RouterOS 7.21 вышла 12 января 2026 года и принесла изменения в маршрутизацию, контейнеры, Wi-Fi, безопасность и поддержку оборудования. Материал группирует длинный официальный changelog по задачам администратора.

На дату проверки актуальны RouterOS 7.24.5 stable (01.10.2026) и 7.23.8 long-term (09.10.2026). Используйте статью для контекста 7.21, а решение об обновлении принимайте по полной цепочке changelog от вашей версии до целевой.

Сетевые протоколы: BGP, OSPF, IPv6 и MPLS

Одним из главных направлений этого релиза стала стабилизация и расширение возможностей маршрутизации. В BGP реализована поддержка RFC 9234 — механизма предотвращения и обнаружения утечек маршрутов с использованием ролей (route roles). Также добавлена возможность использовать одинаковые router-id для eBGP-сессий, что соответствует RFC 6286. Исправлены критические ошибки, связанные с декодированием l2vpn-cisco, повреждением MPLS-меток и выбором полученных VPN-маршрутов.

В OSPF изменено значение по умолчанию параметра nssa-translator с «no» на «candidate», что упрощает развёртывание NSSA-областей. Для IPv6 добавлена гибкая настройка Router Advertisement: теперь можно принимать RA только на определённых интерфейсах и даже анонсировать только опции без префикса (none).

Контейнеризация и приложения

RouterOS 7.21 значительно расширяет возможности работы с контейнерами. Появился новый меню /app для простой установки контейнеризованных приложений (требуется пакет container). Добавлена поддержка ограничения CPU, настройки переменных окружения, монтирования томов и даже базовой работы с Bluetooth-устройствами внутри контейнеров. Это открывает новые горизонты для развёртывания микросервисов прямо на маршрутизаторах MikroTik.

Также улучшена стабильность запуска контейнеров с большим количеством слоёв и добавлена команда update для обновления образов через CLI.

Безопасность и аутентификация

В модуле сертификатов появилась поддержка SHA384 и SHA512 для SCEP, а также новый параметр trust-store для управления доверенными корневыми сертификатами. В Hotspot добавлена поддержка TOTP — двухфакторной аутентификации по времени — для локальных пользователей.

SSH-сервер теперь поддерживает ключи ED25519-SK (security keys), а параметр always-allow-password-login заменён на более понятный password-authentication. Все чувствительные данные (например, приватные ключи WireGuard) теперь скрываются по умолчанию в выводе команды print, если не указан флаг show-sensitive.

Wi-Fi и беспроводные технологии

Обновление затронуло и беспроводной стек. Добавлена поддержка CAPsMAN forwarding (обработка трафика на стороне CAPsMAN), улучшена стабильность при аутентификационных сбоях и увеличен интервал учёта клиентов в диапазоне 2.4 ГГц. Для будущих устройств Wi-Fi 7 введены новые параметры конфигурации. Также исправлены ошибки, связанные с WPA3 и multi-passphrase в комбинации с access-list.

Аппаратная поддержка и стабильность

Для платформы arm64 добавлена возможность включать Receive Packet Steering (RPS), что помогает балансировать нагрузку между ядрами CPU. На устройствах с QCA8081 PHY (RB5009, hAP ax3, Chateau ax) появилась аппаратная поддержка MACsec. Улучшена работа SFP/SFP+ модулей, особенно GPON и 25G DAC на CRS812.

Исправлены десятки проблем, влияющих на стабильность системы: от утечек памяти в логгере до некорректного сохранения panic-логов на ARM-устройствах. Эти изменения делают RouterOS 7.21 одним из самых надёжных релизов в ветке v7.

Если вы используете MikroTik в production-среде, настоятельно рекомендуем ознакомиться с полным списком изменений перед обновлением.

