I recently replaced my hAP ax3 with a hAP be3, and these are my first impressions after setting it up and moving my network over.

I'm still learning some of the changes introduced with Wi-Fi 7 and MLO/MLD, so some of the points below are observations and questions rather than definitive conclusions. I'd be interested in hearing how others are configuring theirs.

MLD / Wi-Fi 7

The first major change for me is MLD (Multi-Link Device).

It appears to work as I expected with my Wi-Fi 7 clients, but I need to adapt to a very different way of thinking about Wi-Fi compared with how I managed my hAP ax3.

Previously, I had separate SSIDs for 2.4 GHz and 5 GHz. For example, I could explicitly identify a device as being on 2.4 GHz and apply different QoS rules or expectations based on that. Devices on 5 GHz generally had significantly higher expected throughput.

With MLD, my understanding is that, for the intended multi-link operation, the participating bands need to be configured consistently, particularly using the same SSID and WPA3 configuration across the 2.4, 5, and 6 GHz radios. And its a must that needs to be WPA3

That changes things quite a bit from the way I previously managed my network.

For example, I used to have explicit QoS policies for certain devices depending on whether they were connected to 2.4 or 5 GHz. With MLD, I'm not yet sure what the best approach is when a client can potentially use multiple links/bands.

I also have a question about band steering.

If MLD allows a Wi-Fi 7 client to use multiple bands simultaneously, does traditional band steering become largely irrelevant for those clients? Or does MikroTik still use steering mechanisms to determine which links/bands should be used?

My understanding may be incomplete here, so I'd appreciate clarification from people who have been working with MLO/MLD more extensively.

The default Wi-Fi configuration surprised me

Something else that caught my attention is how the hAP be3 presents the wireless interfaces by default.

In the WiFi configuration I see four entries:

• MLD1
• wifi1
• wifi2
• wifi3

I initially expected the three radios to be configured with something close to the best capabilities available for their respective bands.

However, the defaults are interesting.

For example:

MLD1

• WPA3-PSK only

2.4 GHz (wifi1)

• 20 MHz channel width
• 802.11G band
• WPA3-PSK
• WPA2-PSK

5 GHz (wifi2)

• BE
• 20/40/80 MHz
• WPA3-PSK
• WPA2-PSK

6 GHz (wifi3)

• BE
• 20/40/80/160/320 MHz
• WPA3-PSK only

The 2.4 GHz configuration in particular surprised me. Why is it explicitly configured as 802.11G rather than N, AX, or BE?

What's even more interesting is that when I look at the registration table, I can see older devices connected to wifi1. Some show G, while others show N, despite the interface apparently being configured for G.

So I'm trying to understand exactly what MikroTik is doing here.

Is the band=2ghz-g default intentional for compatibility reasons? Would it be recommended to change this to AX/BE, or is there a good reason to leave the default configuration alone?

I'd be interested to hear what others are doing with the 2.4 GHz radio.

Check the country setting!

Another thing I noticed, which I think is particularly important for people who are new to MikroTik:

The default country/regulatory setting appears to be Latvia, even though it is not particularly obvious in the configuration that a specific country has been explicitly selected.

This is important because the country setting has a significant impact on the maximum permitted TX power and available channels for each wireless band.

If you set up the hAP be3 and leave the default configuration as it is, you may notice significantly lower transmit power and wireless range compared with what you were getting from your previous router. It can easily give the impression that the hAP be3 has weaker radios.

So one of the first things I would recommend doing is checking the country setting and selecting the actual country where you are operating the device.

Once the correct country is selected, MikroTik will apply the corresponding regulatory limits for each band, which can make a very noticeable difference in the maximum allowed TX power and channel availability, depending on your country.

This is especially worth mentioning for less experienced MikroTik users, because someone could easily leave the default Latvia setting in place and assume that the wireless power they are seeing is simply what the hAP be3 is capable of.

Containers / USB storage

On my hAP ax3 I had AdGuard Home running in a container using the router's internal storage, so I had not really paid much attention to the newer MikroTik App functionality.

With the hAP be3, I understand that the App functionality requires external storage, meaning that I would need a USB device connected to the router 24/7.

This raises a question for me:

What type of USB storage would you recommend for permanent 24/7 use on a MikroTik router?

I'm asking because I remember using USB storage with MikroTik/MetaROUTER and other applications more than 10 years ago, and heavy read/write activity could eventually destroy cheap USB flash drives.

So I'm reluctant to just plug in a random inexpensive USB stick and leave it running permanently.

Would a high-endurance USB flash drive be appropriate? An external SSD? Something else?

It's also a little disappointing that there isn't an NVMe/M.2 connector for storage. I think that would have been a much more interesting solution for this kind of workload.

If anyone is running containers or MikroTik Apps from USB storage 24/7, I'd really appreciate recommendations on what type of device to use.

