MikroTik RouterOS TILE Firmware 6.47 RC 53

Important note!!!

- The Dude server must be updated to monitor v6.46.4 and v6.47beta30+ RouterOS type devices.
- The Dude client must be manually upgraded after upgrading The Dude server.
- Make sure LTE APN Profile name does not match any of the DHCP server's names if LTE passthrough is used.
- The Dude requires "winbox" policy instead of "dude" to monitor v6.46.4 and v6.47beta30+ RouterOS type devices.

MAJOR CHANGES IN v6.47:

- dns - added client side support for DNS over HTTPS (DoH) (RFC8484);
- socks - added support for SOCKS5 (RFC 1928);
- user - enable "winbox" policy for groups with "dude" policy;

Changes in this release:

- socks - added support for SOCKS5 (RFC 1928);
- branding - do not ask to confirm configuration applied from branding package;
- certificate - added "skid" and "akid" values for detailed print;
- certificate - allow dynamic CRL removal;
- console - prevent incorrect type interfaces appearing in command hints;
- crs3xx - fixed QSFP interface linking after removing/inserting QSFP module (introduced in v6.47beta49);
- dhcpv4-server - disallow zero lease-time setting;
- filesystem - fixed NAND memory going into read-only mode or becoming unstable over time;
- ike1 - improved policy lookup with specific protocol;
- ike1 - rekey phase 1 rekeying as responder for Windows initiators;
- ipsec - improved system stability when handling fragmented packets;
- kidcontrol - ignore IPv6 multicast MAC addresses;
- lora - added IPv6 support for LoRa packet forwarder;
- lora - added UTC timestamp for RX events in "rxpk" json;
- lte - added support for Huawei K5161 modem;
- lte - fixed IP type selection from APN on RBSXTLTE3-7;
- snmp - fixed multiple LTE interface OID reporting;
- system - improved kernel panic reporting in logs after reboot;
- wireless - added "russia 6ghz" regulatory domain information;
- wireless - added "skip-dfs-channels" parameter;
- wireless - updated "bangladesh" regulatory domain information;
- wireless - updated "russia4" regulatory domain information;

Other changes since v6.46.4:

- bonding - improved slave interface MAC address handling;
- bonding - prefer primary slave MAC address for bonding interface;
- branding - fixed identity setting from branding package;
- branding - properly use HTML files for Hotspot (introduced in v6.47beta);
- bridge - added logging message when a host MAC address is learned on a different bridge port;
- bridge - added warning message when port is dynamically added to entry with VLAN range (CLI only);
- bridge - correctly remove disabled MSTI;
- bridge - improved hardware offloading enabling/disabling;
- capsman - fixed "certificate" parameter updating on CAP;
- certificate - disabled CRL usage by default;
- certificate - do not use SSL for first CRL update;
- chr - added support for file system quiescing;
- crs3xx - correctly remove switch rules on CRS317-1G-16S+ and CRS309-1G-8S+ devices;
- crs3xx - do not change bridge host ID's when updating host table (introduced in v6.47beta32);
- crs3xx - fixed "ingress-rate" property on CRS309-1G-8S+, CRS312-4C+8XG, CRS326-24S+2Q+ devices;
- crs3xx - fixed QSFP+ interface linking for CRS326-24S+2Q+ device (introduced in v6.47beta19);
- crs3xx - fixed interface statistics for CRS354-48G-4S+2Q+ and CRS354-48P-4S+2Q+ devices;
- crs3xx - fixed traffic forwarding after disabling/enabling bridge hardware offloading for CRS354-48G-4S+2Q+ and CRS354-48P-4S+2Q+ devices;
- crs3xx - improved SFP+ DAC cable initialization for CRS326-24S+2Q+ device;
- crs3xx - improved switch host table updating;
- defconf - fixed "no-defaults=yes" applying default configuration (introduced in v6.47beta);
- defconf - fixed default configuration initialization if power loss occurred during the process;
- dhcpv4 - added end option (255) validation for both server and client;
- dhcpv4-client - improved stability when changing client while still receiving advertisements;
- dhcpv6-client - improved error logging when when renewed address differs;
- dhcpv6-server - fixed MAC address retrieving from DUID when timestamp is present;
- discovery - do not send CDP and LLDP packets on interfaces that does not have MAC address;
- discovery - do not send discovery packets on inactive bonding slave interfaces;
- discovery - do not send discovery packets on interfaces that are blocked by STP;
- disk - improved recently created file survival after reboots;
- dns - added support for exclusive dynamic DNS server usage from IPsec;
- dot1x - added "radius-mac-format" parameter (CLI only);
- dot1x - added hex value support for RADIUS switch rules;
- dot1x - added range "dst-port" support for RADIUS switch rules;
- dot1x - added support for lower case "mac-auth" RADIUS formats;
- dot1x - fixed "reject-vlan-id" value range;
- dot1x - fixed dynamically created switch rule removal when client disconnects;
- dot1x - fixed port blocking when interface changes state from disabled to enabled;
- dot1x - improved debug logging output to "dot1x" topic;
- dot1x - improved value validation for dynamically created switch rules;
- dude - fixed connection to other RouterOS type devices through The Dude agents (introduced in v6.46.4);
- fetch - fixed "User-Agent" usage if provided by "http-header-field";
- filesystem - fixed NAND memory going into read-only mode or becoming unstable over time;
- health - added "gauges" submenu with SNMP OID reporting;
- hotspot - updated splash page design ('/ip hotspot reset-html' required);
- ike1 - added error message when specifying "my-id" for XAuth Identity;
- ike1 - added support for "UNITY_DEF_DOMAIN" and "UNITY_SPLITDNS_NAME" payload attributes;
- ike1 - improved stability when performing policy lookup on non-existant peer;
- ike2 - added support for "INTERNAL_DNS_DOMAIN" payload attribute;
- ipsec - added "split-dns" parameter support for mode configuration (CLI only);
- ipsec - added "use-responder-dns" parameter support (CLI only);
- ipsec - control CRL validation with global "use-crl" setting;
- ipsec - do full certificate validation for identities with explicit certificate;
- ipsec - fixed minor spelling mistake in logs;
- ipsec - improved IPsec service stability when receiving bogus packets;
- lcd - fixed LCD service becoming unavailable on devices without LCD screen;
- led - added "dark-mode" functionality for CRS105-5S-FB;
- led - fixed minor typo in LED warning message;
- lora - added IPv6 support for LoRa packet forwarder;
- lora - added value limits for "freq-off" parameter;
- lora - properly update source address for packets when routing table is changed;
- lte - added support for NEOWAY N720;
- lte - added support for multiple passthrough APN configuration;
- lte - do not allow running "scan" on R11e-4G;
- lte - fixed "allow-roaming" setting when using LTE network mode on R11e-LTE;
- lte - fixed "band" value setting when configuration is reset on R11e-4G;
- lte - fixed multiple APN reactivation after deactivation by operator;
- lte - made "mac-address" parameter read-only;
- lte - show "phy-cellid" value only in LTE mode;
- netinstall - removed "Flashfig" from Netinstall;
- netinstall - removed "Make Floppy" from Netinstall;
- netinstall - signed netinstall.exe with Digital Signature;
- ppp - added support for ZTE MF90;
- ppp - fixed minor typo when running "info" command;
- proxy - increased minimal free RAM that can not be used for proxy services;
- quickset - do not show "SINR" field in Quick Set when there is no data;
- quickset - removed "EARFCN" field from Quick Set;
- quickset - removed "LTE band" setting from Quick Set;
- quickset - show "Antenna Gain" setting on devices without built-in antennas;
- quickset - use "station-wds" mode when connecting to AP with RouterOS flag;
- route - improved system stability after reboot with large amount of VLAN interfaces with PPPoE servers attached;
- routing - improved IGMP-Proxy service stability when receiving bogus packets;
- sniffer - allow setting port for "streaming-server";
- sniffer - fixed minor typo in "host" menu;
- snmp - added "dot1qTpFdbTable" OID reporting for Q-BRIDGE-MIB;
