Component: firewall
159 changelog entries across 58 version(s)
Activity over time (changelog entries per month)
- added "h" flag indicating that firewall service helper is applied for particular connection;
- added support for TOS/mask matching for raw rules;
- clear relevant masqueraded connection tracking entries on IP address change;
- fixed "tls-host" not matching expected hosts;
- fixed hotspot value loss on rule enable/disable;
- fixed strip-ipv4-options always passthrough;
- hide hw-offload setting from devices that do not support it;
- improved system stability and memory allocation when using firewall services;
- make hw-offload=yes default setting in /ip/firewall/filter menu;
- use the highest TTL as timeout value for domain address list entries if multiple domain names resolve to same IP;
- clear relevant masqueraded connection tracking entries on IP address change;
- reduce maximum connection tracking entry count;
- added "liberal-tcp-tracking" connection tracking setting;
- added connection tracking "total-ip4-entries" and "total-ip6-entries" counters;
- allow "dst-limit" matcher to work properly above value 10000;
- fixed IPv6 firewall interface matchers not matching VRF interfaces;
- improved IPv6 connection tracking lookup responsiveness;
- improved system stability when processing connections on multicore systems;
- reorganized firewall connection tracking table values and make them persistent between IPv4 and IPv6;
- always show "passthrough" when exporting mangle table;
- detect VRF addresses as local;
- fixed IP/Settings "ipv4-fasttrack-active" status showing as inactive when it is active;
- allow in-interface/in-bridge-port/in-bridge matching in postrouting chains;
- fixed incorrectly inverted hotspot value configuration;
- increased maximum connection tracking entry count based on device total RAM size;
- added none-dynamic and none-static arguments for IPv6 address-list-timout settings;
- added support for random external port allocation;
- added warning log for TCP SYN flood;
- fixed "dst-limit" and "limit" mathers when using zero value for burst argument;
- improved matching from deeply nested interface-lists;
- removed default mangle passthrough=yes configuration from export;
- added message when interface belonging to VRF is added in filter rules;
- fixed an issue with unsetting src-address-type;
- fixed IPv6 "nth" matcher showing up twice in help;
- fixed issue that prevents restoring src-address-list and dst-addres-list properties using undo command;
- removed unnecessary TLS host matcher from NAT tables;
- added "creation-time" parameter for IPv6 address list entries;
- fixed underlying CAPsMAN tunnel reusing packet marks of encapsulated packets;
- fixed underlying VXLAN/EoIP tunnel reusing packet marks of encapsulated packets;
- increased default "udp-timeout" value from 10s to 30s;
- added "nat-pmp" support;
- added new IPv6 filter arguments "icmp-err-src-routing-header" and "icmp-headers-too-long" for "reject-with" setting;
- do not mark all IPv6 GRE packets as invalid;
- fixed IPv6 address-list timeout;
- fixed altered address-list when upgrading from RouterOS v6;
- fixed connections being tracked when tracking is disabled;
- removed "prohibited" and "unreachable" IPv4 address-type arguments;
- added "ein-snat" and "ein-dnat" connection NAT state matchers for filter and mangle rules;
- added warning when PCC divider argument is smaller than remainder;
- fixed mangle "mark-connection" with "passthrough=yes" rule for TCP RST packets;
- improved system stability when using "endpoint-independent-nat";
- fixed IRC NAT helper (CVE-2022-2663);
- added "endpoint-independent-nat" support;
- added "nth" option for IPv6 firewall;
- fixed IRC NAT helper (CVE-2022-2663);
- added "connection-nat-state" to IPv6 mangle and filter rules;
- fixed bridge priority target;
- fixed DSCP priority target for IPv6 Mangle;
- fixed netmap range maximum address calculation for IPv6 NAT;
- added "set-priority" option for IPv6 mangle firewall;
- made "dynamic" parameter settable for IPv4 address lists;
- added "src/dst-address-type" parameter under "IPv6/Firewall/Mangle" menu;
- disable IRC NAT helper on upgrade;
- fixed IPv6 filtering with "in/out-interface" matcher that is in VRF;
- fixed IRC NAT helper (CVE-2022-2663);
- fixed usage of "netmap" action for IPv6 source NAT;
- added support for RTSP helper;
- fixed "in-interface-list" matcher when VRF is used;
- added "srcnat" and "dstnat" flags to IPv6/Firewall/Connection table;
- added support for IPv6/Firewall/NAT action=src-nat rules;
- fixed IPv6 NAT functionality when processing GRE traffic on TILE devices;
- fixed IPv6/Firewall/RAW functionality;
- include "connection-mark", "connection-state", and "packet-mark" when packet logging is enabled;
- properly handle interface matcher when VRF interface is specified;
- improved available port lookup for source NAT when free port range is exhausted;
- fixed "ingress-priority" matcher;
- fixed GRE protocol packets considered invalid when PPTP helper is disabled;
- fixed fragmented packet processing when only RAW firewall is configured;
- process packets by firewall when accepted by RAW with disabled connection tracking;