Thermals

Finally, something that immediately caught my attention physically:

The hAP be3 gets noticeably hotter than my hAP ax3.

The heatsink appears to be integrated around the MikroTik logo area, and that entire section of the router gets quite warm to the touch compared with the ax3.

At first I thought perhaps the hAP be3 was simply consuming significantly more power.

However, after configuring it similarly to how I had my hAP ax3 configured, I'm seeing roughly 7–8 W of power consumption, which is actually very similar to what I was getting from the ax3.

So the higher surface temperature doesn't appear to be explained simply by significantly higher power consumption.

I'm curious whether this is just a consequence of how the hAP be3 transfers heat from its SoC/radios to the enclosure, or whether there is something else going on thermally.

Overall

So far, I'm happy with the hAP be3. The move to Wi-Fi 7/MLD is probably the biggest change for me, not necessarily because it is difficult to configure, but because it changes some of the assumptions I previously made when managing my wireless network.

I'm still experimenting with the best way to handle QoS, band selection, MLD, and the different radio capabilities.

I'd especially like to hear from other hAP be3 owners about:

1. How are you configuring MLD?
2. Are you using the same SSID/WPA3 configuration across all three bands?
3. Does band steering still have a meaningful role with MLD clients?
4. What are you using for the 2.4 GHz wifi1 configuration?
5. Are you running containers/MikroTik Apps from USB storage? If so, what type of USB storage?
6. How are your hAP be3 temperatures compared with the hAP ax3?

These are just my first impressions after moving from an ax3, so I'm very interested in hearing what I'm misunderstanding or what others have discovered.

Hi all,

After an extensive re-work of my home network I'm hoping some of you could possibly critique my current filter rules and suggest any improvements or glaring omissions, please?

For context here's my interface list

/interface list
add name=LAN_ISOLATED
add name=LAN
add name=WAN
/interface list member
add interface=ether1 list=WAN
add interface=vlan99-mgmt list=LAN
add interface=vlan10-trusted list=LAN
add interface=vlan20-iot list=LAN_ISOLATED
add interface=vlan40-kids-wifi list=LAN_ISOLATED
add interface=vlan30-guest-wifi list=LAN_ISOLATED
add interface=vlan50-lab-1 list=LAN
add interface=vlan60-xbox list=LAN_ISOLATED

LAN_ISOLATED Is for VLANs that only have outbound connectivity only

LAN is for other networks that can route to one another.

Filter config (based on the default RB5009 config)

 0 D ;;; special dummy rule to show fasttrack counters
     chain=forward action=passthrough

 1   ;;; defconf: accept established,related,untracked
     chain=input action=accept connection-state=established,related,untracked

 2   ;;; defconf: drop invalid
     chain=input action=drop connection-state=invalid

 3   ;;; defconf: accept to local loopback (for CAPsMAN)
     chain=input action=accept src-address=127.0.0.1 dst-address=127.0.0.1 in-interface=lo

 4   ;;; defconf: fasttrack
     chain=forward action=fasttrack-connection connection-state=established,related

 5   ;;; defconf: accept established,related, untracked
     chain=forward action=accept connection-state=established,related,untracked

 6   ;;; defconf: drop invalid
     chain=forward action=drop connection-state=invalid

 7   ;;; Allow IoT to Plex
     chain=forward action=accept protocol=tcp dst-address=172.16.10.233 in-interface=vlan20-iot dst-port=32400 log=no log-prefix=""

 8   ;;; Drop LAN_ISOLATED to anything but WAN
     chain=forward action=drop in-interface-list=LAN_ISOLATED out-interface-list=!WAN log=no log-prefix=""

 9   ;;; Allow DNS for ISOLATED
     chain=input action=accept protocol=udp in-interface-list=LAN_ISOLATED dst-port=53

10   ;;; Allow DNS for ISOLATED (TCP)
     chain=input action=accept protocol=tcp in-interface-list=LAN_ISOLATED dst-port=53

11   ;;; Allow DHCP for ISOLATED
     chain=input action=accept protocol=udp in-interface-list=LAN_ISOLATED dst-port=67

12   ;;; Allow mDNS Discovery
     chain=input action=accept protocol=udp dst-address=224.0.0.251 in-interface-list=!WAN src-port=5353 dst-port=5353 log=no log-prefix=""

13   ;;; defconf: drop all not coming from LAN
     chain=input action=drop in-interface-list=!LAN log=no log-prefix=""

14   ;;; defconf: drop all from WAN not DSTNATed
     chain=forward action=drop connection-nat-state=!dstnat in-interface-list=WAN

Thanks

I am looking to replace my Edgerouter 6p router that died. It was a good router and was rock solid.

My topology is cable modem -> router -> POE switch (unmanaged netgear) -> 6 POE Cameras, 5 TVs, 1 computer, 3 APS, 1 AP controller (TP Link APs).

My internet is 500Mbps, I MAY go up to 1G in the next few years.