- snmp - changed "upsEstimatedMinutesRemaining" reported value from seconds to minutes;
- snmp - fixed "dot1dBasePort" index offset for BRIDGE-MIB;
- snmp - improved OID policy checking and error reporting on "set" command;
- snmp - improved stability when polling MAC address related OID;
- ssh - fixed SHA256 user authentication algorithm checking (introduced in v6.46.4);
- supout - added "dot1x" section to supout files;
- supout - added "gps" section to supout files;
- supout - improved PoE-out information reporting;
- supout - improved UPS information reporting;
- switch - made "auto" the default value for "vlan-id" parameter when creating a new static host entry;
- system - correctly handle Generic Receive Offloading (GRO) for MPLS traffic;
- system - improved driver loading speed on startup;
- system - improved system stability when forwarding traffic from switch chip to CPU (introduced in v6.43);
- tr069-client - removed warning log message when not using HTTPS;
- traceroute - improved stability when invalid packet is received;
- traffic-flow - added "postDestinationMacAddress" parameter support for IPFIX and Netflow v9;
- traffic-generator - improved statistics reporting;
- upgrade - fixed space handling in package file names;
- ups - improved compatibility with APC Smart UPS 1000 and 1500;
- w60g - fixed link status logging;
- w60g - improved rate selection in low traffic conditions;
- w60g - improved stability after multiple disconnections;
- w60g - use "arp" and "mtu" parameters from master interface when creating a new station;
- webfig - updated icon design;
- winbox - added "Options" parameter support for DHCPv6 client and server;
- winbox - added "Rate" parameter for switch ACL rules;
- winbox - added "auto-erase" option to "Tool/SMS" menu;
- winbox - added 160Mhz extension channel support for CAPsMAN;
- winbox - added comment support for "Switch->VLAN" menu;
- winbox - added support for "Tools->WoL" menu;
- winbox - added support for inline bar graphs for LTE signal values;
- winbox - aligned all "IP->Traffic Flow->IPFIX" check boxes in single line (WinBox v3.22 required);
- winbox - allow setting "20/40/80/160Mhz-eeeeeeCe" channel under "Channel Width" parameter;
- winbox - allow setting "Primary" parameter for "balance-tlb" bonding interfaces;
- winbox - do not show "Revision" parameter under "System/RouterBOARD" menu on devices that have only one revision;
- winbox - fixed "ARP" parameter inheritance from "CAPs Configuration" configuration;
- winbox - fixed "BGP Origin" value display under "IPv6->Routes" menu;
- winbox - fixed "Bands" parameter display for LTE interfaces;
- winbox - fixed "DSCP" parameter value setting;
- winbox - fixed "Data Rate" checkbox alignment (WinBox v3.22 required);
- winbox - fixed "Frequency" and "Secondary Frequency" parameter inheritance from "CAPs Channel" configuration;
- winbox - fixed "Passthr. MAC Address" parameter display "LTE APNs" menu;
- winbox - fixed "Switch" menu on CRS354-48P-4S+2Q+;
- winbox - fixed "dst-port" unsetting in "IP->Hotspot->Walled Garden" menu;
- winbox - fixed automatic "IPv6->Firewall->Address List" table update;
- winbox - fixed bonding type interface support for "Switch->Host" table;
- winbox - made "none" the default value for "Security Profile" parameter when creating a new "Wirelees->Connect list" entry;
- winbox - made "yes" the default value for "Inject Summary LSAs" parameter when creating a new NSSA or STUB area;
- winbox - properly show "Hw. Offload Group" value for each interface under "Bridge->Ports" menu;
- winbox - removed duplicate "join-eui", "dev-eui", "counter", "chain", "size" and "payload" parameters under "Lora/Traffic";
- winbox - renamed "Memory used" to "HDD used" for HDD type under "Tools->Graphing->Resource Graphs";
- winbox - renamed "Routerboard" to "RouterBOARD" under "System/RouterBOARD" menu;
- winbox - show "Hardware Offload" parameter for bonding interfaces;
- winbox - show "System/RouterBOARD/Mode Button" on devices that have such feature;
- winbox - updated icon design;
- wireless - added "U-NII-2" support for hAP ac2 and RBwAPGR series devices;
- wireless - allow using "russia4" regulatory domain on RU locked devices;
- wireless - enabled unicast flood for DHCP traffic on ARM architecture access points;
- wireless - fixed default "antenna-gain" setting on SXT 2 and LtAP series devices;
- wireless - updated "indonesia4" regulatory domain information;
- www - added "tls-version" parameter in "IP->Services" menu (CLI only);

About Router Firmware:

Before you consider downloading this firmware, go to the system information page of the router and make sure that the currently installed version isn't either newer or matching this release.

Due to the large variety of router models and different methods for upgrading the device, it is highly recommended that you read and, above all, understand the installation steps before you apply the new firmware, even if you are a power user.

In theory, these steps shouldn't be much of a hassle for anyone, because manufacturers try to make them as easy as possible, even if they don't always succeed. Basically, you must upload the new firmware to the router through its administration page and allow it to upgrade.

If you install a new version, you can expect increased security levels, different vulnerability issues to be resolved, improved overall performance and transfer speeds, enhanced compatibility with other devices, added support for newly developed technologies, as well as several other changes.

If you're looking for certain safety measures, remember that it would be best if you perform the upload using an Ethernet cable rather than a wireless connection, which can be interrupted easily. Also, make sure you don't power off the router or use its buttons during the installation, if you wish avoid any malfunctions.

If this firmware meets your current needs, get the desired version and apply it to your router unit; if not, check with our website as often as possible so that you don't miss the update that will improve your device.