u/netravnen

**New video from MikroTik's official TikTube channel**

You have been hearing all this talk about the new apps feature that let's you add custom apps, but now it is time to try it with some examples and updated documentation.

https://manual.mikrotik.com/docs/containers/apps/#custom-apps

https://raw.githubusercontent.com/Druvis-Timma/Mikrotik/refs/heads/main/Custom App store/apps.yaml

0:00 Intro
0:20 Simple pre-built image
1:18 Modify with command
1:56 Learning YAML
3:32 Custom app-store
4:53 Outro

▶ Watch Video

**New video from MikroTik's official TikTube channel**

Turn your hAP be3 media into a full blown entertainment server with simple tools like DLNA and SMB or preconfigured apps like Jellyfin, Plex, the whole *arr stack, MediaManager, BitTorrent client and many more!

https://manual.mikrotik.com/docs/containers/apps/
https://manual.mikrotik.com/docs/storage/dlna

00:00 The WiFi7 media server
00:55 Old-school DLNA w/ SMB
01:53 Quick start with apps
02:26 Jellyfin setup
03:27 ConvertX, Copyparty, Filegator
04:28 Jackett, Prowlarr and the *arr stack
04:49 MediaManager
05:11 Transmission BitTorrent client
05:21 Otbr and other apps
05:51 How the URLs work

▶ Watch Video

New video from MikroTik's official TikTube channel

To learn more about the new option82 configuration, look for the new attributes in the following table:
https://help.mikrotik.com/docs/spaces/ROS/pages/328068/Bridging+and+Switching#BridgingandSwitching-BridgeInterfaceSetup

▶ Watch Video

What's new in 7.24beta2 (2026-Jun-10 10:44):

• app - allow HTTP for Gitea when "check-certificate=no";
• app - fixed home-assistant default config files;
• app - fixed making empty directories when running configuration export;
• app - make secrets sensitive to avoid polluting configuration export;
• bgp - fixed advertisement print handling by "dst" when destination is in VRF;
• bgp - fixed EVPN label corruption and correct EVPN type-5 output;
• bgp - fixed IPv6 End-of-Route processing;
• bgp - improved stability on MP (multiprotocol) parsing;
• bgp - removed "save-to" from "resend" command;
• bgp-vpn - fixed blackhole route export;
• bridge - added ARP inspection and IP source guard support;
• certificate - always use all trust stores for downloaded CRL validation;
• certificate - general improvements in certificate handling;
• console - fixed argument mappings in "do" block for monitor commands;
• console - fixed missing comments in scripts (introduced in v7.24beta1);
• console - fixed proplist order in monitor commands;
• console - fixed quoted input issues for multi-argument properties;
• console - fixed UTF-8 comparisons on some architectures;
• console - improved "print detail" mode;
• console - make execute non-blocking when file parameter is used (introduced in v7.24beta1);
• container - fixed missing config.json issue when upgrading from version 7.20.8 or older;
• defconf - set "configuration.dtim-period=3" for WiFi;
• defconf - use "add-dns-entries=yes" on devices with DHCP server;
• dhcp - fixed processing of DHCP options that are longer than 255 bytes;
• discovery - added "discovery" logging topic (additional fixes);
• discovery - added "last-breath" feature;
• disk - added "last-seen" property that displays disk model and serial when removed;
• disk - added error message when disk state transitions from good to bad;
• disk - avoid reading SCSI stats all the time to allow disks to go to sleep;
• disk - improved error message when a swap file is created without "file-size" specified;
• ethernet - removed "1G-baseT-half" link mode on RTL8367 switch;
• fetch - added option to force HTTP/2 only (only for ARM64 and x86/CHR devices);
• interface - fixed duplicate MAC warning for wireless, wifi, macsec, w60g interfaces (introduced in v7.23);
• ip-service - show service name for "l2tp";
• ipsec,ike2 - fixed active connection termination;
• ipsec,ike2 - fixed SA payload validation;
• ipsec,ike2 - improved pending child SA cleanup and removal of dangling SAs during Phase 2 deletion;
• ipv6,ra - correctly process RAs advertising previously expired prefix;
• ipv6,ra - fixed prefix invalidation;
• isis - fixed missing "l2.lsp-refresh-interval" parameter;
• l2tp - allow fragmentation of large IPv6 packets;
• l3hw - added HW offloaded VRF support on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches (additional fixes);
• leds - added dark mode support for L009;
• lte - cap IPv6 prefix lifetime for ipv6-interface;
• lte - do not add extra /128 IPv6 address for ipv6-interface;
• lte - limit IPv6 prefix lifetime only when lifetime is advertised as infinity;
• lte - make modem MAC persistent for R11e-LTE6 and R11l-LTE7 modems;
• lte - remove site local DNS for ipv6-interface;
• netwatch - fixed issue where ICMP probes did not accept TTL exceeded packets when "accept-icmp-time-exceeded" was enabled;
• netwatch - increased maximum packet size to 65535;
• ospf - added missing interface parameters (additional fixes);
• ospf - allow comments on static interfaces;
• ospf - fixed interface passive flag update in WinBox;
• ospf - fixed unresolved route problem when "routing-table" setting is used;
• pimsm - make "hash-mask-length" parameter naming consistent and fixed typos;
• poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
• poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
• ppp - disable/enable modem radio state depending on ppp interface state (additional fixes);
• ppp - fixed ppp-out stability issue (additional fixes);
• ppp - improved "info" command for BG77 and BG770 modems;
• ppp - only show pin in export with "show-sensitive" flag;
• route - allow to add route with link-local destination address;
• route - fixed memory leak when flapping addresses or interfaces with routing protocols running;
• route - fixed static route flag handling by WinBox on disable;
• sftp - fixed branding package upload;
• switch - increase "ingress-rate" and "egress-rate" maximum value to 400G;
• traffic-generator - fixed injecting pcap/pcapng files on MIPSBE architecture;
• tunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22);
• vrrp - fixed stability issue when "sync-connection-tracking" is enabled;
• wifi - improved roaming/steering behavior for WiFi 7 MLO (additional fixes);
• wifi - upgraded wifi-qcom driver;
• winbox - added "Network" configuration menu for WiFi;
• winbox - added missing values to "AFI" setting under "Routing/BGP" menus;
• winbox - fixed "Connection Bytes" field under "IP/Firewall" menu;
• winbox - fixed "EC/IO" scaling for LTE interface;
• winbox - fixed empty value in "Immediate Gateway" under "IP/Routes" menu;
• winbox - fixed value unset under "MPLS/LDP Neighbor" menu;
• winbox - fixed WinBox v3 stability issue when Netinstall package is enabled (introduced in v7.24beta1);
• winbox - move "EAP" under "Security" tab for WiFi;
• winbox - show priority bits in "VLAN ID" field under "Tools/Packet Sniffer" menu;
• wireguard - fixed peer recreation on interface change;
• x86 - fixed IRQ displaying per CPU on Intel 700 series NIC;

