MikroTik

RouterOS version 6.44.2 has been released in public "stable" channel!

Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 6.44.2 (2019-Apr-01 12:47):

MAJOR CHANGES IN v6.44.2:
----------------------
!) ipv6 - fixed soft lockup when forwarding IPv6 packets;
!) ipv6 - fixed soft lockup when processing large IPv6 Neighbor table;
----------------------

Changes in this release:

*) ipv6 - adjust IPv6 route cache max size based on total RAM memory;

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after some problem has appeared on device

Please keep this forum topic strictly related to this particular RouterOS release.

Hi Emils,

Is this fix related to recent vulnerability issue that were going to go public on 9 April?

yes, see viewtopic.php?f=2&t=147048

Hi Emils,

Is this fix related to recent vulnerability issue that were going to go public on 9 April?

Nice attempt at being subtle there. Wouldn't it have been better to email something like that to support rather than start a new vulnerability panic? ._.

yes, see viewtopic.php?f=2&t=147048

Thanks, at least you gave a source so we can calm our nerves.

EDIT:
Just gonna leave a link to the MikroTik blog post here too.
Here: https://blog.mikrotik.com/software/cve- ... stion.html

The TCP connection tracking issue introduced in 6.44 is still present.
(TCP packets with ACK or ACK,PSH flags are not treated as NEW when loose TCP connection tracking is set, but they should be)

Update from 6.44.1 to 6.44.2 went smooth, no problems

still no progress for bgp and ospf bugs,

thx

still no progress for bgp and ospf bugs,

thx

This version is exclusively IPv6 soft lockup bugfix. No progress in any other facilities at all.

unable to upgrade hap lite AC from 6.43.12, starting with 6.44 version...

what could be the problem..?

unable to upgrade hap lite AC from 6.43.12, starting with 6.44 version...

what could be the problem..?

Check if there's something at the very beginning of /log right after failed attempt to upgrade.

I'm not sure if it was there before, but after upgrading a WAP AC I see a "W60G Station" tab in the wireless menu in Webfig.
Makes no sense on this hardware and should maybe be hidden on non 60GHz hardware?

still no progress for bgp and ospf bugs,

thx

This version is exclusively IPv6 soft lockup bugfix. No progress in any other facilities at all.

Literacy issue wrt release notes I guess.

Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

Can you add a translated page (little brexit flag link) to english please ;-P

unable to upgrade hap lite AC from 6.43.12, starting with 6.44 version...

what could be the problem..?

I did have the same problem. Look in the logs. It may be too little space to upgrade.
Clean out not need file in flash, reboot and then try upgrade. Did work for me.

3 x HapAC 6.44.1 -> 6.44.2 so far seems all is good
Thanks!

i got 2011UiAS-2HnD. After upgrading to 6.44.2 my RB is freezing. When im pinging the router from my computer it goes 1ms..10ms 600.ms..and timeout....over and over again

/log says it does not have enough space.
/log running out of disk space, when min 500kB is reached UM will be stopped!

however i don't have any file in my File Lists except /flash and /flash/skins (empty)

/log says it does not have enough space.
/log running out of disk space, when min 500kB is reached UM will be stopped!

however i don't have any file in my File Lists except /flash and /flash/skins (empty)

I also have the same problem when upgrading into 6.44.2 on hap.
but i make it to do it, it work eventhough only around 500 kb left after routeros uploaded.

clear all the files on /files then upload the npk, stop and clear cache on webproxy, it will give you little space.


thx

Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

Can you add a translated page (little brexit flag link) to english please ;-P

Sorry, I'm out of politics, just use Google Translate xD

clear all the files on /files then upload the npk, stop and clear cache on webproxy, it will give you little space.

Are you REALLY running a webproxy on a hAP using the flash as the proxy cache????

clear all the files on /files then upload the npk, stop and clear cache on webproxy, it will give you little space.

