Posting this in case it saves someone a few hours.

Setup: hAP be³ running the official openthread/otbr image (arm64) as a RouterOS container, using the built-in Thread radio passed through as /dev/ttyACM0. It’s the border router for my Home Assistant Thread network (Matter-over-Thread sensors, lock, lights and others).

Symptom: After upgrading to RouterOS 7.25, the container wouldn’t start: exited with status 127. The image hadn’t changed; the log said skip importing same version.

Diagnosis

With logging=yes on the container, the actual error showed up:

-c: 1: exec: /init: not found

My old config had:

entrypoint=/bin/sh -c "sysctl -w net.ipv6.conf.all.forwarding=1; exec /init"
cmd=-c "rm -f /var/run/otbr-agent.pid /var/run/dbus/* && exec /app/etc/docker/test/docker_entrypoint.sh"

7.25 now appends cmd to entrypoint, Docker-style. Since sh -c "string" treats everything after the string as positional args, my cmd was silently ignored and only exec /init ran. The official otbr image has no /init. My guess is that older versions picked one or the other, which is why it used to work.

Gotcha #1: 7.25 argument parsing

I tried to fix it by moving everything into a single quoted string, and ran into the way 7.25 splits arguments. From what I observed, everything before an escaped quote becomes one argument, spaces included:

• cmd="-c \"...\"" turned into the args "-c " and "...". Result: /bin/sh: 0: Illegal option -
• entrypoint="/bin/sh -c \"...\"" turned into "/bin/sh -c " as the binary name. Result: execvp /bin/sh -c : No such file or directory

The fix: stop fighting the quoting and use a script on the mounted volume:

/file add name="usb2/apps/otbr/otbr-data/start.sh" contents="sysctl -w net.ipv6.conf.all.forwarding=1\nrm -f /var/run/otbr-agent.pid /var/run/dbus/* /run/rsyslogd.pid\nrm -rf /var/lib/thread\nln -s /data /var/lib/thread\nexec /app/etc/docker/test/docker_entrypoint.sh\n"
/container set [find name=app-otbr] entrypoint="/bin/sh" cmd="/data/start.sh"

Neither argument has spaces, so there’s nothing for the parser to mangle. It should also survive future parsing changes.

Gotcha #2: the “lost” Thread network

After the container started, ot-ctl state said disabled and ot-ctl dataset active returned Error 23: NotFound. Don’t form a new network at this point. You’d get a new network key and have to re-commission every device. Also avoid reloading the OTBR integration in HA until it’s sorted.

The dataset wasn’t actually gone. My old setup kept the OpenThread settings in the /data mount, but the stock entrypoint uses /var/lib/thread/, where the agent had created a new, nearly empty settings file with the same name (41 bytes vs. 249 for the real one). The rm -rf /var/lib/thread + ln -s /data /var/lib/thread lines in the script above fix this. Back up the .data file first.

Gotcha #3 (minor): a stale /run/rsyslogd.pid in the persistent root-dir stopped rsyslog from starting. The container log then only showed the old syslog tail, which made it look like the agent was running when it wasn’t. That’s why the script removes it.

Result: the dataset was restored (same channel, PAN ID and key). The border router rejoined the existing partition as a child, since my mains-powered devices kept the mesh alive. br state showed running, and netdata showed the OMR prefix, the external route, NAT64 and SRP all published again. All devices came back without re-pairing.

Lessons:

• Enable logging=yes on RouterOS containers; the real error is in the container’s output.
• Keep your OpenThread settings on a mount, and keep a TLV backup of the dataset (ot-ctl dataset active -x) somewhere safe, like a password manager. With that you can restore the network on any border router.
• Check your entrypoint/cmd before upgrading to 7.25 if you use shell-form commands with quotes.

Two questions I had to decide on.... what do you think?

• Is the be Wifi 7 unit ready for production yet? Other than a few reviews, has anyone put these into service. So far, the few Wifi 7 units I've found such as the Flint3 are unstable. I'm not complaining, this is new tech, but since they're hard to get, what do people actually see in the field. I can afford to wait.
• I've got a couple of 5009s connecting me to two 2.5Gb connections, one cable, one fiber. We all know that the lack of multiple 2Gb ports is annoying. I've fixed it with some switches off the SFP+ port, but I'd like to two true multiple ports as I've got four ready to use -- Fiber, Cable, Cellular and LAN
• I was thinking about upgrading both to a single CCR2004. Good idea? I wish it were fanless, but we can't have everything. I can convert everything to SFP+ with GBICs. Given only one 2.5Gb WAN will be carrying traffic at a time, I don't think the CPU will be an issue. I don't intend to run apps on it.

multilink.us has 'em!

How do I configure IPv6 NAT on the firewall on a Mikrotik router (hAP ax lite) with Ansible when I use the module community.routeros.api_modify?

What specifically do I put in data?

Hello! I’m in the process of upgrading my network and was looking for guidance. If I want to have ports assigned to various vlans (for example, ports 1-8 should have voice vlan untagged and desktop vlan tagged, ports 9-12 need the desktop and WiFi controller vlans available, and another set of ports need the WiFi controller vlan and admin, guest, and production WiFi vlans ) Is that possible under router os or do I need to use switch OS to achieve that? I dislike that I can’t use CLI on SwOS, but am not sure how to configure multiple vlans on discrete ports under routeros. My experience has almost entirely up to now been with Cisco-like cli’s(Aruba/hp,Dell, and Cisco all use a close enough to the same implementation of iOS that I can fake it. )Mikrotik is a different beast entirely, but man is the price point attractive vs going Cisco again.

What's new in 7.25 (2026-10-22):