What's new in 7.23.1 (2026-Jun-02 12:25):

• app - fixed bogus configuration export;
• app - fixed making empty directories when running configuration export;
• bgp - fixed memory leak;
• bridge - fixed stability issue when using DHCPv4 snooping;
• disk - avoid reading SCSI stats all the time to allow disks to go to sleep;
• disk - improved error message when a swap file is created without "file-size" specified;
• ethernet - fixed stability issue with TSO on Alpine CPUs;
• firewall - improved system stability;
• ipsec,ike2 - improved TSi validation to prevent modecfg address conflicts;
• ipv6 - do not disable IPv6 FastPath when Traffic Flow is enabled;
• ospf - added missing interface parameters;
• ospf - fixed unresolved route problem when "routing-table" setting is used;
• ptp - rename "smpte" to "smpte-2059";
• route - improved overall stability;
• route - removed deprecated "/routing/route/rule" menu;
• switch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs;

What's new in 7.24beta1 (2026-May-26 13:47):

*) adlist - improved service stability when adjusting adlist configuration;
*) app - added inventree, opencloud, opencloud-extended apps;
*) app - changed pmacct-netflow YAML;
*) app - use randomly generated secrets in new apps;
*) bfd - fixed delay on session print;
*) bgp - added option to add BGP VPLS created interfaces in interface-list;
*) bgp - fixed memory leak;
*) bridge - added "querier-uses-bridge-address" setting to use bridge source IP address for IGMP querier;
*) bridge - added DHCPv4 snooping IP binding table;
*) bridge - fixed local static host entries;
*) bridge - fixed stability issue when using DHCPv4 snooping;
*) bridge - improved STP bridge and port priority settings (warn when a non-compliant value is used and allow selecting a value from a list);
*) btest - added VRF support for bandwidth-test and speed-test;
*) certificate - added "acme-renew" command;
*) console - added "days" to scheduler;
*) console - added "in" and "has" operators for Array types;
*) console - added "order-by" parameter to "print" command, allowing sorting by up to three arguments in ascending or descending order;
*) console - added log tracing when scripts fail to start due to permissions;
*) console - do not terminate self-removing scripts;
*) console - fixed "print follow on-event" script runner command not showing all argument values in some cases;
*) console - fixed script import/export with empty "policy" setting;
*) console - fixed stability issue in full-screen editor;
*) console - improved script handling and error logging when running scripts from external sources (e.g. DHCP, SNMP, netwatch, hotspot);
*) console - make "mac-auth-password" sensitive in "/ip/hotspot/profile";
*) console - make "password" sensitive in "/system/package/local-update/mirror";
*) console - produce runtime errors for bad command parameters;
*) console - prompt about and offer to stop already existing serial terminal session when opening new one;
*) console - rename "address" to "available-from" in "/ip/service" (backwards compatible via deprecation);
*) console - restrict editing comments in WiFi registration table;
*) container - added "save" command;
*) container - do not allow starting with empty default DNS list and no DNS override;
*) container - do not print environment variables in log on container startup;
*) container - fixed "start-on-boot" not retrying on certain startup errors;
*) container - improved support for containers;
*) container - reduced writes to flash when running health check;
*) container - use env "TERM=xterm" if no TERM variable provided when running shell;
*) dhcpv4-relay - fixed stability issue when creating duplicate relays;
*) dhcpv4-server - do not reset "class-id" parameter when lease loses "bound" status;
*) dhcpv6-relay - fixed non-working relay when adding from WinBox;
*) dhcpv6-server - fixed invalid flag;
*) discovery - added "address6" column to default "/ip/neighbor" print view;
*) discovery - added "discovery" logging topic;
*) discovery - improved service stability when sending discovery packets on interfaces that have hundreds of IP addresses;
*) disk - added "raid-scrub-cancel" command;
*) disk - do not consider USB drives as self-encryption capable;
*) disk - fixed "smart-info" not showing information on certain storage devices;
*) disk - limited maximum swap size to be no more than 10x of device RAM;
*) ethernet - fixed stability issue with TSO on Alpine CPUs;
*) fetch - added "ip-type" parameter;
*) fetch - fixed false "bad request" response when trying to fetch URL with IPv6 address in it;
*) fetch - hint file list for "src-path" and "dst-path" parameters;
*) hardware - rename "max-power" to "manufacturer-reported-max-power";
*) iot - added LoRa keep alive logic for UDP protocol;
*) iot - added missing LoRa US radio plans;
*) iot - added Wiliot USB dongle support;
*) iot - allow maximum Modbus "timeout" property to 10 seconds;
*) iot - monitor LoRa worker state (watchdog);
*) iot - pass Wiliot certification;
*) ip-service - remove reverse-proxy for SMIPS;
*) ipsec,ike2 - improved KE generation validation during initial setup and child SA creation;