Are you REALLY running a webproxy on a hAP using the flash as the proxy cache????

haha yes,

i am implementing transparent proxy, for testing only.
i use hap for home ap.

thx

Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

Can you add a translated page (little brexit flag link) to english please ;-P

Sorry, I'm out of politics, just use Google Translate xD

Fair enough, wise move! Google it is.

clear all the files on /files then upload the npk, stop and clear cache on webproxy, it will give you little space.

Are you REALLY running a webproxy on a hAP using the flash as the proxy cache????

haha yes,

i am implementing transparent proxy, for testing only.
i use hap for home ap.

thx

I think it is an extremely bad idea... remove it as soon as possible.

clear all the files on /files then upload the npk, stop and clear cache on webproxy, it will give you little space.

Are you REALLY running a webproxy on a hAP using the flash as the proxy cache????

haha yes,

i am implementing transparent proxy, for testing only.
i use hap for home ap.

thx

Goodbye flash, these flash chips MT uses are very low endurance...
And they don't have to be better, if used for the purpose they are meant.

Yes indeed. And the storage is so tiny...
It would be better to place the cache in ramdisk, but I don't know if the RouterOS proxy can do that.
(mainly: what happens when the cache directory configured once does not exist after reboot, will it be re-created automatically?)

I would have considered running such a webproxy on our CCR a while ago, but unfortunately MikroTik is not picking up on the request
to implement the ramdisk used on the low-end models (with 16M flash) also on those models with lots of RAM (that is unused).
It should be easy to do as they already have all the required code.

Goodbye flash, these flash chips MT uses are very low endurance...
And they don't have to be better, if used for the purpose they are meant.

Low endurance? They are rated to 100k writings! At least that I checked on were. I agree that it's a bad idea to use them for cache, but low endurance they aren't.

Yes indeed. And the storage is so tiny...
It would be better to place the cache in ramdisk, but I don't know if the RouterOS proxy can do that.
(mainly: what happens when the cache directory configured once does not exist after reboot, will it be re-created automatically?)

I would have considered running such a webproxy on our CCR a while ago, but unfortunately MikroTik is not picking up on the request
to implement the ramdisk used on the low-end models (with 16M flash) also on those models with lots of RAM (that is unused).
It should be easy to do as they already have all the required code.

But there is an option you can check/uncheck, that is "Cache On Disk". It suggests one could use just ram to it, right?

asdfadfasdfadf

clear all the files on /files then upload the npk, stop and clear cache on webproxy, it will give you little space.

Are you REALLY running a webproxy on a hAP using the flash as the proxy cache????

In my case, i didn't run web proxy, but still my routerOS has been freezed.
After while time and one reboot it comes on normal. At the moment works like before.

But there is an option you can check/uncheck, that is "Cache On Disk". It suggests one could use just ram to it, right?

I guess when you don't "cache on disk" it won't cache at all.
But I never tried it... I always use(d) squid proxy.

But there is an option you can check/uncheck, that is "Cache On Disk". It suggests one could use just ram to it, right?

I guess when you don't "cache on disk" it won't cache at all.
But I never tried it... I always use(d) squid proxy.

I think that "don't cache on disk" means "cache on ram". It will really limit the size of the cache, but... The wording makes no sense, otherwise. Why call it "cache on disk", instead of "use cache"?

After checking the wiki it indeed appears you can cache in RAM.
However, caching has become almost completely useless due to the use of https everwhere.
About the only things you might find in a cache these days are certificate revocation lists and OCSP data.

Proxies are now only useful for detailed filtering, not for caching anymore.
In any case, don't use a proxy with "cache on disk" in a MikdoTik router without dedicated storage device for that purpose!

mAP lite 6.44 -> 6.44.2 got the CPU stuck at 100% at all times (profile tool indicates IPsec usage at ~60% constantly >>> only one detail: there is absolutely nothing on the IPsec configuration!!! Zero! Nada!)
Beta 6.45beta27 also got the CPU stuck at 100% usage!

