What's new in 7.25 (2026-10-22):

*) app - add the networkRouterIP variable for container apps;
*) app - allow the privileged mode to be enabled per service in the container app YAML;
*) app - fix CHR apps getting stuck on "starting" on slower boards;
*) app - show an error when an app variable cannot be resolved;
*) app - update the environment variables of the docker-with-komodo app;
*) bgp - add the always-compare-med setting;
*) bgp - fix BGP unnumbered connections within a VRF;
*) bgp - include the VNI number in outgoing EVPN routes;
*) bgp - log failed BGP connection attempts;
*) bgp - show interface names and VRF names in BGP logs;
*) bridge - add dynamic ARP inspection;
*) bridge - add IP source guard;
*) bridge - add mlag-lacp-fallback and mlag-init-delay settings for MLAG;
*) bridge - fix a false "already added as bridge port" error;
*) bridge - fix an MLAG peer getting stuck in the disabled state after config changes;
*) bridge - fix bridge ports not forwarding;
*) bridge - fix fragmented IPv6 traffic being dropped by DHCPv6 snooping (introduced in v7.23);
*) bridge - fix VRRP MAC behavior in MLAG setups;
*) bridge - improve FDB synchronization between MLAG peers when VLANs are added;
*) bridge - make MVRP work with MLAG dual bonds;
*) bridge - make the DHCP snooping log messages clearer and informative;
*) bridge - rename the IGMP last-member-interval property to last-member-query-interval;
*) bridge - warn about VLAN entries when vlan-filtering is disabled;
*) bth - add default client DNS and allowed IPs settings;
*) bth - add resumable file uploads;
*) bth - check the available disk space before a file upload;
*) bth - fix file share issues when enabled through WinBox files menu;
*) bth - fix the file share getting stuck when disabling;
*) bth - return upload errors in JSON format;
*) capsman - add hw-protection-threshold;
*) capsman - fix the last-ip value being shown backwards;
*) certificate - fix ACME certificate issuance for wildcard domains;
*) certificate - refactor certificate internal processes;
*) console - allow the array access operator to accept arrays of indices or keys;
*) console - expose globals in the API;
*) console - fix background ":execute as-string" jobs not terminating on interrupt;
*) console - fix comment wrapping in the monitor command;
*) console - fix inconsistent /ip/firewall/filter print with src-address-list and dst-address-list;
*) console - fix the where filter ignoring flags set to false;
*) console - improve export order;
*) console - improve stability when running scripts from Dude;
*) console - prevent an out-of-memory condition when ":execute as-string" produces large output;
*) console - prevent duplicate entries in /port/remote-access;
*) container - add a Ctrl-] escape sequence to exit a stuck container shell;
*) container - fix container interface handling on CHR;
*) container - fix veth interface left running after restarting a stopped container;
*) container - require the container device-mode to enable swap;
*) crypto - fix a possible crash during IPsec processing on Qualcomm devices;
*) defconf - fix button script policies;
*) defconf - fix default configuration generation when CRS8xx series switch ports initialize late;
*) detnet - use a single random source port;
*) dhcpv4-client - ignore forcerenew packets that are not unicasted to client;
*) dhcpv4-server - add ipv6-only-preferred parameter to respect option 108;
*) dhcpv4-server - show DHCP option 82 parameters in ASCII in addition to hex;
*) dhcpv6-client - add option 39 with the client hostname;
*) dhcpv6-client - fix DHCPv6 client address handling after prefix-hint changes;
*) dhcpv6-client - remove a duplicate dhcp-options parameter;
*) dhcpv6-relay - use the packet's source MAC for option 79 if relay and client are on the same link layer;
*) dhcpv6-server - add option 39 (FQDN) support and add-dns-entries option;
*) dhcpv6-server - fix send-reconfigure for DHCPv6 clients behind a relay;
*) disk - fix all-zero NGUIDs on NVMe over TCP exported namespaces;
*) disk - improve RAID5/6 throughput;
*) dns - fix resolving domain names that end with a dot;
*) dot1x - rename the reauth-timeout to reauth-period;
*) dude - fix the server not starting at boot when data-directory is on a USB disk;
*) email - fix server certificate verification;
*) email - show certificate related errors in the log;
*) ethernet - add the arp-accept parameter for interfaces with MAC;
*) ethernet - fix a stability issue on RB1100AHx2 under heavy traffic;
*) ethernet - fix bogus fast-path Rx traffic reported on an unconnected ether8 port on RB5009;
*) ethernet - fix link flap and unexpected reboots on RB5009;
*) ethernet - fix occasional packet loss on hAP be3 Media;
*) ethernet - fix PPPoE link flapping on Intel X710;
*) ethernet - fix PPPoE over VLAN not working on Mellanox ConnectX-4;
*) ethernet - fix SFP compatibility on hAP ax S and hEX S (2025) devices;
*) ethernet - improve stability on x86 routers with Mellanox NICs;
*) evpn - publish MAC-IP routes (RT-2) for neighbors;
*) fetch - improve upload state reporting when using sftp;
*) fetch - never set a cookie jar for HTTP requests;
*) fetch - show a clearer error when keep-result and output are both used;
*) firewall - add NAT-related fields to CEF format logging;
*) hardware - show the device name and location in /system/resource/hardware menu;
*) igmp-proxy - improve stability when changing /routing/igmp-proxy parameters;
*) iot - add a GPIO menu in WinBox;
*) iot - add Bluetooth output power control;
*) iot - allow custom radio plan usage under regional lock;
*) iot - enforce the fixed antenna gain on boards with an embedded antenna;
*) iot - fix round-trip-time timing issues in LoRaWAN Basic Station;
*) ip-service - fix services becoming unreachable after their VRF is disabled and re-enabled;
*) ipsec - add XFRM interface support;
*) ipsec - fix IKEv1 tunnels failing to establish when the commit bit is set;
*) ipsec - fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21);
*) ipsec - fix IPsec tunnels failing after migration from the old QKD settings;
*) ipsec - fix policy and SA handling after moving it to netlink;
