Форуми

What's new in 7.24.2 (2026-09-03): This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information. *) bgp - fix BGP link-local nexthops unreachable over a VRF and a crash when disabling an unnumbered connection; *) btest - improve stability; *) certificate - fix changing the built-in trust store setting (introduced in 7.22.2); *) console - improve stability; *) console - fix a memory leak in background scripts; *) console - improve stability; *) container - improve container image extraction; *) dhcp - improve stability of DHCP handling; *) disk - improve stability of the SMB server; *) ethernet - improve stability on hAP be3 Media; *) fetch - improve stability of the TFTP client; *) ipv6 - add a neighbor discovery ping; *) leds - fix LEDs set to interface status staying off when the interface is active; *) lte - fix the RG650E-EU modem not bringing link up after a firmware update; *) ping - add parameter checks for arp ping; *) poe-out - fixed missing PoE-Out interface on hEX PoE lite, RB260GSP, OmniTIK 5 PoE, PowerBox; *) ssh - refactor SSH internal processes and improved system stability; *) system - improve stability; *) webfig - improve stability; *) winbox - fix the "addresses" spelling in read-only fields; *) www - improve stability; Свали от тук

What's new in 7.24.1 (2026-Aug-21 16:06): *) app - fix entrypoint and cmd for opencloud-extended-collabora app; *) bridge - fix missing host "E" flag for CRS8xx series switches; *) bridge - fix MLAG for CRS8xx series switches; *) bridge - fix stability issue when using VRRP on bridge; *) bridge - improve MLAG host aging and deletion logic; *) console - fix "find" command argument lookup issue (introduced in v7.24); *) container - improve host isolation when container is set to "privileged=yes"; *) l3hw - fix stability issue on IPv6 offload enable; *) l3hw - fix VRF offload on bond interface remove; *) leds - fix "interface-status" trigger; *) snmp - properly validate password length when applying configuration; *) ssh - refactor SSH service internal processes; *) switch - fix possible Rx traffic stall on CPU for devices with Marvell Prestera switch chip; *) switch - fix stability issue during L2 loop for 98DX224S, 98DX226S, 98DX2528, and 98DX3236 switch chips; *) switch - fix stability issue on RB3011 (introduced in v7.22); *) system - improve handling of invalid SSL/TLS requests; *) wifi - fix stability issue for hAP be lite; *) wireguard - fix peer disable/enable state handling, which could leave the tunnel non-functional (introduced in v7.24); *) wireguard - fix private key handling, including empty private keys; *) www - improve service responsiveness when receiving malformed packets; Свали от тук

What's new in 7.24.1 (2026-Aug-21 16:06): *) app - fix entrypoint and cmd for opencloud-extended-collabora app; *) bridge - fix missing host "E" flag for CRS8xx series switches; *) bridge - fix MLAG for CRS8xx series switches; *) bridge - fix stability issue when using VRRP on bridge; *) bridge - improve MLAG host aging and deletion logic; *) console - fix "find" command argument lookup issue (introduced in v7.24); *) container - improve host isolation when container is set to "privileged=yes"; *) l3hw - fix stability issue on IPv6 offload enable; *) l3hw - fix VRF offload on bond interface remove; *) leds - fix "interface-status" trigger; *) snmp - properly validate password length when applying configuration; *) ssh - refactor SSH service internal processes; *) switch - fix possible Rx traffic stall on CPU for devices with Marvell Prestera switch chip; *) switch - fix stability issue during L2 loop for 98DX224S, 98DX226S, 98DX2528, and 98DX3236 switch chips; *) switch - fix stability issue on RB3011 (introduced in v7.22); *) system - improve handling of invalid SSL/TLS requests; *) wifi - fix stability issue for hAP be lite; *) wireguard - fix peer disable/enable state handling, which could leave the tunnel non-functional (introduced in v7.24); *) wireguard - fix private key handling, including empty private keys; *) www - improve service responsiveness when receiving malformed packets; Свали от тук