*) ipsec,ike2 - improved logging when remote ID is specified;
*) ipsec,ike2 - improved TSi validation to prevent modecfg address conflicts;
*) ipv6 - added "status" column to default "/ipv6/neighbor" print view;
*) ipv6 - do not disable IPv6 FastPath when Traffic Flow is enabled;
*) ipv6,ra - changed default "router-advertisement-route-distance" to 1;
*) ipv6,ra - use lowest value between IPv6/Pool and IPv6/ND/Prefix/Default as dynamic prefix lifetime;
*) l3hw - added HW offloaded support for VLAN interfaces created directly on Ethernet for CRS8xx series switches;
*) l3hw - added HW offloaded VRF support on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches;
*) leds - improved interface stats activity for devices with Marvell Prestera switch chip;
*) lte - fixed EC/IO scale in CLI and GUI;
*) lte - fixed EC25-EU, EG25-G traffic to 67 UDP;
*) lte - fixed third-party modems ICCID decoding for eSIM;
*) lte - improved Cinterion PLS8-E roaming;
*) lte - improved deregistration handling for AT modems;
*) lte - improved system stability when no APN specified;
*) lte - removed extra restart after firmware upgrade for EC200A-EU modem;
*) lte - report short cell ID in 3G network mode also for AT modems;
*) lte - restrict incoming calls for FG621-EU;
*) lte - show "+CME ERROR: 10" as "SIM not present";
*) lte - show "data-class" in LTE monitor instead of "access-technology" also for 5G AT modems;
*) lte - show "primary-band" instead of "earfcn" in LTE monitor also for modems without CA support;
*) lte - show RSCP and EC/IO parameter in 3G network mode for R11e-LTE6, R11l-LTE7 and FG621-EA modems;
*) mesh - fixed missing FDB entries from wireless ports;
*) mpls - added ICMP time exceeded handler for IPv6;
*) mpls - make FastPath work with expl-null;
*) netinstall - added Netinstall package;
*) netinstall - improved architecture detection;
*) netinstall-cli - added "help" parameter;
*) netinstall-cli - added "reboot" and "shutdown" flags to control reboot after installation;
*) netwatch - fixed inaccurate "rtt-stdev" value;
*) ospf - added missing interface parameters;
*) ospf - force passive for VRF interface;
*) pim - added comment for "/routing/gmp" entries;
*) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) ppp - added "MT-Address-List" to IPv6 address list when received from RADIUS and using DHCP for IPv6 configuration;
*) ppp - disable/enable modem radio state depending on PPP interface state;
*) ppp - fixed ppp-out stability issue;
*) ppp - improved OVPN underlying SSL connection management;
*) ppp - report actual network data usage statistics instead of "0" for all IPv6 RADIUS accounting parameters on accounting "Stop" packet;
*) queue - fixed "undo" command for simple queues;
*) rip - do not export authentication keys by default;
*) route - fixed potential race condition;
*) route - improved overall stability;
*) route - removed deprecated "/routing/route/rule" menu;
*) route - respect the "interface" property when pinging IPv6 addresses over ECMP;
*) sfp - fixed linking for hAP ax S and hEX S (2025) with "1G-baseX" link-mode;
*) sfp - removed unsupported "2.5G-baseX" speed on CRS312-4C+8XG and CRS326-4C+20G+2Q+;
*) sms - added some GSM7 symbols to SMS tool;
*) ssh - added mlkem768x25519-sha256 key exchange support;
*) ssh - do not attempt automatic empty password login when RADIUS is used;
*) ssh - fixed SSH tunnel with IPv6 link-local address on non-ethernet interfaces;
*) ssh - make SSH packet validation more strict;
*) supout - added interface monitor-traffic;
*) switch - fixed IEEE reserved MAC handling for CRS1xx, CRS2xx switches;
*) switch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs;
*) system - rename "factory-software" to "minimum-version" and "factory-firmware" to "minimum-firmware";
*) system - restrict RouterOS processes using swap;
*) system - show who is using "/system serial-terminal";
*) vpls - added transmit loop detection;
*) vrrp - added "v3-checksum-as-v2" setting;
*) vxlan - fixed missing L2MTU property when VRF is specified;
*) vxlan - ignore disabled interfaces when checking for configuration conflicts;
*) webfig - fixed issue with increasing keep-alive traffic;
*) webfig - improved underlying encryption and stability processing;
*) webfig - improvements to graphs;
*) wifi - added "Preamble Puncturing" under "WiFi/Channel" menu;
*) wifi - added dash when CAPsMAN generates interface name and prefix ends with digit;
*) wifi - improved regulatory compliance;
*) wifi - improved roaming/steering behavior for WiFi 7 MLO;
*) wifi - improved stability;
*) wifi - improved station-bridge mode;
*) wifi-mediatek - fixed broken interfaces on startup;
*) wifi-mediatek - fixed some channel definitions for certain countries;
*) winbox - added "Preferred Architecture" setting for L009;
*) winbox - added "SIM PIN" under "Tools/SMS";
*) winbox - fixed "Use Ipsec" and "Ipsec Secret" under "Interfaces/L2TP Ether" menu;
*) winbox - fixed sort for "Address List" under "IPv6/Firewall" menu;
*) winbox - make LoRa "Auth key" and MQTT "Password" sensitive;
*) winbox - show "Any. Port" column by default under "IP/Firewall" menu;
*) winbox - show preferred and valid lifetime of IPv6 address also on static IPs;

