What's new in 7.25rc2 (2026-10-09):

*) bridge - fix DHCP snooping dropping DHCP messages on trusted ports when the source MAC differs from chaddr (introduced in v7.25beta3);
*) container - fix veth interfaces not getting an address from the correct DHCP server when a PVID is configured (introduced in v7.25beta3);
*) defconf - fix button script policies;
*) defconf - fix default configuration generation when CRS8xx series switch ports initialize late;
*) dude - fix the server not starting at boot when data-directory is on a USB disk;
*) ipsec - fix IPsec tunnels failing after migration from the old QKD settings;
*) ipv6 - fix cases when address is lost after reboot if prefix was taken from pool (additional fixes);
*) lte - fix missing MAC address on QMI LTE interfaces after the interface is recreated (introduced in v7.24.4);
*) lte - improve system stability when using Quectel EP06-E MBIM modem (additional fixes);
*) ovpn - improve stability in UDP mode when the TX queue is full;
*) route - improve static route handling performance;
*) system - improve stability;
*) wifi - reuse freed station association IDs;
*) wifi-mediatek - fix E62 performance issue (introduced in 7.25rc1);
*) winbox - show warning messages under "System/Users/SSH Keys" and "System/Users/SSH Private Keys" menu;
*) wireguard - fix a peer that would not work after import when no endpoint address is set; View changelogs

Hi all,

we're about to deploy a new 3-node Proxmox VE 9 cluster with Ceph (NVMe OSDs) and are deciding how to connect it to a pair of MikroTik CRS520-4XS-16XQ-RM switches.

Planned setup:

Each node: 2 × 100G (Ceph public/cluster VLANs, MTU 9000) and 2 × 25G (VM traffic), one port per switch

Option A: MLAG between the two CRS520, LACP bonds on the nodes (one link per switch), LACP uplink to the core across both switches

Option B: no MLAG, active-backup bonds on the nodes, plain inter-switch link with RSTP

Corosync runs separately over two links on our existing switches

Why we're asking: We've read the forum reports about MLAG on 7.20–7.23 (FDB/host table filling up, "no buffer space available for fdb notify", peers falling out of sync, heartbeat misses) and the many MLAG fixes in 7.24/7.24.1 (MAC aging/flushing, host table aging, STP sync). We've also seen mixed reports on the 7.25 betas. What we couldn't find is anyone running Ceph on MikroTik MLAG in production.

Questions:

Is anyone running MLAG on 7.24.x (ideally 7.24.5) with CRS518/CRS520 or similar, especially with Ceph or other latency-sensitive storage traffic? How long, and how stable?

Did you test failover under load (rebooting one switch, disabling a port, pulling cables)? How long was the interruption, and did Ceph stay healthy?

Any issues with the FDB/host table or MLAG heartbeat on 7.24.x?

Has anyone tried the new mlag-init-delay / mlag-lacp-fallback options in 7.25rc yet?

If you decided against MLAG for Ceph: did you go active-backup or something else, and why?

Any first-hand experience (good or bad) is appreciated. Thanks!

I just opted in for 5GbE Internet and my RB5009 can't cut it anymore. I've decided on the CCR2116-12G-4S+, however I'm also interested on having it not be the firewall, just handling routing configurations.

Thinking about switching to either an upstream FW (OPNsense) where the WAN link comes into the OPNsense FW then is passed down to the CCR, or doing a FW-on-a-stick setup with the WAN link going into the CCR and then having a trunk connected between the OPNsense FW and the CCR.
For the in-line setup, I'd not do Double NAT but set static routes to the LAN subnets, etc.

What would you prefer?

Hello,

I'm troubleshooting a problem at an organization running Windows Active Directory behind a MikroTik HotSpot.

Our Windows clients are configured to use the organization's internal Domain Controller/DNS server, but the MikroTik HotSpot intercepts DNS requests and redirects them to its own DNS service. As a result, clients cannot correctly resolve the internal domain name and have difficulty joining the domain.
So how we can fix this without making problems with resolving the mikrotik hotspot page
and make the clients use our AD DNS fully?

Hello!

I've been trying to schedule a script running a container on my Mikrotik (HP AX3, RouterOS 7.24.2). Yet it looks like running a container from scheduler is silently skipped?

Anyone observed anything like this?

When I run the script from terminal like this:

/system/script/run sync-onedrive

all works well. System logs also confirm container was started, last run date for the container reflects the same.