What's new in 7.24 (2026-Aug-14 11:33): *) adlist - improved service stability when adjusting adlist configuration; *) app - added "HF_TOKEN" env to openwebui; *) app - added "network-outgoing-access" parameter which does not allow app to make outgoing connections; *) app - added hermes-agent, inventree, opencloud, opencloud-extended apps; *) app - added PAPERLESS_SECRET_KEY env to paperless-nginx; *) app - allow "reset" even if disk not configured; *) app - allow HTTP for Gitea when "check-certificate=no"; *) app - allow setting "working_dir" in app YAML; *) app - changed pmacct-netflow YAML; *) app - disable UI in Hermes, access through /container/shell; *) app - fixed apps not updating firewall redirects when changed in YAML; *) app - fixed apps sometimes getting stuck on "waiting for layer"; *) app - make secrets sensitive to avoid polluting configuration export; *) app - removed healthcheck from opencloud-extended-collabora; *) app - reserve the app's VETH IP when stopped to eliminate IP address changes on every start/stop; *) app - show CHR's address instead of the container's; *) app - use randomly generated secrets in new apps; *) bgp - fixed EVPN label corruption and corrected EVPN type-5 output; *) bgp - improved stability when receiving malformed packets; *) bgp - removed "save-to" from "resend" command; *) bgp-vpn - fixed blackhole route export; *) bridge - added "querier-uses-bridge-address" setting to use bridge source IP address for IGMP querier; *) bridge - added DHCPv4 snooping IP binding table; *) bridge - added scheduling point during VLAN processing to prevent soft lockups when flushing FDB over large VLAN ranges; *) bridge - fixed forwarding through peer-port after disabling MLAG; *) bridge - fixed local static host entries; *) bridge - fixed MLAG MAC address handling issues related to aging, flushing and moving; *) bridge - fixed stability issue when using DHCPv4 snooping; *) bridge - fixed stuck MLAG session when using mismatched L2MTU (introduced in v7.23); *) bridge - improved bridge and port STP "priority" setting (warn when a non-compliant value is used and allow selecting a value from a list); *) bridge - improved STP, BPDU and topology change handling with MLAG, ensure dual-connected port STP state is in sync with MLAG peer; *) btest - added VRF support for bandwidth-test and speed-test; *) certificate - added "acme-renew" command; *) certificate - general improvements in certificate handling; *) certificate - use AES encryption when exporting certificates in PKCS#12 format; *) console - added "days" to scheduler; *) console - added "in" and "has" operators for array types; *) console - added "order-by" parameter to "print" command, allowing sorting by up to three arguments in ascending or descending order; *) console - added comparison operators for array type; *) console - added log tracing when scripts fail to start due to permissions; *) console - do not terminate self-removing scripts; *) console - fixed "print follow on-event" script runner command not showing all argument values in some cases; *) console - fixed argument mappings in "do" block for monitor commands; *) console - fixed proplist order in monitor commands; *) console - fixed script import/export with empty "policy" setting; *) console - fixed stability issue in full-screen editor; *) console - fixed UTF-8 comparisons on some architectures; *) console - improved "print detail" mode; *) console - improved script handling and error logging when running scripts from external sources (e.g. DHCP, SNMP, Netwatch, etc.); *) console - make "mac-auth-password" sensitive in "/ip/hotspot/profile"; *) console - make "password" sensitive in "/system/package/local-update/mirror"; *) console - produce runtime errors for bad command parameters; *) console - prompt about and offer to stop already existing serial terminal session when opening new one; *) console - renamed "address" to "available-from" in "/ip/service" (backwards compatible via deprecation); *) console - renamed "reauth-timeout" to "reauth-period" in "/interface/dot1x/server" (backwards compatible via deprecation); *) console - restrict editing comments in WiFi registration table; *) container - added "save" command to allow saving container images; *) container - added "swap-current" usage; *) container - added "swap-max" global and per-container limit; *) container - added ability to run containers in privileged mode; *) container - added initial support for RKE2; *) container - do not allow starting with empty default DNS list and no DNS override; *) container - do not print environment variables in log on container startup; *) container - fixed "start-on-boot" not retrying on certain startup errors; *) container - fixed container "devices" override to appear under "/dev"; *) container - improved layer size calculation to avoid potential loops; *) container - improved support for containers; *) container - reduced writes to flash when running health check; *) container - use env "TERM=xterm" if no TERM variable provided when running shell; *) crypto - fixed hardware accelerator for GCM cipher in TLS connection on Alpine CPUs; *) defconf - set "configuration.dtim-period=3" for WiFi; *) defconf - use "add-dns-entries=yes" on devices with DHCP server; *) dhcp - fixed processing of DHCP options that are longer than 