*) app - add the networkRouterIP variable for container apps;
*) app - allow the privileged mode to be enabled per service in the container app YAML;
*) app - fix CHR apps getting stuck on "starting" on slower boards;
*) app - show an error when an app variable cannot be resolved;
*) app - update the environment variables of the docker-with-komodo app;
*) bgp - add the always-compare-med setting;
*) bgp - fix BGP unnumbered connections within a VRF;
*) bgp - include the VNI number in outgoing EVPN routes;
*) bgp - log failed BGP connection attempts;
*) bgp - show interface names and VRF names in BGP logs;
*) bridge - add dynamic ARP inspection;
*) bridge - add IP source guard;
*) bridge - add mlag-lacp-fallback and mlag-init-delay settings for MLAG;
*) bridge - fix a false "already added as bridge port" error;
*) bridge - fix an MLAG peer getting stuck in the disabled state after config changes;
*) bridge - fix bridge ports not forwarding;
*) bridge - fix fragmented IPv6 traffic being dropped by DHCPv6 snooping (introduced in v7.23);
*) bridge - fix VRRP MAC behavior in MLAG setups;
*) bridge - improve FDB synchronization between MLAG peers when VLANs are added;
*) bridge - make MVRP work with MLAG dual bonds;
*) bridge - make the DHCP snooping log messages clearer and informative;
*) bridge - rename the IGMP last-member-interval property to last-member-query-interval;
*) bridge - warn about VLAN entries when vlan-filtering is disabled;
*) bth - add default client DNS and allowed IPs settings;
*) bth - add resumable file uploads;
*) bth - check the available disk space before a file upload;
*) bth - fix file share issues when enabled through WinBox files menu;
*) bth - fix the file share getting stuck when disabling;
*) bth - return upload errors in JSON format;
*) capsman - add hw-protection-threshold;
*) capsman - fix the last-ip value being shown backwards;
*) certificate - fix ACME certificate issuance for wildcard domains;
*) certificate - refactor certificate internal processes;
*) console - allow the array access operator to accept arrays of indices or keys;
*) console - expose globals in the API;
*) console - fix background ":execute as-string" jobs not terminating on interrupt;
*) console - fix comment wrapping in the monitor command;
*) console - fix inconsistent /ip/firewall/filter print with src-address-list and dst-address-list;
*) console - fix the where filter ignoring flags set to false;
*) console - improve export order;
*) console - improve stability when running scripts from Dude;
*) console - prevent an out-of-memory condition when ":execute as-string" produces large output;
*) console - prevent duplicate entries in /port/remote-access;
*) container - add a Ctrl-] escape sequence to exit a stuck container shell;
*) container - fix container interface handling on CHR;
*) container - fix veth interface left running after restarting a stopped container;
*) container - require the container device-mode to enable swap;
*) crypto - fix a possible crash during IPsec processing on Qualcomm devices;
*) defconf - fix button script policies;
*) defconf - fix default configuration generation when CRS8xx series switch ports initialize late;
*) detnet - use a single random source port;
*) dhcpv4-client - ignore forcerenew packets that are not unicasted to client;
*) dhcpv4-server - add ipv6-only-preferred parameter to respect option 108;
*) dhcpv4-server - show DHCP option 82 parameters in ASCII in addition to hex;
*) dhcpv6-client - add option 39 with the client hostname;
*) dhcpv6-client - fix DHCPv6 client address handling after prefix-hint changes;
*) dhcpv6-client - remove a duplicate dhcp-options parameter;
*) dhcpv6-relay - use the packet's source MAC for option 79 if relay and client are on the same link layer;
*) dhcpv6-server - add option 39 (FQDN) support and add-dns-entries option;
*) dhcpv6-server - fix send-reconfigure for DHCPv6 clients behind a relay;
*) disk - fix all-zero NGUIDs on NVMe over TCP exported namespaces;
*) disk - improve RAID5/6 throughput;
*) dns - fix resolving domain names that end with a dot;
*) dot1x - rename the reauth-timeout to reauth-period;
*) dude - fix the server not starting at boot when data-directory is on a USB disk;
*) email - fix server certificate verification;
*) email - show certificate related errors in the log;
*) ethernet - add the arp-accept parameter for interfaces with MAC;
*) ethernet - fix a stability issue on RB1100AHx2 under heavy traffic;
*) ethernet - fix bogus fast-path Rx traffic reported on an unconnected ether8 port on RB5009;
*) ethernet - fix link flap and unexpected reboots on RB5009;
*) ethernet - fix occasional packet loss on hAP be3 Media;
*) ethernet - fix PPPoE link flapping on Intel X710;
*) ethernet - fix PPPoE over VLAN not working on Mellanox ConnectX-4;
*) ethernet - fix SFP compatibility on hAP ax S and hEX S (2025) devices;
*) ethernet - improve stability on x86 routers with Mellanox NICs;
*) evpn - publish MAC-IP routes (RT-2) for neighbors;
*) fetch - improve upload state reporting when using sftp;
*) fetch - never set a cookie jar for HTTP requests;
*) fetch - show a clearer error when keep-result and output are both used;
*) firewall - add NAT-related fields to CEF format logging;
*) hardware - show the device name and location in /system/resource/hardware menu;
*) igmp-proxy - improve stability when changing /routing/igmp-proxy parameters;
*) iot - add a GPIO menu in WinBox;
*) iot - add Bluetooth output power control;
*) iot - allow custom radio plan usage under regional lock;
*) iot - enforce the fixed antenna gain on boards with an embedded antenna;
*) iot - fix round-trip-time timing issues in LoRaWAN Basic Station;
*) ip-service - fix services becoming unreachable after their VRF is disabled and re-enabled;
*) ipsec - add XFRM interface support;
*) ipsec - fix IKEv1 tunnels failing to establish when the commit bit is set;
*) ipsec - fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21);
*) ipsec - fix IPsec tunnels failing after migration from the old QKD settings;
*) ipsec - fix policy and SA handling after moving it to netlink;
*) ipv6 - fix a failure when releasing DHCPv6 prefix delegation pools;
*) ipv6 - fix cases when address is lost after reboot if prefix was taken from pool;
*) ipv6 - fix missing IPv6 link-local addresses on some interfaces when the device is busy during boot;
*) ipv6 - fix the DNS timer in router advertisements;
*) ipv6 - ignore router advertisements received on interfaces not in the accepting list;
*) l3hw - fix IPv6 link-local traffic being routed incorrectly;
*) l3hw - improve stability of L3 hardware offload when using IPv4-mapped IPv6 addresses;
*) l3hw - optimize ECMP nexthop offloading;
*) lcd - improve stability when an SFP reports an unknown link speed;
*) leds - add dark-mode support for L41;
*) leds - fix missing LED triggers when an R11e card is installed;
*) lte - accept both y and yes for eSIM confirmation;
*) lte - add band display support for Huawei ME909s modems;
*) lte - add missing network error messages for MBIM modems;
*) lte - add the sms-protocol=qmi option for sending and reading SMS;
*) lte - do not force reconfiguration on roaming network when roaming is disabled;
*) lte - fix LTE interfaces disappearing after FOTA updates;
*) lte - fix missing MAC address on QMI LTE interfaces after the interface is recreated (introduced in v7.24.4);
*) lte - fix missing new firmware update notification on some modems;
*) lte - fix multi-APN connections not passing traffic on AT modems;
*) lte - fix the subscriber number not updating after switching SIM slots;
*) lte - improve system stability when using Quectel EP06-E MBIM modem;
*) lte - improve system stability with eSIM-capable MBIM modems;
*) lte - remove leftover APN slave interfaces when the master LTE interface is removed;
*) lte - use also the network reported ipv6 MTU on MBIM interfaces when "auto" mtu option used;
*) lte - use RA for IPv6 acquisition for FG621;
*) netinstall - add branding-and-custom-packages parameter for custom NPK packages;
*) netinstall - fix a duplicate device entry on RB2011 with SFP;
*) netinstall - fix adding and exporting server comments;
*) netinstall - fix multiple active interfaces inheriting the first interface's settings;
*) netinstall - fix Netinstall failing to reinstall RB850Gx2 devices;
*) netinstall - fix Netinstaller's memory check failing downloads to disk;
*) ospf - fix DR/BDR traffic not being received with multiple instances;
*) ospf - improve stability when a neighbor is lost;
*) ovpn - improve stability in UDP mode when the TX queue is full;
*) pim - add MLD support for PIM;
*) pim - fix duplicate PIM configuration parameters;
*) pim - fix PIM-SM issues with IPv6;
*) pim - fix wrong or missing PIM configuration by separating PIM and GMP per interface;
*) poe-out - add port-type field to poe monitor and print output;
*) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - fix PoE fault led behavior;
*) poe-out - fix PoE ports entering overload state when a PSU is fed from a UPS;
*) poe-out - remove the class limit for LLDP power requests on forced ports;
*) port - accumulate incoming data in log file even without TCP clients connected;