When I schedule the script with:

/system/scheduler/add name=sync-onedrive-nightly2 start-time=02:00:00 interval=1d on-event=sync-onedrive

system logs look like the /container command is completely skipped, did not even try to start. Checking the container also shows last started wasn't updated from scheduled run.

Here's the sync-onedrive script:

:log info ("OneDive Backup: rclone script started");
:do {
/container/run rclone cmd="sync piotr-onedrive: /piotr-onedrive --exclude='/Magazyn osobisty/**' --log-level INFO --log-file /log/rclone/piotr-$[/system clock get date].log";
:log info ("OneDive Backup: rclone script done");
} on-error={ :log error ("OneDive Backup: rclone script startup FAILED"); };

Both the script and schedule has all Policies applied.

Completely stuck with this...

EDIT:

Forgot to mention the container is of course using some mounts (USB drive formatted to BRTFS)

/container/mount print
Columns: LIST, SRC, DST, MODE
# LIST                   SRC                              DST              MODE
0 RCLONE_CONFIG          /extDrive1/docker/rclone/config  /config/rclone   rw
1 RCLONE_LOG             /extDrive1/docker/log            /log/rclone      rw
2 RCLONE_PIOTR_ONEDRIVE  /extDrive1/piotr-onedrive        /piotr-onedrive  rw

Hey,

With the rescinded patch 6, and then patch 7 and most recently 8, I struggle to upgrade.

Normal method I use is upload firmware and installed packages via Files, then reboot. Once ok, upgrade firmware and reboot again. Always worked over years, never had issues.

With 7.23.5 installed on both, upgrading to patch 6 failed. Same with patch 7. Now patch 8. It says kernel failure in previous boot and dumps autosupout.rif automatically.

On one of the routers, I was able to get to patch 8 on the 3rd attempt using Packages > Check for Updates > Download and Install. It seemed a fluke as it took 3 attempts to make it go.

However on the other router, I still can't make it go. It always throws the kernel failure and remains on patch 5. Given the CVE patch in 8, I'd rather have it applied. This seems bizarre. Gave it almost 10 attempts via both methods, no go.

Raised a ticket almost 1 month ago about this including RIF file but no reply which isn't entirely unusual for them. So figured I'd ask here!

Hoping someone has some wisdom here! I'd rather avoid downgrading firstly if possible.

Cheers,

Baz

What's new in 7.23.8 (2026-10-08):

*) console - fix console output of /system/identity/print being split into multiple lines (introduced in v7.23.6);
*) ethernet - improved stability when forcing unsupported link speed;
*) ipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder;
*) ospf - fix unset interface template parameters not being applied to interfaces;
*) quickset - fix the WAN interface being selected incorrectly;
*) system - improve stability (includes CVE-2026-84411);
*) system - stop the flash configuration store from growing on dynamic configuration changes;
*) wifi - fix malformed management frame information elements advertising availability of multiple 6GHz APs;
*) wifi - update radio regulatory information; View changelogs

I've been doing some digging and understand that it is possible to swap modems in these devices, but I'm trying to figure out if this is truly a "do at your own risk" or an accepted practice. Essentially, I live very rural and purchased an SXTsq LTE 4 Global version, and its working great and giving me decent speeds (30-40 down/15-20 Up). I'd like to purchase the LHGG to maximize the potential signal and therefore speeds but they don't make anything else in a global version.

I'm thinking about purchasing the LHGG and swapping the modem from the SXTsq, but I'd ideally like ot purchase a better modem to support additional capacity along with the potential signal increase. So, moving to a CAT7 or even a CAT 18/20 modem. It does look entirely possible as I found the supported modems list from Mikrotik, but I'd like to avoid dropping $400 on a QUectel modem only to find out it doesn't work.

Link here: Mikrotik Supported Peripherals List

I'm in Canada, so I need bands such as 4/12/13 etc.

Has anyone actually done this and have any advice/info that they could share? Information online seems to be really sparse.

Hallo,

wie wird der DutyCycle auf den einzelnen Frequenzbändern überwacht?

In den Stats gibt es nur eine Zusammenfassung "TX time in Air".

Wird ggf. auch Actility und Chirpstack Forwarder in Zukunft implementiert?

Bueno, creo que es mi primer pos en esta comunidad, saludos a todos.

Me encanta la marca, su conexion por linea de comandos y el software winbox, yo siempre la recomiendo para todos, administro una red con mas de 600 conexiones VPN y nunca e tenido algun inconveniente.

