| Version | Change log |
| The Dude 7.21.1 Stabl Jan 21, 2026 |
bridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.21); bridge - improved stability when using MVRP (introduced in v7.21); certificate - fixed empty trust store handling in certain cases (introduced in v7.21); container - changed app auto update to be off by default; container - fixed issue where containers may not start with large mounts; health - fixed fan and PSU state logging for MIPSBE devices; leds - fixed power LED behavior for hAP ax S; lte - fixed APN configuration for QMI modems in a 3G network when use-network-apn=yes is used; switch - fixed switch type for hAP ax lite devices (introduced in v7.21); system - fixed rare partial loss of RouterOS configuration; |
| The Dude 7.21 Stable Jan 13, 2026 |
winbox - fixed switch QoS monitor for mirror properties; winbox - hide certificate "Issuer" field for certificate template; winbox - hide IPv6 addresses for IP neighbors that no longer have them; winbox - make multiple address fields required; winbox - make separate inputs for WiFi Interworking "Authentication Types" and "Connection Capabilities" fields; winbox - make VETH gateway fields not required; winbox - move VRF from Ethernet to generic Interface table; winbox - removed "Add" for dynamic DNS servers; winbox - reorder BGP and OSPF tabs in logical order; winbox - restore route max object 10000 limit; winbox - show "Trusted" field for certificate template; winbox - show warnings in "Routing/BGP" menus; winbox - show warnings in Disk menu; winbox - updated and shortened window titles (e.g. Address List -> Addresses); wireguard - added VRF option (CLI only); wireguard - allow to add AllowedIPs configuration for client configuration template; wireless - added last-ip parameter for the CAPSMAN registration-table tab; wireless - improved system stability when stopping scan process; www - added option to disable individual web services in /ip/service/webserver and IP>Services>Web Server; www - handle escaped characters in resource IDs and names for REST API requests; www - process REST API requests only after user authentication is completed; www - removed ability to publish directories via "/files" www service; |
| The Dude 7.20.6 Stabl Jan 12, 2026 |
Bgp - fixed l2vpn-cisco decoding (introduced in v7.20); Bgp - fixed occasional corruption of MPLS labels in BGP VPN update messages; Bridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20); Bridge - improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20); Bth - make user private-key sensitive; Console - fixed empty output in route menus when using "print where gateway"; Console - updated copyright notice; Firewall - clear relevant masqueraded connection tracking entries on IP address change; Ipv6 - initialize RA receiving when enabled and without any other IPv6 configuration; Log - fixed memory leak; Lte - fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20); Lte - fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17; Ovpn - fixed OVPN server handling on reboot (introduced in v7.20); Ovpn - improved system stability when using cipher=blowfish128; Sfp - fixed "sfp-tx-fault" state indication for CRS520-4XS-16XQ; Sfp - fixed missing link up/down notifies; Switch - fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches; System - detect policy mismatch sooner if script is executed internally by some other service; Ups - fixed board hibernation shutdown; Wifi-mediatek - added Superchannel regulatory profile; |
| The Dude 7.20.7 Stabl Jan 9, 2026 |
bridge - expose more DHCP snooping warning logs; bridge - fixed possible DHCP packet drop caused by the add-dhcp-option82; firewall - clear relevant masqueraded connection tracking entries on IP address change; log - fixed memory leak; tr069-client - expose 5G NR signal metrics for the Chateau R17 ax; w60g - fixed possible memory leak when an interface is disabled; winbox - fixed Preshared Key "auto" and "none" options for WireGuard Peer; |
| The Dude 7.20.6 Stabl Dec 16, 2025 |
bridge - fixed issue where use-ip-firewall was enabled due to running container (introduced in v7.21beta8); certificate - added certificate "trust-store" parameter (additional fixes); console - fixed empty output in route menus when using "print where gateway"; console - improved service stability and memory allocation when using "regexp" operator; console - improved service stability when executing commands that can timeout; hotspot - prevent service from starting unnecessarily in the background on export/print commands; lte - ask for user confirmation before installing eSIM profile (additional fixes); ovpn - improved system stability when using cipher=blowfish128; socksify - listen on all addresses for incoming connections; ups - fixed board hibernation shutdown; usb - fixed cases where USB bus order could change on D53 devices; |
| The Dude 7.20.5 Stabl Nov 28, 2025 |
bgp - fixed BGP origin attribute initial value; bgp - properly apply link.local connection setting when it is used as an interface; bgp-vpn - fixed prefix matching for filters "dst" matcher; ospf - fixed wrong LS Ack warning; pimsm - added comment for static-rp; route - fixed gateway print when gateway is equal to BGP peers address; route - fixed some routes installed in main routing table instead of specified VRF; route - make discourse work with destinations from VRF; routing-filter - fixed inline filters that process BGP communities; system - improved incoming TCP connection responsiveness; user - improved login service stability on busy system; webfig - fixed broken WebFig after going to Quick Set (introduced in v7.20.4); wifi - improved regulatory compliance for Bangladesh country profile; winbox - group L3 and L4 fields under switch rules menu; |
| The Dude 7.20.4 Stabl Nov 6, 2025 |
