u/netravnen

What's new in 7.24beta2 (2026-Jun-10 10:44):

• app - allow HTTP for Gitea when "check-certificate=no";
• app - fixed home-assistant default config files;
• app - fixed making empty directories when running configuration export;
• app - make secrets sensitive to avoid polluting configuration export;
• bgp - fixed advertisement print handling by "dst" when destination is in VRF;
• bgp - fixed EVPN label corruption and correct EVPN type-5 output;
• bgp - fixed IPv6 End-of-Route processing;
• bgp - improved stability on MP (multiprotocol) parsing;
• bgp - removed "save-to" from "resend" command;
• bgp-vpn - fixed blackhole route export;
• bridge - added ARP inspection and IP source guard support;
• certificate - always use all trust stores for downloaded CRL validation;
• certificate - general improvements in certificate handling;
• console - fixed argument mappings in "do" block for monitor commands;
• console - fixed missing comments in scripts (introduced in v7.24beta1);
• console - fixed proplist order in monitor commands;
• console - fixed quoted input issues for multi-argument properties;
• console - fixed UTF-8 comparisons on some architectures;
• console - improved "print detail" mode;
• console - make execute non-blocking when file parameter is used (introduced in v7.24beta1);
• container - fixed missing config.json issue when upgrading from version 7.20.8 or older;
• defconf - set "configuration.dtim-period=3" for WiFi;
• defconf - use "add-dns-entries=yes" on devices with DHCP server;
• dhcp - fixed processing of DHCP options that are longer than 255 bytes;
• discovery - added "discovery" logging topic (additional fixes);
• discovery - added "last-breath" feature;
• disk - added "last-seen" property that displays disk model and serial when removed;
• disk - added error message when disk state transitions from good to bad;
• disk - avoid reading SCSI stats all the time to allow disks to go to sleep;
• disk - improved error message when a swap file is created without "file-size" specified;
• ethernet - removed "1G-baseT-half" link mode on RTL8367 switch;
• fetch - added option to force HTTP/2 only (only for ARM64 and x86/CHR devices);
• interface - fixed duplicate MAC warning for wireless, wifi, macsec, w60g interfaces (introduced in v7.23);
• ip-service - show service name for "l2tp";
• ipsec,ike2 - fixed active connection termination;
• ipsec,ike2 - fixed SA payload validation;
• ipsec,ike2 - improved pending child SA cleanup and removal of dangling SAs during Phase 2 deletion;
• ipv6,ra - correctly process RAs advertising previously expired prefix;
• ipv6,ra - fixed prefix invalidation;
• isis - fixed missing "l2.lsp-refresh-interval" parameter;
• l2tp - allow fragmentation of large IPv6 packets;
• l3hw - added HW offloaded VRF support on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches (additional fixes);
• leds - added dark mode support for L009;
• lte - cap IPv6 prefix lifetime for ipv6-interface;
• lte - do not add extra /128 IPv6 address for ipv6-interface;
• lte - limit IPv6 prefix lifetime only when lifetime is advertised as infinity;
• lte - make modem MAC persistent for R11e-LTE6 and R11l-LTE7 modems;
• lte - remove site local DNS for ipv6-interface;
• netwatch - fixed issue where ICMP probes did not accept TTL exceeded packets when "accept-icmp-time-exceeded" was enabled;
• netwatch - increased maximum packet size to 65535;
• ospf - added missing interface parameters (additional fixes);
• ospf - allow comments on static interfaces;
• ospf - fixed interface passive flag update in WinBox;
• ospf - fixed unresolved route problem when "routing-table" setting is used;
• pimsm - make "hash-mask-length" parameter naming consistent and fixed typos;
• poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
• poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
• ppp - disable/enable modem radio state depending on ppp interface state (additional fixes);
• ppp - fixed ppp-out stability issue (additional fixes);
• ppp - improved "info" command for BG77 and BG770 modems;
• ppp - only show pin in export with "show-sensitive" flag;
• route - allow to add route with link-local destination address;
• route - fixed memory leak when flapping addresses or interfaces with routing protocols running;
• route - fixed static route flag handling by WinBox on disable;
• sftp - fixed branding package upload;
• switch - increase "ingress-rate" and "egress-rate" maximum value to 400G;
• traffic-generator - fixed injecting pcap/pcapng files on MIPSBE architecture;
• tunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22);
• vrrp - fixed stability issue when "sync-connection-tracking" is enabled;
• wifi - improved roaming/steering behavior for WiFi 7 MLO (additional fixes);
• wifi - upgraded wifi-qcom driver;
• winbox - added "Network" configuration menu for WiFi;
• winbox - added missing values to "AFI" setting under "Routing/BGP" menus;
• winbox - fixed "Connection Bytes" field under "IP/Firewall" menu;
• winbox - fixed "EC/IO" scaling for LTE interface;
• winbox - fixed empty value in "Immediate Gateway" under "IP/Routes" menu;
• winbox - fixed value unset under "MPLS/LDP Neighbor" menu;
• winbox - fixed WinBox v3 stability issue when Netinstall package is enabled (introduced in v7.24beta1);
• winbox - move "EAP" under "Security" tab for WiFi;
• winbox - show priority bits in "VLAN ID" field under "Tools/Packet Sniffer" menu;
• wireguard - fixed peer recreation on interface change;
• x86 - fixed IRQ displaying per CPU on Intel 700 series NIC;