What’s new in 7.21 (2026-Jan-12 14:56): *) arm64 — allow enabling receive packet steering on /system/resource/irq/rps menu in order to overcome unbalanced CPU load; *) bgp — allow duplicate router-ids for eBGP sessions (RFC 6286); *) bgp — always advertise extended nexthop cap for all supported address families; *) bgp — do not allow iBGP with non-equal ASNs; *) bgp — fixed l2vpn-cisco decoding (introduced in v7.20); *) bgp — fixed occasional corruption of MPLS labels in BGP VPN update messages; *) bgp — fixed route refresh subcode 0 warning; *) bgp — fixed selection of received BGP VPN routes; *) bgp — implement RFC 9234 route leak prevention and detection using roles; *) bonding — added lacp-system-id and lacp-system-priority settings; *) bonding — fixed lacp-mode=passive; *) bonding — improved stability for 802.3ad LACP; *) bridge — expose more DHCP snooping warning logs; *) bridge — fixed dynamic switch-cpu VLAN creation (introduced in v7.20); *) bridge — fixed filter and NAT matching with «mac-protocol=length»; *) bridge — fixed missing local MAC after changing protocol-mode setting; *) bridge — fixed multicast packet receiving on bridge as multicast-router when HW offloading is used; *) bridge — fixed possible DHCP packet drop caused by the add-dhcp-option82; *) bridge — fixed possible MVRP issues when STP topology changes; *) bridge — fixed static host and MDB entry updates on VLAN add/remove; *) bridge — improved DHCP Option 82 values (circuit-id:»interface-name:vid», remote-id:»bridge MAC address»); *) bridge — improved stability after failed protocol-mode=mstp change; *) bridge — improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20); *) bridge — properly apply bridge MVRP settings on the fly; *) bth — added file-share link preview; *) bth — fixed big file upload; *) bth — fixed file-share expire after reboot; *) bth — make user private-key sensitive; *) certificate — added certificate «trust-store» parameter; *) certificate — added option to configure built-in trust store (replaced «builtin-trust-anchors» parameter); *) certificate — added SHA384, SHA512 support for SCEP; *) certificate — allow ca-crl-host parameter for issued certificates; *) certificate — fixed incorrect appearance of «invalid-before» and «invalid-after» dates; *) certificate — improved logging; *) certificate — on certificate import, added the «issued» flag if the certificate store contains the imported certificate’s CA and its private key; *) certificate — refactored Certificate internal processes; *) chr — fixed guest OS type «Other Linux (64-bit)»; *) console — added «mvrp» to mac-protocol setting; *) console — added delimiter parameter to :toarray command; *) console — added fetch-changelog flag to check-for-updates command; *) console — added reset command to settings directories; *) console — added sensitive flag to QR code in WireGuard «show-client-config»; *) console — added show-sensitive option for print command, hide sensitive settings in print output by default; *) console — changed file id format; *) console — do not allow to set value as empty for arguments that require selection of a specific list entry; *) console — do not set values when «setup» command is interrupted; *) console — fixed :convert from=num on MIPSBE; *) console — fixed «special-login» setting incorrect channel; *) console — fixed autocomplete in fullscreen editor to append tabs, spaces, etc; *) console — fixed empty output in route menus when using «print where gateway»; *) console — improved :toip command to get IPv4 address from IPv4 CIDR address; *) console — improved :toip6 command to get IPv6 addresses from IPv6 prefixes; *) console — improved hints for address arguments; *) console — improved hints for DHCPv6; *) console — improved printing visuals (column layout and paging); *) console — improved stability; *) console — remove unnecessary commands from /ip/hotspot/active menu; *) console — removed /quickset menu; *) console — return error values for certain commands if action failed (e.g. /system/routerboard/upgrade); *) console — show fullscreen script editor completions above hintbar; *) console — updated «Change your password» to «Change your password (Ctrl-C to skip)»; *) console — updated copyright notice; *) container — add initial