What's new in 7.23 (2026-May-25 12:05):

!) upgrade - use HTTPS by default when connecting to MikroTik upgrade servers;
*) app - added "network-outgoing-access=yes/no" setting to prevent containers from initiating outbound traffic;
*) app - added birdnet-go, cryptpad, diagrams-net, lorawan-stack, metube, mikrodash, nextcloud-whiteboard, paperless-ngx, wbo, zulip apps;
*) app - added docker-with-dockge, docker-with-komodo, docker-with-portainer, HA-otbr-matter, odoo, otbr, stalwart, trip apps;
*) app - added possibility to set app command-line parameter from CLI;
*) app - added restart command;
*) app - allow apps on XFS file systems;
*) app - allow filtering by installed apps;
*) app - allow overriding default stop signal;
*) app - allow parsing DNS in YAML;
*) app - allow passing stop signal from YAML and passing it to container as default;
*) app - allow picking app category from drop-down;
*) app - allow updating name parameter from YAML for custom apps;
*) app - allow updating YAML for existing custom app, forces cleanup;
*) app - apps now check for port availability, apps will not start on "internal" if app masks existing service;
*) app - automatically pass any required devices to container, such as otbr;
*) app - automatically restart app when required hardware device is changed;
*) app - bundled ollama with openwebui;
*) app - check if certificate already exists before creating a new one;
*) app - disabled PiHole syncing NTP to host;
*) app - fixed issue where XFS disks did not appear in the app disk drop-down;
*) app - fixed saving custom apps;
*) app - fixed showing ui-url for apps;
*) app - fixed some apps not containing the full repository URL;
*) app - fixed stability issue when running cleanup on many apps;
*) app - fixed store issue when adding a custom app;
*) app - fixed YAML not exported for custom apps;
*) app - improved app network and port behavior;
*) app - improved automatic hardware device passing to container;
*) app - improved YAML error message;
*) app - make sure all layer .tar.gz files are deleted after extraction finishes;
*) app - on file-based devices, swap is enabled on the file itself instead of creating another and enabling it on that;
*) app - stability fixes for the "/app" menu;
*) app - swap file is now created based on the mount-point it is attached to;
*) app - updated uptime-kuma image;
*) arm64,x86 - updated Broadcom bnxt Ethernet driver for 200G support;
*) bfd - fixed source address selection for IPv6 multihop sessions;
*) bridge - added ability to set custom Option 82 with dhcp-agent-circuit-id, dhcp-agent-remote-id settings (replaces add-dhcp-option82 setting; configuration is automatically updated after upgrade);
*) bridge - added DHCPv6 snooping feature with ability to set custom Option 18 and Option 37;
*) bridge - fixed dynamic VLAN update for WiFi interfaces;
*) bridge - improved MAC synchronization for MLAG;
*) bridge - recognize more DHCP message types when dhcp-snooping is enabled;
*) bth - fixed WireGuard client config IP address netmask;
*) certificate - added "ISRG Root X1" and "DigiCert Global Root G2" to SMIPS built-in root certificate authorities store;
*) certificate - allow deleting ACME certificate that failed to generate;
*) certificate - improved ACME logging;
*) certificate - improved ACME status reporting;
*) certificate - set Let's Encrypt as default ACME directory;
*) chr - improved guest tool config for arm64 CHR;
*) cloud - cloud backup file management now requires "policy" policy;
*) cloud - show error if cloud services are not supported on the device;
*) console - added comment in "/ip/dhcp-server/option/sets" and "/ipv6/dhcp-server/option/sets" menus;
*) console - added path parameter to export;
*) console - added syntax highlight for script properties in some menus (e.g. dhcp-client, dhcp-server, ppp/profile, interface/vrrp);
*) console - export mentions custom defconf script presence in header;
*) console - fixed "/log/print follow on-event" to work with "where" (introduced in v7.22);
*) console - fixed output when oversized completion present;
*) console - removed redundant keepalive for the serial-terminal, ensure that the device no longer periodically outputs /0 while using "/system/serial-terminal";
*) console - show "/system/resource/hardware/usb-power-reset" only on x86;
*) console - show warning in print header when terminal is too narrow to show any columns;
*) console - treat non-existent command parameters as runtime errors;
*) container - added restart-policy=no/always/on-failure, stop-on-unhealthy, restart-count, restart-interval, restart-max-count properties;
*) container - added support for noexec option to mounts;
*) container - added support for USB audio devices for containers;
*) container - allow disabling individual container environment variables without deleting them;
*) container - allow picking mount source directories with the file picker in WinBox;
*) container - allow setting memory-max globally and per container;
