MikroTik RouterOS x86 Firmware 6.40 RC 38 Download

Posted at December 21, 2024 by PCI-DB Team

MikroTik RouterOS x86 Firmware 6.40 RC 38 Description

Important note backup before upgrade!

- RouterOS v6.40rc36 contains new bridge implementation that supports hardware offloading (hw-offload).
- This update will convert all interface "master-port" configuration into new bridge configuration, and eliminate "master-port" option as such.
- Bridge will handle all Layer2 forwarding and the use of switch-chip (hw-offload) will be automatically turned on based on appropriate conditions.
- The rest of RouterOS Switch specific configuration remains untouched in usual menus for now.
- Please, note that downgrading to previous RouterOS versions will not restore "master-port" configuration, so use backups to restore configuration on downgrade.

What's new in 6.40rc38:

- certificate - update and reload old certificate with new one if SKID matches;
- email - added support for multiple attachments;
- firewall - added "none-dynamic" and "none-static" options for "address-list-timeout" parameter;
- firewall - fixed crash on fasttrack dummy rule manual change attempt;
- ikev2 - fixed duplicate policy checking with "0.0.0.0/0" policies;
- lte - added initial fastpath support (except SXT LTE and Sierra modems);
- mmips - added support for NVME disks;
- ppp - added output values for "info" command for finding the GSM base station's location ("LAC" and "IMSI");
- ppp - fixed "user-command" output;
- quickset - simplified LTE status monitoring;
- rb1100ahx4 - fixed startup problems (requires additional reboot after upgrade);
- ssl - added Wildcard support for "left-most" DNS label (will allow to use signed Wildcard certificate on VPN servers);
- userman - do not send disconnect request for user when "simultaneous session limit reached";
- userman - added "/tool user-manager user clear-profiles" command;

Other changes since 6.39.2:

- bridge - implemented software based "igmp-snooping" (untested, undocumented, CLI only);
- bridge - implemented software based MSTP (untested, undocumented, CLI only);
- bridge - implemented software based vlan-aware bridges;
- switch - "master-port" conversion into a bridge with hardware offload "hw" option (undocumented, CLI only);
- switch - CRS3xx switch VLAN configuration integrated within bridge VLAN configuration with hw-offload;
- wireless - added Nv2 AP synchronization feature (for experimental use)(CLI only);
- btest - fixed crash when packet size has been changed during test;
- capsman - added "current-registered-clients" and "current-authorized-clients" count for CAP interfaces;
- capsman - fixed EAP identity reporting in "registration-table";
- capsman - set minimal "caps-man-names" and "caps-man-certificate-common-names" length to 1 char;
- certificate - added "crl-use" setting to disable CRL use (CLI only);
- chr - fixed MAC address assignment when hot plugging NIC on XenServer;
- chr - maximal system disk size now limited to 16GB;
- conntrack - fixed IPv6 connection tracking enable/disable;
- console - fixed different command auto complete on ;
- crs212 - fixed Optech sfp-10G-tx module compatibility with SFP ports;
- defconf - added IPv6 default firewall configuration (IPv6 package must be enabled on reset);
- defconf - improved IPv4 default firewall configuration;
- defconf - renamed 192.168.88.1 address static DNS entry from "router" to "router.lan";
- dhcp - added "debug" logs on MAC address change;
- dhcpv4-client - added "gateway-address" script parameter;
- dhcpv4-server - fixed lease renew for DHCP clients that sends renewal with "ciaddr = 0.0.0.0";
- dhcpv4-server - fixed server state on interface change in Winbox and Webfig;
- discovery - fixed timeouts for LLDP neighbours;
- dns - remove all dynamic cache RRs of same type when adding static entry;
- dude - fixed server crash;
- ethernet - fixed forced 10Mbps full-duplex linking on 100Mbps Ethernet ports;
- ethernet - fixed occasional broken interface order after reset/first boot;
- ethernet - fixed rare linking problem with forced 10Mbps full-duplex mode;
- export - added "terse" option;
- export - added default "init-delay" setting for "/routerboard settings" menu;
- export - added router model and serial number to configuration export;
- export - fixed "/interface list" verbose export;
- export - fixed "/ipv6 route" compact export;
- export - fixed MPLS "dynamic-label-range" export;
- export - fixed SNMP "src-address" for compact export;
- fastpath - fixed router rebooting itself (introduced in 6.40rc24);
- fastpath - improved performance when packets for slowpath are received;
- fastpath - improved removing process of dynamic interface;
- fasttrack - fixed fasttrack over interfaces with dynamic MAC address;
- fetch - added "src-address" parameter for HTTP and HTTPS;
- filesystem - improved error correcting process on tilera and RB1100Dx4 storage;
- firewall - fixed bridge "action=log" rules;
- firewall - fixed cosmetic "inactive" flag when item was disabled;
- firewall - removed unique address list name limit;
- hAP ac lite - removed nonexistent "wlan-led";
- health - fixed memory leak on devices that have "/system health" menu (introduced in 6.40rc30);
- hotspot - added "address-list" support in "walled-garden" IP section;
- hotspot - require "dns-name" to contain "." symbol under Hotspot Server Profile configuration;
- ike1 - added support for "framed-pool" RADIUS attribute;
- ike1 - fixed minor memory leak on peer configuration change;
- ike1 - kill phase1 instead of rekey if "mode-config" is used;
- ike1 - removed SAs on DPD;
- ike1 - send phase1 delete;
- ike2 - added RADIUS attributes "Framed-Pool", "Framed-Ip-Address", "Framed-Ip-Netmask";
- ike2 - added pfkey kernel return checks;
- ike2 - added support for "Mikrotik_Address_List" RADIUS attribute;
- ike2 - added support for "mode-config" static address;
- ike2 - by default use "/24" netmask for peer IP address in split net;
- ike2 - prefer traffic selector with "mode-config" address;
- ikev1 - added log error message if netmask was not provided by "mode-config" server;
- ipsec - added "firewall=add-notrack" peer option (CLI only);
- ipsec - added information in console XML for "mode-config" menu;
- ipsec - added support for "key-id" peer identification type;
- ipsec - do not deduct "dst-address" from "sa-dst-address" for "/0" policies;
- ipsec - enabled modp2048 DH group by default;
- ipsec - fixed connections cleanup on policy or proposal modification;
- ipsec - optimized logging under IPSec topic;
- ipsec - removed policy priority;
- l2tp - fixed handling of pre-authenticated L2TP sessions with CHAP authentication;
- l2tp-server - added "one-session-per-host" option;
- log - added "poe-out" topic;
- log - improved "l2tp" logs;
- log - optimized "wireless,info" topic logs;
- log - work on false CPU/RAM overclocked alarms;
- lte - added "accounting" logs for LTE connections;
- lte - added additional driver support for DWR-910;
- lte - added info command support for the Jaton LTE modem;
- lte - added initial support for "NTT DoCoMo" modem;
- lte - added support for Huawei E3531-6;
- lte - improved SMS delivery report;
- lte - improved reliability on SXT LTE;
- metarouter - fixed display of bogus error message on startup;
- modem - added support for ZTE TE W120;
- modem - fixed info command when it is executed at the same time as modem restarts/disconnects;
- ovpn - added support for "push-continuation";
- ovpn - added support for topology subnet for IP mode;
- ovpn - fixed duplicate default gateway presence when receiving extra routes;
- ovpn - improved performance when receiving too many options;
- packages - increased automatic download retry interval to 5 minutes if there is no free disk space;
- ping - fixed ping getting stuck (after several thousands of ping attempts);
- ppp - added initial support for ZTE K4203-Z;
- ppp - added initial support for ZTE ME3630-E;
- ppp - improved MLPPP packet forwarding performance;
- ppp - use interface name instead of IP as default route gateway;
- proxy - fixed potential crash;
- proxy - fixed rare program crash after closing client connection;
- quickset - added "Band" setting to "CPE" and "PTP CPE" modes;
- quickset - added special firewall exception rules for IPSec;
- quickset - fixed incorrect VPN address value on arm and tilera;
- quickset - use active user name and permissions when applying changes;
- rb3011 - fixed packet passthrough on switch2 while booting;
- rb750gr3 - fixed USB power;
- routerboard - added "caps-mode" option for "reset-configuration" (CLI only);
- routerboard - added "caps-mode-script" for default-configuration print;
- routing - allow to disable "all" interface entry in BFD;
- safe-mode - fixed session handling when Safe Mode is used on multiple sessions at the same time;
- sms - decode reports in readable format;
- sniffer - do not skip L2 packets when "all" interface mode was used;
- snmp - added "ifindex" on interface traps;
- snmp - added CAPsMAN interface statistics;
- snmp - added ability to set "src-address";
- snmp - fixed "/system resource cpu print oid" menu;
- snmp - fixed crash on interface table get;
- snmp - fixed wireless interface walk table id ordering;
- socks - fixed crash while processing many simultaneous sessions;
- supout - fixed IPv6 firewall section;
- switch - fixed "loop-protect" on CRS SFP/SFP+ ports;
- tile - fixed copying large amount of text over serial console;
- tr069-client - fixed lost HTTP header on authorization;
- trafficgen - added "lost-ratio" to statistics;
- ups - show correct "line-voltage" value for usbhid UPS devices;
- userman - lookup language files also in "/flash" directory;
- vlan - do not delete existing VLAN interface on "failure: already have such vlan";
- webfig - fixed wireless "scan-list" parameter not being saved after applying changes;
- winbox - added "eap-identity" to CAPsMAN registration table;
- winbox - added "no-dad" setting to IPv6 addresses;
- winbox - added "reselect-channel" to CAPsMAN interfaces;
- winbox - added "session-uptime" to LTE interface;
- winbox - added "src-address-list" & "dst-address-list" to HotSpot Walled Garden;
- winbox - added TR069 support;
- winbox - do not autoscale graphs outside known maximums;
- winbox - fixed wireless interface "amsdu-threshold" max limit;
- winbox - hide LCD menu on CRS112-8G-4S;
- winbox - moved LTE info fields to status tab;
- winbox - show "/system health" only on boards that have health monitoring;
- winbox - show "D" flag under "/interface mesh port" menu;
- wireless - NAK any methods except MS-CHAPv2 as inner method in PEAP;
- wireless - added option to change "nv2-downlink-ratio" for nv2 protocol;
- wireless - added option to set "fixed-downlink" mode for nv2 protocol;
- wireless - allow VirutalAP on Level0 (24h demo) license;
- wireless - always use "multicast-helper" when DHCP is being used;
- wireless - do not skip >2462 channels if interface is WDS slave;
- wireless - fixed 802.11u wireless request processing;
- wireless - fixed EAP PEAP success processing;
- wireless - fixed compatibility with "AR5212" wireless chips;
- wireless - fixed rare crash on cap disable;
- wireless - fixed registration table "signal-strength" reporting for chains when using nv2;

