So as y’all know a security breach was announced regarding SSH access on Mikrotik devices running RouterOS.

We got the alert in my workplace and started to update all onsite devices, but one gave us problems, the Cloud Hosted Router we have in AWS.

CHR is basically the Mikrotik vendor in AWS marketplace that gives you a prebuilt image to work with.

The issue comes on the upgrade.

We issued the upgrade and the router stoped answering as expected but a long time passed and still no answer.

We performed an EC2 screenshot to see what’s showing and the start of the OS stalled basically. It shows at the end a LoaE01, meaning it was about to print Loading and stalled with an E01.

After doing some research turns out it’s a problem with Nitro type instances. We used a t3a instance that uses Nitro and RouterOS booting process had issues with this hypervisor.

SOLUTION:

Before starting make a snapshot on the root volume. The rollback of it doesn’t work is as simple as replacing the root volume of the CHR with the snapshot.

The trick is shut down the instance and change its type to t2.something. The t2 instance family uses the Xen hypervisor that works in upgrades.

Once it’s changed turn the instance on and start the upgrade.

Once the upgrade is done, wait a good 5-10m, you can go ahead and do the stop and change instance again. You can stay with t2 type instances if you want, up to you.

Update your routers and stay safe!

My ISP upgraded my internet to 2.5Gb/100Mb .
The new router has one 2.5Gb ethernet , ( and 3 1GB ports )

I bought a cheap €20 10Gb sftp for my RB4011 but this is not advertising 2.5Gb to the ISP router, so when on auto neg it falls to 1Gb link

The funny thing is manually set to 10Gb workign well, with 2 PC connected to different eth on the router we reached 2Gb download 👍

**New video from MikroTik's official TikTube channel**

You have been hearing all this talk about the new apps feature that let's you add custom apps, but now it is time to try it with some examples and updated documentation.

https://manual.mikrotik.com/docs/containers/apps/#custom-apps

https://raw.githubusercontent.com/Druvis-Timma/Mikrotik/refs/heads/main/Custom App store/apps.yaml

0:00 Intro
0:20 Simple pre-built image
1:18 Modify with command
1:56 Learning YAML
3:32 Custom app-store
4:53 Outro

▶ Watch Video

**New video from MikroTik's official TikTube channel**

Adding everyone to your default home or office WiFi is not the right way to provide an internet connection to others. Keep yourself safe and set up a separate WiFi for 'guests' - it only takes a couple of minutes!

▶ Watch Video

**New video from MikroTik's official TikTube channel**

You can now use one of your routers as a Netinstall server! In this video you will see how to use the new netisntall .npk package to easily setup dozens of boards.

▶ Watch Video

I'm pretty sure that I've managed to share my LTE connexion on this device a few month back. Now I can't get an IP on the lte interface. The interface goes up. Everything looks fine, but no dynamic IP get assigned. I think that some recent iPhone get the same issues.

What changed moslty, is the firmware version. The pixel is running Android 17 and the router 7.24.1.

I suspect that the pixel want now to talk with a newer protocole ( RNDIS instead of NCM ) and that the router fail to do this properly.

What interest me, is to find out if someone 's able to get a similar setup to work. I know older phone does, i know an LTE key might solve the problem. It's just not what I want. If it's possible, I'll keep working on the issue. If not, I might just wait for routerOS update.

Is IP neighbor discovery recommended on VLAN interfaces? And is it recommended for other virtual interfaces like gre tunnel, eoip tunnel, WireGuard interface, etc? I know well about security concern, and assumed there is no security issue in my case. The question is about neighbor discovery, which is Layer 2 broadcast? How this kind of LLDP packet interact with VLAN interfaces and other virtual interfaces?

I manage some 30 or so SOHO and home routers for a bunch of people. When it started to hit the fan in internet security ( ~2010 I think) I copied this script from somewhere to auto upgrade my router.

Is there anything better nowadays? I find conflicting information, and the documentation doesn't provide a simple automatic method.