What's new in 7.23.1 (2026-Jun-02 12:25):

• app - fixed bogus configuration export;
• app - fixed making empty directories when running configuration export;
• bgp - fixed memory leak;
• bridge - fixed stability issue when using DHCPv4 snooping;
• disk - avoid reading SCSI stats all the time to allow disks to go to sleep;
• disk - improved error message when a swap file is created without "file-size" specified;
• ethernet - fixed stability issue with TSO on Alpine CPUs;
• firewall - improved system stability;
• ipsec,ike2 - improved TSi validation to prevent modecfg address conflicts;
• ipv6 - do not disable IPv6 FastPath when Traffic Flow is enabled;
• ospf - added missing interface parameters;
• ospf - fixed unresolved route problem when "routing-table" setting is used;
• ptp - rename "smpte" to "smpte-2059";
• route - improved overall stability;
• route - removed deprecated "/routing/route/rule" menu;
• switch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs;

What's new in 7.24beta1 (2026-May-26 13:47):

*) adlist - improved service stability when adjusting adlist configuration;
*) app - added inventree, opencloud, opencloud-extended apps;
*) app - changed pmacct-netflow YAML;
*) app - use randomly generated secrets in new apps;
*) bfd - fixed delay on session print;
*) bgp - added option to add BGP VPLS created interfaces in interface-list;
*) bgp - fixed memory leak;
*) bridge - added "querier-uses-bridge-address" setting to use bridge source IP address for IGMP querier;
*) bridge - added DHCPv4 snooping IP binding table;
*) bridge - fixed local static host entries;
*) bridge - fixed stability issue when using DHCPv4 snooping;
*) bridge - improved STP bridge and port priority settings (warn when a non-compliant value is used and allow selecting a value from a list);
*) btest - added VRF support for bandwidth-test and speed-test;
*) certificate - added "acme-renew" command;
*) console - added "days" to scheduler;
*) console - added "in" and "has" operators for Array types;
*) console - added "order-by" parameter to "print" command, allowing sorting by up to three arguments in ascending or descending order;
*) console - added log tracing when scripts fail to start due to permissions;
*) console - do not terminate self-removing scripts;
*) console - fixed "print follow on-event" script runner command not showing all argument values in some cases;
*) console - fixed script import/export with empty "policy" setting;
*) console - fixed stability issue in full-screen editor;
*) console - improved script handling and error logging when running scripts from external sources (e.g. DHCP, SNMP, netwatch, hotspot);
*) console - make "mac-auth-password" sensitive in "/ip/hotspot/profile";
*) console - make "password" sensitive in "/system/package/local-update/mirror";
*) console - produce runtime errors for bad command parameters;
*) console - prompt about and offer to stop already existing serial terminal session when opening new one;
*) console - rename "address" to "available-from" in "/ip/service" (backwards compatible via deprecation);
*) console - restrict editing comments in WiFi registration table;
*) container - added "save" command;
*) container - do not allow starting with empty default DNS list and no DNS override;
*) container - do not print environment variables in log on container startup;
*) container - fixed "start-on-boot" not retrying on certain startup errors;
*) container - improved support for containers;
*) container - reduced writes to flash when running health check;
*) container - use env "TERM=xterm" if no TERM variable provided when running shell;
*) dhcpv4-relay - fixed stability issue when creating duplicate relays;
*) dhcpv4-server - do not reset "class-id" parameter when lease loses "bound" status;
*) dhcpv6-relay - fixed non-working relay when adding from WinBox;
*) dhcpv6-server - fixed invalid flag;
*) discovery - added "address6" column to default "/ip/neighbor" print view;
*) discovery - added "discovery" logging topic;
*) discovery - improved service stability when sending discovery packets on interfaces that have hundreds of IP addresses;
*) disk - added "raid-scrub-cancel" command;
*) disk - do not consider USB drives as self-encryption capable;
*) disk - fixed "smart-info" not showing information on certain storage devices;
*) disk - limited maximum swap size to be no more than 10x of device RAM;
*) ethernet - fixed stability issue with TSO on Alpine CPUs;
*) fetch - added "ip-type" parameter;
*) fetch - fixed false "bad request" response when trying to fetch URL with IPv6 address in it;
*) fetch - hint file list for "src-path" and "dst-path" parameters;
*) hardware - rename "max-power" to "manufacturer-reported-max-power";
*) iot - added LoRa keep alive logic for UDP protocol;
*) iot - added missing LoRa US radio plans;
*) iot - added Wiliot USB dongle support;
*) iot - allow maximum Modbus "timeout" property to 10 seconds;
*) iot - monitor LoRa worker state (watchdog);
*) iot - pass Wiliot certification;
*) ip-service - remove reverse-proxy for SMIPS;
*) ipsec,ike2 - improved KE generation validation during initial setup and child SA creation;