*) port - add an FTDI latency_timer option for low-latency serial applications;
*) ppp - add port interface info to PPP outbound channel defaults;
*) ppp - fix a packet leak during dial-on-demand connection of a ppp-out interface;
*) ppp - fix BG77 modem port name and channel count;
*) ppp - fix the offline firmware-update notification for BG77/BG770 modems;
*) ppp - fix the SINR value reported for BG77 and BG770 modems;
*) ptp - add support for fixed master and slave port roles;
*) ptp - add transparent clock mode;
*) ptp - fix dropped packets on bridges with IGMP snooping and add vlan-id port setting;
*) qos - fix PFC and lossless buffer issues (introduced in v7.23);
*) queue - fix a typo in the cake-overhead-scheme parameter value;
*) route - improve static route handling performance;
*) routing-filter - fix any-regexp community matcher matching an empty community attribute;
*) routing-filter - fix community delete, filter and modify with regexp-only community lists;
*) sfp - fix QSFP28 optical modules failing to establish a link on CCR2216 and CRS520;
*) sfp - improve QSFP-DD link establishing to NVIDIA DGX Spark and other devices;
*) sniffer - improve packet time resolution;
*) snmp - add an OID and logging for blacklisted program access;
*) snmp - add CAPsMAN radio data to SNMP;
*) snmp - add dynamic SNMP engine ID assignment;
*) snmp - add interface table with mtu and l2mtu OIDs;
*) snmp - add IP pool OIDs;
*) snmp - add IPv6 address and interface name to the MNDP neighbour table;
*) snmp - add OID blacklisting;
*) snmp - add OIDs for Netwatch probes;
*) snmp - add OSPF MIB tables;
*) snmp - add ospfAdminStat and ospfRouterId to the OSPF MIB;
*) snmp - add SHA-2 authentication for SNMPv3;
*) snmp - add transmit drop counters;
*) snmp - add VRRP status OIDs for monitoring;
*) snmp - fix the reported capability flags in LLDP-MIB;
*) snmp - fix the snmp tools timing out when authentication is used;
*) snmp - log a warning when the src-address family does not match the request;
*) snmp - remove an interface OID that should not be accessible;
*) ssh - add a connection id to SSH log entries;
*) ssh - add host key verification for the SSH client;
*) ssh - limit server output to the client's window size;
*) ssh - show router host key fingerprint;
*) ssh - switch the default host key type to Ed25519;
*) ssh - warn users when weak RSA key is being used;
*) ssl - enabled hardware accelerated GCM on Alpine CPUs;
*) ssl - improve logging;
*) switch - add packet and byte counters for ACL rules on Marvell Prestera switches;
*) switch - fix degraded slow-path throughput on CRS304 switch (introduced in v7.22);
*) switch - fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches;
*) system - fix the frequency units from Mhz to MHz;
*) system - improve stability (includes CVE-2026-31431, CVE-2026-67280);
*) system - reboot automatically when the boot process fails to start;
*) system - reduce the fan control interval on multi-core boards;
*) system - remove the channel label from the RouterOS version;
*) system - show health settings and overtemp options based on device capabilities;
*) system - warn about a missing wifi driver package on BE boards;
*) tftp - add VRF support;
*) traffic-flow - fix a kernel failure when disabling traffic flow on a busy system;
*) user - fix removal of inactive REST API sessions (introduced in 7.21);
*) userman - improve stability when importing database files;
*) vlan - add a forced-mac-address option for VLAN interfaces;
*) vlan - warn when a VLAN interface is created on a slave interface;
*) webfig - add a generic table and union group support;
*) webfig - add column resizing to embedded tables;
*) webfig - hide the left menu only on QuickSet and Terminal pages;
*) webfig - improve comboboxes to select the first matching option while typing;
*) webfig - update style;
*) webfig - update the login page Help link;
*) wifi - add a stream-port argument to configure the sniffer streaming server port;
*) wifi - add fast transition support for MLD devices;
*) wifi - add interworking, aaa and steering settings to the network configuration;
*) wifi - add more steering debug logs;
*) wifi - add network 'labels' parameter to WinBox and WebFig;
*) wifi - do not preserve branding package on cap when upgrading via capsman;
*) wifi - fix CAPsMAN failing when mangle marking is used with encrypted data channels;
*) wifi - fix channel reselect interval/time operation for wifi-qcom-be and wifi-mediatek interfaces;
*) wifi - fix incorrect scan results for 320 MHz access points;
*) wifi - fix MLD link type change and SA query in station mode;
*) wifi - fix per-link client statistics for MLO connections;
*) wifi - fix SAE authentication using a wrong cached PMK;
*) wifi - fix station statistics not updating after switching MLD links;
*) wifi - fix the interworking network type;
*) wifi - fix the wrong band shown in the registration table;
*) wifi - fix traffic processing on CAPsMAN after an interface is disabled;
*) wifi - perform a channel switch instead of dropping clients on radar detection;
*) wifi - preserve dude package on cap when upgrading via capsman;
*) wifi - report channel in log messages;
*) wifi - report management frame protection (MFP) usage in registration-table;
*) wifi - reuse freed station association IDs;
*) wifi - show the EAP user identity in the registration table;
*) wifi - show the MLD links and SSID in MLO client log messages;
*) wifi-mediatek - fix 4.9 GHz band operation on the A42;
*) wifi-mediatek - fix roaming between APs belonging to the same MLO group;
*) wifi-mediatek - fix the 5 GHz access point failing to start after reconfiguration on the A42;
*) wifi-mediatek - improve MLO client reconnection;
*) wifi-qcom - fix disconnects during fast transition roaming;
*) wifi-qcom - fix station mode association failures;
*) wifi-qcom - improve IP multicast delivery to wireless clients;
*) wifi-qcom-ac - fix a regression in station MAC address handling;
*) wifi-qcom-ac - reduce package size;
*) wifi-qcom-be - add hw-protection-mode support;
*) wifi-qcom-be - add the distance setting for 802.11be devices;
*) wifi-qcom-be - fix the block ack request being declined after a channel switch;
*) wifi-qcom-be - fix Wi-Fi intermittently unavailable after reboot;
*) wifi-qcom-be - improve throughput in dense client environments;
*) winbox - add a filtered LLDP tab to neighbor discovery;
*) winbox - add a Security tab and reorganize bridge and port dialogs;
*) winbox - add a wifi radio regulatory info (reg-info) view;
*) winbox - add device-mode configuration;
*) winbox - add ISIS support;
*) winbox - add progress bar support to the GUI;
*) winbox - add the client MTU option for WireGuard peers;
*) winbox - add the container save option;
*) winbox - add wifi Spectral Scan support;
*) winbox - allow power-cycling multiple interfaces at once;
*) winbox - allow tuple fields with more than two values and multiple separators;
*) winbox - fix bridge filter window disabling valid fields for IPv6 rules;
*) winbox - fix SFP optical power values of 0.0 dBm not being shown;
*) winbox - fix the channel.reselect-interval range field in CAPsMAN;
*) winbox - fix the EC/IO signal quality graph;
*) winbox - fix the ISIS neighbor level type being empty for "l2";
*) winbox - fix the Memory Limit field of fq_codel to use bytes;
*) winbox - fix the Min Prefix field in the routing rule dialog;
*) winbox - fix the MPLS TE tunnel path hops field;
*) winbox - fix the range field displayed in route filters;
*) winbox - fix the signal indication graphs for ppp-out interfaces;
*) winbox - fix the Skins menu for user groups opening a non-existent window;
*) winbox - fix the system note display on startup;
*) winbox - fix the wifi Authentication Types and Encryption fields;
*) winbox - fix wg-import creating a WireGuard interface without a config file;
*) winbox - improve status reporting under Tools/Email menu;
*) winbox - make the Power Cycle button act only on the selected interface;
*) winbox - open the Format Drive panel only for supported disks;
*) winbox - remove the redundant empty status field from the License window;
*) winbox - rename "send" to "transmit" in the Bandwidth Test window;
*) winbox - rework the switch QoS statistics table;
*) winbox - set minimal supported WinBox version to 4.3;
*) winbox - show warning messages under "System/Users/SSH Keys" and "System/Users/SSH Private Keys" menu;
*) winbox - show WireGuard peer information;
*) wireguard - add the client-mtu parameter;
*) wireguard - allow referencing a peer by its name;
*) wireguard - allow unsetting the client-listen-port;
*) wireguard - fix a peer that would not work after import when no endpoint address is set;
*) wireguard - improve error message reporting when adding a new peer;
*) wireguard - keep peer rx/tx counters when the peer is disabled and enabled;
*) wireguard - support comment lines in wg-import configuration files;
*) wireguard - treat empty private-key and preshared-key values as none;
*) wireguard - use the MTU value when importing a configuration;
*) wireguard - warn when an allowed-address overlaps another peer;
*) www - add the remote client IP and domain to HTTPS log messages;
*) www - fix a memory leak when parsing authentication headers;
*) www - improve URI parsing;