Bluetooth device support; *) container — added «/app» menu for simple containerized app installation (requires «container» package and enabled «container» device-mode); *) container — added CPU usage; *) container — added hosts setting; *) container — added kill command to send signals (CLI only); *) container — added option to limit CPUs used by containers; *) container — added root dir size; *) container — added run command to allow interactive mode (CLI only); *) container — added stop-time setting; *) container — added update command (CLI only); *) container — allow /tmp tmpfs to be unlimited in size; *) container — allow app network to be any bridge interface; *) container — allow to configure extra ENV variables directly in container; *) container — allow to disable/enable envs and mounts; *) container — allow to specify mounts directly in container; *) container — calculate volume sizes; *) container — convert container mounts setting to mountlists, old mount name becomes list name, list name can map to multiple mounts; *) container — do not allow layer-dir to be within some containers root-dir; *) container — enable relevant kernel features to support more container apps; *) container — fixed error for starting container which consists of large number of layers; *) container — fixed extract issues; *) container — fixed VETH when using long interface name; *) container — general container service stability fixes and improvements; *) container — have per container layer-dir setting to be able to have separate layer stores for different sets of containers; *) container — made it possible to set timeout on /container/shell; *) container — make sure a working directory is created if it does not exist; *) container — show detailed import status, helps understand long imports; *) container — show image-id field (CLI only); *) container — shows app URL and «running» status only when port is open; *) container — store image import data (allows keeping container after netinstall); *) detnet — do not try detection on slave interfaces; *) detnet — fixed unnecessary process starting even when feature is not enabled; *) dhcpv4-client — don’t stop client on unsuccessful client option value change; *) dhcpv4-server — added «support-broadband-tr101» setting to pass additional Option 82 suboptions to RADIUS server; *) dhcpv4-server — added setting allowing to select client-id, MAC address and opt82 parameters for dynamic lease addition; *) dhcpv4-server — allow creating static DHCPv4 leases for VETH interfaces; *) dhcpv4-server — allow to set other gateway types not just IP for dhcp lease «routes» parameter; *) dhcpv4-server — improved logging; *) dhcpv4-server — improved setup wizard prompts relating to DNS; *) dhcpv4-server — respond with hlen 0 when htype is 8; *) dhcpv4-server — send RADIUS Accounting Stop messages when interim-update is zero; *) dhcpv6-client — do not show I flag for disabled client; *) dhcpv6-client — fixed misleading «couldn’t acquire address, continue with prefix only» error when prefix is not even requested; *) dhcpv6-relay — added «about» error message option; *) dhcpv6-relay — enable configuration of options that are added to relayed DHCPv6 requests; *) dhcpv6-server — added accounting to use-radius setting, similar to DHCPv4 server; *) dhcpv6-server — attempt to extract MAC from DUID for dual-stack purposes when client uses DUID-EN type of DUID; *) dhcpv6-server — improved event logging messages; *) dhcpv6-server — improved service stability when receiving DHCP requests for PPP service clients without included IA_PD; *) dhcpv6-server — include traffic usage statistics when accounting is stopped due to binding expiry and removal; *) discovery — correctly report PoE dual signature per-pair class; *) discovery — fixed MNDP IPv6 status reporting; *) discovery — send out neighbor discovery immediately on IPv4/IPv6 changes; *) disk — added nvme-tcp-server-nqn setting to be able to explicitly configure NQN, will default to «nqn.2000-02.com.mikrotik:slot» for new configurations; *) disk — allow only lowercase chars in iscsi-server-iqn; *) disk — allow to have type=file devices without rose-storage (needed for file based swap); *) disk — allow to set smb-share only for type=smb; *) disk — consolidate