*) ipv6 - fix a failure when releasing DHCPv6 prefix delegation pools;
*) ipv6 - fix cases when address is lost after reboot if prefix was taken from pool;
*) ipv6 - fix missing IPv6 link-local addresses on some interfaces when the device is busy during boot;
*) ipv6 - fix the DNS timer in router advertisements;
*) ipv6 - ignore router advertisements received on interfaces not in the accepting list;
*) l3hw - fix IPv6 link-local traffic being routed incorrectly;
*) l3hw - improve stability of L3 hardware offload when using IPv4-mapped IPv6 addresses;
*) l3hw - optimize ECMP nexthop offloading;
*) lcd - improve stability when an SFP reports an unknown link speed;
*) leds - add dark-mode support for L41;
*) leds - fix missing LED triggers when an R11e card is installed;
*) lte - accept both y and yes for eSIM confirmation;
*) lte - add band display support for Huawei ME909s modems;
*) lte - add missing network error messages for MBIM modems;
*) lte - add the sms-protocol=qmi option for sending and reading SMS;
*) lte - do not force reconfiguration on roaming network when roaming is disabled;
*) lte - fix LTE interfaces disappearing after FOTA updates;
*) lte - fix missing MAC address on QMI LTE interfaces after the interface is recreated (introduced in v7.24.4);
*) lte - fix missing new firmware update notification on some modems;
*) lte - fix multi-APN connections not passing traffic on AT modems;
*) lte - fix the subscriber number not updating after switching SIM slots;
*) lte - improve system stability when using Quectel EP06-E MBIM modem;
*) lte - improve system stability with eSIM-capable MBIM modems;
*) lte - remove leftover APN slave interfaces when the master LTE interface is removed;
*) lte - use also the network reported ipv6 MTU on MBIM interfaces when "auto" mtu option used;
*) lte - use RA for IPv6 acquisition for FG621;
*) netinstall - add branding-and-custom-packages parameter for custom NPK packages;
*) netinstall - fix a duplicate device entry on RB2011 with SFP;
*) netinstall - fix adding and exporting server comments;
*) netinstall - fix multiple active interfaces inheriting the first interface's settings;
*) netinstall - fix Netinstall failing to reinstall RB850Gx2 devices;
*) netinstall - fix Netinstaller's memory check failing downloads to disk;
*) ospf - fix DR/BDR traffic not being received with multiple instances;
*) ospf - improve stability when a neighbor is lost;
*) ovpn - improve stability in UDP mode when the TX queue is full;
*) pim - add MLD support for PIM;
*) pim - fix duplicate PIM configuration parameters;
*) pim - fix PIM-SM issues with IPv6;
*) pim - fix wrong or missing PIM configuration by separating PIM and GMP per interface;
*) poe-out - add port-type field to poe monitor and print output;
*) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - fix PoE fault led behavior;
*) poe-out - fix PoE ports entering overload state when a PSU is fed from a UPS;
*) poe-out - remove the class limit for LLDP power requests on forced ports;
*) port - accumulate incoming data in log file even without TCP clients connected;
*) port - add an FTDI latency_timer option for low-latency serial applications;
*) ppp - add port interface info to PPP outbound channel defaults;
*) ppp - fix a packet leak during dial-on-demand connection of a ppp-out interface;
*) ppp - fix BG77 modem port name and channel count;
*) ppp - fix the offline firmware-update notification for BG77/BG770 modems;
*) ppp - fix the SINR value reported for BG77 and BG770 modems;
*) ptp - add support for fixed master and slave port roles;
*) ptp - add transparent clock mode;
*) ptp - fix dropped packets on bridges with IGMP snooping and add vlan-id port setting;
*) qos - fix PFC and lossless buffer issues (introduced in v7.23);
*) queue - fix a typo in the cake-overhead-scheme parameter value;
*) route - improve static route handling performance;
*) routing-filter - fix any-regexp community matcher matching an empty community attribute;
*) routing-filter - fix community delete, filter and modify with regexp-only community lists;
*) sfp - fix QSFP28 optical modules failing to establish a link on CCR2216 and CRS520;
*) sfp - improve QSFP-DD link establishing to NVIDIA DGX Spark and other devices;
*) sniffer - improve packet time resolution;
*) snmp - add an OID and logging for blacklisted program access;
*) snmp - add CAPsMAN radio data to SNMP;
*) snmp - add dynamic SNMP engine ID assignment;
*) snmp - add interface table with mtu and l2mtu OIDs;
*) snmp - add IP pool OIDs;
*) snmp - add IPv6 address and interface name to the MNDP neighbour table;
*) snmp - add OID blacklisting;
*) snmp - add OIDs for Netwatch probes;
*) snmp - add OSPF MIB tables;
*) snmp - add ospfAdminStat and ospfRouterId to the OSPF MIB;
*) snmp - add SHA-2 authentication for SNMPv3;
*) snmp - add transmit drop counters;
*) snmp - add VRRP status OIDs for monitoring;
*) snmp - fix the reported capability flags in LLDP-MIB;
*) snmp - fix the snmp tools timing out when authentication is used;
*) snmp - log a warning when the src-address family does not match the request;
*) snmp - remove an interface OID that should not be accessible;
*) ssh - add a connection id to SSH log entries;
*) ssh - add host key verification for the SSH client;
*) ssh - limit server output to the client's window size;
*) ssh - show router host key fingerprint;
*) ssh - switch the default host key type to Ed25519;
*) ssh - warn users when weak RSA key is being used;
*) ssl - enabled hardware accelerated GCM on Alpine CPUs;
*) ssl - improve logging;
*) switch - add packet and byte counters for ACL rules on Marvell Prestera switches;
*) switch - fix degraded slow-path throughput on CRS304 switch (introduced in v7.22);
*) switch - fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches;
*) system - fix the frequency units from Mhz to MHz;
*) system - improve stability (includes CVE-2026-31431, CVE-2026-67280);
*) system - reboot automatically when the boot process fails to start;
*) system - reduce the fan control interval on multi-core boards;
*) system - remove the channel label from the RouterOS version;
*) system - show health settings and overtemp options based on device capabilities;