*) ipsec,ike2 - improved logging when remote ID is specified;
*) ipsec,ike2 - improved TSi validation to prevent modecfg address conflicts;
*) ipv6 - added "status" column to default "/ipv6/neighbor" print view;
*) ipv6 - do not disable IPv6 FastPath when Traffic Flow is enabled;
*) ipv6,ra - changed default "router-advertisement-route-distance" to 1;
*) ipv6,ra - use lowest value between IPv6/Pool and IPv6/ND/Prefix/Default as dynamic prefix lifetime;
*) l3hw - added HW offloaded support for VLAN interfaces created directly on Ethernet for CRS8xx series switches;
*) l3hw - added HW offloaded VRF support on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches;
*) leds - improved interface stats activity for devices with Marvell Prestera switch chip;
*) lte - fixed EC/IO scale in CLI and GUI;
*) lte - fixed EC25-EU, EG25-G traffic to 67 UDP;
*) lte - fixed third-party modems ICCID decoding for eSIM;
*) lte - improved Cinterion PLS8-E roaming;
*) lte - improved deregistration handling for AT modems;
*) lte - improved system stability when no APN specified;
*) lte - removed extra restart after firmware upgrade for EC200A-EU modem;
*) lte - report short cell ID in 3G network mode also for AT modems;
*) lte - restrict incoming calls for FG621-EU;
*) lte - show "+CME ERROR: 10" as "SIM not present";
*) lte - show "data-class" in LTE monitor instead of "access-technology" also for 5G AT modems;
*) lte - show "primary-band" instead of "earfcn" in LTE monitor also for modems without CA support;
*) lte - show RSCP and EC/IO parameter in 3G network mode for R11e-LTE6, R11l-LTE7 and FG621-EA modems;
*) mesh - fixed missing FDB entries from wireless ports;
*) mpls - added ICMP time exceeded handler for IPv6;
*) mpls - make FastPath work with expl-null;
*) netinstall - added Netinstall package;
*) netinstall - improved architecture detection;
*) netinstall-cli - added "help" parameter;
*) netinstall-cli - added "reboot" and "shutdown" flags to control reboot after installation;
*) netwatch - fixed inaccurate "rtt-stdev" value;
*) ospf - added missing interface parameters;
*) ospf - force passive for VRF interface;
*) pim - added comment for "/routing/gmp" entries;
*) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) ppp - added "MT-Address-List" to IPv6 address list when received from RADIUS and using DHCP for IPv6 configuration;
*) ppp - disable/enable modem radio state depending on PPP interface state;
*) ppp - fixed ppp-out stability issue;
*) ppp - improved OVPN underlying SSL connection management;
*) ppp - report actual network data usage statistics instead of "0" for all IPv6 RADIUS accounting parameters on accounting "Stop" packet;
*) queue - fixed "undo" command for simple queues;
*) rip - do not export authentication keys by default;
*) route - fixed potential race condition;
*) route - improved overall stability;
*) route - removed deprecated "/routing/route/rule" menu;
*) route - respect the "interface" property when pinging IPv6 addresses over ECMP;
*) sfp - fixed linking for hAP ax S and hEX S (2025) with "1G-baseX" link-mode;
*) sfp - removed unsupported "2.5G-baseX" speed on CRS312-4C+8XG and CRS326-4C+20G+2Q+;
*) sms - added some GSM7 symbols to SMS tool;
*) ssh - added mlkem768x25519-sha256 key exchange support;
*) ssh - do not attempt automatic empty password login when RADIUS is used;
*) ssh - fixed SSH tunnel with IPv6 link-local address on non-ethernet interfaces;
*) ssh - make SSH packet validation more strict;
*) supout - added interface monitor-traffic;
*) switch - fixed IEEE reserved MAC handling for CRS1xx, CRS2xx switches;
*) switch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs;
*) system - rename "factory-software" to "minimum-version" and "factory-firmware" to "minimum-firmware";
*) system - restrict RouterOS processes using swap;
*) system - show who is using "/system serial-terminal";
*) vpls - added transmit loop detection;
*) vrrp - added "v3-checksum-as-v2" setting;
*) vxlan - fixed missing L2MTU property when VRF is specified;
*) vxlan - ignore disabled interfaces when checking for configuration conflicts;
*) webfig - fixed issue with increasing keep-alive traffic;
*) webfig - improved underlying encryption and stability processing;
*) webfig - improvements to graphs;
*) wifi - added "Preamble Puncturing" under "WiFi/Channel" menu;
*) wifi - added dash when CAPsMAN generates interface name and prefix ends with digit;
*) wifi - improved regulatory compliance;
*) wifi - improved roaming/steering behavior for WiFi 7 MLO;
*) wifi - improved stability;
*) wifi - improved station-bridge mode;
*) wifi-mediatek - fixed broken interfaces on startup;
*) wifi-mediatek - fixed some channel definitions for certain countries;
*) winbox - added "Preferred Architecture" setting for L009;
*) winbox - added "SIM PIN" under "Tools/SMS";
*) winbox - fixed "Use Ipsec" and "Ipsec Secret" under "Interfaces/L2TP Ether" menu;
*) winbox - fixed sort for "Address List" under "IPv6/Firewall" menu;
*) winbox - make LoRa "Auth key" and MQTT "Password" sensitive;
*) winbox - show "Any. Port" column by default under "IP/Firewall" menu;
*) winbox - show preferred and valid lifetime of IPv6 address also on static IPs;

