MikroTik RouterOS ARM Firmware 6.47 RC 60

Important note!!!

- The Dude server must be updated to monitor v6.46.4 and v6.47beta30+ RouterOS type devices.
- The Dude client must be manually upgraded after upgrading The Dude server.
- Make sure LTE APN Profile name does not match any of the DHCP server's names if LTE passthrough is used.
- The Dude requires "winbox" policy instead of "dude" to monitor v6.46.4 and v6.47beta30+ RouterOS type devices.

MAJOR CHANGES IN v6.47:

- dns - added client side support for DNS over HTTPS (DoH) (RFC8484);
- socks - added support for SOCKS5 (RFC 1928);
- user - enable "winbox" policy for groups with "dude" policy;

Changes in this release:

- dns - added client side support for DNS over HTTPS (DoH) (RFC8484);
- socks - added support for SOCKS5 (RFC 1928);
- branding - improved branding package installation process when another branding package is already installed;
- chr - enabled support for VMBus protocol version 4.1;
- chr - improved system stability when running CHR on Hyper-V;
- crs3xx - fixed hardware offloaded bonding on Ethernet interfaces for CRS354 devices;
- crs3xx - fixed switch rule "dst-port" parameter for IPv6 traffic on CRS305-1G-4S+, CRS326-24G-2S+, CRS328-24P-4S+, CRS328-4C-20S-4S+, netPower 15FR devices;
- crs3xx - improved system stability when creating multiple hardware offloaded bonding interfaces (introduced in v6.47beta49);
- crs3xx - show correct switch model for netPower 15FR device;
- defconf - fixed default IP address assigning on non-paired 60 GHz devices;
- disk - improved disk management service stability when receiving bogus packets;
- dns - added support for forwarding DNS queries of static entries to specific server (CLI only);
- dns - added support for multiple type static entries (CLI only);
- email - added support for multiple "to" recipients (CLI only);
- graphing - improved graphing service stability when receiving bogus packets;
- ike1 - do not try to keep phase 2 when purging phase 1;
- ike2 - added support for RADIUS Disconnect-Request message handling;
- interface - increased loopback interface MTU to 65536;
- ipsec - allow specifying two peers for a single policy for failover (CLI only);
- lora - added "altitude", "latitude" and "longitude" to stat json if GPS is available;
- lte - improved stability during firmware upgrade process;
- routerboard - added "hold-time" parameter to mode-button menu (CLI only);
- routerboard - added "reset-button" menu - custom command execution with reset button (CLI only);
- snmp - fixed "ifSpeed" reporting for tunnel interfaces;
- ssh - improved SSH service stability when receiving bogus packets;
- switch - correctly display switch statistics when all switch ports are disabled on RTL8367 switch chip;
- switch - fixed missing switch statistics (introduced in v6.47beta49);
- user - improved user management service stability when receiving bogus packets;
- webfig - fixed WinBox download link;
- webfig - fixed skin usage from branding package;
- winbox - added "bus" parameter for "USB Power Reset" command on RBM33G;
- winbox - allow to specify any ethernet like interface under "Tool/WoL" menu;
- winbox - fixed "Tx/Rx Signal Strength" value presence for 4 chain interfaces;
- winbox - fixed memory leak (introduced in v6.46.4);
- winbox - fixed wireless interface "HT" tab setting presence when "band=5ghz-n/ac";
- winbox - increased limit of multi-entry fields to 100;
- winbox - limit number of simultaneous WinBox sessions to 5 for users without "write" permission;
- wireless - improved management service stability when receiving bogus packets;
- wireless - updated "south africa" regulatory domain information;

Other changes since v6.46.5:

- bonding - improved slave interface MAC address handling;
- bonding - prefer primary slave MAC address for bonding interface;
- branding - do not ask to confirm configuration applied from branding package;
- branding - fixed identity setting from branding package;
- branding - properly use HTML files for Hotspot (introduced in v6.47beta);
- bridge - added logging message when a host MAC address is learned on a different bridge port;
- bridge - added warning message when port is dynamically added to entry with VLAN range (CLI only);
- bridge - correctly remove disabled MSTI;
- bridge - improved hardware offloading enabling/disabling;
- certificate - added "skid" and "akid" values for detailed print;
- certificate - allow dynamic CRL removal;
- certificate - disabled CRL usage by defau<
- certificate - do not use SSL for first CRL update;
- chr - added support for file system quiescing;
- crs3xx - correctly remove switch rules on CRS317-1G-16S+ and CRS309-1G-8S+ devices;
- crs3xx - do not change bridge host ID's when updating host table (introduced in v6.47beta32);
- crs3xx - fixed "ingress-rate" property on CRS309-1G-8S+, CRS312-4C+8XG, CRS326-24S+2Q+ devices;
- crs3xx - fixed QSFP interface linking after removing/inserting QSFP module (introduced in v6.47beta49);
- crs3xx - fixed QSFP+ interface linking for CRS326-24S+2Q+ device (introduced in v6.47beta19);
- crs3xx - improved switch host table updating;
- defconf - fixed "no-defaults=yes" applying default configuration (introduced in v6.47beta);
- defconf - fixed default configuration initialization if power loss occurred during the process;
- dhcpv4 - added end option (255) validation for both server and client;
- dhcpv4-client - improved stability when changing client while still receiving advertisements;
- dhcpv4-server - disallow zero lease-time setting;
- dhcpv6-client - improved error logging when when renewed address differs;
- dhcpv6-server - fixed MAC address retrieving from DUID when timestamp is present;
- discovery - do not send discovery packets on inactive bonding slave interfaces;
- discovery - do not send discovery packets on interfaces that are blocked by STP;
- disk - improved recently created file survival after reboots;
- dns - added support for exclusive dynamic DNS server usage from IPsec;
- dot1x - added "radius-mac-format" parameter (CLI only);
- dot1x - added hex value support for RADIUS switch rules;
- dot1x - added range "dst-port" support for RADIUS switch rules;
- dot1x - added support for lower case "mac-auth" RADIUS formats;
- dot1x - fixed "reject-vlan-id" value range;
- dot1x - fixed dynamically created switch rule removal when client disconnects;
- dot1x - fixed port blocking when interface changes state from disabled to enabled;
- dot1x - improved debug logging output to "dot1x" topic;
- dot1x - improved value validation for dynamically created switch rules;
- fetch - fixed "User-Agent" usage if provided by "homepage";
- filesystem - fixed NAND memory going into read-only mode or becoming unstable over time;
- health - added "gauges" submenu with SNMP OID reporting;
- hotspot - updated splash page design ('/ip hotspot reset-html' required);
- ike1 - added error message when specifying "my-id" for XAuth Identity;
- ike1 - added support for "UNITY_DEF_DOMAIN" and "UNITY_SPLITDNS_NAME" payload attributes;
- ike1 - improved policy lookup with specific protocol;
- ike1 - improved stability when performing policy lookup on non-existant peer;
- ike2 - added support for "INTERNAL_DNS_DOMAIN" payload attribute;
- ipsec - added "split-dns" parameter support for mode configuration (CLI only);
- ipsec - added "use-responder-dns" parameter support (CLI only);
- ipsec - control CRL validation with global "use-crl" setting;
- ipsec - do full certificate validation for identities with explicit certificate;
- ipsec - fixed minor spelling mistake in logs;
- ipsec - improved IPsec service stability when receiving bogus packets;
- kidcontrol - ignore IPv6 multicast MAC addresses;
- lcd - fixed LCD service becoming unavailable on devices without LCD screen;
- led - fixed minor typo in LED warning message;
- lte - added support for Huawei K5161 modem;
- lte - added support for NEOWAY N720;
- lte - added support for multiple passthrough APN configuration;
- lte - do not allow running "scan" on R11e-4G;
- lte - fixed "allow-roaming" setting when using LTE network mode on R11e-LTE;
- lte - fixed "band" value setting when configuration is reset on R11e-4G;
- lte - fixed multiple APN reactivation after deactivation by operator;
- lte - made "mac-address" parameter read-only;
- lte - show "phy-cellid" value only in LTE mode;
- netinstall - removed "Flashfig" from Netinstall;
- netinstall - removed "Make Floppy" from Netinstall;
- netinstall - signed netinstall.exe with Digital Signature;
- ppp - added support for ZTE MF90;
- ppp - fixed minor typo when running "info" command;
- proxy - increased minimal free RAM that can not be used for proxy services;
- quickset - do not show "SINR" field in Quick Set when there is no data;
- quickset - removed "EARFCN" field from Quick Set;
- quickset - removed "LTE band" setting from Quick Set;