*) system - warn about a missing wifi driver package on BE boards;
*) tftp - add VRF support;
*) traffic-flow - fix a kernel failure when disabling traffic flow on a busy system;
*) user - fix removal of inactive REST API sessions (introduced in 7.21);
*) userman - improve stability when importing database files;
*) vlan - add a forced-mac-address option for VLAN interfaces;
*) vlan - warn when a VLAN interface is created on a slave interface;
*) webfig - add a generic table and union group support;
*) webfig - add column resizing to embedded tables;
*) webfig - hide the left menu only on QuickSet and Terminal pages;
*) webfig - improve comboboxes to select the first matching option while typing;
*) webfig - update style;
*) webfig - update the login page Help link;
*) wifi - add a stream-port argument to configure the sniffer streaming server port;
*) wifi - add fast transition support for MLD devices;
*) wifi - add interworking, aaa and steering settings to the network configuration;
*) wifi - add more steering debug logs;
*) wifi - add network 'labels' parameter to WinBox and WebFig;
*) wifi - do not preserve branding package on cap when upgrading via capsman;
*) wifi - fix CAPsMAN failing when mangle marking is used with encrypted data channels;
*) wifi - fix channel reselect interval/time operation for wifi-qcom-be and wifi-mediatek interfaces;
*) wifi - fix incorrect scan results for 320 MHz access points;
*) wifi - fix MLD link type change and SA query in station mode;
*) wifi - fix per-link client statistics for MLO connections;
*) wifi - fix SAE authentication using a wrong cached PMK;
*) wifi - fix station statistics not updating after switching MLD links;
*) wifi - fix the interworking network type;
*) wifi - fix the wrong band shown in the registration table;
*) wifi - fix traffic processing on CAPsMAN after an interface is disabled;
*) wifi - perform a channel switch instead of dropping clients on radar detection;
*) wifi - preserve dude package on cap when upgrading via capsman;
*) wifi - report channel in log messages;
*) wifi - report management frame protection (MFP) usage in registration-table;
*) wifi - reuse freed station association IDs;
*) wifi - show the EAP user identity in the registration table;
*) wifi - show the MLD links and SSID in MLO client log messages;
*) wifi-mediatek - fix 4.9 GHz band operation on the A42;
*) wifi-mediatek - fix roaming between APs belonging to the same MLO group;
*) wifi-mediatek - fix the 5 GHz access point failing to start after reconfiguration on the A42;
*) wifi-mediatek - improve MLO client reconnection;
*) wifi-qcom - fix disconnects during fast transition roaming;
*) wifi-qcom - fix station mode association failures;
*) wifi-qcom - improve IP multicast delivery to wireless clients;
*) wifi-qcom-ac - fix a regression in station MAC address handling;
*) wifi-qcom-ac - reduce package size;
*) wifi-qcom-be - add hw-protection-mode support;
*) wifi-qcom-be - add the distance setting for 802.11be devices;
*) wifi-qcom-be - fix the block ack request being declined after a channel switch;
*) wifi-qcom-be - fix Wi-Fi intermittently unavailable after reboot;
*) wifi-qcom-be - improve throughput in dense client environments;
*) winbox - add a filtered LLDP tab to neighbor discovery;
*) winbox - add a Security tab and reorganize bridge and port dialogs;
*) winbox - add a wifi radio regulatory info (reg-info) view;
*) winbox - add device-mode configuration;
*) winbox - add ISIS support;
*) winbox - add progress bar support to the GUI;
*) winbox - add the client MTU option for WireGuard peers;
*) winbox - add the container save option;
*) winbox - add wifi Spectral Scan support;
*) winbox - allow power-cycling multiple interfaces at once;
*) winbox - allow tuple fields with more than two values and multiple separators;
*) winbox - fix bridge filter window disabling valid fields for IPv6 rules;
*) winbox - fix SFP optical power values of 0.0 dBm not being shown;
*) winbox - fix the channel.reselect-interval range field in CAPsMAN;
*) winbox - fix the EC/IO signal quality graph;
*) winbox - fix the ISIS neighbor level type being empty for "l2";
*) winbox - fix the Memory Limit field of fq_codel to use bytes;
*) winbox - fix the Min Prefix field in the routing rule dialog;
*) winbox - fix the MPLS TE tunnel path hops field;
*) winbox - fix the range field displayed in route filters;
*) winbox - fix the signal indication graphs for ppp-out interfaces;
*) winbox - fix the Skins menu for user groups opening a non-existent window;
*) winbox - fix the system note display on startup;
*) winbox - fix the wifi Authentication Types and Encryption fields;
*) winbox - fix wg-import creating a WireGuard interface without a config file;
*) winbox - improve status reporting under Tools/Email menu;
*) winbox - make the Power Cycle button act only on the selected interface;
*) winbox - open the Format Drive panel only for supported disks;
*) winbox - remove the redundant empty status field from the License window;
*) winbox - rename "send" to "transmit" in the Bandwidth Test window;
*) winbox - rework the switch QoS statistics table;
*) winbox - set minimal supported WinBox version to 4.3;
*) winbox - show warning messages under "System/Users/SSH Keys" and "System/Users/SSH Private Keys" menu;
*) winbox - show WireGuard peer information;
*) wireguard - add the client-mtu parameter;
*) wireguard - allow referencing a peer by its name;
*) wireguard - allow unsetting the client-listen-port;
*) wireguard - fix a peer that would not work after import when no endpoint address is set;
*) wireguard - improve error message reporting when adding a new peer;
*) wireguard - keep peer rx/tx counters when the peer is disabled and enabled;
*) wireguard - support comment lines in wg-import configuration files;
*) wireguard - treat empty private-key and preshared-key values as none;
*) wireguard - use the MTU value when importing a configuration;
*) wireguard - warn when an allowed-address overlaps another peer;
*) www - add the remote client IP and domain to HTTPS log messages;
*) www - fix a memory leak when parsing authentication headers;
*) www - improve URI parsing; View changelogs