255 bytes; *) dhcpv4-relay - fixed stability issue when creating duplicate relays; *) dhcpv4-server - do not reset "class-id" parameter when lease loses "bound" status; *) dhcpv4-server - set "ciaddr" in forcerenew messages so a relay, if used, can unicast such messages; *) dhcpv6-relay - fixed non-working relay when adding from WinBox; *) dhcpv6-server - fixed invalid flag; *) discovery - added "address6" column to default "/ip/neighbor" print view; *) discovery - added "discovery" logging topic; *) discovery - added "dying-gasp" feature for LLDP, MNDP, CDP that sends packet with "TTL=0" before graceful reboot/shutdown/upgrade; *) discovery - clear neighbor entry when receiving "dying-gasp" packet; *) discovery - improved service stability when sending discovery packets on interfaces that have hundreds of IP addresses; *) disk - added "last-seen" property that displays disk model and serial when removed; *) disk - added "raid-scrub-cancel" command; *) disk - added error message when disk state transitions from good to bad; *) disk - do not consider USB drives as self-encryption capable; *) disk - fixed "smart-info" not showing information on certain storage devices; *) disk - limited maximum swap size to be no more than 10x of device RAM; *) disk - resolved issue where storage device might change information upon reboot; *) ethernet - disable EEE on hAP be3 Media; *) ethernet - fixed stability issue for Chateau PRO ax devices; *) ethernet - fixed stability issue for devices with Alpine CPU; *) ethernet - removed "1G-baseT-half" link mode on RTL8367 switch; *) fetch - added "ip-type" parameter; *) fetch - added option to force HTTP/2 only (only for ARM64 and x86/CHR devices); *) fetch - fixed false "bad request" response when trying to fetch URL with IPv6 address in it; *) fetch - hint file list for "src-path" and "dst-path" parameters; *) hardware - renamed "max-power" to "manufacturer-reported-max-power"; *) iot - added LoRa keep alive logic for UDP protocol; *) iot - added missing LoRa US radio plans; *) iot - added Wiliot USB dongle support; *) iot - allow maximum Modbus "timeout" property to be 10 seconds; *) iot - monitor LoRa worker state (watchdog); *) iot - pass Wiliot certification; *) ip-service - remove reverse-proxy for SMIPS; *) ip-service - show service name for "l2tp"; *) ipsec - fixed expired SA handling to prevent “no such item” errors during listing; *) ipsec,ike1 - dropped base mode exchange; *) ipsec,ike1 - fixed negotiated PFS validation; *) ipsec,ike1 - improved SA, transform, fragment parsing and malformed packet validation; *) ipsec,ike2 - fixed ppk child key generation during rekey; *) ipsec,ike2 - improved KE generation validation during initial setup and child SA creation; *) ipsec,ike2 - improved PPK handling by always using it when authorized, including additional Child SAs, and moved PPK processing to the Child SA task; *) ipsec,ike2 - use first child KE selection only during IKE_AUTH exchange; *) ipsec,qkd - moved QKD to "/system/keymat-provider" menu and made it a generic key material provider; *) ipv6 - added "status" column to default "/ipv6/neighbor" print view; *) ipv6,ra - changed default "router-advertisement-route-distance" to 1; *) ipv6,ra - correctly process RAs advertising previously expired prefix; *) ipv6,ra - fixed prefix invalidation; *) ipv6,ra - use lowest value between IPv6/Pool and IPv6/ND/Prefix/Default as dynamic prefix lifetime; *) isis - fixed ECMP route removal; *) l2tp - allow fragmentation of large IPv6 packets; *) l3hw - added HW offloaded support for VLAN interfaces created directly on Ethernet for CRS8xx series switches; *) l3hw - added HW offloaded VRF support on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches; *) l3hw - added VRF assignment via switch ACL rules for devices with Marvell Prestera switch chip; *) l3hw - allow VLAN tagged traffic inside VXLAN tunnel; *) l3hw - fixed VRF-related issues for CRS8xx series switches; *) l3hw - fixed VTEP offload on IPv4 /32 route changes; *) leds - added dark mode support for L009, hAP ax2, hAP ax3, hEX refresh, hEX S (2025), hAP ax S and Chateau ax devices; *) leds - fixed Ethernet activity LED for Chateau LTE18 ax (introduced in v7.23); *) leds - improved interface stats activity for devices with Marvell Prestera switch chip; *) lte - added force-confirmation parameter for eSIM provision command; *) lte - cap IPv6 prefix lifetime for ipv6-interface; *) lte - do not add extra /128 IPv6 address for ipv6-interface; *) lte - do not query 5G neighbor cell info until RG650E-EU FW fixed; *) lte - enabled AT registration unsolicited event reporting for EG25-G and EC25-EU boards; *) lte - fixed cases where R11l-LTE7 modem would not display correct cell