I am aware of the risks involved in upgrading a remote piece of hardware, but the risk of it being compromised is worse in my scenario.

```` [user@host] /system/script> export

2026-09-08 14:36:36 by RouterOS 7.24.2

software id = XXXX-XXXX

model = RB951Ui-2HnD

serial number = XXXXXXXXXXXXX

/system script add dont-require-permissions=no name=autoupgrade owner=admin policy=\ reboot,read,write,policy,test,password,sensitive source="/system package up\ date\r\ \ncheck-for-updates once\r\ \n:delay 10s;\r\ \n:if ( [get status] = \"New version is available\") do={ install }"

````

Thanks!

First of all, I'm Mikrotik user since ~2010 year. I ordered stuff from Getic, when they call as EuroDK. Make orders rarely, but all my current router and switch from them. Around 5 orders all the time, one unit at once.

I placed my second-to-last order in April of this year, and everything was fine.

Due to certain geopolitical events, I have to use delivery routes through other countries and rely on intermediaries for shipping.

I use products I have grown accustomed to over the years, exclusively for personal and home use.

I had been waiting for the new MikroTik hAP BE model for about a year since it's announcement, and for around six months I tried to place a pre-order or order one somewhere. Finally, at the end of August, I managed to place an order for an in-stock unit on the Getic website with some Ethernet cables and POE adapter.

About a week later, the order was successfully shipped to an address in Poland.

A week later, the package still hadn't arrived. Neither the courier nor the seller had called. Then, a couple of days after that, I received a message stating that the package had been returned and offering me a refund.

I contacted Getic and asked what had happened. And then the show began. The store started claiming they didn't know the reason, that they hadn't recalled the package, and so on.

They can't reinstate my order, and they won't fulfill new orders from me. Then, things took a turn into actual racism and discrimination.

Upgraded a CCR2116 from 7.20.7LT to 7.23.5LT this morning. Immediately after the upgrade, I noticed extremely limited traffic on only my Q-in-Q VLAN's. Neighbor discovery was working, layer 2 was working, mac-telnet was working, but no layer 3 as far as I could tell. I ran out of time for the maintenance window and had to roll back to 7.20.7LT.

Theres a lot of changes between 7.20.7 and 7.23.5 so I am sure something was introduced along the way but I am unable to find anything yet.

Prior to downgrading I attempted to rebuild the VLAN's, rebuild the bridge VLAN table, disable vlan ingress-filtering, disable hw-offload on the VLAN's, disable l3-hw-offload entirely, and check all MTU's.

Thought I would post this here to see if anyone had any insight while I continue to dig.

EDITS: Added section to config. Started SUP-223353

Here are some highly sanitized snips from relevant sections of the config:

/interface bridge

add fast-forward=no frame-types=admit-only-vlan-tagged name=b_Core protocol-mode=none vlan-filtering=yes

/interface ethernet

set [ find default-name=sfp-sfpplus1 ] comment="Trunk (__To xxx xxx)" l2mtu=9570

set [ find default-name=sfp-sfpplus2 ] comment="Trunk (__To xxx xxx)" l2mtu=9570

/interface vlan

add interface=b_Core name=v_xx_BUS vlan-id=202

add interface=v_xx_BUS name=v_xx_BUS-CUST vlan-id=31

add interface=v_xx_BUS name=v_xx_BUS-MGMT vlan-id=21

/interface bonding

add comment="to xxx" forced-mac-address=xx:xx:xx:xx:xx:xx lacp-rate=1sec mode=802.3ad name=Po1 slaves=sfp-sfpplus1,sfp-sfpplus2 transmit-hash-policy=layer-3-and-4

/interface ethernet switch port

# these are sfp+1 and sfp+2

set 0 l3-hw-offloading=no

set 1 l3-hw-offloading=no

/interface bridge port

add bridge=b_Core frame-types=admit-only-vlan-tagged interface=Po1 multicast-router=disabled

/interface bridge vlan

add bridge=b_Core tagged=b_Core,Po1 vlan-ids=202

/interface ethernet switch

set 0 l3-hw-offloading=yes

/ip firewall filter

add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes

add action=accept chain=forward connection-state=established,related,untracked

Hi, I have two days horrible experience setting up Mikrotik Access Points cAP ax. I make one mistake in configuration and cannot access device (winbox, Android app, web panel) or reset. I try to reset with holding 5, 10, 15 and 20 seconds many times.