So I was desperate to get my hands on a hAP be3, I really needed a replacement router or 2 so since I live near the border I thought to see if any Canadian sellers had it to go pickup in BC. To my dismay nobody sold it, however I stumbled upon a even better option. MikroTik Canada sells and ships to the USA, however they charge $40 for shipping. They have 91 units in stock so if you're willing to splurge I'll tell you they're legit I just got my 2 yesterday and shipping was quick.

https://www.store.mikrotikcanada.ca/wireless-for-home-and-office/709-mikrotik-hap-be3-media-wi-fi-7-router.html

Not gonna lie, my first thought was to keep quiet and maybe buy 10 and throw them on Ebay using the profit to cover the cost of the 2 routers I needed, but that just felt super wrong even if it wasn't the 100 to 200 percent mark up scalpers do, so I'm dropping the source I found for everyone in the community who's been jonesing for this thing after all the delays.

EDIT: This site (US based) also has stock as well, go here first if you're US based! https://www.streakwave.com/mikrotik-ma53ughbeh-us-hap-be3-media-wifi-7-home-router-us

Hi everyone,

I'm finally jumping into the MikroTik ecosystem for the first time and planning a complete overhaul of my home network. I'm currently torn between two very different setups and would love some real-world advice on which route makes the most sense for my specific use case.

My setup and requirements:

Internet: Symmetric 1 Gbps / 1 Gbps fiber. Due to ISP restrictions, I cannot plug the fiber directly into my own hardware, so I'll be connecting the MikroTik to an RJ45 bridge port on the ISP router.

Devices: About 4 to 5 wired clients (main PC, a Raspberry Pi, a home server, etc.) and around 15 to 18 Wi-Fi devices (smartphones, laptops, smart home/IoT stuff).

Usage: Running a home lab, working from home, and general everyday browsing/streaming.

The two options on the table:

Option hAP be³ Media:

- Pros: Great all-in-one package. It features the new Qualcomm platform with all 2.5 Gbps ports, Wi-Fi 7 (802.11be), and 2GB of RAM. The built-in Thread/Bluetooth radio for IoT is a nice bonus, though I won't be using it right away.

Option RB5009UG+S+IN + cAP ax / wAP ax (one or more)

- Pros: The RB5009 is an absolute routing and firewall beast. It has a great port layout (10G SFP+ which I won't use immediately, a 2.5 Gbps port, and several 1 Gbps ports).

- Cons: Going this route keeps me "stuck" on Wi-Fi 6 (802.11ax) for now. On top of that, the total cost is easily more than double compared to the hAP be³ Media when factoring in the router and a dedicated AP.

Is the raw processing power, stability, and modularity of the RB5009 still the absolute gold standard for an entry-level home lab setup, or does the massive generational leap of the hAP be³ Media (all-2.5Gbps ports, Wi-Fi 7, 2GB RAM) make it a more future-proof buy, even if I end up using it strictly as a wired router down the line?

If MikroTik had already released a direct successor to the RB5009, I probably wouldn't even be considering the hAP be³, but here we are.

Since this will be my very first experience with RouterOS, I'd really appreciate your take. For anyone who has hands-on experience with the new hAP be³ Media or runs a similar RB5009 combo, which path would you recommend?

Thanks in advance!

I've got the new Mikrotik router hap be lite that has RouterOs 7 installed.