client states into single field, as each item can be only one type of «client»; *) disk — do not allow setting raid-master when have filesystem; *) disk — do not allow starting Btrfs replace when replace is suspended; *) disk — do not delete partition configs on device remove and eject (fixes lost config with unstable hardware); *) disk — fixed iscsi client; *) disk — fixed iscsi export disable; *) disk — fixed issue with double «/» in SMB share path for some clients; *) disk — fixed SATA eject/scan; *) disk — fixed SMB mount to be writable by container; *) disk — fixed write RAID superblock; *) disk — improved cleanup order to avoid waiting for timeouts on shutdown; *) disk — improved RDS2216 SATA controller; *) disk — improved system stability; *) disk — rename nvme-tcp client name to nqn everywhere symmetrically with server; *) disk — show NVMe critical warnings; *) disk — unshare iscsi and nfs client/server ids, add iscsi-server-iqn; *) disk — update interface type/speed after scan; *) disk — use default label when nothing specified when formatting from WinBox; *) dns — added VRF support to «:resolve» command; *) dns — added VRF support to DNS servers; *) email — added «certificate-verification» parameter; *) email — return all errors to console when executed from console; *) eoipv6,gre6,ipip6 — added «dont-fragment» setting to control packet fragmentation for packet sizes exceeding underlay interface MTU; *) ethernet — added «unsupported speed» warning for forced 1Gbps, 2.5Gbps, 5Gbps, 10Gbps baseT modes; *) ethernet — change default L2MTU 1518 to 1596 for RB5009; *) ethernet — fixed 2.5G-baseT link-partner-advertising on RB5009, hAP ax3, Chateau ax devices; *) ethernet — improved Ethernet port mapping to ensure a consistent and reliable interface order for wAP ax; *) ethernet — improved system stability for RB912, RB911 devices; *) evpn — fixed Ethernet Segment (ES) routes; *) fetch — added «http-percent-encoding» parameter; *) fetch — fixed http headers appearance when received payload is empty; *) fetch — send http-data for any http method; *) file — distinguish empty mount points from disks; *) file — improved error messages provided to GUI; *) file — improved stability and interoperability with WinBox and console; *) firewall — added «h» flag indicating that firewall service helper is applied for particular connection; *) firewall — added support for TOS/mask matching for raw rules; *) firewall — clear relevant masqueraded connection tracking entries on IP address change; *) firewall — fixed «tls-host» not matching expected hosts; *) firewall — fixed hotspot value loss on rule enable/disable; *) firewall — fixed strip-ipv4-options always passthrough; *) firewall — hide hw-offload setting from devices that do not support it; *) firewall — improved system stability and memory allocation when using firewall services; *) firewall — make hw-offload=yes default setting in /ip/firewall/filter menu; *) firewall — use the highest TTL as timeout value for domain address list entries if multiple domain names resolve to same IP; *) health — upgraded fan controller firmware to latest version; *) hotspot — added TOTP support for local hotspot users; *) hotspot — improved system stability; *) hotspot — prevent service from starting unnecessarily in the background on export/print commands; *) ike2 — adapt rekey procedure for compatibility with Libreswan; *) iot — added LoRa Round Trip Time monitoring support; *) iot — added Modbus rx-switch-offset parameter which helps offset Rx window; *) iot — added mqtt disconnect/connect GUI options; *) iot — added support for Modbus port baud-rates from 9600 to 115200; *) iot — changed LoRa packet’s timestamp format, which fixes duty cycle issues for some servers; *) iot — improved Modbus multi-write registers handling; *) ip-service — do not duplicate entries for containers running in same netns; *) ip-settings — limit IPv4/IPv6 max-neighbor-entries maximum value; *) ippool6 — added «Valid Lifetime» and «Preferred Lifetime» options and use them when constructing IPv6 address; *) ippool6 — fixed minor memory leak; *) ippool6 — log address removal; *) ippool6 — take into account «subnet-id» when specified on address; *) ipsec — fixed CHACHA20 typo in log messages; *) ipsec — support