*) container - allow user-defined mounts overriding /sys and /dev;
*) container - check if root-dir does not exist before adding a container;
*) container - clean up layers of non-existing containers;
*) container - detect and show containers killed by out-of-memory killer;
*) container - do not allow starting container/shell with non-existing user or group;
*) container - draw graphs in container stats;
*) container - fixed container entrypoint and shell override by user;
*) container - fixed container layer size calculation;
*) container - fixed container shell not working with multi-arg commands;
*) container - fixed repull if root-dir of container was in tmpfs;
*) container - fixed running "/container shell" with the correct user, if container user is set or overridden;
*) container - improved errors at container start;
*) container - improved running container instance memory usage;
*) container - layers are now accessible under "Layers" tab;
*) container - pass any container startup error message back to "run" and make it exit immediately;
*) container - remove container backup directory if import fails;
*) container - removed "Layers" button;
*) container - show container size and container data size;
*) container - show default DNS servers;
*) container - show layer size calculation status;
*) container - updated /dev/net/tun permissions;
*) crypto - fixed fallback flag loss in qcrypto;
*) crypto - fixed stability issue;
*) crypto - improved safexcel driver with upstream changes and patches;
*) dhcpv4-server - added "add-dns-entries" and "add-dns-entries-suffix" properties for creating local DNS entries;
*) dhcpv4-server - changed lease agent-circuit-id and agent-remote-id format to hex;
*) dhcpv4-server - do not raise an alert when receiving a packet originating from the same device;
*) dhcpv4-server - do not suggest bogus pools when using setup command (e.g. when address is /31 or /32);
*) dhcpv4-server - fixed an issue where renew packets without giaddr were sometimes not processed;
*) discovery - added "add-dns-entries" and "add-dns-entries-suffix" properties for creating local DNS entries;
*) discovery - added option to disable/enable LLDP MED;
*) discovery - added separate read-only menu "/ip/neighbor/lldp" for neighbors discovered by LLDP (CLI only);
*) discovery - dynamically update advertised "interface-name";
*) discovery - fixed LLDP MAC/PHY TLV;
*) disk - added "/disk" smart-info;
*) disk - added disk check and repair for ext4, Btrfs and XFS file systems;
*) disk - improved device name tracking in "/system/resource/hardware" menu;
*) disk - show disk io errors in "/disk" menu;
*) dns - added HTTP/2 support to DoH on ARM64 and x86/CHR devices;
*) ethernet - improved system stability for RB3011, L009, NetMetal ax, hAP ax lite devices;
*) ethernet - improved system stability on devices with Alpine CPUs;
*) fetch - fixed non-working idle-timeout in some cases;
*) file - added copy, tail, head commands (CLI only);
*) firewall - added "action=drop" to mangle;
*) firewall - improved stability for SIP helper;
*) firewall - matcher "in-bridge-port" does not require "use-ip-firewall=yes";
*) graphing - improved service stability when storing data;
*) hardware - report the correct state of PCI devices in "/system/resource/hardware" menu;
*) health - hide health menu for RB951ui-2nD;
*) ike2 - fixed child SA cleanup during flush operation;
*) ike2 - fixed pending responder connection cleanup after peer removal;
*) ike2 - fixed SA delete handling on initiator during rekey;
*) ike2 - improved HMAC size validation checks;
*) interface - show warning when same MAC address is used on more than one virtual interface;
*) iot - added LoRa Tx delay setting;
*) iot - added MQTT subscribe message real-time monitoring option;
*) iot - added Wiliot support;
*) iot - fixed LoRa LBT issues, which caused Tx packets not getting delivered;
*) iot - fixed LoRa lockpack preventing lock from applying;
*) iot - improved LoRa stability;
*) iot - improved LoRa Tx handling;
*) iot - improved LoRa Tx scheduling;
*) ip - added IPv6 and VRF support for reverse-proxy;
*) ip - added SNI logging for reverse-proxy;
*) ip - fixed hanging connections for reverse-proxy;
*) ip-settings - added ipv4-fragment-time and ipv4-high-fragment-thresh settings, use default values based on total device memory;
*) ipip - disabled IPv6 link-local address generation;
*) ippool - fixed issue when changing pool with already used addresses;
*) ippool6 - allow variable length pool;
*) ippool6 - properly follow pool changes for already used prefixes;
*) ipsec - added netlink-based SA and policy handling;
*) ipsec - fixed SA proto parameter conversion and policy "none" type handling;
*) ipsec - improved NAT encapsulation parameter forwarding;
*) ipsec – fixed expired SA handling to prevent “no such item” errors during listing;
*) ipv6 - added from-pool-policy address property that controls how address is acquired from the pool;
*) ipv6 - added without-acquire address property;