Please help me to understand the mld interface concept.

I can setup RouterOS 6 with two wifi interfaces.

But what is MLD concept?

Tried to google but did not understand the documentation.

​My edge router is the MikroTik RB750GL. I am migrating my entire network to Wi-Fi 7, CAT6 cables, and 2.5 GbE ports.

​Since this RB will no longer meet my needs, and I want to stay with RouterOS, which model should I upgrade to?

I already have a Wi-Fi 7 access point (UniFi 7 Pro), so the upgrade is specifically for the router.

This L009 LEDs like this, try with NETINSTALL (7.24.5 and 6.49.23) but not working. Hard reset also not working. All components on board look clean. using switch in middle also not working. change eth 1,2 also not working. test 2 PCs also the same. all cant get it boot to OS. plz share more solution to solve this issue.

Hello everyone,

Apologies for having to ask something like this, but I’m actually quite concerned.

For some reason, I can’t recall the password for my RB [RouterBOARD]. I’ve already tried every password I use for the various pieces of equipment in my environment, but I keep getting an "incorrect password or username" error. I’m hoping for some guidance on how to resolve this without having to reset the device, as I have numerous server configurations and services running that are exposed to the internet.

I would be very grateful if anyone who has encountered a similar situation could share how they managed to regain access and reset the password.

Thanks

When will Mikrotik release new APs? Any chance of 6Ghz or should I just buy Grandstream?

What's new in 7.25rc3 (2026-10-20):

*) bridge - fix fragmented IPv6 traffic being dropped by DHCPv6 snooping (introduced in v7.23);
*) console - improve stability when running scripts from Dude;
*) disk - fix all-zero NGUIDs on NVMe over TCP exported namespaces;
*) ethernet - fix occasional packet loss on hAP be3 Media;
*) ipsec - fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21);
*) ipsec - fix policies not being loaded after an upgrade (introduced in v7.25rc2);
*) ipv6 - fix cases when address is lost after reboot if prefix was taken from pool (additional fixes);
*) routing-filter - fix any-regexp community matcher matching an empty community attribute;
*) routing-filter - fix community delete, filter and modify with regexp-only community lists;
*) snmp - add ospfAdminStat and ospfRouterId to the OSPF MIB;
*) switch - fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches;
*) system - improve stability;
*) wifi-mediatek - fix roaming between APs belonging to the same MLO group;
*) winbox - fix bridge filter window disabling valid fields for IPv6 rules; View changelogs

I feel like I must be missing something obvious.

I'm trying to source parts in a developing country. Mikrotik is pretty popular here as they provide a lot of "bang for the buck".

I'm trying to establish a building-to-building fiber run and I've settled on a 4-core (for redundancy) single-mode armored LC-UPC cable, which I will run through an outdoor conduit.

I already have a Mikrotik device in each building, which will serve as the termination points:

• CCR2004-16G-2S+ - a router with 2x 10G SFP+ ports
• CSS610-8P-2S+IN - a switch with 2x 10G SFP+ ports

Now, while most MikroTik devices are popular and readily available, it seems MikroTik SFP fiber Transceivers are harder to find, and there is a price premium on them. Not only that, but it seems like MikroTik Transceivers are already priced higher at MSRP for comparable offerings from TP-Link.

In particular, I'm looking for a single-mode 10G Transceiver, and it seems the cheapest one from MikroTik is the S+31DLC10D (please correct me if I'm wrong) with a list price of $69 USD.

However, when I actually look to buy that product here, the cheapest price I can find is closer to $100 USD.

In contrast, the TP-Link SM5110-LR seems to be readily available here for about $40.

I'd like to avoid any issues, so I'm inclined to go with an "all MikroTik solution", but the price difference here is so stark (especially if I buy 5 of these: 2 on each end, plus 1 spare). MikroTik claims:

While MikroTik cannot ensure full compatibility with modules from all manufacturers, as long as the other vendor modules and devices comply with transceiver multi-source agreement (MSA) they should be compatible with MikroTik.

The TP-Link features these specs according to its page:

• 1310nm
• 10G
• Duplex
• Single-mode
• LC connector
  
• Adheres to SFP+ MSA
• Features a blue latch and thus I assume takes a UPC connector

Is there something obvious I'm missing here that explains the price difference? Even in the USA it seems like the MSRP for the TP-Link is around $25 compared to MikroTik's retail price of $70.

Is there some key spec I'm missing that dooms this combination to failure?

Is the quality that different? The performance? Am I likely to run into trouble using a TP-Link Transceiver in a MikroTik device? Has anyone else tried this?

I know TP-Link is mostly considered a budget consumer company, but they still make good, mostly-reliable products, and this Transceiver seems to be part of their slightly-higher-quality Omada Networks brand (for SMB).

When I configure that traffic to bridge/LAN stops.