Post-Quantum Pre-shared Key (PPK) with QKD integration (CLI only); *) ipv6 — added «none» option for IPv6/ND/Prefix when advertising just options, not prefix; *) ipv6 — added «self» option for IPv6/ND DNS advertise settings; *) ipv6 — allow to specify on which interfaces to accept Router-Advertisements; *) ipv6 — do not disable/enable Router-Advertisements functionality based on IPv6/ND configuration; *) ipv6 — initialize RA receiving when enabled and without any other IPv6 configuration; *) ipv6 — properly remove SLAAC installed route when prefixes expire; *) ipv6 — remove SLAAC installed DNS server and route on expire; *) isis — improved stability; *) isis — improved system stability when changing passive flag; *) isis — improved system stability when receiving a hello packet; *) l3hw — added per-VLAN «l3-hw-offloading» setting and «H» flag for /interface/vlan menu; *) l3hw — display warning when partial offloading is active (suggest users to use suppress-hw-offloading to control which routes get HW offloaded and which are CPU processed); *) l3hw — fixed issue with IPv4 ARP and IPv6 neighbor resolve for CRS812; *) l3hw — fixed partial offloading with /31 routes; *) l3hw — fixed per-VLAN counters when packets are going through CPU; *) l3hw — fixed VLAN and VXLAN counters for CRS520 device; *) l3hw — improved stability and performance during L3HW enable with many routes; *) l3hw — improvements and optimizations for IPv4 /32 and IPv6 /128 route offloading; *) l3hw — prioritize local IP address over ARP/neighbor entry with same IP (fixes incorrect packet flow); *) log — fixed ISO8601 time format; *) log — fixed memory leak; *) log — fixed remote logging on remote-protocol configuration change; *) log — fixed unnecessary file creation when configuring a disabled log action with «target=disk»; *) log — hide irrelevant log action parameters; *) log — limit firewall log prefix length; *) log — limit log socket buffer memory size; *) lte — added «force-delete» command to allow deletion of active eSIM profiles; *) lte — added additional logging for error reported by modem during APN profile setup; *) lte — added command to send out EUICC generated notifications manually; *) lte — added confirmation prompt when deleting eSIM profile; *) lte — added support for additional D-Link DWM-222 variation (vendor-id=»0x2001″ device-id=»0x7e46″); *) lte — added support for additional Huawei E3372-325 variation (vendor-id=»0x3566″ device-id=»0x2001″); *) lte — added support for R11e-LTE6 v039 firmware release and availability notification; *) lte — ask for user confirmation before installing eSIM profile; *) lte — clear SIM not present error when performing modem FW upgrade; *) lte — discontinued support for RBSXTLTE3-7, further versions will use v7.20 LTE firmware package; *) lte — do not retry activation for IPv4 and IPv6 APNs on QMI modems if only one address family is assigned; *) lte — fixed cases where LTE monitor could show abnormalities; *) lte — fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20); *) lte — fixed MTU inheritance from master interface in multi-APN setups; *) lte — fixed MTU setting for AT modems; *) lte — fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17; *) lte — force sms-protocol to AT for FG621-EA modem; *) lte — improved AT modems at-chat control channel handling after modem has closed AT channel unexpectedly; *) lte — improved modem recovery for Chateau 5G and Chateau 5G R16; *) lte — improved stability for FG621-EA modem; *) lte — improved system stability when receiving SMS messages; *) lte — provide firmware download URL when no LTE package installed on «SXT LTE3-7»; *) lte — relay EUICC generated notifications after profile enable/disable/remove/provision; *) lte — rework multiapn support for AT modems; *) lte — unify «SIM not present» status for all modems; *) macsec — added initial support for hardware-offloaded support (available only on QCA8081 PHY: RB5009, hAP ax3, Chateau ax ether1 port); *) media — fixed console autocomplete for path parameter; *) mpls — fixed LDP filter upgrade from v6 where neighbor parameter is not specified; *) mpls — fixed update of LDP Address message when local addresses change; *) mpls — properly renew services when LDP transport address changes its