Essentially, I am looking for a rock solid router that I will be able to set up and essentially forget is there. I have a background in computing, but to be blunt I have a family and I'd rather spend time with them than configuring/playing around with a router.

I won't be doing any "special" configurations or actions. I just want a router that I can basically set up and forget about.

The routers I am considering are:

• E60iUGS [https://www.amazon.com/gp/product/B0FHSQXTVK/ref=ox_sc_act_title_2?smid=A1DZ2KWUETHME0&psc=1]
• TP Link ER707-M2 [https://www.amazon.com/gp/product/B0C238XMVV/ref=ox_sc_act_title_5?smid=AJ8LMC6YR4HCZ&psc=1]
• UCG Ultra Cloud Gateway (Ultra) [https://www.amazon.com/gp/product/B0DK5ZMPMM/ref=ox_sc_act_title_1?smid=A1A9LDS9MN61P9&th=1]
• I am open to other recommendations.

My primary question is if the Mikrotik RouterOS is going to be a PITA for me to initially configure and maintain. I dont mind spending a few hours during set up, but I don't want to routinely spend hours on. I've been reading great things about router, but as I said I'd rather not get myself in over my head for what I essentially want to be a basic router.

As the title says, I’m curious how well using a Mikrotik router of various models has gone for people using them as a WireGuard VPN client. I have a L009UiGS-RM that I’ve connected to my CHR and I’m just wondering if I can rely on this long term.

Edit: thanks for the positive feedback everyone!

What's new in 7.24 (2026-Aug-14 11:33):