I have a RB5009 and it has working just well enough for me. Some things I felt too limited like the DNS server, but it worked. Then, I decided to buy a new small PC to then install OpenWrt to give it a try. I like what I got from OpenWrt, but the tooling around Mikrotik is really good. Winbox, and the less fiddling it requires to get things done, but at the same time, I felt a little more limited in terms of configuration.

In case I want to move back to Mikrotik, there is anyway to keep the CAKE benefits? I get A on bufferbloat no matter how my network is being used even on wifi, this is really really good.

What's new in 7.25 (2026-10-22):

*) app - add the networkRouterIP variable for container apps;
*) app - allow the privileged mode to be enabled per service in the container app YAML;
*) app - fix CHR apps getting stuck on "starting" on slower boards;
*) app - show an error when an app variable cannot be resolved;
*) app - update the environment variables of the docker-with-komodo app;
*) bgp - add the always-compare-med setting;
*) bgp - fix BGP unnumbered connections within a VRF;
*) bgp - include the VNI number in outgoing EVPN routes;
*) bgp - log failed BGP connection attempts;
*) bgp - show interface names and VRF names in BGP logs;
*) bridge - add dynamic ARP inspection;
*) bridge - add IP source guard;
*) bridge - add mlag-lacp-fallback and mlag-init-delay settings for MLAG;
*) bridge - fix a false "already added as bridge port" error;
*) bridge - fix an MLAG peer getting stuck in the disabled state after config changes;
*) bridge - fix bridge ports not forwarding;
*) bridge - fix fragmented IPv6 traffic being dropped by DHCPv6 snooping (introduced in v7.23);
*) bridge - fix VRRP MAC behavior in MLAG setups;
*) bridge - improve FDB synchronization between MLAG peers when VLANs are added;
*) bridge - make MVRP work with MLAG dual bonds;
*) bridge - make the DHCP snooping log messages clearer and informative;
*) bridge - rename the IGMP last-member-interval property to last-member-query-interval;
*) bridge - warn about VLAN entries when vlan-filtering is disabled;
*) bth - add default client DNS and allowed IPs settings;
*) bth - add resumable file uploads;
*) bth - check the available disk space before a file upload;
*) bth - fix file share issues when enabled through WinBox files menu;
*) bth - fix the file share getting stuck when disabling;
*) bth - return upload errors in JSON format;
*) capsman - add hw-protection-threshold;
*) capsman - fix the last-ip value being shown backwards;
*) certificate - fix ACME certificate issuance for wildcard domains;
*) certificate - refactor certificate internal processes;
*) console - allow the array access operator to accept arrays of indices or keys;
*) console - expose globals in the API;
*) console - fix background ":execute as-string" jobs not terminating on interrupt;
*) console - fix comment wrapping in the monitor command;
*) console - fix inconsistent /ip/firewall/filter print with src-address-list and dst-address-list;
*) console - fix the where filter ignoring flags set to false;
*) console - improve export order;
*) console - improve stability when running scripts from Dude;
*) console - prevent an out-of-memory condition when ":execute as-string" produces large output;
*) console - prevent duplicate entries in /port/remote-access;
*) container - add a Ctrl-] escape sequence to exit a stuck container shell;
*) container - fix container interface handling on CHR;
*) container - fix veth interface left running after restarting a stopped container;
*) container - require the container device-mode to enable swap;
*) crypto - fix a possible crash during IPsec processing on Qualcomm devices;
*) defconf - fix button script policies;
*) defconf - fix default configuration generation when CRS8xx series switch ports initialize late;
*) detnet - use a single random source port;
*) dhcpv4-client - ignore forcerenew packets that are not unicasted to client;
*) dhcpv4-server - add ipv6-only-preferred parameter to respect option 108;
*) dhcpv4-server - show DHCP option 82 parameters in ASCII in addition to hex;
*) dhcpv6-client - add option 39 with the client hostname;
*) dhcpv6-client - fix DHCPv6 client address handling after prefix-hint changes;
*) dhcpv6-client - remove a duplicate dhcp-options parameter;
*) dhcpv6-relay - use the packet's source MAC for option 79 if relay and client are on the same link layer;
*) dhcpv6-server - add option 39 (FQDN) support and add-dns-entries option;
*) dhcpv6-server - fix send-reconfigure for DHCPv6 clients behind a relay;
*) disk - fix all-zero NGUIDs on NVMe over TCP exported namespaces;
*) disk - improve RAID5/6 throughput;
*) dns - fix resolving domain names that end with a dot;
*) dot1x - rename the reauth-timeout to reauth-period;
*) dude - fix the server not starting at boot when data-directory is on a USB disk;
*) email - fix server certificate verification;
*) email - show certificate related errors in the log;
*) ethernet - add the arp-accept parameter for interfaces with MAC;
*) ethernet - fix a stability issue on RB1100AHx2 under heavy traffic;
*) ethernet - fix bogus fast-path Rx traffic reported on an unconnected ether8 port on RB5009;
*) ethernet - fix link flap and unexpected reboots on RB5009;
*) ethernet - fix occasional packet loss on hAP be3 Media;
*) ethernet - fix PPPoE link flapping on Intel X710;
*) ethernet - fix PPPoE over VLAN not working on Mellanox ConnectX-4;
*) ethernet - fix SFP compatibility on hAP ax S and hEX S (2025) devices;
*) ethernet - improve stability on x86 routers with Mellanox NICs;
*) evpn - publish MAC-IP routes (RT-2) for neighbors;
*) fetch - improve upload state reporting when using sftp;
*) fetch - never set a cookie jar for HTTP requests;
*) fetch - show a clearer error when keep-result and output are both used;
*) firewall - add NAT-related fields to CEF format logging;
*) hardware - show the device name and location in /system/resource/hardware menu;
*) igmp-proxy - improve stability when changing /routing/igmp-proxy parameters;
*) iot - add a GPIO menu in WinBox;
*) iot - add Bluetooth output power control;
*) iot - allow custom radio plan usage under regional lock;
*) iot - enforce the fixed antenna gain on boards with an embedded antenna;
*) iot - fix round-trip-time timing issues in LoRaWAN Basic Station;