Downgrade to Stable 6.43.14 worked out OK (got the cpu back to normal usage).

I don't know when it happened but the kid controls don't appear to accept times anymore. Not that it's important in the grand scheme of things.
It was working when it accepted only the allowed times but Mikrotik decided to add on times and off times which is odd.

The TCP connection tracking issue introduced in 6.44 is still present.
(TCP packets with ACK or ACK,PSH flags are not treated as NEW when loose TCP connection tracking is set, but they should be)

+1 Also waiting for the fix of this. Because of this bug, we where forced to switch our routers to a long-term tree. 

i got 2011UiAS-2HnD. After upgrading to 6.44.2 my RB is freezing. When im pinging the router from my computer it goes 1ms..10ms 600.ms..and timeout....over and over again

Having same FREEZE problem even clock sits at 0.00 - nothing is using mem, cleared files, disabled advanced tools, enabled ipv6 on client & tower ( we usually disable these ) but no joy - still two client routerboards frozen. This was happening since ver 6.44

6.44.2 major issue!!! Got a huge problem with the changes on the IPsec configuration! I managed to reproduce the same problem on mAP lite, 951G and hEX, all coming from 6.44!

Details:
As soon as you attempt to create a new identity (on the 'identities' tab) with the 'Auth. Method' set to "rsa signature hybrid", the CPU spikes to 100% and the device becomes almost completely unresponsive!
Only solution is a Configuration Reset (but as soon as I attempt to create the IPsec identity again the process repeats).

As soon as you attempt to create a new identity (on the 'identities' tab) with the 'Auth. Method' set to "rsa signature hybrid", the CPU spikes to 100% and the device becomes almost completely unresponsive!
Only solution is a Configuration Reset (but as soon as I attempt to create the IPsec identity again the process repeats).

I'm running road-warrior IPsec with rsa-signature-hybrid on RB4011 (currently running 6.44) and do not see such problem. I suspect the problem you describe can be something specific to your particular configuration. I'd suggest you emailing support@ and don't forget to attach the supout file.

Guys, just after i've updated to latest version my dhcp server is gone, but log tells someting about removing leases from mac xx:xx:xx where this mac was a fixed mac and ip... tried to restart 2 times, without sucess, only downgrade solve this, this happens at 2 CCR at distinct configurations and different locations at my network !!!!
IPV6 off tonight ???

As soon as you attempt to create a new identity (on the 'identities' tab) with the 'Auth. Method' set to "rsa signature hybrid", the CPU spikes to 100% and the device becomes almost completely unresponsive!
Only solution is a Configuration Reset (but as soon as I attempt to create the IPsec identity again the process repeats).

I'm running road-warrior IPsec with rsa-signature-hybrid on RB4011 (currently running 6.44) and do not see such problem. I suspect the problem you describe can be something specific to your particular configuration. I'd suggest you emailing support@ and don't forget to attach the supout file.

I only got this problem on 6.44.2... Didn't have any problem with my road-warrior IPsec VPN with rsa signature hybrid on 6.44 (and before that).
Only solution I found (to stay on 6.44.2) is to change the Auth Method to pre-shared-key+XAuth. As soon as I attempt to create an identity with rsa signature hybrid the CPU spikes to 100% and becomes unresponsive (and if I attempt to upgrade a device that already has an identity with rsa signature hybrid the device boots up with CPU stuck at 100% and sluggish and unresponsive).

No IPV6 on PPPOE clients after upgrade to 6.43.14 and 6.44.2.
Sad...

Hi,
I wanted to point up a probable UDP performance issues on the 6.44.2 release. I tried this release on a CCR1036, CCR1009 and an RB3011.
For me there are UDP traffic problems. For example, I run a speedtest between the two routers and the maximum "send" direction bandwidth from CCR1036 vs RB3011 and viceversa was about 400 kbps in UDP test. This not appear on same TCP test.
The same issues appear during file trasfer that use UDP protocol (ex. RDP) on Mikrotik router that only forward packet without any firewall rule.
Downgrading to version 6.43 the problem disappears.