Here the code:

```
- name: Create IPv6 bridge
community.routeros.api_modify:
hostname: "{{ inventory_hostname }}"
username: "{{ username }}"
password: "{{ ansible_password }}"
path: interface bridge
data:
- name: bridge-ipv6
protocol-mode: none

- name: Add ether1 and ether2, ether3, ether4, wifi1 as bridge ports
community.routeros.api_modify:
hostname: "{{ inventory_hostname }}"
password: "{{ ansible_password }}"
username: "{{ username }}"
path: interface bridge port
data:
- bridge: bridge-ipv6 # the bridge-ipv6 is the default-used bridge
interface: ether1
- bridge: bridge-ipv6
interface: ether2
- bridge: bridge-ipv6
interface: ether3
- bridge: bridge-ipv6
interface: ether4
- bridge: bridge-ipv6
interface: wifi1

- name: Allow only IPv6 frames
community.routeros.api_modify:
hostname: "{{ inventory_hostname }}"
username: "{{ username }}"
password: "{{ ansible_password }}"
path: interface bridge filter
data:
- chain: forward
in-interface: ether1
out-interface: ether2
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether2
out-interface: ether1
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether1
out-interface: ether3
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether3
out-interface: ether1
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether1
out-interface: ether4
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether4
out-interface: ether1
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: ether1
out-interface: wifi1
mac-protocol: ipv6
action: accept
- chain: forward
in-interface: wifi1
out-interface: ether1
mac-protocol: ipv6
action: accept
- chain: forward
action: drop
```

What I actually want is, IPv6 traffic from ether2-ether4 use router solicitation with ether1, but still route IPv4 traffic via "bridge".

Can I have two bridges on the same interfaces working?

Thanks.

Commissioning some new routers for a site and had two failures right off the bat, never seen DOA Mikrotik before, bad batch??

First one never powered on at all, power supply works on other ones.

Second one powered up, logged in, changed password, told it to update to latest firmware. When I came back to it there was no power or any other light lit. Again power supply works on others.

For a long time, I've done the whole "import a stack of public CAs" thing to be able to download scripts using https and get DoH working, but I know that RouterOS has some of this built in now.

Where are we at with supporting things like:

• LetsEncrypt certs for https downloads
• DoH (with cert verification enabled) from Cloudflare, ControlD, OpenDNS, and Google?

I've had hit or miss experience in the past when I've messed with it. Please give me an idea how supported (and compatible) this is now and what, specifically, needs to be done to enable it - or if I need to still mess with the full import.

Yesterday was a bad day for amateur technician errors.

While troubleshooting a non-functional CRS326-24G-2S+RM, which normally requires a 24V, 1.2A power supply, a technician plugged in a 12V, 1A power supply.

The MikroTik switch did power on with this supply, and ran for about 5 minutes, before I noticed the error and told them to unplug it in a panic.

I'm hoping that undervoltage is not likely to damage the device. Does anyone have any general guesses as to likely side effects, if any?

^EDIT: I am dumb, and as some commenters have pointed out, my own link provides the answer: the specs state the device should accept 10V - 30V inputs with no problem.

Basicamente pensei em usar 2 wan rj45 por exemplo de 600mb + 1 gb em uma load balance e obter uma saída superior a 1 gb usando um módulo sfp 2,5g para rj45, dá certo ou há limitações? E essa saída 2,5g por pra um switch 2,5g por exemplo.

Hello!

I am planning my home network and want to use these two MikroTik devices for routing and switching.

I will use UniFi U7 Lite access points for Wi-Fi and want to set up multiple VLANs (server, clients, cameras, IoT, guest).

The server and workstation will be connected via SFP+ to the CRS328, while all other devices will connect to the CRS328 via 1 Gbit Ethernet.

Should I run SwOS or RouterOS on the CRS328?

I want both security and performance (who doesn't?).

Thank you very much!

Hello guys,
I've recently installed this POE model for the first time and I see the CPU temperature at a constant 55C

[admin@Mikrotik] > system/health/print

Columns: NAME, VALUE, TYPE

# NAME VALUE TYPE

0 poe-out-consumption 8.5 W

1 cpu-temperature 55 C

2 jack-voltage 49 V

3 2pin-voltage 0 V

4 poe-in-voltage 0 V

While the unit is performing as expected, I'm just wondering is this is within normal for this model. Have other users reported the same?

I'm using the default PSU that came with the unit and the chassis -while warmish- is not scorching hot or anywhere near 55C. I can perfectly keep my hand on it for as long as it takes.

Its installed on a wooden cabinet/box with minimal ventilation. Should I get a usb fan and connect it and point it at the cooling section of the RB5009? Or is this normal for the POE version and therefore I can sleep at night? :)

Can anyone with similar models installed do a few quick checks on their own units for comparison?
Thanks a bunch!

What's new in 7.26beta3 (2026-10-16):