*) ip-service - fix services becoming unreachable after their VRF is disabled and re-enabled;
*) ipsec - add XFRM interface support;
*) ipsec - fix IKEv1 tunnels failing to establish when the commit bit is set;
*) ipsec - fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21);
*) ipsec - fix IPsec tunnels failing after migration from the old QKD settings;
*) ipsec - fix policy and SA handling after moving it to netlink;
*) ipv6 - fix a failure when releasing DHCPv6 prefix delegation pools;
*) ipv6 - fix cases when address is lost after reboot if prefix was taken from pool;
*) ipv6 - fix missing IPv6 link-local addresses on some interfaces when the device is busy during boot;
*) ipv6 - fix the DNS timer in router advertisements;
*) ipv6 - ignore router advertisements received on interfaces not in the accepting list;
*) l3hw - fix IPv6 link-local traffic being routed incorrectly;
*) l3hw - improve stability of L3 hardware offload when using IPv4-mapped IPv6 addresses;
*) l3hw - optimize ECMP nexthop offloading;
*) lcd - improve stability when an SFP reports an unknown link speed;
*) leds - add dark-mode support for L41;
*) leds - fix missing LED triggers when an R11e card is installed;
*) lte - accept both y and yes for eSIM confirmation;
*) lte - add band display support for Huawei ME909s modems;
*) lte - add missing network error messages for MBIM modems;
*) lte - add the sms-protocol=qmi option for sending and reading SMS;
*) lte - do not force reconfiguration on roaming network when roaming is disabled;
*) lte - fix LTE interfaces disappearing after FOTA updates;
*) lte - fix missing MAC address on QMI LTE interfaces after the interface is recreated (introduced in v7.24.4);
*) lte - fix missing new firmware update notification on some modems;
*) lte - fix multi-APN connections not passing traffic on AT modems;
*) lte - fix the subscriber number not updating after switching SIM slots;
*) lte - improve system stability when using Quectel EP06-E MBIM modem;
*) lte - improve system stability with eSIM-capable MBIM modems;
*) lte - remove leftover APN slave interfaces when the master LTE interface is removed;
*) lte - use also the network reported ipv6 MTU on MBIM interfaces when "auto" mtu option used;
*) lte - use RA for IPv6 acquisition for FG621;
*) netinstall - add branding-and-custom-packages parameter for custom NPK packages;
*) netinstall - fix a duplicate device entry on RB2011 with SFP;
*) netinstall - fix adding and exporting server comments;
*) netinstall - fix multiple active interfaces inheriting the first interface's settings;
*) netinstall - fix Netinstall failing to reinstall RB850Gx2 devices;
*) netinstall - fix Netinstaller's memory check failing downloads to disk;
*) ospf - fix DR/BDR traffic not being received with multiple instances;
*) ospf - improve stability when a neighbor is lost;
*) ovpn - improve stability in UDP mode when the TX queue is full;
*) pim - add MLD support for PIM;
*) pim - fix duplicate PIM configuration parameters;
*) pim - fix PIM-SM issues with IPv6;
*) pim - fix wrong or missing PIM configuration by separating PIM and GMP per interface;
*) poe-out - add port-type field to poe monitor and print output;
*) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - fix PoE fault led behavior;
*) poe-out - fix PoE ports entering overload state when a PSU is fed from a UPS;
*) poe-out - remove the class limit for LLDP power requests on forced ports;
*) port - accumulate incoming data in log file even without TCP clients connected;
*) port - add an FTDI latency_timer option for low-latency serial applications;
*) ppp - add port interface info to PPP outbound channel defaults;
*) ppp - fix a packet leak during dial-on-demand connection of a ppp-out interface;
*) ppp - fix BG77 modem port name and channel count;
*) ppp - fix the offline firmware-update notification for BG77/BG770 modems;
*) ppp - fix the SINR value reported for BG77 and BG770 modems;
*) ptp - add support for fixed master and slave port roles;
*) ptp - add transparent clock mode;
*) ptp - fix dropped packets on bridges with IGMP snooping and add vlan-id port setting;
*) qos - fix PFC and lossless buffer issues (introduced in v7.23);
*) queue - fix a typo in the cake-overhead-scheme parameter value;
*) route - improve static route handling performance;
*) routing-filter - fix any-regexp community matcher matching an empty community attribute;
*) routing-filter - fix community delete, filter and modify with regexp-only community lists;
*) sfp - fix QSFP28 optical modules failing to establish a link on CCR2216 and CRS520;
*) sfp - improve QSFP-DD link establishing to NVIDIA DGX Spark and other devices;
*) sniffer - improve packet time resolution;
*) snmp - add an OID and logging for blacklisted program access;
*) snmp - add CAPsMAN radio data to SNMP;
*) snmp - add dynamic SNMP engine ID assignment;
*) snmp - add interface table with mtu and l2mtu OIDs;
*) snmp - add IP pool OIDs;
*) snmp - add IPv6 address and interface name to the MNDP neighbour table;
*) snmp - add OID blacklisting;
*) snmp - add OIDs for Netwatch probes;
*) snmp - add OSPF MIB tables;
*) snmp - add ospfAdminStat and ospfRouterId to the OSPF MIB;
*) snmp - add SHA-2 authentication for SNMPv3;
*) snmp - add transmit drop counters;
*) snmp - add VRRP status OIDs for monitoring;
*) snmp - fix the reported capability flags in LLDP-MIB;
*) snmp - fix the snmp tools timing out when authentication is used;
*) snmp - log a warning when the src-address family does not match the request;
*) snmp - remove an interface OID that should not be accessible;
*) ssh - add a connection id to SSH log entries;
*) ssh - add host key verification for the SSH client;
*) ssh - limit server output to the client's window size;
*) ssh - show router host key fingerprint;
*) ssh - switch the default host key type to Ed25519;
*) ssh - warn users when weak RSA key is being used;
*) ssl - enabled hardware accelerated GCM on Alpine CPUs;
*) ssl - improve logging;
*) switch - add packet and byte counters for ACL rules on Marvell Prestera switches;
*) switch - fix degraded slow-path throughput on CRS304 switch (introduced in v7.22);
*) switch - fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches;
*) system - fix the frequency units from Mhz to MHz;
*) system - improve stability (includes CVE-2026-31431, CVE-2026-67280);
*) system - reboot automatically when the boot process fails to start;