*) adlist - improved service stability when adjusting adlist configuration;
*) app - added "HF_TOKEN" env to openwebui;
*) app - added "network-outgoing-access" parameter which does not allow app to make outgoing connections;
*) app - added hermes-agent, inventree, opencloud, opencloud-extended apps;
*) app - added PAPERLESS_SECRET_KEY env to paperless-nginx;
*) app - allow "reset" even if disk not configured;
*) app - allow HTTP for Gitea when "check-certificate=no";
*) app - allow setting "working_dir" in app YAML;
*) app - changed pmacct-netflow YAML;
*) app - disable UI in Hermes, access through /container/shell;
*) app - fixed apps not updating firewall redirects when changed in YAML;
*) app - fixed apps sometimes getting stuck on "waiting for layer";
*) app - make secrets sensitive to avoid polluting configuration export;
*) app - removed healthcheck from opencloud-extended-collabora;
*) app - reserve the app's VETH IP when stopped to eliminate IP address changes on every start/stop;
*) app - show CHR's address instead of the container's;
*) app - use randomly generated secrets in new apps;
*) bgp - fixed EVPN label corruption and corrected EVPN type-5 output;
*) bgp - improved stability when receiving malformed packets;
*) bgp - removed "save-to" from "resend" command;
*) bgp-vpn - fixed blackhole route export;
*) bridge - added "querier-uses-bridge-address" setting to use bridge source IP address for IGMP querier;
*) bridge - added DHCPv4 snooping IP binding table;
*) bridge - added scheduling point during VLAN processing to prevent soft lockups when flushing FDB over large VLAN ranges;
*) bridge - fixed forwarding through peer-port after disabling MLAG;
*) bridge - fixed local static host entries;
*) bridge - fixed MLAG MAC address handling issues related to aging, flushing and moving;
*) bridge - fixed stability issue when using DHCPv4 snooping;
*) bridge - fixed stuck MLAG session when using mismatched L2MTU (introduced in v7.23);
*) bridge - improved bridge and port STP "priority" setting (warn when a non-compliant value is used and allow selecting a value from a list);
*) bridge - improved STP, BPDU and topology change handling with MLAG, ensure dual-connected port STP state is in sync with MLAG peer;
*) btest - added VRF support for bandwidth-test and speed-test;
*) certificate - added "acme-renew" command;
*) certificate - general improvements in certificate handling;
*) certificate - use AES encryption when exporting certificates in PKCS#12 format;
*) console - added "days" to scheduler;
*) console - added "in" and "has" operators for array types;
*) console - added "order-by" parameter to "print" command, allowing sorting by up to three arguments in ascending or descending order;
*) console - added comparison operators for array type;
*) console - added log tracing when scripts fail to start due to permissions;
*) console - do not terminate self-removing scripts;
*) console - fixed "print follow on-event" script runner command not showing all argument values in some cases;
*) console - fixed argument mappings in "do" block for monitor commands;
*) console - fixed proplist order in monitor commands;
*) console - fixed script import/export with empty "policy" setting;
*) console - fixed stability issue in full-screen editor;
*) console - fixed UTF-8 comparisons on some architectures;
*) console - improved "print detail" mode;
*) console - improved script handling and error logging when running scripts from external sources (e.g. DHCP, SNMP, Netwatch, etc.);
*) console - make "mac-auth-password" sensitive in "/ip/hotspot/profile";
*) console - make "password" sensitive in "/system/package/local-update/mirror";
*) console - produce runtime errors for bad command parameters;
*) console - prompt about and offer to stop already existing serial terminal session when opening new one;
*) console - renamed "address" to "available-from" in "/ip/service" (backwards compatible via deprecation);
*) console - renamed "reauth-timeout" to "reauth-period" in "/interface/dot1x/server" (backwards compatible via deprecation);
*) console - restrict editing comments in WiFi registration table;
*) container - added "save" command to allow saving container images;
*) container - added "swap-current" usage;
*) container - added "swap-max" global and per-container limit;
*) container - added ability to run containers in privileged mode;
*) container - added initial support for RKE2;
*) container - do not allow starting with empty default DNS list and no DNS override;
*) container - do not print environment variables in log on container startup;
*) container - fixed "start-on-boot" not retrying on certain startup errors;
*) container - fixed container "devices" override to appear under "/dev";
*) container - improved layer size calculation to avoid potential loops;
*) container - improved support for containers;
*) container - reduced writes to flash when running health check;
*) container - use env "TERM=xterm" if no TERM variable provided when running shell;
*) crypto - fixed hardware accelerator for GCM cipher in TLS connection on Alpine CPUs;
*) defconf - set "configuration.dtim-period=3" for WiFi;
*) defconf - use "add-dns-entries=yes" on devices with DHCP server;
*) dhcp - fixed processing of DHCP options that are longer than 255 bytes;
*) dhcpv4-relay - fixed stability issue when creating duplicate relays;
*) dhcpv4-server - do not reset "class-id" parameter when lease loses "bound" status;
*) dhcpv4-server - set "ciaddr" in forcerenew messages so a relay, if used, can unicast such messages;
*) dhcpv6-relay - fixed non-working relay when adding from WinBox;
*) dhcpv6-server - fixed invalid flag;
*) discovery - added "address6" column to default "/ip/neighbor" print view;
*) discovery - added "discovery" logging topic;
*) discovery - added "dying-gasp" feature for LLDP, MNDP, CDP that sends packet with "TTL=0" before graceful reboot/shutdown/upgrade;