state; *) netinstall — fixed install with old RouterBOOT; *) ospf — changed nssa-translator default value from no to candidate; *) ospf — fixed OSPF interface «Standby» state detection; *) ospf — improved stability; *) ospf — show interface as separate prop for interface and neighbor; *) ovpn — fixed OVPN server handling on reboot (introduced in v7.20); *) ovpn — improved system stability when using cipher=blowfish128; *) ovpn-server — added support for pushing IPv6 routes; *) poe-out — added input name hint to poe max-power settings; *) poe-out — added LED blink on error for RB5009; *) poe-out — firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces); *) poe-out — fixed CRS354 misreporting approved LLDP power; *) poe-out — improved firmware update stability; *) poe-out — improved power-on mechanism for 802.3at capable boards; *) port — added comment for /port/remote-access (CLI only); *) port — added support for additional baudrates for USB to serial adapters; *) port — do not show serial port for ATL 5G R16; *) port — fixed displaying «baud-rate=auto» on x86; *) port — fixed export for default serial port name; *) port — give «gps» prefix for R11e-LR8G and R11e-LR9G GPS ports; *) ppp — added multi-APN support to ppp-client dialer; *) ppp — added setting to set BG77 modem cellular connection mode (auto; lte-m; nb-iot) (CLI only); *) ppp — improved service stability when using IPv6 with DHCP and RADIUS accounting; *) qos-hw — added «default» flags to default entries; *) qos-hw — added «mirror-profile» which allows to select profile (traffic-class) for mirrored traffic; *) qos-hw — always show usage and PFC counters, even when they are zero; *) qos-hw — fixed counters for ports that are configured with «offline» tx-manager; *) qos-hw — fixed profile add/remove for CRS812; *) qos-hw — fixed shared-pools for CRS812; *) qos-hw — remove unnecessary «offline» tx-manager for CRS812 (not supported by hardware); *) queue — improved system stability when using SFQ kind of queues; *) route — added options in /routing/settings to adjust check-gateway=ping timers; *) route — fixed SNMP output for ECMP routes having interface gateways; *) route — hide suppress-hw-offload setting from devices that do not support it; *) route — improved stability; *) route — improved system stability with multicast routing; *) route — make check-gateway=ping work on p2p interface gateways; *) route — removed /routing stats mem-blocks; *) routerboot — fixed boot MAC for CRS305-1G-4S+ and CRS328-4C-20S-4S+ switches («/system routerboard upgrade» required); *) sfp — expose sfp-cmis-module-state to monitor; *) sfp — filter out non-breakout modes for breakout modules; *) sfp — fixed «sfp-tx-fault» state indication for CRS520-4XS-16XQ; *) sfp — fixed combo-mode change for CRS326-4C+20G+2Q+; *) sfp — fixed missing link up/down notifies; *) sfp — improved initialization and linking for 25G DAC on CRS812; *) sfp — improved system stability with some GPON modules for CRS418, CCR2004 and CCR2116 devices; *) sfp — recognize 40G Active Cable (XLPPI); *) sfp — remove 40G-baseCR4, 40G-baseSR4-LR4 from sfp-supported list for qsfp28-x-3 interfaces; *) snmp — added lldpLocChassisId OID; *) snmp — count only «bound» leases for mtxrDHCPLeaseCount OID; *) snmp — make lldpLocPortId and lldpLocPortDesc OIDs information consistent with LLDP TLVs; *) socksify — improved system stability when using Socksify service; *) ssh — added support for ED25519-SK keys; *) ssh — improved logging of failed login attempts; *) ssh — refactored SSH service internal processes; *) ssh — renamed User SSH keys «key-owner» field to «info»; *) ssh — replaced «always-allow-password-login» with «password-authentication» in SSH settings; *) supout — added info log entry when autosupout.rif is generated; *) switch — added dynamic «copy-to-cpu» ACL rule for loop-protect; *) switch — automatically add local bridge MAC to switch FDB; *) switch — fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches; *) switch — improved HW bond load balancing by adding MPLS labels to transmit hash for 98DXxxxx, 98CXxxxx switches; *) switch — improved stability on MediaTek switch chips; *) swos — fixed «allow-from» setting for MIPSBE devices; *) system — added disks to /system/resource/hardware list; *) system — detect policy mismatch sooner if script is executed internally by some other service; *) system — fixed local update package filename generation; *) system — fixed network header offset for interfaces with MAC (fixes VRRP Tx on IGMP snooping bridge); *) system — fixed potential configuration loss when available disk space was insufficient; *) system — fixed saving panic logs to autosupout.rif for ARM CRS3xx devices; *) system — improved system stability when processing different kinds of lists; *) system — improved system stability when processing GRE packets on TILE devices; *) system — improved system stability; *) system — limit number of interface-lists to 244; *) tr069-client — added LTE link recovery timer setting; *) tr069-client — allow disabling Device.WiFi.AccessPoint; *) tr069-client — expose 5G NR signal metrics for the Chateau R17 ax; *) traffic-generator — added support for injecting pcapng files; *) undo — do not show internally issued commands in /system/history; *) undo — show console commands in WinBox/WebFig for /system/history entries; *) ups — fixed board hibernation shutdown; *) usb — fixed cases where USB bus order could change on D53 devices; *) usb — LTE modem and USB-Serial Controller enumeration fix; *) usb — support video capture devices for arm64 and x86, for passthrough to containers; *) user-manager — added RadSec support; *) veth — add container-mac-address setting; *) veth — added default print brief table mode; *) veth — added dhcp setting that allows to auto-configure IPv4 address, works when VETH is bridged with other interfaces and there is a DHCP server running somewhere on that network; *) veth — complain immediately when VETH gateway not reachable, more detailed error message when network setup fails; *) veth — fixed IP address not appearing in the app menu when VETH uses DHCP; *) veth — fixed VETH interface not getting an IP address in a vlan-aware bridge containing multiple DHCP servers; *) veth — show only when container package installed; *) vrf — added read-only property to IPv4/IPv6 addresses, ARP and IPv6 neighbor; *) vrf — allow setting comment on default «lo» interface; *) vrrp — do not show «ttl not 255» warning when received VRRP VRID does not match with configured VRID; *) vrrp — fixed gratuitous ARP being sent after VRRP is disabled (fixes packet forwarding on HW offloaded bridge after VRRP is disabled); *) w60g — fixed possible memory leak when an interface is disabled; *) webfig — added a hint for Undo/Redo buttons; *) webfig — added Apps menu to login; *) webfig — added capability to check/uncheck entry tree in skin designer; *) webfig — added Copy capability; *) webfig — added missing PPP types to Skin Designer; *) webfig — added TCP State column for connection tracking table; *) webfig — check if device is still reachable before disconnect on error; *) webfig — fixed container config memory high input; *) webfig — fixed issue where routes and PIM table did not load; *) webfig — fixed issue where Torch stops running; *) webfig — fixed name and title store in skins; *) webfig — fixed new item window name when using skins; *) webfig — improved mikrotik_logo.svg; *) webfig — improved service stability after deleting a skin; *) webfig — increase graph width for better scaling; *) webfig — increase maximum number size in forms; *) webfig — make close button as a button instead of link; *) webfig — make combobox accessible to screen readers; *) webfig — remember last user in login page; *) webfig — turn off auto-capitalize and auto-correct for on-screen keyboards; *) wifi — added «CAP» information field on interfaces view; *) wifi — added CAPsMAN forwarding support (datapath.traffic-processing=on-capsman); *) wifi — added configuration parameters relevant to the upcoming WiFi 7 products; *) wifi — enable configuration of «3gpp-info-raw» and «realms-raw» interworking parameters; *) wifi — fixed issue when trying to use interface as bonding slave; *) wifi — fixed multi-passphrase usage in combination with access-list; *) wifi — fixed possible duplicate values for WPA3 authentication types in scan results; *) wifi — fixed possible memory leak when failing to start AP on chosen channel; *) wifi — fixed some CAPsMAN settings to be optional; *) wifi — improved