What's new in 7.23 (2026-May-25 12:05):

!) upgrade - use HTTPS by default when connecting to MikroTik upgrade servers;
*) app - added "network-outgoing-access=yes/no" setting to prevent containers from initiating outbound traffic;
*) app - added birdnet-go, cryptpad, diagrams-net, lorawan-stack, metube, mikrodash, nextcloud-whiteboard, paperless-ngx, wbo, zulip apps;
*) app - added docker-with-dockge, docker-with-komodo, docker-with-portainer, HA-otbr-matter, odoo, otbr, stalwart, trip apps;
*) app - added possibility to set app command-line parameter from CLI;
*) app - added restart command;
*) app - allow apps on XFS file systems;
*) app - allow filtering by installed apps;
*) app - allow overriding default stop signal;
*) app - allow parsing DNS in YAML;
*) app - allow passing stop signal from YAML and passing it to container as default;
*) app - allow picking app category from drop-down;
*) app - allow updating name parameter from YAML for custom apps;
*) app - allow updating YAML for existing custom app, forces cleanup;
*) app - apps now check for port availability, apps will not start on "internal" if app masks existing service;
*) app - automatically pass any required devices to container, such as otbr;
*) app - automatically restart app when required hardware device is changed;
*) app - bundled ollama with openwebui;
*) app - check if certificate already exists before creating a new one;
*) app - disabled PiHole syncing NTP to host;
*) app - fixed issue where XFS disks did not appear in the app disk drop-down;
*) app - fixed saving custom apps;
*) app - fixed showing ui-url for apps;
*) app - fixed some apps not containing the full repository URL;
*) app - fixed stability issue when running cleanup on many apps;
*) app - fixed store issue when adding a custom app;
*) app - fixed YAML not exported for custom apps;
*) app - improved app network and port behavior;
*) app - improved automatic hardware device passing to container;
*) app - improved YAML error message;
*) app - make sure all layer .tar.gz files are deleted after extraction finishes;
*) app - on file-based devices, swap is enabled on the file itself instead of creating another and enabling it on that;
*) app - stability fixes for the "/app" menu;
*) app - swap file is now created based on the mount-point it is attached to;
*) app - updated uptime-kuma image;
*) arm64,x86 - updated Broadcom bnxt Ethernet driver for 200G support;
*) bfd - fixed source address selection for IPv6 multihop sessions;
*) bridge - added ability to set custom Option 82 with dhcp-agent-circuit-id, dhcp-agent-remote-id settings (replaces add-dhcp-option82 setting; configuration is automatically updated after upgrade);
*) bridge - added DHCPv6 snooping feature with ability to set custom Option 18 and Option 37;
*) bridge - fixed dynamic VLAN update for WiFi interfaces;
*) bridge - improved MAC synchronization for MLAG;
*) bridge - recognize more DHCP message types when dhcp-snooping is enabled;
*) bth - fixed WireGuard client config IP address netmask;
*) certificate - added "ISRG Root X1" and "DigiCert Global Root G2" to SMIPS built-in root certificate authorities store;
*) certificate - allow deleting ACME certificate that failed to generate;
*) certificate - improved ACME logging;
*) certificate - improved ACME status reporting;
*) certificate - set Let's Encrypt as default ACME directory;
*) chr - improved guest tool config for arm64 CHR;
*) cloud - cloud backup file management now requires "policy" policy;
*) cloud - show error if cloud services are not supported on the device;
*) console - added comment in "/ip/dhcp-server/option/sets" and "/ipv6/dhcp-server/option/sets" menus;
*) console - added path parameter to export;
*) console - added syntax highlight for script properties in some menus (e.g. dhcp-client, dhcp-server, ppp/profile, interface/vrrp);
*) console - export mentions custom defconf script presence in header;
*) console - fixed "/log/print follow on-event" to work with "where" (introduced in v7.22);
*) console - fixed output when oversized completion present;
*) console - removed redundant keepalive for the serial-terminal, ensure that the device no longer periodically outputs /0 while using "/system/serial-terminal";
*) console - show "/system/resource/hardware/usb-power-reset" only on x86;
*) console - show warning in print header when terminal is too narrow to show any columns;
*) console - treat non-existent command parameters as runtime errors;
*) container - added restart-policy=no/always/on-failure, stop-on-unhealthy, restart-count, restart-interval, restart-max-count properties;
*) container - added support for noexec option to mounts;
*) container - added support for USB audio devices for containers;
*) container - allow disabling individual container environment variables without deleting them;
*) container - allow picking mount source directories with the file picker in WinBox;
*) container - allow setting memory-max globally and per container;