*) ipv6 - always ensure that prefix length matches the one given by the pool even if address was set to 0;
*) ipv6,ra - added option to ignore MTU and DNS servers;
*) ipv6,ra - added router-advertisement-route-distance setting;
*) ipv6,ra - allow receiving DNS servers over multiple interfaces;
*) ipv6,ra - clamp valid-lifetime to minimum of 2h on deprecation;
*) ipv6,ra - extend processed RA logging;
*) ipv6,ra - fixed advertised DNS parameter logging;
*) ipv6,ra - fixed changing default "all" interface configuration;
*) ipv6,ra - fixed DNS and pref64 property unset;
*) ipv6,ra - fixed sending only DNS or MTU when prefix is set to "none";
*) ipv6,ra - improved service stability;
*) ipv6,ra - warn when interface is under the bridge;
*) isis - allow to configure metric-type;
*) l3hw - added HW offloaded VRF support on CRS8xx switches;
*) l3hw - added VRF assignment via switch ACL rules on CRS8xx switches (CLI only);
*) l3hw - fixed VXLAN packet matching by local IP;
*) leds - added new PoE fault LED cases (bad fw, PoE card power cable disconnected, PoE card not inserted);
*) leds - fixed power LED turning off while LTE interface is inactive (introduced in v7.22);
*) log - added "discover" topic and log events for discovered local DNS entries;
*) log - added CC option for e-mail action;
*) log - added ssld error logging;
*) log - added TLS support;
*) lte - added fast SIM switchover support using AT channel for MBIM modems without MBIM_CID_MS_UICC_RESET firmware support;
*) lte - configure IP address for AT modems even if no DNS is received from the network;
*) lte - delete CID profiles one by one instead of "delete all" for QMI modems, as command does not work for all modems;
*) lte - do not duplicate primary-band also in ca-band for QMI modems in 5G SA network;
*) lte - do not reconfigure modem in passthrough mode if passthrough cannot be activated because of slave interface;
*) lte - emit RS every 60s on LTE interface;
*) lte - filter packets by MAC in multi-apn setup for EC200A-EU modem;
*) lte - fixed automatic modeswitch for "Chateau 5G R16" and "Chateau 5G";
*) lte - fixed broken network scan after being interrupted by reconfiguration;
*) lte - fixed operator setting for QMI modems;
*) lte - fixed rare cases where the Tx queue could stop and never wake up on multi-core CPU devices;
*) lte - fixed RSSI signal monitor for 3rd party modems where AT+CSQ responses are not parsed;
*) lte - fixed user set MTU not applied to LTE interface;
*) lte - improved system stability for devices with QMI modems;
*) lte - improved system stability when modem configured in passthrough mode with VLANs for "Chateau 5G R16" and "Chateau 5G";
*) lte - improved system stability;
*) lte - improvements for passthrough mode in IPv6 only setup;
*) lte - keep MAC persistent across reboots for QMI modems;
*) lte - read subscriber number also for QMI modems;
*) lte - removed LTE external-antenna scan;
*) lte - set SMS send timeout to 180s;
*) lte - show external-antenna as "none" before actual scan is done instead of empty value;
*) lte - show MTU as "auto" also on interface level if "auto" used;
*) lte - SIMCom modems, skip error state when modem sends improperly formatted CREG response/URC;
*) lte - stop network scan on interruption for QMI modems;
*) lte - unify "modem-init" for all driver types;
*) macsec - added aes-gcm-xpn-128 cipher support;
*) netwatch - fixed memory leak when using HTTP/HTTPS GET probe with invalid src-address;
*) ospf - allow adding interface configuration manually, bypassing interface-template;
*) ospf - change virtual link configuration to use OSPF interface directly;
*) ospf - fixed missing interface-template configuration which previously was converted by upgrading from RouterOS v6;
*) ospf - fixed nssa bit check;
*) ospf - fixed routes not being installed on ABRs;
*) pimsm - do not ignore priority when selecting RP from BSR;
*) pimsm - fixed possible BSR loop;
*) pimsm - improved stability;
*) ping - resolve domain name to IPv6 if src-address is IPv6 address;
*) ping - show time in microseconds for flood-ping;
*) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) port - added support for "tcp-client" and "udp" modes for "remote-access";
*) port - expose RG650E-EU diagnostics channel;
*) port - remove unused serial port on RB1100AHx4;
*) pppoe - do not reset pppoe-client interface when adding a comment;
*) ptp - added support for CRS812, CRS804;
*) ptp - fixed crash during initialization on some devices;
*) qos-hw - added automap setting to QoS Profiles (enabled by default);
*) qos-hw - added ECN and PFC support on CRS8xx;
*) qos-hw - added new default "auto" value to mirror-buffers, multicast-buffers, shared-buffers QoS Settings (old defaults are shown in export after upgrade);
*) qos-hw - added queueX-byte-max stats to port usage on CRS8xx;
*) qos-hw - fixed CPU traffic mapping to queues on CRS8xx switches;
*) qos-hw - introduced lossless-traffic-class and lossless-buffers settings;
*) qos-hw - removed shared-pool-index setting;