formatting of FT request action frames; *) wifi — improved interface stability when encountering authentication failures; *) wifi — improved stability when capturing data at high rates with wifi sniffer; *) wifi — increased accounting interval, maximum client entry count for 2.4GHz probe response delay feature; *) wifi — rename ft-wpa2-eap authentication type to «ft-eap»; *) wifi — split access-list time property in days and time; *) wifi-mediatek — added Superchannel regulatory profile; *) wifi-qcom — added Unsolicited BSS Transition Management Request support; *) wifi-qcom — improved default RTS/CTS policy for CPE station radios; *) wifi-qcom — multicast-enhance will no longer apply for station mode configured devices; *) wifi,wireless — include «Event-Timestamp» in RADIUS accounting messages; *) winbox — added «Last Status» and «Last Address» fields in «Tools/Email» menu; *) winbox — added file selector for BTH files; *) winbox — added Forwarding Table in «MPLS» menu; *) winbox — added missing «SM-DP+ Oid» LTE eSIM provisioning field; *) winbox — added Sessions tab in «Routing/RPKI» menu; *) winbox — added support for new settings and fixed several existing ones; *) winbox — Bandwidth test, Speed test, Ping, Traceroute tools use RouterOS DNS service to resolve domain names; *) winbox — fixed «Too many entries» not showing in WinBox v4; *) winbox — fixed Disk iscsi/smb configuration; *) winbox — fixed Disk NVMe-TCP configuration; *) winbox — fixed Dude/Tools appearance after Apply action; *) winbox — fixed graphs in some forms with big numbers; *) winbox — fixed Keepalive Time format in «Routing/BGP» menus; *) winbox — fixed Preshared Key «auto» and «none» options for WireGuard Peer; *) winbox — fixed switch QoS monitor for mirror properties; *) winbox — hide certificate «Issuer» field for certificate template; *) winbox — hide IPv6 addresses for IP neighbors that no longer have them; *) winbox — make multiple address fields required; *) winbox — make separate inputs for WiFi Interworking «Authentication Types» and «Connection Capabilities» fields; *) winbox — make VETH gateway fields not required; *) winbox — move VRF from Ethernet to generic Interface table; *) winbox — removed «Add» for dynamic DNS servers; *) winbox — reorder BGP and OSPF tabs in logical order; *) winbox — restore route max object 10000 limit; *) winbox — show «Trusted» field for certificate template; *) winbox — show warnings in «Routing/BGP» menus; *) winbox — show warnings in Disk menu; *) winbox — updated and shortened window titles (e.g. Address List -> Addresses); *) wireguard — added VRF option (CLI only); *) wireguard — allow to add AllowedIPs configuration for client configuration template; *) wireless — added last-ip parameter for the CAPSMAN registration-table tab; *) wireless — improved system stability when stopping scan process; *) www — added option to disable individual web services in /ip/service/webserver and IP>Services>Web Server; *) www — handle escaped characters in resource IDs and names for REST API requests; *) www — process REST API requests only after user authentication is completed; *) www — removed ability to publish directories via «/files» www service;

Заключение

RouterOS 7.21 — это зрелый и продуманный релиз, сочетающий в себе как новые функции (контейнеры, RFC 9234, TOTP), так и глубокую доработку существующих компонентов. Независимо от того, управляете ли вы небольшой сетью или крупной инфраструктурой провайдера, обновление до этой версии принесёт ощутимые преимущества в стабильности, безопасности и гибкости настройки.

Хотите освоить все возможности RouterOS? Присоединяйтесь к нашему курсу MikroTik для профессионалов», где мы детально разбираем BGP, IPv6, контейнеры и автоматизацию на реальных кейсах.

Как проверить результат

• Отметьте функции, которые используются на вашем устройстве.
• Прочитайте промежуточные changelog и известные ограничения архитектуры.
• Проверьте обновление на резервном устройстве или CHR до рабочей сети.

Источники и связанные материалы

• Changelog RouterOS
• Все статьи
• Аудит MikroTik
• Настройка MikroTik

Команды в статье меняют сетевую конфигурацию. Перед работой сохраните экспорт, подготовьте способ восстановления доступа и применяйте изменения сначала в тестовой среде.