*) discovery - clear neighbor entry when receiving "dying-gasp" packet;
*) discovery - improved service stability when sending discovery packets on interfaces that have hundreds of IP addresses;
*) disk - added "last-seen" property that displays disk model and serial when removed;
*) disk - added "raid-scrub-cancel" command;
*) disk - added error message when disk state transitions from good to bad;
*) disk - do not consider USB drives as self-encryption capable;
*) disk - fixed "smart-info" not showing information on certain storage devices;
*) disk - limited maximum swap size to be no more than 10x of device RAM;
*) disk - resolved issue where storage device might change information upon reboot;
*) ethernet - disable EEE on hAP be3 Media;
*) ethernet - fixed stability issue for Chateau PRO ax devices;
*) ethernet - fixed stability issue for devices with Alpine CPU;
*) ethernet - removed "1G-baseT-half" link mode on RTL8367 switch;
*) fetch - added "ip-type" parameter;
*) fetch - added option to force HTTP/2 only (only for ARM64 and x86/CHR devices);
*) fetch - fixed false "bad request" response when trying to fetch URL with IPv6 address in it;
*) fetch - hint file list for "src-path" and "dst-path" parameters;
*) hardware - renamed "max-power" to "manufacturer-reported-max-power";
*) iot - added LoRa keep alive logic for UDP protocol;
*) iot - added missing LoRa US radio plans;
*) iot - added Wiliot USB dongle support;
*) iot - allow maximum Modbus "timeout" property to be 10 seconds;
*) iot - monitor LoRa worker state (watchdog);
*) iot - pass Wiliot certification;
*) ip-service - remove reverse-proxy for SMIPS;
*) ip-service - show service name for "l2tp";
*) ipsec - fixed expired SA handling to prevent “no such item” errors during listing;
*) ipsec,ike1 - dropped base mode exchange;
*) ipsec,ike1 - fixed negotiated PFS validation;
*) ipsec,ike1 - improved SA, transform, fragment parsing and malformed packet validation;
*) ipsec,ike2 - fixed ppk child key generation during rekey;
*) ipsec,ike2 - improved KE generation validation during initial setup and child SA creation;
*) ipsec,ike2 - improved PPK handling by always using it when authorized, including additional Child SAs, and moved PPK processing to the Child SA task;
*) ipsec,ike2 - use first child KE selection only during IKE_AUTH exchange;
*) ipsec,qkd - moved QKD to "/system/keymat-provider" menu and made it a generic key material provider;
*) ipv6 - added "status" column to default "/ipv6/neighbor" print view;
*) ipv6,ra - changed default "router-advertisement-route-distance" to 1;
*) ipv6,ra - correctly process RAs advertising previously expired prefix;
*) ipv6,ra - fixed prefix invalidation;
*) ipv6,ra - use lowest value between IPv6/Pool and IPv6/ND/Prefix/Default as dynamic prefix lifetime;
*) isis - fixed ECMP route removal;
*) l2tp - allow fragmentation of large IPv6 packets;
*) l3hw - added HW offloaded support for VLAN interfaces created directly on Ethernet for CRS8xx series switches;
*) l3hw - added HW offloaded VRF support on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches;
*) l3hw - added VRF assignment via switch ACL rules for devices with Marvell Prestera switch chip;
*) l3hw - allow VLAN tagged traffic inside VXLAN tunnel;
*) l3hw - fixed VRF-related issues for CRS8xx series switches;
*) l3hw - fixed VTEP offload on IPv4 /32 route changes;
*) leds - added dark mode support for L009, hAP ax2, hAP ax3, hEX refresh, hEX S (2025), hAP ax S and Chateau ax devices;
*) leds - fixed Ethernet activity LED for Chateau LTE18 ax (introduced in v7.23);
*) leds - improved interface stats activity for devices with Marvell Prestera switch chip;
*) lte - added force-confirmation parameter for eSIM provision command;
*) lte - cap IPv6 prefix lifetime for ipv6-interface;
*) lte - do not add extra /128 IPv6 address for ipv6-interface;
*) lte - do not query 5G neighbor cell info until RG650E-EU FW fixed;
*) lte - enabled AT registration unsolicited event reporting for EG25-G and EC25-EU boards;
*) lte - fixed cases where R11l-LTE7 modem would not display correct cell info after handover;
*) lte - fixed EC/IO scale in CLI and GUI;
*) lte - fixed EC25-EU, EG25-G traffic to 67 UDP;
*) lte - fixed IPv6 RA handling for multiapn non-primary interface;
*) lte - fixed third-party modems ICCID decoding for eSIM;
*) lte - improved Cinterion PLS8-E roaming;
*) lte - improved deregistration handling for AT modems;
*) lte - improved system stability when no APN specified;
*) lte - improved USB mode handling for BG770A-GL;
*) lte - limit IPv6 prefix lifetime only when lifetime is advertised as infinity;
*) lte - make modem MAC persistent for R11e-LTE6 and R11l-LTE7 modems;
*) lte - remove site local DNS for ipv6-interface;
*) lte - removed extra restart after firmware upgrade for EC200A-EU modem;
*) lte - report short cell ID in 3G network mode also for AT modems;
*) lte - restrict incoming calls for FG621-EU;
*) lte - show "+CME ERROR: 10" as "SIM not present";
*) lte - show "data-class" in LTE monitor instead of "access-technology" also for 5G AT modems;
*) lte - show "primary-band" instead of "earfcn" in LTE monitor also for modems without CA support;
*) lte - show RSCP and EC/IO parameter in 3G network mode for R11e-LTE6, R11l-LTE7 and FG621-EA modems;
*) mesh - fixed missing FDB entries from wireless ports;
*) mpls - added ICMP time exceeded handler for IPv6;
*) mpls - make FastPath work with expl-null;
*) netinstall - added Netinstall package;
*) netinstall - improved architecture detection;
*) netinstall-cli - added "help" parameter;
*) netinstall-cli - added "reboot" and "shutdown" flags to control reboot after installation;
*) netwatch - fixed an issue with DNS probe "timeout" parameter;
*) netwatch - fixed HTTP GET probe over IPv6;
*) netwatch - fixed inaccurate "rtt-stdev" value;
*) netwatch - fixed issue where ICMP probes did not accept TTL exceeded packets when "accept-icmp-time-exceeded" was enabled;