- quickset - show "Antenna Gain" setting on devices without built-in antennas;
- quickset - use "station-wds" mode when connecting to AP with RouterOS flag;
- route - improved system stability after reboot with large amount of VLAN interfaces with PPPoE servers attached;
- routing - improved IGMP-Proxy service stability when receiving bogus packets;
- sniffer - allow setting port for "streaming-server";
- snmp - added "dot1qTpFdbTable" OID reporting for Q-BRIDGE-MIB;
- snmp - changed "upsEstimatedMinutesRemaining" reported value from seconds to minutes;
- snmp - fixed "dot1dBasePort" index offset for BRIDGE-MIB;
- snmp - fixed multiple LTE interface OID reporting;
- snmp - improved OID policy checking and error reporting on "set" command;
- snmp - improved stability when polling MAC address related OID;
- ssh - fixed SHA256 user authentication algorithm checking (introduced in v6.46.4);
- supout - added "dot1x" section to supout files;
- supout - improved UPS information reporting;
- switch - made "auto" the default value for "vlan-id" parameter when creating a new static host entry;
- system - correctly handle Generic Receive Offloading (GRO) for MPLS traffic;
- system - improved driver loading speed on startup;
- tr069-client - removed warning log message when not using HTTPS;
- traffic-flow - added "postDestinationMacAddress" parameter support for IPFIX and Netflow v9;
- upgrade - fixed space handling in package file names;
- ups - improved compatibility with APC Smart UPS 1000 and 1500;
- w60g - fixed link status logging;
- w60g - improved rate selection in low traffic conditions;
- w60g - use "arp" and "mtu" parameters from master interface when creating a new station;
- webfig - updated icon design;
- winbox - added "Rate" parameter for switch ACL rules;
- winbox - added "auto-erase" option to "Tool/SMS" menu;
- winbox - added comment support for "Switch->VLAN" menu;
- winbox - added support for inline bar graphs for LTE signal values;
- winbox - aligned all "IP->Traffic Flow->IPFIX" check boxes in single line (WinBox v3.22 required);
- winbox - allow setting "Primary" parameter for "balance-tlb" bonding interfaces;
- winbox - fixed "BGP Origin" value display under "IPv6->Routes" menu;
- winbox - fixed "Data Rate" checkbox alignment (WinBox v3.22 required);
- winbox - fixed bonding type interface support for "Switch->Host" table;
- winbox - made "yes" the default value for "Inject Summary LSAs" parameter when creating a new NSSA or STUB area;
- winbox - removed duplicate "join-eui", "dev-eui", "counter", "chain", "size" and "payload" parameters under "Lora/Traffic";
- winbox - renamed "Routerboard" to "RouterBOARD" under "System/RouterBOARD" menu;
- winbox - show "Hardware Offload" parameter for bonding interfaces;
- winbox - updated icon design;
- wireless - added "russia 6ghz" regulatory domain information;
- wireless - allow using "russia4" regulatory domain on RU locked devices;
- wireless - enabled unicast flood for DHCP traffic on ARM architecture access points;
- wireless - improved 5GHz interface stability on RB4011iGS+5HacQ2HnD and Audience;
- wireless - improved system stability on hAP ac^2;
- wireless - updated "russia4" regulatory domain information;
- www - added "tls-version" parameter in "IP->Services" menu (CLI only);

About Router Firmware:

Before you consider downloading this firmware, go to the system information page of the router and make sure that the currently installed version isn't either newer or matching this release.

Due to the large variety of router models and different methods for upgrading the device, it is highly recommended that you read and, above all, understand the installation steps before you apply the new firmware, even if you are a power user.

In theory, these steps shouldn't be much of a hassle for anyone, because manufacturers try to make them as easy as possible, even if they don't always succeed. Basically, you must upload the new firmware to the router through its administration page and allow it to upgrade.

If you install a new version, you can expect increased security levels, different vulnerability issues to be resolved, improved overall performance and transfer speeds, enhanced compatibility with other devices, added support for newly developed technologies, as well as several other changes.

If you're looking for certain safety measures, remember that it would be best if you perform the upload using an Ethernet cable rather than a wireless connection, which can be interrupted easily. Also, make sure you don't power off the router or use its buttons during the installation, if you wish avoid any malfunctions.

If this firmware meets your current needs, get the desired version and apply it to your router unit; if not, check with our website as often as possible so that you don't miss the update that will improve your device.

  It is highly recommended to always use the most recent driver version available.

Try to set a system restore point before installing a device driver. This will help if you installed an incorrect or mismatched driver. Problems can arise when your hardware device is too old or not supported any longer.