About Router Firmware:

Before you consider downloading this firmware, go to the system information page of the router and make sure that the currently installed version isn't either newer or matching this release.

Due to the large variety of router models and different methods for upgrading the device, it is highly recommended that you read and, above all, understand the installation steps before you apply the new firmware, even if you are a power user.

In theory, these steps shouldn't be much of a hassle for anyone, because manufacturers try to make them as easy as possible, even if they don't always succeed. Basically, you must upload the new firmware to the router through its administration page and allow it to upgrade.

If you install a new version, you can expect increased security levels, different vulnerability issues to be resolved, improved overall performance and transfer speeds, enhanced compatibility with other devices, added support for newly developed technologies, as well as several other changes.

If you're looking for certain safety measures, remember that it would be best if you perform the upload using an Ethernet cable rather than a wireless connection, which can be interrupted easily. Also, make sure you don't power off the router or use its buttons during the installation, if you wish avoid any malfunctions.

If this firmware meets your current needs, get the desired version and apply it to your router unit; if not, check with our website as often as possible so that you don't miss the update that will improve your device.

  It is highly recommended to always use the most recent driver version available.

Try to set a system restore point before installing a device driver. This will help if you installed an incorrect or mismatched driver. Problems can arise when your hardware device is too old or not supported any longer.

Related MikroTik Drivers