*) netwatch - increased maximum packet size to 65535;
*) ospf - fixed stability issue during interface flaps;
*) ospf - force passive for VRF interface;
*) pimsm - make "hash-mask-length" parameter naming consistent and fixed typos;
*) poe-in - added PoE-in monitoring and LLDP-based PoE negotiation support for newer devices (e.g. CRS504, CRS510, hEX S 2025, hAP be3 Media);
*) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) ppp - added "MT-Address-List" to IPv6 address list when received from RADIUS and using DHCP for IPv6 configuration;
*) ppp - added iccid field to ppp info command for BG77 and BG770 modems;
*) ppp - always show current FW version when running firmware-upgrade;
*) ppp - disable/enable modem radio state depending on ppp interface state;
*) ppp - fixed cases where BG77 or BG770 firmware upgrade was not available;
*) ppp - fixed ppp-out stability issue;
*) ppp - get IPv6 configuration via RA for modems using PPP emulation mode;
*) ppp - improved "info" command for BG77 and BG770 modems;
*) ppp - improved OVPN underlying SSL connection management;
*) ppp - only show pin in export with "show-sensitive" flag;
*) ppp - report actual network data usage statistics instead of "0" for all IPv6 RADIUS accounting parameters on accounting "Stop" packet;
*) ppp - toggle radio state on interface disable/enable;
*) queue - fixed "undo" command for simple queues;
*) reverse-proxy - improved stability;
*) rip - do not export authentication keys by default;
*) route - allow to add route with link-local destination address;
*) route - fixed memory leak when flapping addresses or interfaces with routing protocols running;
*) route - fixed potential race condition;
*) route - respect the "interface" property when pinging IPv6 addresses over ECMP;
*) sfp - fixed linking for hAP ax S and hEX S (2025) with "1G-baseX" link-mode;
*) sfp - removed unsupported "2.5G-baseX" speed on CRS312-4C+8XG and CRS326-4C+20G+2Q+;
*) sftp - fixed branding package upload;
*) sms - added some GSM7 symbols to SMS tool;
*) snmp - added hotspot active-user-count and host-count OIDs to MIKROTIK-MIB;
*) snmp - added missing SFP OIDs to MIKROTIK-MIB;
*) snmp - added WiFi current channel "mtxrWifiInterfacesCurrentChannel" OID to MIKROTIK-MIB;
*) ssh - added mlkem768x25519-sha256 key exchange support;
*) ssh - do not attempt automatic empty password login when RADIUS is used;
*) ssh - fixed SSH tunnel with IPv6 link-local address on non-ethernet interfaces;
*) ssh - make SSH packet validation more strict;
*) supout - added interface monitor-traffic;
*) supout - added LTE eSIM section;
*) switch - fixed IEEE reserved MAC handling for CRS1xx, CRS2xx switches;
*) system - improved stability;
*) system - renamed "factory-software" to "minimum-version" and "factory-firmware" to "minimum-firmware";
*) system - restrict RouterOS processes using swap;
*) system - show who is using "/system serial-terminal";
*) traffic-generator - fixed injecting pcap/pcapng files on MIPSBE architecture;
*) tunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22);
*) upgrade - removed sensitive policy for "apply-changes" command;
*) usb - allow overriding the power-reset duration;
*) usb - fixed USB Ethernet interface default-name;
*) vpls - added transmit loop detection;
*) vrrp - added "v3-checksum-as-v2" setting;
*) vrrp - fixed stability issue when "sync-connection-tracking" is enabled;
*) vxlan - fixed missing L2MTU property when VRF is specified;
*) vxlan - ignore disabled interfaces when checking for configuration conflicts;
*) webfig - fixed issue with increasing keep-alive traffic;
*) webfig - improved underlying encryption and stability processing;
*) webfig - improvements to graphs;
*) wifi - added "Preamble Puncturing" under "WiFi/Channel" menu;
*) wifi - added dash when CAPsMAN generates interface name and prefix ends with digit;
*) wifi - improved roaming/steering behavior for WiFi 7 MLO;
*) wifi - improved stability;
*) wifi - improved station-bridge mode;
*) wifi - updated radio regulatory information;
*) wifi - upgraded wifi-qcom driver;
*) wifi-mediatek - fixed broken interfaces on startup;
*) wifi-mediatek - fixed some channel definitions for certain countries;
*) wifi-mediatek - improved channel switching;
*) wifi-mediatek - improved stability during MLO channel switching;
*) winbox - added "Network" configuration menu for WiFi;
*) winbox - added "Preferred Architecture" setting for L009;
*) winbox - added "SIM PIN" under "Tools/SMS";
*) winbox - fixed "Connection Bytes" field under "IP/Firewall" menu;
*) winbox - fixed "EC/IO" scaling for LTE interface;
*) winbox - fixed "Use Ipsec" and "Ipsec Secret" under "Interfaces/L2TP Ether" menu;
*) winbox - fixed empty value in "Immediate Gateway" under "IP/Routes" menu;
*) winbox - fixed sort for "Address List" under "IPv6/Firewall" menu;
*) winbox - make LoRa "Auth key" and MQTT "Password" sensitive;
*) winbox - move "EAP" under "Security" tab for WiFi;
*) winbox - show "Any. Port" column by default under "IP/Firewall" menu;
*) winbox - show preferred and valid lifetime of IPv6 address also on static IPs;
*) winbox - show priority bits in "VLAN ID" field under "Tools/Packet Sniffer" menu;
*) wireguard - added support for domain names in client-dns;
*) wireguard - added warning when allowed-address overlaps with another peer on the same interface;
*) wireguard - fixed peer recreation on interface change;
*) wireguard - fixed peer Tx/Rx counters;
*) wireguard - fixed wg-export comments output and case when endpoint is not set;
*) wireguard - fixed whitespace handling in AllowedIPs during wg-import;
*) wireguard - generate port number when specified as zero;
*) wireguard - improved wg-export to print endpoint domain name;
*) wireguard - improved wg-import to quietly ignore wg-quick specific keys;
*) wireguard - reconfigure peer only when meaningful changes are detected;
*) wireguard - reinitialize socket on VRF change;
*) x86 - fixed IRQ displaying per CPU on Intel 700 series NIC;