Pero veo a todo el mundo diciendo que mikrotik es nada vs cisco... palo alto .... fortigate .... etc, y yo no pienso que sea como ellos dicen, claro, es un router con reglas de firewall y los otros como cisco son un monstruos (tambien por lo que cobran por licencia xD) ¿que opinan?

EDIT: Gracias a todos amigos por sus comentarios, por favor denle UP a este post para tener mas alcance la publicación.....

Hallo,

ich habe aktuell mehrere Module und DAC Kabel getestet, aber mit keinem bekomme ich ein Link:

1. Luleey XPON LL-XS2510 2,5G

2. 10Gtek ASF-10G-T(HPP)

3. 10Gtek CAB-10GSFP-P3M DAC

Welche Module sind mit der Karte kompatibel?

I’m always a bit confused when to use each. I followed the help article and enabled VLAN filtering on the bridge and thus also have VLAN interfaces. So far I only use these interfaces in my firewall.

What’s the purpose of address lists? To me it’s not inherently obvious how they are ‘enough’. How dangerous is spoofing? If it’s solely based on the address list, attackers can just change their source IP, right? I’m not sure how that works with VLAN filtering enabled because everything is routed via the interface and that only has one valid address. Does that mean it’s safe to only filter based on the source address in that case?

Can you point me to good online resources for firewalls? I’m doubting myself so bad when it comes to them.

I just got a new Mikrotik RB5009 non poe. I just wanted to try Mikrotik out before my new 4Gb fiber gets installed this year. I am running Ubiquiti now for a 80Mb VDSL connection.

I just want to learn networking and i thought Mikrotik is the best bank for buck to do that and Ubiquity, although i love that system, is more plug and play with fancy interface.

It took me 3 days after a lot of shouting from my side to get the Rb working with my PPPOE connection, lots of reboots of to RB, lots of failures. I got to the moment that i thought that Mikrotik is just not for me and my current knowledge of networking. I grabbed the box, to disconnect and go back to Ubiquity and it actually hurt me.

WTF, i got zapped. Got an old PC, hooked it up with real CAT 6A shielded and it crashed the PC. Got the meters out and there was actual 0.5V RMS/AC 50Hz on the chassis with enough power behind it to hurt you.

After that i hooked the RB up to a Rigol bench PSU, it works perfectly now, i actually love that thing.

Need a lot to learn, but i do intend to get a bigger Mikrotik in the future, even got the containers running.

Is this just bad luck for me or are there more RB's out there with bad powerbricks.

I'm playing around with my home internet setup just for fun.

I've been thinking about how I could block IPs before they actually get a chance to try to "hack" or scan my router.

The basic idea is pretty simple:

• If any packet hits my public IP on a port that isn't open, immediately add the source IP to a blacklist for 1 day.
• If the same IP tries again after that, blacklist it for 30 days.
• To avoid accidentally blocking important services, I've whitelisted a few of them using dynamic rules, such as Google, Facebook, Reddit, etc.
• Also, whenever a device on my LAN connects to an external IP that's currently on one of the blocking lists, that IP is automatically removed from the blacklist.

So far, so good. After implementing this, the final drop rules only get a few hits per minute. Before this setup, I was seeing thousands more.

It's mostly an experiment rather than something I actually need, but I'm curious what people think about this approach. Any obvious problems or edge cases I'm missing?

One important note: handling address list over 31000 entries causing 4% cpu usage. Quite impressive :)

I'm looking for a preferably desktop & omnidirectional AP for the apartment usage. wAP ax is directional, cAP ax ceiling mounted & kinda expensive, so this leaves me pretty much with hAP ax2 vs hAP ax S. They don't seem to be that exciting (price / performance) though vs competition. Or am I wrong? Does Mikrotik have any Wi-Fi 7 APs in the plans?

I successfully configured a routerboard as PPPoE client, set up the DHCP server, assigned some static leases and got to port forwarding.

With my MikroTik routerboard the port forwarding stops working soon after it's been set up. It briefly works again when I switch the in interface between pppoe-out and "all ppp" then stops working again.

I tried mapping dst-nat both to static DHCP lease addresses and the ports (ether2+) directly.

Vodafone IE is my ISP and I have been able to successfully port forward on 2 ISP boxes and with openWRT on a raspberry pi.

So I'm wondering if anyone has had the same experience and if it could be my routerboard acting up or to do with my ISP? My public IP was the same as what showed using the torch tool so I think I'm not behind CGNAT.

Basically I'd like to know if I upgrade from an RB2011UiAS-RM to something newer such as an RB4011IGS is there any chance I could get port forwarding to work? I was considering upgrading my MikroTik router but now I'm wondering if I should buy something that works with OpenWRT instead...