*) container - allow user-defined mounts overriding /sys and /dev;
*) container - check if root-dir does not exist before adding a container;
*) container - clean up layers of non-existing containers;
*) container - detect and show containers killed by out-of-memory killer;
*) container - do not allow starting container/shell with non-existing user or group;
*) container - draw graphs in container stats;
*) container - fixed container entrypoint and shell override by user;
*) container - fixed container layer size calculation;
*) container - fixed container shell not working with multi-arg commands;
*) container - fixed repull if root-dir of container was in tmpfs;
*) container - fixed running "/container shell" with the correct user, if container user is set or overridden;
*) container - improved errors at container start;
*) container - improved running container instance memory usage;
*) container - layers are now accessible under "Layers" tab;
*) container - pass any container startup error message back to "run" and make it exit immediately;
*) container - remove container backup directory if import fails;
*) container - removed "Layers" button;
*) container - show container size and container data size;
*) container - show default DNS servers;
*) container - show layer size calculation status;
*) container - updated /dev/net/tun permissions;
*) crypto - fixed fallback flag loss in qcrypto;
*) crypto - fixed stability issue;
*) crypto - improved safexcel driver with upstream changes and patches;
*) dhcpv4-server - added "add-dns-entries" and "add-dns-entries-suffix" properties for creating local DNS entries;
*) dhcpv4-server - changed lease agent-circuit-id and agent-remote-id format to hex;
*) dhcpv4-server - do not raise an alert when receiving a packet originating from the same device;
*) dhcpv4-server - do not suggest bogus pools when using setup command (e.g. when address is /31 or /32);
*) dhcpv4-server - fixed an issue where renew packets without giaddr were sometimes not processed;
*) discovery - added "add-dns-entries" and "add-dns-entries-suffix" properties for creating local DNS entries;
*) discovery - added option to disable/enable LLDP MED;
*) discovery - added separate read-only menu "/ip/neighbor/lldp" for neighbors discovered by LLDP (CLI only);
*) discovery - dynamically update advertised "interface-name";
*) discovery - fixed LLDP MAC/PHY TLV;
*) disk - added "/disk" smart-info;
*) disk - added disk check and repair for ext4, Btrfs and XFS file systems;
*) disk - improved device name tracking in "/system/resource/hardware" menu;
*) disk - show disk io errors in "/disk" menu;
*) dns - added HTTP/2 support to DoH on ARM64 and x86/CHR devices;
*) ethernet - improved system stability for RB3011, L009, NetMetal ax, hAP ax lite devices;
*) ethernet - improved system stability on devices with Alpine CPUs;
*) fetch - fixed non-working idle-timeout in some cases;
*) file - added copy, tail, head commands (CLI only);
*) firewall - added "action=drop" to mangle;
*) firewall - improved stability for SIP helper;
*) firewall - matcher "in-bridge-port" does not require "use-ip-firewall=yes";
*) graphing - improved service stability when storing data;
*) hardware - report the correct state of PCI devices in "/system/resource/hardware" menu;
*) health - hide health menu for RB951ui-2nD;
*) ike2 - fixed child SA cleanup during flush operation;
*) ike2 - fixed pending responder connection cleanup after peer removal;
*) ike2 - fixed SA delete handling on initiator during rekey;
*) ike2 - improved HMAC size validation checks;
*) interface - show warning when same MAC address is used on more than one virtual interface;
*) iot - added LoRa Tx delay setting;
*) iot - added MQTT subscribe message real-time monitoring option;
*) iot - added Wiliot support;
*) iot - fixed LoRa LBT issues, which caused Tx packets not getting delivered;
*) iot - fixed LoRa lockpack preventing lock from applying;
*) iot - improved LoRa stability;
*) iot - improved LoRa Tx handling;
*) iot - improved LoRa Tx scheduling;
*) ip - added IPv6 and VRF support for reverse-proxy;
*) ip - added SNI logging for reverse-proxy;
*) ip - fixed hanging connections for reverse-proxy;
*) ip-settings - added ipv4-fragment-time and ipv4-high-fragment-thresh settings, use default values based on total device memory;
*) ipip - disabled IPv6 link-local address generation;
*) ippool - fixed issue when changing pool with already used addresses;
*) ippool6 - allow variable length pool;
*) ippool6 - properly follow pool changes for already used prefixes;
*) ipsec - added netlink-based SA and policy handling;
*) ipsec - fixed SA proto parameter conversion and policy "none" type handling;
*) ipsec - improved NAT encapsulation parameter forwarding;
*) ipsec – fixed expired SA handling to prevent “no such item” errors during listing;
*) ipv6 - added from-pool-policy address property that controls how address is acquired from the pool;
*) ipv6 - added without-acquire address property;