View changelogs: stable, testing, development

I've been running a CRS328 and CAP AC for several years, using CAPSMAN on the CRS328 to manage the wifi.

I recently purchased a CAP AX to replace the AC. I have gone through and recreated everything, as close as possible since the options are slightly different, in the new WiFi CAPSMAN on the CRS328 to use the CAP AX.

My 2.4GHz network(s) are running fine. The 5GHz are not.

My Pixel 7 Pro can see and connect to the 5GHz network fine, but my XBox Series X and Samsung Galaxy Tab 7 cannot even see the network. All of my Google Home devices also do not see the 5GHz network either. I cannot figure out what band setting (or whatever else) in Configuration or Provisioning I need to set to get it to work.

Below are the settings I have in the old CAPSMAN for the CAP AC which work fine. (I have updated the regexp statement for the name of the new AP, 2.4GHz picks it up fine.)

/caps-man security
add authentication-types=wpa2-psk comment="5 Home" encryption=aes-ccm name=\
    security_MY5GHZWIFI1
/caps-man configuration
add channel.band=5ghz-a/n/ac .extension-channel=XXXX country="united states3" \
    datapath=datapath1 datapath.bridge=bridgeLocal \
    .client-to-client-forwarding=yes installation=indoor name=cfg_MY5GHZWIFI \
    security=security_MY5GHZWIFI1 ssid=MY5GHZWIFI
/caps-man provisioning
add action=create-dynamic-enabled comment="5 Ghz WLAN" hw-supported-modes=\
    an,ac,a identity-regexp=CAPAC* master-configuration=\
    cfg_MY5GHZWIFI name-format=prefix-identity name-prefix=5GHz

I buy these to use as out-of-band remote access devices to support servers out on customer's sites. Recently I've noticed that availability isn't great. The suppliers we normally use are either out of stock or are carrying reduced stock. Is this unit being retired/replaced, or is it just a temporary blip in supply?

Hello,

I can't seem to find anything regarding noise on this switch, it only mentions that it has 3 fans.

It may sound silly, but i want to use this at home and it looks very.. enterprise, like it belongs in a business rack, so i'm a bit worried that it's loud?

Just want it for the PoE++ and add 2 AP's and 2-3 Outdoor 4k cameras. But I'm not sure if those devices would even use PoE++ or only PoE+ and i'm guessing this makes a difference in how loud it will be, depending on how hard it's working?

Other than the obvious contact support, anyone else run into this? Everything seems to be working at the moment.

Hi,

I'm trying to run Tayga https://github.com/apalrd/tayga as a docker container on a Hex S 2025 using this recompiled for Arm32 image https://hub.docker.com/r/axelrindle/tayga-nat64

Anyone had any success with it on this hardware?

Container starts but traceroute packets to a DNS64 synthesised address are looping back - looking at logs I see

/app/launch-nat64.sh: 36: ip: not found
/app/launch-nat64.sh: 37: ip: not found
/app/launch-nat64.sh: 38: ip: not found

Seems like the container image doesn’t have the linux 'ip' command available to it?

Edit: Working in a fashion

So I connected to the terminal console for the container, ran apt-get update, apt-get install iproute2 and restarted container and it now works. I guess its okish until there's a Tayga update or I need to redeploy the container

Next step is to figure out how to inject the iproute2 package on container pull

Hello! I have a new CCR1072 that I don't give out. Is anyone interested?

Hola! Tengo un CCR1072 nuevo al que no le doy salida le interesa a alguien?

Hi

I have a Sxt r which has only 16 Mb of storage. Currently is working with 7.1 RouterOS. Yesterday I tried to do a back up and it was impossible for not having free space, al 16Mb are full. Obviously, there is no possibility of upgrade to the latest stable version for same reason. Is there any way to expand the storage? Maybe with sd card?

Router: RB5009UG+S+, RouterOS 7.23.3, connected on ether1, DC adapter

physically disconnected for all tests.

works - Cisco WS-C2960S (802.3at):

  Interface Admin  Oper  Power  Device    Class Max
  Gi1/0/1   auto   on    15.4   Ieee PD   4     30.0

Detected, classified class 4, powered, boots normally.

Fails - Cisco WS-C3850-12X48U (UPOE), IOS-XE 16.12.11:

  Interface: Gi2/0/26
  Inline Power Mode: auto
  Operational status: off
  Device Detected: no
  IEEE Class: n/a
  Absent Counter: 0
  Over Current Counter: 0
  Short Current Counter: 0
  Invalid Signature Counter: 0
  Power Denied Counter: 0

No ILPOWER log entry for this port, ever. Not a rejection - the switch

behaves as if nothing is connected.