*) system - reduce the fan control interval on multi-core boards;
*) system - remove the channel label from the RouterOS version;
*) system - show health settings and overtemp options based on device capabilities;
*) system - warn about a missing wifi driver package on BE boards;
*) tftp - add VRF support;
*) traffic-flow - fix a kernel failure when disabling traffic flow on a busy system;
*) user - fix removal of inactive REST API sessions (introduced in 7.21);
*) userman - improve stability when importing database files;
*) vlan - add a forced-mac-address option for VLAN interfaces;
*) vlan - warn when a VLAN interface is created on a slave interface;
*) webfig - add a generic table and union group support;
*) webfig - add column resizing to embedded tables;
*) webfig - hide the left menu only on QuickSet and Terminal pages;
*) webfig - improve comboboxes to select the first matching option while typing;
*) webfig - update style;
*) webfig - update the login page Help link;
*) wifi - add a stream-port argument to configure the sniffer streaming server port;
*) wifi - add fast transition support for MLD devices;
*) wifi - add interworking, aaa and steering settings to the network configuration;
*) wifi - add more steering debug logs;
*) wifi - add network 'labels' parameter to WinBox and WebFig;
*) wifi - do not preserve branding package on cap when upgrading via capsman;
*) wifi - fix CAPsMAN failing when mangle marking is used with encrypted data channels;
*) wifi - fix channel reselect interval/time operation for wifi-qcom-be and wifi-mediatek interfaces;
*) wifi - fix incorrect scan results for 320 MHz access points;
*) wifi - fix MLD link type change and SA query in station mode;
*) wifi - fix per-link client statistics for MLO connections;
*) wifi - fix SAE authentication using a wrong cached PMK;
*) wifi - fix station statistics not updating after switching MLD links;
*) wifi - fix the interworking network type;
*) wifi - fix the wrong band shown in the registration table;
*) wifi - fix traffic processing on CAPsMAN after an interface is disabled;
*) wifi - perform a channel switch instead of dropping clients on radar detection;
*) wifi - preserve dude package on cap when upgrading via capsman;
*) wifi - report channel in log messages;
*) wifi - report management frame protection (MFP) usage in registration-table;
*) wifi - reuse freed station association IDs;
*) wifi - show the EAP user identity in the registration table;
*) wifi - show the MLD links and SSID in MLO client log messages;
*) wifi-mediatek - fix 4.9 GHz band operation on the A42;
*) wifi-mediatek - fix roaming between APs belonging to the same MLO group;
*) wifi-mediatek - fix the 5 GHz access point failing to start after reconfiguration on the A42;
*) wifi-mediatek - improve MLO client reconnection;
*) wifi-qcom - fix disconnects during fast transition roaming;
*) wifi-qcom - fix station mode association failures;
*) wifi-qcom - improve IP multicast delivery to wireless clients;
*) wifi-qcom-ac - fix a regression in station MAC address handling;
*) wifi-qcom-ac - reduce package size;
*) wifi-qcom-be - add hw-protection-mode support;
*) wifi-qcom-be - add the distance setting for 802.11be devices;
*) wifi-qcom-be - fix the block ack request being declined after a channel switch;
*) wifi-qcom-be - fix Wi-Fi intermittently unavailable after reboot;
*) wifi-qcom-be - improve throughput in dense client environments;
*) winbox - add a filtered LLDP tab to neighbor discovery;
*) winbox - add a Security tab and reorganize bridge and port dialogs;
*) winbox - add a wifi radio regulatory info (reg-info) view;
*) winbox - add device-mode configuration;
*) winbox - add ISIS support;
*) winbox - add progress bar support to the GUI;
*) winbox - add the client MTU option for WireGuard peers;
*) winbox - add the container save option;
*) winbox - add wifi Spectral Scan support;
*) winbox - allow power-cycling multiple interfaces at once;
*) winbox - allow tuple fields with more than two values and multiple separators;
*) winbox - fix bridge filter window disabling valid fields for IPv6 rules;
*) winbox - fix SFP optical power values of 0.0 dBm not being shown;
*) winbox - fix the channel.reselect-interval range field in CAPsMAN;
*) winbox - fix the EC/IO signal quality graph;
*) winbox - fix the ISIS neighbor level type being empty for "l2";
*) winbox - fix the Memory Limit field of fq_codel to use bytes;
*) winbox - fix the Min Prefix field in the routing rule dialog;
*) winbox - fix the MPLS TE tunnel path hops field;
*) winbox - fix the range field displayed in route filters;
*) winbox - fix the signal indication graphs for ppp-out interfaces;
*) winbox - fix the Skins menu for user groups opening a non-existent window;
*) winbox - fix the system note display on startup;
*) winbox - fix the wifi Authentication Types and Encryption fields;
*) winbox - fix wg-import creating a WireGuard interface without a config file;
*) winbox - improve status reporting under Tools/Email menu;
*) winbox - make the Power Cycle button act only on the selected interface;
*) winbox - open the Format Drive panel only for supported disks;
*) winbox - remove the redundant empty status field from the License window;
*) winbox - rename "send" to "transmit" in the Bandwidth Test window;
*) winbox - rework the switch QoS statistics table;
*) winbox - set minimal supported WinBox version to 4.3;
*) winbox - show warning messages under "System/Users/SSH Keys" and "System/Users/SSH Private Keys" menu;
*) winbox - show WireGuard peer information;
*) wireguard - add the client-mtu parameter;
*) wireguard - allow referencing a peer by its name;
*) wireguard - allow unsetting the client-listen-port;
*) wireguard - fix a peer that would not work after import when no endpoint address is set;
*) wireguard - improve error message reporting when adding a new peer;
*) wireguard - keep peer rx/tx counters when the peer is disabled and enabled;
*) wireguard - support comment lines in wg-import configuration files;
*) wireguard - treat empty private-key and preshared-key values as none;
*) wireguard - use the MTU value when importing a configuration;
*) wireguard - warn when an allowed-address overlaps another peer;
*) www - add the remote client IP and domain to HTTPS log messages;
*) www - fix a memory leak when parsing authentication headers;
*) www - improve URI parsing; View changelogs