*) ipv6 - always ensure that prefix length matches the one given by the pool even if address was set to 0;
*) ipv6,ra - added option to ignore MTU and DNS servers;
*) ipv6,ra - added router-advertisement-route-distance setting;
*) ipv6,ra - allow receiving DNS servers over multiple interfaces;
*) ipv6,ra - clamp valid-lifetime to minimum of 2h on deprecation;
*) ipv6,ra - extend processed RA logging;
*) ipv6,ra - fixed advertised DNS parameter logging;
*) ipv6,ra - fixed changing default "all" interface configuration;
*) ipv6,ra - fixed DNS and pref64 property unset;
*) ipv6,ra - fixed sending only DNS or MTU when prefix is set to "none";
*) ipv6,ra - improved service stability;
*) ipv6,ra - warn when interface is under the bridge;
*) isis - allow to configure metric-type;
*) l3hw - added HW offloaded VRF support on CRS8xx switches;
*) l3hw - added VRF assignment via switch ACL rules on CRS8xx switches (CLI only);
*) l3hw - fixed VXLAN packet matching by local IP;
*) leds - added new PoE fault LED cases (bad fw, PoE card power cable disconnected, PoE card not inserted);
*) leds - fixed power LED turning off while LTE interface is inactive (introduced in v7.22);
*) log - added "discover" topic and log events for discovered local DNS entries;
*) log - added CC option for e-mail action;
*) log - added ssld error logging;
*) log - added TLS support;
*) lte - added fast SIM switchover support using AT channel for MBIM modems without MBIM_CID_MS_UICC_RESET firmware support;
*) lte - configure IP address for AT modems even if no DNS is received from the network;
*) lte - delete CID profiles one by one instead of "delete all" for QMI modems, as command does not work for all modems;
*) lte - do not duplicate primary-band also in ca-band for QMI modems in 5G SA network;
*) lte - do not reconfigure modem in passthrough mode if passthrough cannot be activated because of slave interface;
*) lte - emit RS every 60s on LTE interface;
*) lte - filter packets by MAC in multi-apn setup for EC200A-EU modem;
*) lte - fixed automatic modeswitch for "Chateau 5G R16" and "Chateau 5G";
*) lte - fixed broken network scan after being interrupted by reconfiguration;
*) lte - fixed operator setting for QMI modems;
*) lte - fixed rare cases where the Tx queue could stop and never wake up on multi-core CPU devices;
*) lte - fixed RSSI signal monitor for 3rd party modems where AT+CSQ responses are not parsed;
*) lte - fixed user set MTU not applied to LTE interface;
*) lte - improved system stability for devices with QMI modems;
*) lte - improved system stability when modem configured in passthrough mode with VLANs for "Chateau 5G R16" and "Chateau 5G";
*) lte - improved system stability;
*) lte - improvements for passthrough mode in IPv6 only setup;
*) lte - keep MAC persistent across reboots for QMI modems;
*) lte - read subscriber number also for QMI modems;
*) lte - removed LTE external-antenna scan;
*) lte - set SMS send timeout to 180s;
*) lte - show external-antenna as "none" before actual scan is done instead of empty value;
*) lte - show MTU as "auto" also on interface level if "auto" used;
*) lte - SIMCom modems, skip error state when modem sends improperly formatted CREG response/URC;
*) lte - stop network scan on interruption for QMI modems;
*) lte - unify "modem-init" for all driver types;
*) macsec - added aes-gcm-xpn-128 cipher support;
*) netwatch - fixed memory leak when using HTTP/HTTPS GET probe with invalid src-address;
*) ospf - allow adding interface configuration manually, bypassing interface-template;
*) ospf - change virtual link configuration to use OSPF interface directly;
*) ospf - fixed missing interface-template configuration which previously was converted by upgrading from RouterOS v6;
*) ospf - fixed nssa bit check;
*) ospf - fixed routes not being installed on ABRs;
*) pimsm - do not ignore priority when selecting RP from BSR;
*) pimsm - fixed possible BSR loop;
*) pimsm - improved stability;
*) ping - resolve domain name to IPv6 if src-address is IPv6 address;
*) ping - show time in microseconds for flood-ping;
*) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) port - added support for "tcp-client" and "udp" modes for "remote-access";
*) port - expose RG650E-EU diagnostics channel;
*) port - remove unused serial port on RB1100AHx4;
*) pppoe - do not reset pppoe-client interface when adding a comment;
*) ptp - added support for CRS812, CRS804;
*) ptp - fixed crash during initialization on some devices;
*) qos-hw - added automap setting to QoS Profiles (enabled by default);
*) qos-hw - added ECN and PFC support on CRS8xx;
*) qos-hw - added new default "auto" value to mirror-buffers, multicast-buffers, shared-buffers QoS Settings (old defaults are shown in export after upgrade);
*) qos-hw - added queueX-byte-max stats to port usage on CRS8xx;
*) qos-hw - fixed CPU traffic mapping to queues on CRS8xx switches;
*) qos-hw - introduced lossless-traffic-class and lossless-buffers settings;
*) qos-hw - removed shared-pool-index setting;