*) apptraffic - fix connection tracking not reverting to auto when apptraffic is disabled;
*) bridge - add dhcp-snooping-option82-policy setting for handling packets that already carry option 82;
*) bridge - add topology-change, host-moves and STP timer statistics to monitors;
*) bridge - fix fragmented IPv6 traffic being dropped by DHCPv6 snooping (introduced in v7.23);
*) bridge - fix static host entries being aged out of the hardware table;
*) bth - fix allow-uploads being settable on shares that point to a file;
*) cmr - add low-voltage-pd-detected poe status;
*) cmr - add user attribution to log entries;
*) cmr - allow using the WiFi SSID as an automatic label;
*) cmr - do not create alert conditions when rebooted=no or unpaired-device-connected=no;
*) cmr - fix channel width report for wifi stations;
*) cmr - fix device identity changes not syncing with the server;
*) cmr - fix failed upgrade alerts showing an incorrect version;
*) cmr - fix layout node coordinates displayed incorrectly when negative;
*) cmr - fix manual upgrade to a pinned version;
*) cmr - fix missing application counters in the apptraffic view;
*) cmr - fix missing device export command;
*) cmr - fix pairing password requirement changes not being detected;
*) cmr - fix pairing state after a failed password pairing;
*) cmr - fix setting port-labels for multiple ports from the CLI;
*) cmr - fix the first interface-change alert not firing;
*) cmr - fix upgrade "show-devices" listing non-paired devices;
*) cmr - fix wifi-logs showing entries from unselected devices;
*) console - fix /cmr configuration missing from the export;
*) console - improve stability;
*) container - add label support;
*) defconf - disable FTP and Telnet services;
*) defconf - fix boot device selection after configuration reset with keep-apps=yes;
*) discovery - do not send LLDP power requests before the default configuration is applied;
*) disk - fix all-zero NGUIDs on NVMe over TCP exported namespaces;
*) disk - fix newly formatted Btrfs disks failing to mount (introduced in v7.26beta1);
*) dot1x - fix MACsec not working between ARM and MIPS devices;
*) dude - replace dude 32-bit client with 64-bit version;
*) ethernet - fix broadcast traffic still reaching the CPU when port isolation is used on Atheros and MediaTek switches;
*) ethernet - fix occasional packet loss on hAP be Media;
*) ethernet - fix spurious duplicate MAC address warning on WDS interfaces;
*) evpn - fix MAC-IP route origination and withdrawal (introduced in v7.25);
*) iot - fix LoRa gateway packet validation when transmitting;
*) ipsec - fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21);
*) ipsec - fix policies not being loaded after an upgrade (introduced in v7.25);
*) l3hw - add VXLAN offloading to CRS8xx series switches;
*) l3hw - add VXLAN offloading to CRS8xx series switches;
*) l3hw - fix hardware offload for active-backup bonds;
*) l3hw - fix hardware offload for VLAN interfaces created directly on Ethernet ports on CRS8xx series switches;
*) l3hw - fix offload issues on ECMP routes with non-offloadable paths;
*) l3hw - fix packet loss when a directly connected host moves from a bond to Ethernet;
*) l3hw - gate L3 hardware offload by the port's L2 hardware offload state;
*) l3hw - stop forwarding packets through an unreachable nexthop;
*) lcd - improve stability when changing the color scheme after touchscreen recalibration;
*) leds - fix Audience front LED when wifi is managed by wifi-qcom-ac;
*) log - fix the default flag not being shown for the default configuration log rules;
*) lte - clear the cached eSIM profile list after a SIM change;
*) lte - fix dialer for D-Link DWM-222W modems (additional fixes);
*) lte - fix iOS tethering not obtaining an IP address;
*) lte - fix linkup only after link-recovery-timer after firmware-upgrade on RG650E-EU modem;
*) lte - fix packet loss with R11e-LTE-US modems (introduced in v7.21);
*) lte - fix QMI modems waiting out the full link-recovery-timer after re-attaching;
*) lte - fix Telit LE910C4-WWX modem not initializing after a cold boot;
*) lte - improve modem firmware-upgrade for EG800K-EU modem;
*) lte - improve stability for devices with QMI modems;
*) lte - keep the "auto" MTU option on LTE interface after reboot (additional fixes);
*) lte - prevent removing an APN profile that is still in use by inactive interfaces;
*) mpls - fix dynamic-label-range rejecting a valid 1024-label range;
*) netinstall - add force stop for in-progress installations;
*) netwatch - improve stability when deleting https-get probes;
*) poe-out - fix export not showing the configuration under the poe submenu;
*) poe-out - fix poe-in voltage monitoring and LLDP power requests on hEX S (2025) devices;
*) routing-filter - fix any-regexp community matcher matching an empty community attribute;
*) routing-filter - fix community delete, filter and modify with regexp-only community lists;
*) sfp - fix host link breaking on S+RJ10 modules when changing advertised modes;
*) sfp - improve link stability for QSFP28 breakout ports to prevent interface lane flapping when one lane goes offline;
*) sniffer - fix long-running captures failing after approximately 4.3 billion packets;
*) snmp - add ospfAdminStat and ospfRouterId to the OSPF MIB;
*) ssh - fix a failed command returning a successful exit status;
*) ssh - fix incorrect key size shown for imported RSA keys (introduced in v7.9);
*) switch - fix egress rate limiting with jumbo frames on Marvell Prestera switches;
*) switch - fix link flapping on QSFP cage ports when connecting to NVIDIA DGX Spark;
*) switch - fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches;
*) switch - improve SFP/QSFP auto-negotiation on CRS8xx series switches;
*) system - fix interface statistics for third-party monitoring tools;
*) system - improve stability;
*) system - improve stability;
*) tls - add Renegotiation Indication Extension support;
*) traffic-flow - add post-NAT IPv6 addresses to NetFlow records;
*) traffic-flow - fix CPU usage being classified as networking in the profiler;
*) webfig - add on-demand loading of directory contents in the Files menu;
*) webfig - fix static IPv6 addresses showing wrong lifetime values;
*) webfig - improve network topology view performance;
*) wifi - add station-bridge and station-pseudobridge mode support for MLO stations;
*) wifi - fix client isolation assigned via RADIUS being lost after roaming;
*) wifi - improve stability when disabling an AP with multiple connected stations;
*) wifi - initial MLO station mode support on 802.11be devices;
*) wifi - make station interfaces compatible with access points that do not retransmit EAPoL message 1;
*) wifi-mediatek - fix roaming between APs belonging to the same MLO group;
*) wifi-mediatek - improve stability when MLO stations connect;
*) wifi-mediatek - update radio regulatory information;
*) wifi-mediatek - update the wireless driver and firmware (additional fixes);
*) wifi-qcom-ac - fix traffic being sent to the wrong station after a station-bridge roams between APs;
*) winbox - add a comment field to the DNS adlist window;
*) winbox - add the default-country parameter to wifi radio settings;
*) winbox - add wpa3-psk-gd to wifi security profile authentication types;
*) winbox - add ZeroTier controller, member and peer hint settings;
*) winbox - allow adding LTE interfaces with a master interface and APN profile;
*) winbox - display the "forced-on-bt" PoE-out mode set from the CLI;
*) winbox - fix bridge filter window disabling valid fields for IPv6 rules;
*) winbox - fix wifi radio band selection not being available in radio settings;
*) winbox - hide ACL rule counter tools and graphs on non-Prestera switches;
*) winbox - rename last-member-interval to last-member-query-interval;
*) wireguard - ignore disabled peers when checking for duplicate Allowed Addresses;
*) www - fix REST API login for users with rest-api policy, but without api policy; View changelogs