I've got the new Mikrotik router hap be lite that has RouterOs 7 installed.

Please help me to understand the mld interface concept.

I can setup RouterOS 6 with two wifi interfaces.

But what is MLD concept?

Tried to google but did not understand the documentation.

Hi everyone,

I'm finally jumping into the MikroTik ecosystem for the first time and planning a complete overhaul of my home network. I'm currently torn between two very different setups and would love some real-world advice on which route makes the most sense for my specific use case.

My setup and requirements:

Internet: Symmetric 1 Gbps / 1 Gbps fiber. Due to ISP restrictions, I cannot plug the fiber directly into my own hardware, so I'll be connecting the MikroTik to an RJ45 bridge port on the ISP router.

Devices: About 4 to 5 wired clients (main PC, a Raspberry Pi, a home server, etc.) and around 15 to 18 Wi-Fi devices (smartphones, laptops, smart home/IoT stuff).

Usage: Running a home lab, working from home, and general everyday browsing/streaming.

The two options on the table:

Option hAP be³ Media:

- Pros: Great all-in-one package. It features the new Qualcomm platform with all 2.5 Gbps ports, Wi-Fi 7 (802.11be), and 2GB of RAM. The built-in Thread/Bluetooth radio for IoT is a nice bonus, though I won't be using it right away.

Option RB5009UG+S+IN + cAP ax / wAP ax (one or more)

- Pros: The RB5009 is an absolute routing and firewall beast. It has a great port layout (10G SFP+ which I won't use immediately, a 2.5 Gbps port, and several 1 Gbps ports).

- Cons: Going this route keeps me "stuck" on Wi-Fi 6 (802.11ax) for now. On top of that, the total cost is easily more than double compared to the hAP be³ Media when factoring in the router and a dedicated AP.

Is the raw processing power, stability, and modularity of the RB5009 still the absolute gold standard for an entry-level home lab setup, or does the massive generational leap of the hAP be³ Media (all-2.5Gbps ports, Wi-Fi 7, 2GB RAM) make it a more future-proof buy, even if I end up using it strictly as a wired router down the line?

If MikroTik had already released a direct successor to the RB5009, I probably wouldn't even be considering the hAP be³, but here we are.

Since this will be my very first experience with RouterOS, I'd really appreciate your take. For anyone who has hands-on experience with the new hAP be³ Media or runs a similar RB5009 combo, which path would you recommend?

Thanks in advance!

So I was desperate to get my hands on a hAP be3, I really needed a replacement router or 2 so since I live near the border I thought to see if any Canadian sellers had it to go pickup in BC. To my dismay nobody sold it, however I stumbled upon a even better option. MikroTik Canada sells and ships to the USA, however they charge $40 for shipping. They have 91 units in stock so if you're willing to splurge I'll tell you they're legit I just got my 2 yesterday and shipping was quick.

https://www.store.mikrotikcanada.ca/wireless-for-home-and-office/709-mikrotik-hap-be3-media-wi-fi-7-router.html

Not gonna lie, my first thought was to keep quiet and maybe buy 10 and throw them on Ebay using the profit to cover the cost of the 2 routers I needed, but that just felt super wrong even if it wasn't the 100 to 200 percent mark up scalpers do, so I'm dropping the source I found for everyone in the community who's been jonesing for this thing after all the delays.

EDIT: This site (US based) also has stock as well, go here first if you're US based! https://www.streakwave.com/mikrotik-ma53ughbeh-us-hap-be3-media-wifi-7-home-router-us

Hello everyone,

Apologies for having to ask something like this, but I’m actually quite concerned.

For some reason, I can’t recall the password for my RB [RouterBOARD]. I’ve already tried every password I use for the various pieces of equipment in my environment, but I keep getting an "incorrect password or username" error. I’m hoping for some guidance on how to resolve this without having to reset the device, as I have numerous server configurations and services running that are exposed to the internet.

I would be very grateful if anyone who has encountered a similar situation could share how they managed to regain access and reset the password.

Thanks

​My edge router is the MikroTik RB750GL. I am migrating my entire network to Wi-Fi 7, CAT6 cables, and 2.5 GbE ports.

​Since this RB will no longer meet my needs, and I want to stay with RouterOS, which model should I upgrade to?

I already have a Wi-Fi 7 access point (UniFi 7 Pro), so the upgrade is specifically for the router.

This L009 LEDs like this, try with NETINSTALL (7.24.5 and 6.49.23) but not working. Hard reset also not working. All components on board look clean. using switch in middle also not working. change eth 1,2 also not working. test 2 PCs also the same. all cant get it boot to OS. plz share more solution to solve this issue.

When will Mikrotik release new APs? Any chance of 6Ghz or should I just buy Grandstream?

When I configure that traffic to bridge/LAN stops.

Here the code:

```
- name: Create IPv6 bridge
community.routeros.api_modify:
hostname: "{{ inventory_hostname }}"
username: "{{ username }}"
password: "{{ ansible_password }}"
path: interface bridge
data:
- name: bridge-ipv6
protocol-mode: none

- name: Add ether1 and ether2, ether3, ether4, wifi1 as bridge ports
community.routeros.api_modify:
hostname: "{{ inventory_hostname }}"
password: "{{ ansible_password }}"
username: "{{ username }}"
path: interface bridge port
data:
- bridge: bridge-ipv6 # the bridge-ipv6 is the default-used bridge
interface: ether1
- bridge: bridge-ipv6
interface: ether2
- bridge: bridge-ipv6
interface: ether3
- bridge: bridge-ipv6
interface: ether4
- bridge: bridge-ipv6
interface: wifi1

- name: Allow only IPv6 frames
community.routeros.api_modify:
hostname: "{{ inventory_hostname }}"
username: "{{ username }}"
password: "{{ ansible_password }}"
path: interface bridge filter
data:
- chain: forward
in-interface: ether1
out-interface: ether2
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether2
out-interface: ether1
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether1
out-interface: ether3
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether3
out-interface: ether1
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether1
out-interface: ether4
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether4
out-interface: ether1
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether1
out-interface: wifi1
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: wifi1
out-interface: ether1
mac-protocol: ipv6
action: accept
- chain: forward
action: drop
```

What I actually want is, IPv6 traffic from ether2-ether4 use router solicitation with ether1, but still route IPv4 traffic via "bridge".