*) route - fixed link-local interface check when resolving IPv6 nexthops;
*) route - revert to old routing rule priorities for containers (introduced in v7.22);
*) routerboot - fixed Netinstall failure when using multiple partitions on AL73400, AL52400, AL32400 CPUs ("/system routerboard upgrade" required);
*) sftp - fixed path canonicalization request;
*) smb - do not start /ip smb server on container interfaces;
*) sniffer - added IP ECN field;
*) sniffer - fixed missing VLAN tag in the TZSP packets;
*) snmp - added missing BRIDGE-MIB OIDs (dot1dBaseNumPorts, dot1dBaseType, dot1dStpDesignatedRoot, dot1dStpPortDesignatedBridge, dot1dStpRootCost, dot1dStpRootPort, dot1dStpHoldTime, dot1dStpBridgeMaxAge, dot1dStpBridgeHelloTime, dot1dStpBridgeForwardDelay, dot1dStpPortForwardTransitions, dot1dTpAgingTime);
*) snmp - added missing LLDP-MIB OIDs (lldpMessageTxInterval, lldpMessageTxHoldMultiplier, lldpLocManAddrTable);
*) snmp - enforce minimum password length;
*) snmp - fixed compliance of LLDP-MIB lldpRemManAddrTable;
*) snmp - fixed connection tracking counter OID;
*) snmp - fixed dot1dStpPortDesignatedPort, dot1dStpPortDesignatedRoot OIDs;
*) snmp - fixed ifSpeed and ifHighSpeed OIDs for 802.3ad and balance-xor bonding interfaces;
*) snmp - fixed lldpLocSysDesc OID;
*) snmp - implemented LTE firmware upgrade option;
*) snmp - use "/ip/neighbor/lldp" for lldpRemTable and lldpRemManAddrTable (fixes lldpRemTable showing neighbors discovered by MNCP or CDP);
*) ssh - do not advertise password login method when it is disabled;
*) ssh - improved host resolve error logging;
*) switch - fixed issue with MAC table for RB2011 (introduced in v7.21);
*) switch - fixed missing ethernet counters for non-running interfaces on CRS8xx switches (introduced in v7.22);
*) switch - improved FDB operations on QCA8337, Atheros8327;
*) switch - rework how IEEE reserved MAC addresses are handled on QCA8337, Atheros8327;
*) switch - updated switch-marvell.npk driver;
*) switch - use names instead of numbers in switch menu configuration export;
*) system - improved handling of HTTP/2 connection closure;
*) system - improved RouterOS package download over slow connection;
*) system - improved switching to HTTP/1 if HTTP/2 is not supported by remote host;
*) system - keep HTTP/2 connection open if it is not closed by system or server;
*) system - make default identity based on board name;
*) timezone - updated timezone information from "tzdata2026b" release;
*) upgrade - added the option to configure HTTP/HTTPS modes when connecting to MikroTik upgrade servers;
*) upgrade - changed status message for scheduled installs;
*) upgrade - check for available packages when opening System/Packages in GUI;
*) usb - added ax88179_178a driver;
*) usb - improved USB Ethernet adapter recognition;
*) usb - show USB device reported maximum power;
*) user-manager - improved stability when removing user-profile while session updates counters;
*) veth - fixed link-local address not being configurable as a gateway;
*) vxlan - fixed fast-path when using "checksum=no" (introduced in v7.20);
*) vxlan - improved system stability;
*) webfig - added postfix byte value support (e.g. "/ip/settings/ipv4-high-fragment-thresh");
*) webfig - added support for filter in tables;
*) wifi - improved interface provisioning for WiFi 7 access points;
*) wifi - improved on-capsman traffic processing;
*) wifi-mediatek - fixed multicast-enhance functionality;
*) wifi-mediatek - fixed stability issue getting regulatory information and during initialization;
*) wifi-qcom-be - fixed incorrect channel info for punctured channels;
*) wifi-qcom-be - fixed stability issue during initialization;
*) wifi-qcom-be,mediatek - correctly advertise RRM capabilities when 802.11k neighbor reports are enabled;
*) winbox - added "MLD Static" and "MLD Datapath" properties under the "WiFi/CAP" menu;
*) winbox - added "Multipath" property under the "Routing/BGP/Instance" menu;
*) winbox - added “Remove” action under "System/Certificates/Requests" menu;
*) winbox - added comment for DHCPv6 relay;
*) winbox - added group numbers for DH and PFS groups for IPsec;
*) winbox - allow setting "CAPsMAN address" for CAP as domain name;
*) winbox - do not accept interface without specifying IP or MAC in "Ping To" field;
*) winbox - improved "External Antenna" property display;
*) winbox - improved Routing/PIM SM menu;
*) winbox - move bridge IGMP Snooping checkbox to IGMP tab;
*) winbox - rename DHCPv6 server binding "Peer Address" to "Client Address";
*) winbox - show "Directory URL" field for ACME certificates in Certificate view;
*) winbox - show "IPv6 Address" property by default under the "IP/Neighbors" menu;
*) winbox - show accepted connections in tree view under "IP/Services" menu;
*) winbox - updated socksify icon for firewall NAT rules;
*) wireguard - improved system stability;
*) www - added partial content (HTTP 206) support;
*) www - improved REST API user cache processing;
*) www - improved system stability;
*) zerotier - switch to 1.14.2 version;