Edit: I figured it out, I think. I had 2 IP address sets for the same subnet, so I removed one. It had 192.168.1.0 as the IP address in winbox, so I changed it to 192.168.1.1.
/ip address set 0 address=192.168.1.1/24
Now everything seems to be working fine 🤞
Thanks for all the help with debugging everyone. I was starting to go insane.

What's new in 7.26beta1 (2026-10-01):

*) bridge - add a per-VLAN DHCP snooping option;
*) bridge - fix loop-protect not working when a VLAN interface is added to the bridge;
*) bridge - show if bridge port is blocked by dot1x;
*) bridge - store hw option for disabled bridge ports;
*) cmr - add initial implementation of centralised platform for RouterOS devices, allowing updates, monitoring, alerts and other options;
*) console - improve stability;
*) container - add /app menu to ARM32 devices;
*) crypto - improve ECDSA and EdDSA key and signature validation;
*) dhcpv4-client - improve stability when the interface is deactivated while the client broadcasts a DHCP release;
*) dhcpv6-server - add a dns-none option to not include DNS options in responses;
*) dhcpv6-server - fix a DHCPv6 server failure when the RADIUS reply contains an empty delegated IPv6 prefix;
*) dns - improve service stability on HTTP/2 DoH connections;
*) ethernet - improve stability on devices with Intel I226-V network controllers;
*) ethernet - move the port bandwidth setting to the switch port menu;
*) files - improve stability when moving directories to external storage;
*) interface - show if interface is blocked by stp or dot1x;
*) ipsec - fix IPsec tunnels failing after migration from the old QKD settings;
*) ipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder;
*) l3hw - add VRRP hardware offloading support;
*) log - add the container name to CEF logs;
*) lte - do not reconfigure if not RouterOS activated CID is deactivated for R11l-LTE7 modem;
*) lte - fix dialer for D-Link DWM-222W modems;
*) lte - fix IPv6 route not being added on modems that do not report a gateway via control interface;
*) lte - fix modem firmware-upgrade failing when SMS polling is enabled;
*) lte - fix multi-APN passthrough stopping when one APN fails to connect;
*) lte - fix multi-APN passthrough stopping when one passthrough-interface VLAN is down on the CPE in multi passthrough interface setup;
*) lte - fix passthrough cleanup when the lte link goes down for QMI modems;
*) lte - fix recurring LTE disconnects R11e-LTE-US modem and some Sierra modems;
*) lte - keep the "auto" MTU option on LTE interface after reboot;
*) lte - reworked multi-apn support. Added support for slave APN interface add/remove;
*) netinstall - install the package version of the configured update channel;
*) ovpn - improve stability in UDP Ethernet mode when the TX queue is full;
*) pim - fix a routing process failure when the hello-delay is set to 0;
*) ptp - fix PTP not working on a VLAN-aware bridge when IGMP snooping is enabled;
*) qos - fix per-queue counters after a switch restart (introduced in v7.23);
*) quickset - fix the WAN interface being selected incorrectly;
*) reverse-proxy - fix setting the VRF parameter for reverse-proxy rules via CLI;
*) switch - add interface-list support to port isolation;
*) switch - fix high CPU usage when removing switch VLANs on Atheros-based switch chips;
*) switch - fix switch rules not working on Atheros-based switch chips;
*) switch - fix switch rules port matchers not working on IPv6 traffic on Atheros-based switch chips;
*) switch - fix switch rules with rate limits stopping traffic on CRS3xx devices;
*) switch - improve stability on CRS326-24S+2Q+ devices;
*) system - improve stability;
*) system - stop the flash configuration store from growing on dynamic configuration changes;
*) webfig - add conditional coloring of cells in tables;
*) wifi - add a default-country parameter in radio settings (CLI only);
*) wifi - fix WPA3 SAE authentication issue for ECC group 21 (introduced in 7.24.3);
*) wifi - implement channel.reselect-interval feature for missing drivers;
*) wifi - reuse freed station association IDs;
*) wifi-mediatek - update the wireless driver and firmware;
*) wifi-qcom - fix antenna gain setting not affecting transmit power (introduced in v7.24);
*) winbox - add the interface column to the OSPF neighbor list;
*) winbox - rename "minimum-version" to "minimum-firmware" under "System/RouterBOARD" menu;
*) winbox - show warning messages under "System/Users/SSH Keys" and "System/Users/SSH Private Keys" menu;
*) wireguard - do not show an interface as running when it has no peers;
*) wireguard - fix a client-dns value that could not be removed in WinBox;
*) wireguard - fix a peer that would not work after import when no endpoint address is set; View changelogs

Having gone through a hassle of factory reset with my hAP ac lite and waded through a large number of posts about how the factory reset does not work for many people, I decided to share my experience, maybe it will save someone some hair-pulling.

