Component: firewall
159 changelog entries across 58 version(s)
Releases by channel (stacked)
- added "h" flag indicating that firewall service helper is applied for particular connection;
- added support for TOS/mask matching for raw rules;
- clear relevant masqueraded connection tracking entries on IP address change;
- fixed "tls-host" not matching expected hosts;
- fixed hotspot value loss on rule enable/disable;
- fixed strip-ipv4-options always passthrough;
- hide hw-offload setting from devices that do not support it;
- improved system stability and memory allocation when using firewall services;
- make hw-offload=yes default setting in /ip/firewall/filter menu;
- use the highest TTL as timeout value for domain address list entries if multiple domain names resolve to same IP;
- clear relevant masqueraded connection tracking entries on IP address change;
- reduce maximum connection tracking entry count;
- added "liberal-tcp-tracking" connection tracking setting;
- added connection tracking "total-ip4-entries" and "total-ip6-entries" counters;
- allow "dst-limit" matcher to work properly above value 10000;
- fixed IPv6 firewall interface matchers not matching VRF interfaces;
- improved IPv6 connection tracking lookup responsiveness;
- improved system stability when processing connections on multicore systems;
- reorganized firewall connection tracking table values and make them persistent between IPv4 and IPv6;
- always show "passthrough" when exporting mangle table;
- detect VRF addresses as local;
- fixed IP/Settings "ipv4-fasttrack-active" status showing as inactive when it is active;
- allow in-interface/in-bridge-port/in-bridge matching in postrouting chains;
- fixed incorrectly inverted hotspot value configuration;
- increased maximum connection tracking entry count based on device total RAM size;
- added none-dynamic and none-static arguments for IPv6 address-list-timout settings;
- added support for random external port allocation;
- added warning log for TCP SYN flood;
- fixed "dst-limit" and "limit" mathers when using zero value for burst argument;
- improved matching from deeply nested interface-lists;
- removed default mangle passthrough=yes configuration from export;
- added message when interface belonging to VRF is added in filter rules;
- fixed an issue with unsetting src-address-type;
- fixed IPv6 "nth" matcher showing up twice in help;
- fixed issue that prevents restoring src-address-list and dst-addres-list properties using undo command;
- removed unnecessary TLS host matcher from NAT tables;
- added "creation-time" parameter for IPv6 address list entries;
- fixed underlying CAPsMAN tunnel reusing packet marks of encapsulated packets;
- fixed underlying VXLAN/EoIP tunnel reusing packet marks of encapsulated packets;
- increased default "udp-timeout" value from 10s to 30s;
- added "nat-pmp" support;
- added new IPv6 filter arguments "icmp-err-src-routing-header" and "icmp-headers-too-long" for "reject-with" setting;
- do not mark all IPv6 GRE packets as invalid;
- fixed IPv6 address-list timeout;
- fixed altered address-list when upgrading from RouterOS v6;
- fixed connections being tracked when tracking is disabled;
- removed "prohibited" and "unreachable" IPv4 address-type arguments;
- added "ein-snat" and "ein-dnat" connection NAT state matchers for filter and mangle rules;
- added warning when PCC divider argument is smaller than remainder;
- fixed mangle "mark-connection" with "passthrough=yes" rule for TCP RST packets;
- improved system stability when using "endpoint-independent-nat";
- fixed IRC NAT helper (CVE-2022-2663);
- added "endpoint-independent-nat" support;
- added "nth" option for IPv6 firewall;
- fixed IRC NAT helper (CVE-2022-2663);
- added "connection-nat-state" to IPv6 mangle and filter rules;
- fixed bridge priority target;
- fixed DSCP priority target for IPv6 Mangle;
- fixed netmap range maximum address calculation for IPv6 NAT;
- added "set-priority" option for IPv6 mangle firewall;
- made "dynamic" parameter settable for IPv4 address lists;
- added "src/dst-address-type" parameter under "IPv6/Firewall/Mangle" menu;
- disable IRC NAT helper on upgrade;
- fixed IPv6 filtering with "in/out-interface" matcher that is in VRF;
- fixed IRC NAT helper (CVE-2022-2663);
- fixed usage of "netmap" action for IPv6 source NAT;
- added support for RTSP helper;
- fixed "in-interface-list" matcher when VRF is used;
- added "srcnat" and "dstnat" flags to IPv6/Firewall/Connection table;
- added support for IPv6/Firewall/NAT action=src-nat rules;
- fixed IPv6 NAT functionality when processing GRE traffic on TILE devices;
- fixed IPv6/Firewall/RAW functionality;
- include "connection-mark", "connection-state", and "packet-mark" when packet logging is enabled;
- properly handle interface matcher when VRF interface is specified;
- improved available port lookup for source NAT when free port range is exhausted;
- fixed "ingress-priority" matcher;
- fixed GRE protocol packets considered invalid when PPTP helper is disabled;
- fixed fragmented packet processing when only RAW firewall is configured;
- process packets by firewall when accepted by RAW with disabled connection tracking;