bgp - improved instance upgrade from versions prior to v7.20; console - fixed file id conversion operations; pppoe-server - fixed client disconnects when multiple servers are active (introduced in v7.20); rip - fixed RIP configuration conversion on upgrade from v6 to v7; route - fixed gateway print when gateway is equal to BGP peers address; routing-filter - check AFI when setting pref-src; routing-filter - fixed default route destination matcher behavior for different AFIs; webfig - fixed button handling in skin designer; winbox - show "Bus" parameter for "USB Power Reset" on Chateau LTE6/LTE18 ax devices; winbox - show "System/RouterBOARD/Mode Button" on devices that have such a button; |
| The Dude 7.20.2 Stabl Oct 22, 2025 |
bridge - fixed incorrectly blocked ports by STP (introduced in v7.20); console - fixed incorrect ids in /file/print relative mode (introduced in v7.20); console - improved stability when printing ids for a non-existent directory (introduced in v7.20) dhcpv6-client - improved system stability when DHCPv6 client uses "rapid-commit=no", "accept-prefix-without-address=no" and receives only prefix from the server; dhcpv6-server - do not force set "address-pool" on static bindings with unset pool option after system reboot; evpn - added basic logging support; evpn - fixed MAC mobility; firewall - reduce maximum connection tracking entry count; iot - fixed an issue preventing LoRa downlink packets from being broadcasted; ip - removed duplicate CLI parameters for socksify; log - cleaned up older config by removing leading slashes from "disk-file-name" values; mpls - fixed LDP label binding if nexthop is link-local address; poe-out - fixed RB5009 PoE-in indication on cold-boot with no other power source; routing-filter - change "^$" regexp to bgp-path-len=0 on upgrade from v6 to v7; routing-filter - use bgp-out-med for set bgp-med on upgrade from v6 to v7; snmp - fixed SNMP SET operation (introduced in v7.20); snmp - set maximum message size to 8 KB; system - fixed ".auto.rsc" file execution (introduced in v7.20); system - fixed package list fetch from local upgrade server; system - fixed Windows executable compatibility with Microsoft AppLocker; winbox - added IP/Socksify menu; winbox - added support for 200Gbps/400Gbps Rate fields; winbox - fixed Ethernet Tx Stats (introduced in v7.20); |
| The Dude 7.20.1 Stabl Oct 10, 2025 |
bgp - added output.network-blackhole setting; bgp - do not auto-generate blackhole routes by default (introduced in v7.20); bgp - fixed inactive flag in GUI after instance disable/enable; console - fixed ".id" printing when using "group-by" (introduced in v7.20); console - fixed relative path printing (introduced in v7.20); ike1 - fixed an issue where policies could be released too early before re-acquisition; ipsec - improved driver stability; ipv6,ra - fixed prefix unlinking from interface on configuration change and stop deprecating prefixes when the validity lifetime expires; lte - fixed issue with firmware update for FG621-EA modem; ppp - added support for KNOT BG77 modem firmware upgrade to version BG77LAR02A04_A0.301.A0.301; qos-hw - always use qos-hw-offloading=yes for CRS812 device; quickset - fixed issue where routes set by QuickSet did not appear in export; route - improved stability; routerboard - fixed non-running interfaces for CRS310-8G+2S+IN after booting to SwOS ("/system routerboard upgrade" required) (introduced in v7.20); sfp - improved interface link speed configuration for CRS812; snmp - fixed SNMP trap messages being corrupted when sent to multiple targets; switch - fixed "failure: cpu flow control not supported" (introduced in v7.20); webfig - fixed form closing with saving when pressing Enter key (introduced in v7.20); webfig - fixed interface settings and graphs (introduced in v7.20); webfig - improved container form loading performance when router has a lot of files; winbox - fixed WinBox 3 application failure when opening IPv6/Firewall/Connection entry (introduced in v7.20); www - improved stability (CVE-2025-10948); |
| The Dude 7.20 Stable Oct 7, 2025 |
arm64 - allow enabling receive packet steering on /system/resource/irq/rps menu in order to overcome unbalanced CPU load; bgp - added output.network-blackhole setting; bgp - allow duplicate router-ids for eBGP sessions (RFC-6286 ; bgp - always advertise extended nexthop cap for all supported address families; bgp - do not allow iBGP with non-equal ASNs; bgp - do not auto-generate blackhole routes by default (introduced in v7.20 ; bgp - fixed inactive flag in GUI after instance disable/enable; bgp - fixed route refresh subcode 0 warning; bgp - fixed selection of received BGP VPN routes; bgp - implement RFC 9234 route leak prevention and detection using roles; bonding - added lacp-system-id and lacp-system-priority settings; bonding - fixed lacp-mode=passive; bonding - improved stability for 802.3ad LACP; bridge - fixed filter and NAT matching with "mac-protocol=length"; bridge - fixed missing local MAC after changing protocol-mode setting; bridge - fixed static host and MDB entry updates on VLAN add/remove; bridge - improved DHCP Option 82 values (circuit-id:"interface-name:vid", remote-id:"bridge MAC address" ; bridge - improved stability after failed protocol-mode=mstp change; bth - added file-share link preview; bth - fixed big file upload; bth - fixed file-share expire after reboot; certificate - added SHA384, SHA512 support for SCEP; certificate - allow ca-crl-host parameter for issued certificates; certificate - improved Let's Encrypt logging; certificate - on certificate import, added the "issued" flag if the certificate store contains the imported certificate's CA and its private key; certificate - refactored Certificate internal processes; chr - fixed guest OS type "Other Linux (64-bit "; console - added "mvrp" to mac-protocol setting; console - added changelog to /system/package/update/check-for-updates; console - added delimiter parameter to :toarray command; console - added reset command to setti |