*) route - fixed link-local interface check when resolving IPv6 nexthops;
*) route - revert to old routing rule priorities for containers (introduced in v7.22);
*) routerboot - fixed Netinstall failure when using multiple partitions on AL73400, AL52400, AL32400 CPUs ("/system routerboard upgrade" required);
*) sftp - fixed path canonicalization request;
*) smb - do not start /ip smb server on container interfaces;
*) sniffer - added IP ECN field;
*) sniffer - fixed missing VLAN tag in the TZSP packets;
*) snmp - added missing BRIDGE-MIB OIDs (dot1dBaseNumPorts, dot1dBaseType, dot1dStpDesignatedRoot, dot1dStpPortDesignatedBridge, dot1dStpRootCost, dot1dStpRootPort, dot1dStpHoldTime, dot1dStpBridgeMaxAge, dot1dStpBridgeHelloTime, dot1dStpBridgeForwardDelay, dot1dStpPortForwardTransitions, dot1dTpAgingTime);
*) snmp - added missing LLDP-MIB OIDs (lldpMessageTxInterval, lldpMessageTxHoldMultiplier, lldpLocManAddrTable);
*) snmp - enforce minimum password length;
*) snmp - fixed compliance of LLDP-MIB lldpRemManAddrTable;
*) snmp - fixed connection tracking counter OID;
*) snmp - fixed dot1dStpPortDesignatedPort, dot1dStpPortDesignatedRoot OIDs;
*) snmp - fixed ifSpeed and ifHighSpeed OIDs for 802.3ad and balance-xor bonding interfaces;
*) snmp - fixed lldpLocSysDesc OID;
*) snmp - implemented LTE firmware upgrade option;
*) snmp - use "/ip/neighbor/lldp" for lldpRemTable and lldpRemManAddrTable (fixes lldpRemTable showing neighbors discovered by MNCP or CDP);
*) ssh - do not advertise password login method when it is disabled;
*) ssh - improved host resolve error logging;
*) switch - fixed issue with MAC table for RB2011 (introduced in v7.21);
*) switch - fixed missing ethernet counters for non-running interfaces on CRS8xx switches (introduced in v7.22);
*) switch - improved FDB operations on QCA8337, Atheros8327;
*) switch - rework how IEEE reserved MAC addresses are handled on QCA8337, Atheros8327;
*) switch - updated switch-marvell.npk driver;
*) switch - use names instead of numbers in switch menu configuration export;
*) system - improved handling of HTTP/2 connection closure;
*) system - improved RouterOS package download over slow connection;
*) system - improved switching to HTTP/1 if HTTP/2 is not supported by remote host;
*) system - keep HTTP/2 connection open if it is not closed by system or server;
*) system - make default identity based on board name;
*) timezone - updated timezone information from "tzdata2026b" release;
*) upgrade - added the option to configure HTTP/HTTPS modes when connecting to MikroTik upgrade servers;
*) upgrade - changed status message for scheduled installs;
*) upgrade - check for available packages when opening System/Packages in GUI;
*) usb - added ax88179_178a driver;
*) usb - improved USB Ethernet adapter recognition;
*) usb - show USB device reported maximum power;
*) user-manager - improved stability when removing user-profile while session updates counters;
*) veth - fixed link-local address not being configurable as a gateway;
*) vxlan - fixed fast-path when using "checksum=no" (introduced in v7.20);
*) vxlan - improved system stability;
*) webfig - added postfix byte value support (e.g. "/ip/settings/ipv4-high-fragment-thresh");
*) webfig - added support for filter in tables;
*) wifi - improved interface provisioning for WiFi 7 access points;
*) wifi - improved on-capsman traffic processing;
*) wifi-mediatek - fixed multicast-enhance functionality;
*) wifi-mediatek - fixed stability issue getting regulatory information and during initialization;
*) wifi-qcom-be - fixed incorrect channel info for punctured channels;
*) wifi-qcom-be - fixed stability issue during initialization;
*) wifi-qcom-be,mediatek - correctly advertise RRM capabilities when 802.11k neighbor reports are enabled;
*) winbox - added "MLD Static" and "MLD Datapath" properties under the "WiFi/CAP" menu;
*) winbox - added "Multipath" property under the "Routing/BGP/Instance" menu;
*) winbox - added “Remove” action under "System/Certificates/Requests" menu;
*) winbox - added comment for DHCPv6 relay;
*) winbox - added group numbers for DH and PFS groups for IPsec;
*) winbox - allow setting "CAPsMAN address" for CAP as domain name;
*) winbox - do not accept interface without specifying IP or MAC in "Ping To" field;
*) winbox - improved "External Antenna" property display;
*) winbox - improved Routing/PIM SM menu;
*) winbox - move bridge IGMP Snooping checkbox to IGMP tab;
*) winbox - rename DHCPv6 server binding "Peer Address" to "Client Address";
*) winbox - show "Directory URL" field for ACME certificates in Certificate view;
*) winbox - show "IPv6 Address" property by default under the "IP/Neighbors" menu;
*) winbox - show accepted connections in tree view under "IP/Services" menu;
*) winbox - updated socksify icon for firewall NAT rules;
*) wireguard - improved system stability;
*) www - added partial content (HTTP 206) support;
*) www - improved REST API user cache processing;
*) www - improved system stability;
*) zerotier - switch to 1.14.2 version;

