate further on what should be fixed for hot lock mode? AFAIK it is not broken, and it is not causing any trouble to anyone especially now when ctrl+v no longer enables this mode.
Is that related to the above, i.e. to IPv6? Because for me GRE/IPsec tunnels that transport IPv4 over IPv4 work OK in v7.2.As others have reported previously, GRE-IPSec tunnels are not working well in 7.x. I had no performance issues with them in 6.x, but they are extremely slow in 7.x.
# apr/11/2022 16:06:40 by RouterOS 7.2
# software id =
#
/interface bridge
add ingress-filtering=no name=bridgeLocal protocol-mode=none vlan-filtering=yes
/interface vlan
add interface=bridgeLocal name=vlan200 vlan-id=200
/interface bridge port
add bridge=bridgeLocal frame-types=admit-only-untagged-and-priority-tagged interface=ether3
/ip pool
add name=pool_vlan200 ranges=10.200.0.10-10.200.0.254
/ip dhcp-server
add address-pool=pool_vlan200 interface=vlan200 lease-time=1h name=dhcp_vlan200
/user-manager user
add attributes=Tunnel-Private-Group-ID:200,Tunnel-Medium-Type:6,Tunnel-Type:13 name=00:0C:29:16:E1:B7
/interface bridge vlan
add bridge=bridgeLocal tagged=bridgeLocal vlan-ids=200
/interface dot1x server
add auth-types=mac-auth interface=ether3
/ip address
add address=10.200.0.1/24 interface=vlan200 network=10.200.0.0
/ip dhcp-server network
add address=10.200.0.0/24 dns-server=10.200.0.1 gateway=10.200.0.1 netmask=24
/ip dns
set allow-remote-requests=yes
/radius
add address=127.0.0.1 service=hotspot,ipsec,dot1x src-address=127.0.0.1
/radius incoming
set accept=yes
/system logging
add topics=manager
add topics=dot1x
/user-manager
set enabled=yes
/user-manager router
add address=127.0.0.1 name=local
winbox.exe is a portable executable that easily runs under wine on both Linux and Mac.Winbox is not an option for me as it's Mac and Linux only here.
on run
do shell script "/usr/local/bin/wine64 /Applications/Winbox.app/Contents/MacOS/winbox64.exe"
end run
/system/health> print
Columns: NAME, VALUE, TYPE
# NAME VALUE TYPE
0 temperature -274 C
1 cpu-temperature 61 C
2 sfp-temperature -274 C
3 fan1-speed 5550 RPM
4 fan2-speed 5445 RPM
5 fan3-speed 5610 RPM
6 board-temperature1 44 C
7 board-temperature2 27 C
8 psu1-state ok
9 psu2-state ok
I found this! When command is typed there is pcap file on disc that is saved. Downloaded on computer and read with a pcap reader (wireshark in my case)Just upgraded CCR2004-16G-2S+ / Overall OK
BGP Prefix Count still 0
*) bgp - added BGP advertisements display (requires output.keep-sent-attributes to be set); even that i set output.keep-sent-attributes=yes still no info on commandThere are 2 BGP PeersCode: Select all[username@identity] > routing/bgp/session/dump-saved-advertisements numbers: 1 [username@identity] > routing/bgp/session/dump-saved-advertisements numbers: 0
Simple Queues now don’t immediately break IPv6 (thank you!) however… enabling them causes the router to become slow-to-unresponsive in about 60 seconds (RB750GR3). Only quickly logging in via terminal (webfig is unresponsive) to disable the simple queue rescues it.
edit: Reading the other thread viewtopic.php?p=925637#p925637 and it may be Cake, rather than the Simple Queue. Currently using a Simple Queue with fqcodel and not yet seeing an issue.
On paste i get this now........or mouse right click :)
I am using Winbox for MAC 3.30.
/routing filter rule
chain=DISTRIBUTE rule="accept"
/routing bgp vpn
export-filter=DISTRIBUTE
BIG problem!!Echoing the experience. Upgraded from 7.1.5 to 7.2 and some OpenVPN clients using AES on some routers are broken. It does not matter which AES cipher is chosen... none of them work with OpenVPN after the upgrade.OpenVPN client broken with AES-256-CBC since upgraded to RouterOS 7.2 (from 7.1.5), switching to Blowfish 128 works.
I sent the following information to Mikrotik support:
Code: Select allSubject: RouterOS 7.2 - OpenVPN client with AES appears broken on some routers OpenVPN client with AES appears to be broken on some routers in RouterOS 7.2. Configs worked just fine prior to upgrade from 7.1.5. Client logs show connecting… disconnected… connecting… disconnect… but no error message. Logs on OpenVPN server (also Mikrotik devices) show no errors. Setting cipher on client and server to blowfish128 will allow tunnel to connect and stay connected. Issue appears only with AES on the following routers: MMIPS (RB750Gr3, RB760iGS) – OpenVPN AES client FAILED ARM (RB4011iGS+) – OpenVPN client with AES WORKED CHR – OpenVPN client with AES WORKED MIPSBE - OpenVPN client with AES WORKED POWERPC (RB1200) – OpenVPN client with AES WORKED TILE (CCR1009-7G-1C-1S+) – OpenVPN client with AES WORKED Original notes: Started to test RouterOS 7.2 last night. Upgraded my home office router first (RouterBOARD 750G r3 s/n 6F3806195642) from 7.1.5 to 7.2. This router has several production VPN client connections of various types (L2TP/IPSEC, OpenVPN, SSTP, and Wireguard) to remote Mikrotik devices of various types. My L2TP/IPSEC, SSTP, and Wireguard client connections worked properly after the upgrade, but my OpenVPN connections would not connect. Two of these were OpenVPN TCP client to RouterOS 7.1.5 CHR instances and one to a Mikrotik 760iGS running 6.49.5. If I use any of the AES ciphers, the connections just bounce (connected… disconnected… connected… disconnected…) with no error messages. If I set the cipher to blowfish128, the OpenVPN clients connect and operate properly. I then upgraded some other test routers from 7.1.5 to 7.2: two CHR instances, an old RB1200, and an RB760iGS. • The CHR instances have no problems to other RouterOS OpenVPN servers regardless of protocol (tcp or udp) and cipher. • The RB1200 and the RB760iGS routers both fail in the same way my home office router fails. Switching the cipher to blowfish128 allows the VPNs to work. It appears that there is some sort of issue with the OpenVPN AES cipher on certain RouterOS devices in 7.2 As a last test, I took a fresh RB760iGS router out of the box, upgraded it to 7.2, factory reset the config again (no-defaults=yes) added my test VPN configuration, and created the attached supout.rif file. Please let me know if I can provide any additional information
4/11/2022 Edit: Mikrotik support confirms there is an issue that is affecting the mmips based routers with OpenVPN AES and says it will be resolved in the next release. 🤞
You can get it from here..........@Note
Can you share your mangle
Or at least ,Qos DSCP
I have 2WAN in loadbalance
Problem fixed with secret disabled.Works fine for me...After upgrade from 6.49.5 to 7.2 RoMon stopped seeing almost all devices in our network. If needed I can post the config here?
Try the export-netinstall-import route.
(do not forget show-sensitive with the export)