Hello!
After upgrading firmware to 6.44.x, the shh and telnet connections, passing through the router, began to break.
If you open an ssh session with a server, for example using putty, and leave the window for 30 minutes, the connection will be broken.
If you do something in the window - the connection does not break.
This error does not exist in previous versions of firmware and this is not a server setup problem.
I solved the problem temporarily rolling back to version 6.43. But it's not right.
P.S. It happens on mipsbe and powerpc versions of hardware.

Hello!
After upgrading firmware to 6.44.x, the shh and telnet connections, passing through the router, began to break.

It is the problem mentioned in posting #5 above. It is known "to us" but not to MikroTik, it appears (never any reaction to those complaints from several people).
You can fix it for SSH by putting this in your sshd_config:

ClientAliveInterval 300
ClientAliveCountMax 6

(before you could also use TCPKeepAlive yes but it appears it no longer works)

For me there are UDP traffic problems. For example, I run a speedtest between the two routers and the maximum "send" direction bandwidth from CCR1036 vs RB3011 and viceversa was about 400 kbps in UDP test.

Does this happen only when you run the builtin speedtest between the routers or also when you run it between end systems on the networks at both ends?

Hello!
After upgrading firmware to 6.44.x, the shh and telnet connections, passing through the router, began to break.

It is the problem mentioned in posting #5 above. It is known "to us" but not to MikroTik, it appears (never any reaction to those complaints from several people).
You can fix it for SSH by putting this in your sshd_config:

ClientAliveInterval 300
ClientAliveCountMax 6

(before you could also use TCPKeepAlive yes but it appears it no longer works)

And openssh client knows these options:

ServerAliveInterval 300
ServerAliveCountMax 6

Looks like putty does not support sending keepalive packets through the encrypted tunnel, you can set TCP keepalive, though.

For me there are UDP traffic problems. For example, I run a speedtest between the two routers and the maximum "send" direction bandwidth from CCR1036 vs RB3011 and viceversa was about 400 kbps in UDP test.

Does this happen only when you run the builtin speedtest between the routers or also when you run it between end systems on the networks at both ends?

This also happens even when passing any UDP traffic between routers (forward) example RDP etc... and so between end systems.

Looks like putty does not support sending keepalive packets through the encrypted tunnel, you can set TCP keepalive, though.

However, that does not resolve this issue. I think the established timer is not reset by TCP keepalive packets.

I had this problem on 6.43.14(long-term) and will post here because maybe it will help on 6.44.2(stable) too.

Alright! For those who have lost IPv6 in concentrators with PPPOE server:
-Remove remove everything from /ipv6/pool.
-Reboot.
-Add the pools again.
-The log will be full of erros because the profile is looking for the pools you removed. As soon as you add the pools again ipv6 will work again.
-Remove all pppoe connections from /ppp/active and let they connect again getting the prefixes correctly.

Anyone experienced database corruption on dude with 6.44.2 ?
After intalling 6.44.2, after some minutes of normal working dude service stopped; in log I saw corruption messages. Switching to 6.44.1 and reimporting didn't fix the problem.
I've switched back to long-term 6.43.14, reimported the last backup db I had for 6.43.x version and now I am back in business (losing some hystory).
Is it just me messing around ?! ..even though I never touched the config recently and it's quite simple one.

Bye

after updating my gr3 to stable, the board died, and i have to use neinstall to recover it

Updated several RB2011UiAS-2HnD-IN, RB1100AHx4 and hAP ac over a day ago. No issues detected so far.

Nevertheless... one issue with IPsec still persist along many versions: after sending few TBs of traffic over site2site tunnels, the router just collapse and reboot itself without any warning - just a few minutes before the collapse the network experienced problems with IPv4 traffic forwarding. The only message left in log is "router was rebooted without proper shutdown".