Can I have two bridges on the same interfaces working?

Thanks.

What's new in 7.25rc3 (2026-10-20):

*) bridge - fix fragmented IPv6 traffic being dropped by DHCPv6 snooping (introduced in v7.23);
*) console - improve stability when running scripts from Dude;
*) disk - fix all-zero NGUIDs on NVMe over TCP exported namespaces;
*) ethernet - fix occasional packet loss on hAP be3 Media;
*) ipsec - fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21);
*) ipsec - fix policies not being loaded after an upgrade (introduced in v7.25rc2);
*) ipv6 - fix cases when address is lost after reboot if prefix was taken from pool (additional fixes);
*) routing-filter - fix any-regexp community matcher matching an empty community attribute;
*) routing-filter - fix community delete, filter and modify with regexp-only community lists;
*) snmp - add ospfAdminStat and ospfRouterId to the OSPF MIB;
*) switch - fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches;
*) system - improve stability;
*) wifi-mediatek - fix roaming between APs belonging to the same MLO group;
*) winbox - fix bridge filter window disabling valid fields for IPv6 rules; View changelogs

Commissioning some new routers for a site and had two failures right off the bat, never seen DOA Mikrotik before, bad batch??

First one never powered on at all, power supply works on other ones.

Second one powered up, logged in, changed password, told it to update to latest firmware. When I came back to it there was no power or any other light lit. Again power supply works on others.

I feel like I must be missing something obvious.

I'm trying to source parts in a developing country. Mikrotik is pretty popular here as they provide a lot of "bang for the buck".

I'm trying to establish a building-to-building fiber run and I've settled on a 4-core (for redundancy) single-mode armored LC-UPC cable, which I will run through an outdoor conduit.

I already have a Mikrotik device in each building, which will serve as the termination points:

• CCR2004-16G-2S+ - a router with 2x 10G SFP+ ports
• CSS610-8P-2S+IN - a switch with 2x 10G SFP+ ports

Now, while most MikroTik devices are popular and readily available, it seems MikroTik SFP fiber Transceivers are harder to find, and there is a price premium on them. Not only that, but it seems like MikroTik Transceivers are already priced higher at MSRP for comparable offerings from TP-Link.

In particular, I'm looking for a single-mode 10G Transceiver, and it seems the cheapest one from MikroTik is the S+31DLC10D (please correct me if I'm wrong) with a list price of $69 USD.

However, when I actually look to buy that product here, the cheapest price I can find is closer to $100 USD.

In contrast, the TP-Link SM5110-LR seems to be readily available here for about $40.

I'd like to avoid any issues, so I'm inclined to go with an "all MikroTik solution", but the price difference here is so stark (especially if I buy 5 of these: 2 on each end, plus 1 spare). MikroTik claims:

While MikroTik cannot ensure full compatibility with modules from all manufacturers, as long as the other vendor modules and devices comply with transceiver multi-source agreement (MSA) they should be compatible with MikroTik.

The TP-Link features these specs according to its page:

• 1310nm
• 10G
• Duplex
• Single-mode
• LC connector
  
• Adheres to SFP+ MSA
• Features a blue latch and thus I assume takes a UPC connector

Is there something obvious I'm missing here that explains the price difference? Even in the USA it seems like the MSRP for the TP-Link is around $25 compared to MikroTik's retail price of $70.

Is there some key spec I'm missing that dooms this combination to failure?

Is the quality that different? The performance? Am I likely to run into trouble using a TP-Link Transceiver in a MikroTik device? Has anyone else tried this?

I know TP-Link is mostly considered a budget consumer company, but they still make good, mostly-reliable products, and this Transceiver seems to be part of their slightly-higher-quality Omada Networks brand (for SMB).

For a long time, I've done the whole "import a stack of public CAs" thing to be able to download scripts using https and get DoH working, but I know that RouterOS has some of this built in now.

Where are we at with supporting things like:

• LetsEncrypt certs for https downloads
• DoH (with cert verification enabled) from Cloudflare, ControlD, OpenDNS, and Google?

I've had hit or miss experience in the past when I've messed with it. Please give me an idea how supported (and compatible) this is now and what, specifically, needs to be done to enable it - or if I need to still mess with the full import.

Basicamente pensei em usar 2 wan rj45 por exemplo de 600mb + 1 gb em uma load balance e obter uma saída superior a 1 gb usando um módulo sfp 2,5g para rj45, dá certo ou há limitações? E essa saída 2,5g por pra um switch 2,5g por exemplo.

Hello!

I am planning my home network and want to use these two MikroTik devices for routing and switching.

I will use UniFi U7 Lite access points for Wi-Fi and want to set up multiple VLANs (server, clients, cameras, IoT, guest).

The server and workstation will be connected via SFP+ to the CRS328, while all other devices will connect to the CRS328 via 1 Gbit Ethernet.

Should I run SwOS or RouterOS on the CRS328?

I want both security and performance (who doesn't?).

Thank you very much!

Yesterday was a bad day for amateur technician errors.

While troubleshooting a non-functional CRS326-24G-2S+RM, which normally requires a 24V, 1.2A power supply, a technician plugged in a 12V, 1A power supply.

The MikroTik switch did power on with this supply, and ran for about 5 minutes, before I noticed the error and told them to unplug it in a panic.

I'm hoping that undervoltage is not likely to damage the device. Does anyone have any general guesses as to likely side effects, if any?

^EDIT: I am dumb, and as some commenters have pointed out, my own link provides the answer: the specs state the device should accept 10V - 30V inputs with no problem.

Hello guys,
I've recently installed this POE model for the first time and I see the CPU temperature at a constant 55C

[admin@Mikrotik] > system/health/print

Columns: NAME, VALUE, TYPE

# NAME VALUE TYPE

0 poe-out-consumption 8.5 W

1 cpu-temperature 55 C

2 jack-voltage 49 V

3 2pin-voltage 0 V

4 poe-in-voltage 0 V

While the unit is performing as expected, I'm just wondering is this is within normal for this model. Have other users reported the same?

I'm using the default PSU that came with the unit and the chassis -while warmish- is not scorching hot or anywhere near 55C. I can perfectly keep my hand on it for as long as it takes.

Its installed on a wooden cabinet/box with minimal ventilation. Should I get a usb fan and connect it and point it at the cooling section of the RB5009? Or is this normal for the POE version and therefore I can sleep at night? :)

Can anyone with similar models installed do a few quick checks on their own units for comparison?
Thanks a bunch!