- fixed fragmented packet processing when only RAW firewall is configured;
- process packets by firewall when accepted by RAW with disabled connection tracking;
- fixed "tls-host" firewall feature (introduced in v6.41);
- limited maximum "address-list-timeout" value to “35w3d13h13m56s”;
- fixed "tls-host" firewall feature (introduced v6.41);
- limited maximum "address-list-timeout" value to 35w3d13h13m56s;
- added "tls-host" firewall matcher;
- do not NAT address to 0.0.0.0 after reboot if to-address is used but not specified;
- fixed bridge "action=log" rules;
- fixed crash on fasttrack dummy rule manual change attempt;
- properly remove "address-list" entry after timeout ends;
- removed unique address list name limit;
- properly remove "address-list" entry after timeout ends;
- do not allow to set "rate" value to 0 for "limit" parameter;
- fixed "address-list" entry "creation-time" adjustment to timezone;
- fixed "address-list" entry changing from IP to DNS and vice versa;
- fixed cosmetic "invalid" flag when item was disabled;
- fixed "address-list" entry "creation-time" adjustment to timezone;
- do not allow to set "rate" value to 0 for "limit" parameter;
- fixed "address-list" entry changing from IP to DNS and vice versa;
- do not allow to set "time" parameter to 0s for "limit" option;
- fixed import of exported configuration that had updated "limit" setting;
- do not allow to set "time" parameter to 0s for "limit" option;
- added "fasttrack" dummy rule to "/ip firewall raw" table;
- do not show IPv4 “fastpath” as active if “route-cache” is disabled;
- fixed import of exported configuration that had updated "limit" setting;
- nat action "netmap" now requires to-addresses to be specified;
- do not defragment packets which are marked with "notrack" in raw firewall;
- fixed "time" option by recognizing weekday properly (introduced in v6.37.2);
- fixed dynamic raw rule behaviour;
- fixed rule activation if "time" option is used and no other active rules are present;
- nat action "netmap" now requires to-addresses to be specified;
- added "creation-time" to address list entries;
- added sctp/dccp/udp-lite support for "src-port", "dst-port", "port" and "to-ports" firewall options;
- do not defragment packets which are marked with "notrack" in raw firewall;
- fixed "time" option by recognizing weekday properly (introduced in v6.37.2);
- fixed dynamic raw rule behaviour;
- fixed rule activation if "time" option is used and no other active rules are present;
- increased max size of connection tracking table to 1048576;
- new faster "connection-limit" option implementation;
- significantly improved large firewall rule set import performance;
- fixed filter rule "limit" parameter by making it visible again;
- fixed interface slave state recognition (broken in 6.37.2);
- fixed timeout option on address lists with domain name;
- do not allow to increase/decrease ttl and hop-limit by 0;
- fixed "connection-state" value disappearance in rules that were created before v6.22;
- fixed compact export (introduced in 6.37rc14);
- improved "time" option (ranges like 22h-10h now are acceptable);
- fixed dynamic dummy firewall rules appearance in raw tables;
- added additional matchers for firewall raw rules;
- fixed time based rules on time/timezone changes (again);
- fixed time based rules on time/timezone changes;
- added "/interface list" menu which allows to create list of interfaces which can be used as in/out-interface-list matcher in firewall and use as a filter in traffic-flow;
- added pre-connection tracking filter - "raw" table, that allow to protect connection-tracking from unnecessary traffic;
- allow to add domain name to address-lists (dynamic entries for resolved addresses will be added to specified list);
- added udplite, dccp, sctp connection tracking helpers;
- do not show disabled=no in export;
- fixed spelling in built-in firewall commentary;
- do not show disabled=no in export;
- fixed policy routing configurations (introduced in 6.35rc38);
- added experimental "action=route" in mangle prerouting - that forces packets to specific gateway by ignoring routing decisions (CLI only);
- added inversion support for "limit" option;
- added bit rate matching for "limit" option;
- improved performance for "limit" option;
- do not allow to add new rule before built-in (reverted);
- SIP helper update for newer Cisco phones;
- fixed connection-rate matcher;
- do not lose firewall mangle rules on start-up;
- fixed limit and dst-limit options.
- sip helper improved, large packets no longer dropped;
- added ipsec-policy matcher to check wheather packet
- fixed sector writes rising starting since 6.28;
- packet defragmenting will only happen with connection tracking enabled;
- optimized option matching order with-in a rule;
- rules that require CONNTRACK to work will now have Invalid flag
- rules that require use-ip-firewall to work will now have invalid flag
- rules that have interface with "Slave" flag specified as in-/out-interface
- rules that have interface without "Slave" flag specified as in-/out-bridge-port
- rules with Invalid flags will now be auto-commented to explain why;
- to-address can be specified as ip address with mask in addition to