This is true? https://securityaffairs.co/wordpress/83 ... -flaw.html

This is true? https://securityaffairs.co/wordpress/83 ... -flaw.html

https://blog.mikrotik.com/software/cve- ... stion.html

IPSec configuration completely lost after the update! All profiles 'unknown'. It was neccesary downgrade and restore backup previously done! Major bug! Be careful with this before name a version "stable", please!!!

IPSec configuration completely lost after the update! All profiles 'unknown'. It was neccesary downgrade and restore backup previously done! Major bug! Be careful with this before name a version "stable", please!!!

Please send a supout.rif file from your router to support@mikrotik.com

IPSec configuration completely lost after the update! All profiles 'unknown'. It was neccesary downgrade and restore backup previously done! Major bug! Be careful with this before name a version "stable", please!!!

Please send a supout.rif file from your router to support@mikrotik.com

Perfect, I'll send it. Thank you.

IPSec configuration completely lost after the update! All profiles 'unknown'. It was neccesary downgrade and restore backup previously done! Major bug! Be careful with this before name a version "stable", please!!!

Plenty of devices with IPSec configured upgraded to ver. 6.44.2, no problem at all.

Regards,

Plenty of devices with IPSec configured upgraded to ver. 6.44.2, no problem at all.

That might explain why @emils asks for a supout.rif from the unique case where it failed

Looks like they fixed the loose connection tracking issue in the latest 6.45beta31.

Plenty of devices with IPSec configured upgraded to ver. 6.44.2, no problem at all.

That might explain why @emils asks for a supout.rif from the unique case where it failed

You are right. My post is mostly comment for this sentence:

Be careful with this before name a version "stable", please!!!

Regards,

Hi
could it be that the dhcp package in 6.44.2 has some issue ?

If i switch a router to bridge only (no lets not discuss if this makes sense) and i disable dhcp i still get to the clients IPs in the range 0.0.0.x assigned.
and strange such a pool pops up in the mikrotik.And i didnt add ths pool. The switch to bridge only was done from a factory default config via the QuickSet menue in WinBox.
This is tested with hEX and hAP Lite.

Anybody with similar issues ?

For me it looks like hat the DHCP cannot be completly switched off.


Switching back 6.43.14 solves the issue.


Yours

Guys, just after i've updated to latest version my dhcp server is gone, but log tells someting about removing leases from mac xx:xx:xx where this mac was a fixed mac and ip... tried to restart 2 times, without sucess, only downgrade solve this, this happens at 2 CCR at distinct configurations and different locations at my network !!!!

Related?
viewtopic.php?f=21&t=146485&start=50#p724058

Hello!
Problem after upgrate to 6.44
The gps receiver has become unavailable. how to fix it.
The receiver is not available to the terminal and is not displayed in the system menu.

https://yadi.sk/i/Z-bxBOx4M85PGQ

iYakovlev
Please send your MikroTik's Supout.rif file to support@mikrotik.com.

The gps receiver has become unavailable. how to fix it.

What does system package print where name~"gps" show? If the output is just the headline (# NAME ...), the gps package may have fallen out from the basic one so you may be able to fix it by downloading the zip with all packages for your architecture and installing gps-6.44.2.npk from there.

After update to 6.44.2(CHR), i found that the port of 2828(upnp related port) will be closed when you restart ros, even the upnp settings still show as enabled.

To enable it, i need to disable upnp then reenable it many times.

And if restart ros, the port will be closed again.

Any one else has the same problem?

The gps receiver has become unavailable. how to fix it.

What does system package print where name~"gps" show? If the output is just the headline (# NAME ...), the gps package may have fallen out from the basic one so you may be able to fix it by downloading the zip with all packages for your architecture and installing gps-6.44.2.npk from there.

Thank you very match, GPS became available but after https://wiki.mikrotik.com/wiki/Manual:S ... Properties GPS with external GPS Antenna does not wotk. No coordinates, GPS external antenna from the outside.

New version 6.44.3 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=147904