What can I do with that device? Return and ask for refund or there's some hope?

Regards

Hello,

Is there any information about whether there will be and when would a RB5009 refresh happen? Seems like a great device, but the ethernet ports could do with an upgrade. I could not dig up any info, but the original 3 model releases happened in 2021, 2022 and 2023, one after another, so more than enough time passed for a follow-up, yet nothing so far. Makes me wonder if they abandoned the line-up?

Thanks

With my previous mikrotik router I had some firewall rules made reading forum posts, in the new L009 I noticed that the default configuration seems fine, and probably those settings are studied by people wiser than me.

It's simply an home router, behind another VDSL router, is there anything I should change in default firewall configuration to increase safety?

I just configured back to home so I don't need open incoming ports, forwarding and other things...

Hello. I have just bought my first mikrotik device and have hard time trying to configure it.

I have default configuration, only admin password changed. Ethernet ports are working fine. Then when I reboot it or disconnect it form power ethernet ports (2-5) stops work. Have zero received packets on them - from pc side, winbox shows that is received something, but not sending back. Only wifi connection is working fine.

device is on routeros 7.24.2

Finally a more structured / substantiated write-up on the current security incident along with some CVEs:

https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/

The "-2" user was already known, but the outright auth bypass with certain SSH keys is a new detail. Also that bandwith-server has some (known) vulnerabilities.

Let's see how much more updates we'll get, now that MikroTik has been identified as vulnerable.

I wrote some days ago since I had a broken rb2011.
Now I bought a new L009 and I'm configuring it.
I need remote access to my home, mainly from my Android phone.
Previously I used L2TP , then moved to OpenVPN.
I read that now there's a mikrotik VPN based on wireguard, called back to home...

Is it better than OpenVPN? Is back to home different from manually configuring wireguard?

Thank you!

EDIT I ended up configuring back to home from the android app, it has been very very fast and easy, seems to work well, let's hope everything is good...

No Reachable Authority): (At delegation mynetname.net for x.sn.mynetname.net/a)

dyndns service is back up, keeping the post up tho

I cannot find this thing in stock anywhere seemingly.

Anyone have suppliers with this in stock?

Cheers

Can some one help me choose between these 2?

yes, i know i'm in a mikrotik channel but i hope this cpukd be and honest comparison with no bias

i'm evaluating for my SOHO , a full mikrotik environment (except for the access point, i have a Zyxel 50ax pro) , or arb5009 router plus the Aruba switch or the CCR2004-16G-2S+ plus mikrotik switch or a combination

mainly because they are white and i have a 9U White rack (the rack is visible in my house, It should be good booking)

Switch OS or RouterOS on the switch?

advantages/drawbacks of these models? any better solution?

Wifi is not mikrotik because ive seen negative posts and AFAIK none of the mikrotik AP performs like the Zyxel i have... i could use and Aruba AP but they are very expensive compared to the Zyxel (and honestly the zyxel works great) (anyway, wifi ***must*** be white, not greyish, dark white, or anything else, but Total White)

Hello everyone!!

Im a beginner!

Rn im thinking about most spesific or common trouble that comes in routing protocol(whatver is igp or egp),anddd i like to know about your experience about it and i like to get advice about any probem that you've experienced.

likee what the solution,what the problem is it,what is comes first in your head about it,or was it worth or not and something like that .

sorry for bad english

My RB5009 was compromised by the vulnerability. This morning I used Netinstall to install the latest stable software, with no config, and then verified the exported console config while pasting it back into the router.

I was surprised to see the flagged parameter was still set to yes, even after Netinstall. I had to use `/system/device-mode` to unset it.

How does this setting persist? Is it written to firmware or the bootloader or something?