Sometimes you don't have to buy a single-board computer or a single-board MCU... You might be able to take reading from sensors and control relays straight from RouterOS!

Read more about GPIO here:
https://help.mikrotik.com/docs/spaces/ROS/pages/68944101/GPIO
https://help.mikrotik.com/docs/spaces/UM/pages/366477381/KNOT+Embedded+LTE4+EC25-EU+KNe
https://help.mikrotik.com/docs/spaces/UM/pages/41680915/RB924i-2nD-BT5+BG77
https://help.mikrotik.com/docs/spaces/UM/pages/14222434/RBM33G

https://tiktube.com/w/tozYQPUMQ3hwGDDgwzPYPW

What's new in 7.23rc4 (2026-May-22 10:53):

*) app - added "network-outgoing-access=yes/no" setting to prevent containers from initiating outbound traffic;
*) bridge - fixed dynamic VLAN update for WiFi interfaces;
*) bridge - improved MAC synchronization for MLAG (additional fixes);
*) certificate - improved ACME logging (additional fixes);
*) certificate - improved ACME status reporting (additional fixes);
*) cloud - cloud backup file management now requires "policy" policy;
*) container - updated /dev/net/tun permission;
*) crypto - fixed stability issue;
*) dhcpv4-server - added "add-dns-entries" and "add-dns-entries-suffix" properties for creating local DNS entries (additional fixes);
*) discovery - added "add-dns-entries" and "add-dns-entries-suffix" properties for creating local DNS entries (additional fixes);
*) firewall - added "action=drop" to mangle;
*) firewall - matcher "in-bridge-port" does not require "use-ip-firewall=yes";
*) ike2 - fixed child SA cleanup during flush operation;
*) ike2 - fixed pending responder connection cleanup after peer removal;
*) ike2 - fixed SA delete handling on initiator during rekey;
*) ike2 - improved HMAC size validation checks;
*) iot - fixed LoRa lockpack preventing lock from applying;
*) ipv6,ra - improved service stability (additional fixes);
*) isis - allow to configure metric-type;
*) leds - fixed power LED turning off while LTE interface is inactive (introduced in v7.22);
*) lte - fixed rare cases where the Tx queue could stop and never wake up on multi-core CPU devices;
*) switch - fixed issue with MAC table for RB2011 (introduced in v7.21);
*) switch - fixed missing ethernet counters for non-running interfaces on CRS8xx switches (introduced in v7.22);
*) system - improved switching to HTTP/1 if HTTP/2 is not supported by remote host (additional fixes);
*) timezone - updated timezone information from "tzdata2026b" release;
*) vrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge (additional fixes);
*) vxlan - fixed fast-path when using "checksum=no" (introduced in v7.20);
*) wifi - improved on-capsman traffic processing;
*) www - improved REST API user cache processing;
*) www - properly respond with custom HTTP response code instead of replying always with 200 (introduced in v7.23rc1);

What's new in 7.22.3 (2026-May-07 12:19):

*) console - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal;
*) ethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22);
*) vrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip;

What's new in 7.23rc3 (2026-May-06 19:26):

*) console - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal;
*) discovery - added separate read-only menu "/ip/neighbor/lldp" for neighbors discovered by the LLDP (CLI only) (additional fixes);
*) ethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22);
*) ip - added IPv6 and VRF support for reverse-proxy;
*) netwatch - fixed memory leak when using HTTP/HTTPS GET probe with invalid src-address;
*) sniffer - fixed missing VLAN tag in the TZSP packets (additional fixes);
*) system - improved switching to HTTP/1 if HTTP/2 is not supported by remote host;
*) upgrade - added the option to configure HTTP/HTTPS modes when connecting to MikroTik upgrade servers (additional fixes);
*) vrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip;
*) wifi - improved interface provisioning for WiFi 7 access points;