info after handover; *) lte - fixed EC/IO scale in CLI and GUI; *) lte - fixed EC25-EU, EG25-G traffic to 67 UDP; *) lte - fixed IPv6 RA handling for multiapn non-primary interface; *) lte - fixed third-party modems ICCID decoding for eSIM; *) lte - improved Cinterion PLS8-E roaming; *) lte - improved deregistration handling for AT modems; *) lte - improved system stability when no APN specified; *) lte - improved USB mode handling for BG770A-GL; *) lte - limit IPv6 prefix lifetime only when lifetime is advertised as infinity; *) lte - make modem MAC persistent for R11e-LTE6 and R11l-LTE7 modems; *) lte - remove site local DNS for ipv6-interface; *) lte - removed extra restart after firmware upgrade for EC200A-EU modem; *) lte - report short cell ID in 3G network mode also for AT modems; *) lte - restrict incoming calls for FG621-EU; *) lte - show "+CME ERROR: 10" as "SIM not present"; *) lte - show "data-class" in LTE monitor instead of "access-technology" also for 5G AT modems; *) lte - show "primary-band" instead of "earfcn" in LTE monitor also for modems without CA support; *) lte - show RSCP and EC/IO parameter in 3G network mode for R11e-LTE6, R11l-LTE7 and FG621-EA modems; *) mesh - fixed missing FDB entries from wireless ports; *) mpls - added ICMP time exceeded handler for IPv6; *) mpls - make FastPath work with expl-null; *) netinstall - added Netinstall package; *) netinstall - improved architecture detection; *) netinstall-cli - added "help" parameter; *) netinstall-cli - added "reboot" and "shutdown" flags to control reboot after installation; *) netwatch - fixed an issue with DNS probe "timeout" parameter; *) netwatch - fixed HTTP GET probe over IPv6; *) netwatch - fixed inaccurate "rtt-stdev" value; *) netwatch - fixed issue where ICMP probes did not accept TTL exceeded packets when "accept-icmp-time-exceeded" was enabled; *) netwatch - increased maximum packet size to 65535; *) ospf - fixed stability issue during interface flaps; *) ospf - force passive for VRF interface; *) pimsm - make "hash-mask-length" parameter naming consistent and fixed typos; *) poe-in - added PoE-in monitoring and LLDP-based PoE negotiation support for newer devices (e.g. CRS504, CRS510, hEX S 2025, hAP be3 Media); *) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces); *) poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces); *) ppp - added "MT-Address-List" to IPv6 address list when received from RADIUS and using DHCP for IPv6 configuration; *) ppp - added iccid field to ppp info command for BG77 and BG770 modems; *) ppp - always show current FW version when running firmware-upgrade; *) ppp - disable/enable modem radio state depending on ppp interface state; *) ppp - fixed cases where BG77 or BG770 firmware upgrade was not available; *) ppp - fixed ppp-out stability issue; *) ppp - get IPv6 configuration via RA for modems using PPP emulation mode; *) ppp - improved "info" command for BG77 and BG770 modems; *) ppp - improved OVPN underlying SSL connection management; *) ppp - only show pin in export with "show-sensitive" flag; *) ppp - report actual network data usage statistics instead of "0" for all IPv6 RADIUS accounting parameters on accounting "Stop" packet; *) ppp - toggle radio state on interface disable/enable; *) queue - fixed "undo" command for simple queues; *) reverse-proxy - improved stability; *) rip - do not export authentication keys by default; *) route - allow to add route with link-local destination address; *) route - fixed memory leak when flapping addresses or interfaces with routing protocols running; *) route - fixed potential race condition; *) route - respect the "interface" property when pinging IPv6 addresses over ECMP; *) sfp - fixed linking for hAP ax S and hEX S (2025) with "1G-baseX" link-mode; *) sfp - removed unsupported "2.5G-baseX" speed on CRS312-4C+8XG and CRS326-4C+20G+2Q+; *) sftp - fixed branding package upload; *) sms - added some GSM7 symbols to SMS tool; *) snmp - added hotspot active-user-count and host-count OIDs to MIKROTIK-MIB; *) snmp - added missing SFP OIDs to MIKROTIK-MIB; *) snmp - added WiFi current channel "mtxrWifiInterfacesCurrentChannel" OID to MIKROTIK-MIB; *) ssh - added mlkem768x25519-sha256 key exchange support; *) ssh - do not attempt automatic empty password login when RADIUS is used; *) ssh - fixed SSH tunnel with IPv6 link-local address on non-ethernet interfaces; *) ssh - make SSH packet validation more strict; *) supout - added interface monitor-traffic; *) supout - added LTE eSIM section; *) switch - fixed IEEE reserved MAC handling for CRS1xx, CRS2xx switches; *) system - improved stability; *) system - renamed "factory-software" to "minimum-version" and "factory-firmware" to "minimum-firmware"; *) system - restrict RouterOS processes using swap; *) system - show who is using "/system serial-terminal"; *) traffic-generator - fixed injecting pcap/pcapng files on MIPSBE architecture; *) tunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22); *) upgrade - removed sensitive policy for "apply-changes" command; *) usb - allow overriding the power-reset duration; *) usb - fixed USB Ethernet interface default-name; *) vpls - added transmit loop detection; *) vrrp - added "v3-checksum-as-v2" setting; *) vrrp - fixed stability issue when "sync-connection-tracking" is enabled; *) vxlan - fixed missing L2MTU property when VRF is specified; *) vxlan - ignore disabled interfaces when checking for configuration conflicts; *) webfig - fixed issue with increasing keep-alive traffic; *) webfig - improved underlying encryption and stability processing; *) webfig - improvements to graphs; *) wifi - added "Preamble Puncturing" under "WiFi/Channel" menu; *) wifi - added dash when CAPsMAN generates interface name and prefix ends with digit; *) wifi - improved roaming/steering behavior for WiFi 7 MLO; *) wifi - improved stability; *) wifi - improved station-bridge mode; *) wifi - updated radio regulatory information; *) wifi - upgraded wifi-qcom driver; *) wifi-mediatek - fixed broken interfaces on startup; *) wifi-mediatek - fixed some channel definitions for certain countries; *) wifi-mediatek - improved channel switching; *) wifi-mediatek - improved stability during MLO channel switching; *) winbox - added "Network" configuration menu for WiFi; *) winbox - added "Preferred Architecture" setting for L009; *) winbox - added "SIM PIN" under "Tools/SMS"; *) winbox - fixed "Connection Bytes" field under "IP/Firewall" menu; *) winbox - fixed "EC/IO" scaling for LTE interface; *) winbox - fixed "Use Ipsec" and "Ipsec Secret" under "Interfaces/L2TP Ether" menu; *) winbox - fixed empty value in "Immediate Gateway" under "IP/Routes" menu; *) winbox - fixed sort for "Address List" under "IPv6/Firewall" menu; *) winbox - make LoRa "Auth key" and MQTT "Password" sensitive; *) winbox - move "EAP" under "Security" tab for WiFi; *) winbox - show "Any. Port" column by default under "IP/Firewall" menu; *) winbox - show preferred and valid lifetime of IPv6 address also on static IPs; *) winbox - show priority bits in "VLAN ID" field under "Tools/Packet Sniffer" menu; *) wireguard - added support for domain names in client-dns; *) wireguard - added warning when allowed-address overlaps with another peer on the same interface; *) wireguard - fixed peer recreation on interface change; *) wireguard - fixed peer Tx/Rx counters; *) wireguard - fixed wg-export comments output and case when endpoint is not set; *) wireguard - fixed whitespace handling in AllowedIPs during wg-import; *) wireguard - generate port number when specified as zero; *) wireguard - improved wg-export to print endpoint domain name; *) wireguard - improved wg-import to quietly ignore wg-quick specific keys; *) wireguard - reconfigure peer only when meaningful changes are detected; *) wireguard - reinitialize socket on VRF change; *) x86 - fixed IRQ displaying per CPU on Intel 700 series NIC; Свали от тук

What's new in 7.23.3 (2026-Jul-30 14:17): *) certificate - added "ISRG Root X2", "Root YE" and "Root YR" to SMIPS built-in root certificate authorities store; *) certificate - added "Root YE" and "Root YR" to built-in root certificate authorities store; *) defconf - added virtual "iot-wifi" to MLO supporting devices; *) dhcpv4-server - fixed "expires-after" field for disabled static lease (introduced in v7.23); *) fastpath - properly fall back to SlowPath when FastPath is not possible due to fragmentation; *) ipsec - fixed identity lookup to skip past disabled and certificate-matched identities when scanning for an exact ID match; *) ipsec,ike2 - improved logging when remote ID is specified; *) ipsec,ike2 - use peer certificates also when identity has one set for peer matching; *) ipv6,ra - show warning about paused automatic RA on upgraded routers; *) ospf - fixed "duplicate config" issue when using ptp-unnumbered interface type; *) ptp - fixed a race condition when reading transmit timestamps, which could cause unstable clock offset under background traffic; *) ptp - fixed PTPv1 traffic forwarding when a PTPv2 profile is enabled on bridge ports; *) snmp - improved SNMPv3 request processing logic; *) system - added microSD card support for hAP be3 Media; *) system - improved handling of data re-sending on authorization requests (introduced in v7.22); *) system - improved stability; *) system - updated certificate for Windows executable signing; *) tftp - limit maximum simultaneous session count to 100; Свали от тук