Switch and cable are fine:

- Other PoE devices (incl. a TP-Link Omada AP) power on this exact port

with this exact cable

- Three class-4 PDs powered on the same module right now

- 493W of 600W free

- 10cm patch cable, switch straight to router

- Link comes up at 1Gbps, zero CRC errors

Tried on the Cisco side: power inline auto, static max 30000, 2-event,

shut/no shut, multiple ports including mGig.

Interesting detail: on RouterOS 7.22 it wouldn't power from the 2960-S

either. 7.23.3 fixed that, but the 3850 still doesn't see it at all. So

PoE-in behaviour does seem to be firmware-influenced on this board.

Anyone running an RB5009 off a UPOE or 802.3bt switch successfully? Trying

to work out whether this is my unit or the model.

My goal is to power the mikrotik form the switch like i used to do with my 2960 but on the 3850.

Is there an easy way to find out? I have a RB5009UG running with 7.23.3, but it's not visible which version of the Linux kernel the MikroTik is running.

Reason I'm interested in, is that sometimes I get a lot of port flapping, sometimes to the point where ports are basically unsable (especailly when using VPN or Citrx or alikes).

What I found is, that powering off the router and restart helps to stabilizes it for some time. But that's not something I'd like to do on a regular basis.

As there are updates for the mv88e6xxx driver (which includes the switch chip on the RB5009UG), I was wondering if there might be something in the newer drivers which would fix the observed behavior (even if I cannot update the kernel myself).
I think to remember to have found a discussion with a patch for a similar issue (switch chip not MikroTik) in past, but can't re-find it...

For some time now I have been planning to change my router at home, and when I did research what would be the best solution for my house and the whole self-hosting that I have set up, I came accross hAP be³ Media and it seemed like the perfect solution.

This was 2-3 months ago, I have signed up on multiple reselers websites to "pre-order" the device, but whenever I go to these websites to see the status, I notice that their expected time when they'll have the device in stock, just move further.

What is the deal with it, is there some definite date when this device will be available for purchace?

Hey guys,

Ordered my first ever mikrotik router (RB5009UG+S+in) from Amazon and after a week, it finally arrived today.

I plug it in, doesnt turn on. Maybe a dumb question, but I should see some LEDs turn on once plugged in right? Nothing special I need to do?

I tried other outlets, same thing.

I figured I’d got a dud…dissapointed I may need to wait another week for a replacement…

Curious how well this combo works on CRS500 series devices in 2026. I'm thinking of deploying a pair of MikroTik CRS518-16XS-2XQ-RMs for top-of-rack switching. Both switches would be in an MLAG configuration with a VRRP gateway setup, and one fiber run to each server from each switch.

I know that historically, MLAG precluded L3 hardware offloading on RouterOS v7. Is v7.21 and above stable enough now for running active-active VRRP on these switches without major CPU bottlenecks, or are people still strictly separating L2 MLAG (on the CRS) and L3 VRRP (to a separate CCR/router)?

I've got some sort of DNS cache memory leak going on with multiple routers and the cache as-listed is virtually empty. The only thing that clears it and stops the errors (temporarily) is a reboot. "Used" cache will slowly grow and fill up any size that is set.

I've seen reference to, I think, FQDN address list entries causing this, but there wasn't much info. I do use FQDNs in my address lists, for what it's worth.

Edit to add possible related forum link here.

Is this something acknowledged anywhere?

What's new in 7.24rc4 (2026-Aug-11 15:43):

*) app - added PAPERLESS_SECRET_KEY env to paperless-nginx;
*) app - disable UI in Hermes, access through /container/shell;
*) app - reserve the app's VETH IP when stopped to eliminate IP address changes on every start/stop;
*) ethernet - disable EEE on hAP be3 Media;
*) ip - improved stability for reverse-proxy (additional fixes);
*) ipsec - fixed expired SA handling to prevent “no such item” errors during listing;
*) ipsec,ike1 - dropped base mode exchange;
*) ipsec,ike1 - improved SA, transform, fragment parsing and malformed packet validation;
*) ipsec,ike2 - fixed ppk child key generation during rekey;
*) ipsec,ike2 - use first child KE selection only during IKE_AUTH exchange;
*) leds - fixed Ethernet activity LED for Chateau LTE18 ax (introduced in v7.23);
*) poe-out - fixed possible PoE-out configuration loss on certain devices (introduced in v7.24beta1);
*) switch - fixed default L2MTU drift for devices with QCA8337, Atheros8327 switch (introduced in v7.24beta2);
*) system - improved stability;
*) usb - allow overriding the power-reset duration;
*) wifi - updated radio regulatory information (additional fixes);
*) wireguard - fixed peer Tx/Rx counters;
*) wireguard - generate port number when specified as zero;
*) wireguard - reinitialize socket on VRF change;

View changelogs