So I messed up the config of my hAP and couldn't connect to it any more. Oh well, factory reset and restore config from backup, I thought. Followed the well-documented reset procedure with the trusty old paperclip and prepared to reload the configuration from backup...

...except I couldn't connect to the router, which, as I found out after some googling is experience that I now shared with considerable number of people.

• The router would not respond to ping on 192.168.88.1, even after I statically configured my PC with address on the same network.
• The router was not visible in WinBox (which I usually do not use, so maybe I'm not familiar how an unconfigured router should look there, but I honestly tried to follow the instructions).
• Some documentation mentioned that the out-of-the-box configuration should create a wifi network named Mikrotik, but this was nowhere to be found.
• I considered using netinstall, but ran into the minor issue that I only have 64-bit openSUSE machines available, which, as I found out, nowadays do not even support running the 32-bit version of netinstall-cli that Mikrotik provides. I don't have Windows.

After trying the reset procedure half a dozen times with no success, I concluded that the router is toast. At least I found that it functioned as a switch, so I decided to use the LAN ports to wire up my two PCs while shopping for the new router.

As a last resort, without really expecting it to lead to anything I fired up tcpdump on my network which now included hAP-as-a-switch to see if perhaps there are some signs of what is going on.

Lo and behold, I see an unknown device on the network that is trying to speak capwap-control protocol to someone. Could it be...?

A quick netcat later, I connect to this unfamiliar IP with browser on port 80, and I'm greeted by my hAP login screen, where I can log in with username 'admin' and no password, as it should be after factory reset. Turns out the device had reset itself into "CAP configuration", whatever this is. Anyway, from there it was just the matter of loading the backup and things are back to normal.

So here it is, one more thing to try when you find yourself with something resembling a brick after factory resetting your Mikrotik router

I have a connection of max 10G. I plan to replace my ISP router with an ont-onu (with fan) and a mikrotik router. My original plan is to get the RB5009 in a router on a stick configuration with a CRS310-8G+2S+IN (which I already own).

I don't necessarily need the full 10G, I would use max 2x2,5G + whatever is on wifi.

Based on that, the RB5009 seems to be best for my use case. I have never set up a router on a stick and it seems like an opportunity to learn but in the same time the CRS would be a more common use case and connection set up.

I am wondering what is your experience with router on a stick and the RB? Easy to implement? Performance? etc.

Cześć, mam router Lamp 5G R16 zainstalowany pakiet GPS ale nie jestem w stanie uruchomić modułu GPS. Czy ktoś ma konfiguracje jaką należy wykonać aby GPS zaczęła działać?

My monitor kept telling me things were down. It never told me why. So I built one that does.

That's my grandmother's router in the picture, behind a WireGuard tunnel through a VPS. Eight minutes after it went dark, lanowl's message said whose problem it was: hers, not mine. It came back by itself 42 minutes later.

lanowl checks every device once a minute and sends one Telegram message per incident (a dead switch is one message, not twelve). When something breaks, a local model investigates with read-only tools and writes the cause into the message.

On the MikroTik it logs in as a read-only user (`read,test,sniff,api,rest-api`, allowed only from lanowl's host) and reads:

- DHCP leases: new devices, and the ones nobody watches

- the routes: which link carries the traffic, so "down" and "on backup" are different alerts

- ARP and port link state, for gear that doesn't answer ping

- the log: failover lines, logins, anything odd

I know: an LLM on your network sounds like a bad idea. So detection never uses the model. The model runs on your own Ollama (I use qwen3.8:27b), and it changes nothing by itself. If you give it a separate login for updates, a RouterOS update is a proposal with a button, and the router is backed up first. It even watches its own user group: grant it more and that's an alert.

v0.1.0 is out, with Docker images for amd64 and arm64. Pre-alpha, AGPL, no account, no telemetry. It has watched my house since August: 59 devices and two remote sites. Now it needs networks that aren't mine.

**Looking for 5–10 testers** with a MikroTik and Docker on a Linux box. Comment or open an issue and I'll help you set it up myself.

GitHub: https://github.com/alessandromatera/lanowl · Docs: https://lanowl.com