I have a poe camera (reolink) that I can't run an ethernet cable direct from the nvr. I need a wireless bridge to span a gap I can't get an ethernet cable to. I've check the wireless signal and it's good.

I haven't worked with Mikrotik before and I'm looking at the Mikrotik mAP (RBmAP2nD). It looks like it can bridge wireless, but has poe out but it doesn't look like that is compatible so I may need to use a poe injector.

Could someone confirm that a Mikrotik mAP wireless can bridge with an existing wireless network (WPA2-PSK AES).

reolink camera poe is:

IEEE 802.3af, 48V, active

camera (poe) -> wireless bridge with poe out -> wireless -> nvr

It's the same as this post by someone else a few years ago that directed towards Mikrotik:

https://www.reddit.com/r/networking/comments/12xv1f1/wifi_bridge_with_poe_output/

hello, i made the mistake of buying a mikrotik equipment and not checking that its an 8 year old model.
i am pretty sure the official (package, os) support will go on for a while as it is a powerful hardware and not obsolete (i hope). i am not here to complain.
the model is: RB4011iGS+5HacQ2HnD and it has an arm cpu unfortunately. i am very new to mikrotik but not new to it and networking.
cloudflare is not maintaining anymore a docker image for arm (but arm64) of its cloudflared tunnel and i would like to run that as it is (even more) simpler than wireguard and mikrotik's back to home wireguard variant.
i need to set it up for a no technical person to use and while wireguard "shaves" the certificate thing off the vpn universe and does the private/public key thing, cloudflare does not require even those and any config is handled on the plaform, the user needs only to log into his cloudflare account which is very convenient for the peacock user i have to help.
my quesiton is; is there somewhere a "safe" cloudflared docker image somewhere from trustable source that works on arm arhitecture which is a common practice for my case or i can forget it?
(just in case: vanilla wireguard is finnicky, back to home is less but still finnicky and please dont torch me, this is not me i am totally fine with back to home/wg/ovpn/etc).
thank you.

So I'm looking at building a home lab to "play with"

I don't want to spend a fortune on older Cisco or whatever hardware, so I've been thinking about a small Mikro Tik lab.

I am only looking for a few switches but I do want to play with VXLAN. I read this may / may not be an issue.

I've thought about getting the following

1 x MikroTik CRS305-1G-4S+IN (spine)

2 x MikroTik CRS310-8G+2S+IN (leaf)

I will be investing in a server or 2 down the line.

Any guidance about what my thoughts are?

[FIXED]
For laughs I decide to try and update RouterOS on an old 411U and Netinstall failed near the end.

No problem I thought, I'll just reset.

Unplugged, held in reset, re-plugged.

Now, 411U never ever appears in Netinstall it doesnt matter how long I hold reset.

And no matter what version of Winbox in admin mode Neighbours shows the router as IP 0.0.0.0 and always refuses admin with blank password.

On later versions of Winbox I get Mac timeout etc or just forever connecting. Earlier versions report bad password.

Have I bricked it?

Ed:

> To reset you need to hold something metallic on the reset circle (near the SIM card slot).

Thanks - that sorted it!

Three years ago I bought a RB5009UG+S+IN to be the main router.

The RB5009UG+S+IN gives me problems insofar that after some time the ports start to flap to the point where the device is barely usable. I tried to replace cables, no improvement. When I pull the plug on power and plug it back in, it stabilizes for some days but then starts again and flapping frequency starts to increase.

For testing I replaced it with an hAP ax² (don't need the Wifi, but had it "lying around"). Even though both devices have 1GB ports I don't see the flapping on the hAP ax².

Configs are the (mostyl) same. I just copied my export over to the hAP ax² and fixed non matching parts (e.g. number of ports configured).

Anyone an idea what I could do to stabilize the RB5009UG+S+IN? Otherwise it's kind of an expensive brick...

Hi,

Ive been trying really hard to find an option on the wireless interface as well as spotting capsman features to modify data rates on 2.4Ghz.

Does any one know where the functionalities are?

Devices are sticking to 2.4Ghz at 1mbps.

Equipment

hAP ac 2 (wifi-qcom-ac) ros7 stable release

Regards