Sometimes you don't have to buy a single-board computer or a single-board MCU... You might be able to take reading from sensors and control relays straight from RouterOS!

Read more about GPIO here:
https://help.mikrotik.com/docs/spaces/ROS/pages/68944101/GPIO
https://help.mikrotik.com/docs/spaces/UM/pages/366477381/KNOT+Embedded+LTE4+EC25-EU+KNe
https://help.mikrotik.com/docs/spaces/UM/pages/41680915/RB924i-2nD-BT5+BG77
https://help.mikrotik.com/docs/spaces/UM/pages/14222434/RBM33G

https://tiktube.com/w/tozYQPUMQ3hwGDDgwzPYPW

What's new in 7.23rc4 (2026-May-22 10:53):

*) app - added "network-outgoing-access=yes/no" setting to prevent containers from initiating outbound traffic;
*) bridge - fixed dynamic VLAN update for WiFi interfaces;
*) bridge - improved MAC synchronization for MLAG (additional fixes);
*) certificate - improved ACME logging (additional fixes);
*) certificate - improved ACME status reporting (additional fixes);
*) cloud - cloud backup file management now requires "policy" policy;
*) container - updated /dev/net/tun permission;
*) crypto - fixed stability issue;
*) dhcpv4-server - added "add-dns-entries" and "add-dns-entries-suffix" properties for creating local DNS entries (additional fixes);
*) discovery - added "add-dns-entries" and "add-dns-entries-suffix" properties for creating local DNS entries (additional fixes);
*) firewall - added "action=drop" to mangle;
*) firewall - matcher "in-bridge-port" does not require "use-ip-firewall=yes";
*) ike2 - fixed child SA cleanup during flush operation;
*) ike2 - fixed pending responder connection cleanup after peer removal;
*) ike2 - fixed SA delete handling on initiator during rekey;
*) ike2 - improved HMAC size validation checks;
*) iot - fixed LoRa lockpack preventing lock from applying;
*) ipv6,ra - improved service stability (additional fixes);
*) isis - allow to configure metric-type;
*) leds - fixed power LED turning off while LTE interface is inactive (introduced in v7.22);
*) lte - fixed rare cases where the Tx queue could stop and never wake up on multi-core CPU devices;
*) switch - fixed issue with MAC table for RB2011 (introduced in v7.21);
*) switch - fixed missing ethernet counters for non-running interfaces on CRS8xx switches (introduced in v7.22);
*) system - improved switching to HTTP/1 if HTTP/2 is not supported by remote host (additional fixes);
*) timezone - updated timezone information from "tzdata2026b" release;
*) vrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge (additional fixes);
*) vxlan - fixed fast-path when using "checksum=no" (introduced in v7.20);
*) wifi - improved on-capsman traffic processing;
*) www - improved REST API user cache processing;
*) www - properly respond with custom HTTP response code instead of replying always with 200 (introduced in v7.23rc1);

What's new in 7.22.3 (2026-May-07 12:19):

*) console - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal;
*) ethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22);
*) vrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip;

What's new in 7.23rc3 (2026-May-06 19:26):

*) console - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal;
*) discovery - added separate read-only menu "/ip/neighbor/lldp" for neighbors discovered by the LLDP (CLI only) (additional fixes);
*) ethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22);
*) ip - added IPv6 and VRF support for reverse-proxy;
*) netwatch - fixed memory leak when using HTTP/HTTPS GET probe with invalid src-address;
*) sniffer - fixed missing VLAN tag in the TZSP packets (additional fixes);
*) system - improved switching to HTTP/1 if HTTP/2 is not supported by remote host;
*) upgrade - added the option to configure HTTP/HTTPS modes when connecting to MikroTik upgrade servers (additional fixes);
*) vrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip;
*) wifi - improved interface provisioning for WiFi 7 access points;