This is a stupid report because even if they're not stored in plaintext, there still has to be a decryption key stored in non-volatile memory somewhere to actually use these credentials, otherwise you would require the user to authenticate to unlock the credentials every time they were going to be used.

You could have the credentials encrypted at rest and then the user would have to provide a master key every time they boot the router. Who do you know that would do that? Reset the router and have to dig out their security key or provide a password before it can boot up? Not a chance. A boot up credential would be stored on a device permanently plugged into a USB port and it would be vulnerable to the exact same physical access attack.

This seems like the kind of "vulnerability" that would be reported by someone just looking for something to report so they can put it in their portfolio, not someone that actually understands security design for consumer devices.

Thanks for this info. I was wrong, I have a CRS320, not CRS310. And, here’s an Imgur album of how things are laid out: https://imgur.com/a/DT3htLJ

Now that I understand the topology better, I have questions about how the VLANs are assigned. Are you using a RADIUS server?

Also, I’m a little confused about the VLAN participation in both switches. I would expect an end client device (like those in your diagram) to connect to an untagged VLAN ports. But, your VLAN assignment screenshots only show your client VLANs on the trunk port.

For example, here’s how I’m doing untagged VLANs on my CRS320:

So, the fact that you can only reach VLAN10 targets from the CSS610 clients makes me think it’s related to VLAN assignment. Yes, it’s different than what’s being observed on your CRS310 clients, but one step at a time.

Hey HybridSarcasm

Pulled this together this afternoon, let me know if it's missing any key details.

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.12.74",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "GL.iNet GL-MT6000",
        "board_name": "glinet,gl-mt6000",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "25.12.1",
                "firmware_url": "https://downloads.openwrt.org/",
                "revision": "r32768-b21cfa8f8c",
                "target": "mediatek/filogic",
                "description": "OpenWrt 25.12.1 r32768-b21cfa8f8c",
                "builddate": "1773711117"
        }
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid 'REDACT'
        option ula_prefix 'REDACT'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan5'

config interface 'lan'
        option device 'br-lan.10'
        option proto 'static'
        option ip6assign '60'
        option multipath 'off'
        list ipaddr '10.1.10.1/24'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'lan1:t'
        list ports 'lan2:t'
        list ports 'lan5:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan1:t'
        list ports 'lan2:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '30'
        list ports 'lan1:t'
        list ports 'lan2:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '40'
        list ports 'lan1:t'
        list ports 'lan2:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '50'
        list ports 'lan1:t'
        list ports 'lan2:t'

config interface 'IoT'
        option proto 'static'
        option device 'br-lan.20'
        option ipaddr '10.1.20.1'
        option netmask '255.255.255.0'
        option multipath 'off'

config interface 'Guest'
        option proto 'static'
        option device 'br-lan.30'
        option ipaddr '10.1.30.1'
        option netmask '255.255.255.0'
        option multipath 'off'
        option type 'bridge'

config interface 'Main'
        option proto 'static'
        option device 'br-lan.40'
        option ipaddr '10.1.40.1'
        option netmask '255.255.255.0'
        option multipath 'off'

config interface 'Servers'
        option proto 'static'
        option device 'br-lan.50'
        option ipaddr '10.1.50.1'
        option netmask '255.255.255.0'
        option multipath 'off'

• Yep, the Flint 2 is tagging ports 2 & 3 with all VLAN IDs (trunk?)
• Nothing between the router and switches
• Shared the /etc/config/network

How do you have your switches configured?

I have these 2 Mikrotik switches, but in a different configuration.

It would be good to know what your router is doing. Is it tagging ports? What is between the router and the switches? What are the configs of the ports on the router?

A detailed network diagram might also be helpful.

@mikrotik@mikrotik.social @mikrotik@lemmy.world my home lab earned me a job in a datacenter. My home network is also 90% mikrotik!

Just completed the arm to arm64 conversion on my L009.

Thanks Mikrotik!

Adore my Mikrotik router. Took me longer to set up compared to the other routers here because of lack of familiarity, love it anyway.

Advantage of mikrotik: you can make everything with it

Disadvantage of mikrotik: you must make everything with it

(But still my preferred routers.)

Had no issues with the few mikrotik bits I have. Easily my favourite provider now.

Most happy and enthusiastic Latvian man

This is a reference to Steve Jobs' iPhone 1 presentation from 2007: https://www.youtube.com/watch?v=VQKMoT-6XSg

thanks for not spoiling ;)

Hap be³ Media, finally more than 1 port with 2.5Gb/s. No date or price announced.

I managed to get it working with IPv6 mangle.

I seem to need 3x mangle rules, preroute mark connection, preroute mark routing, and forward mark routing. I also needed to disable fasttrack for marked connections.

The downside is that there seems to be a performance hit, as mangle is (I guess?) more resource intensive than simple routing rules.

ETA: It seems the mark routing preroute wants an interface (in my case, a VLAN), although my use case is a little funky as I am routing this traffic via WireGuard running on an AP, as the AP CPU is way beefier than my router.

Brilliant! That did it perfectly! Thanks!

/caps-man/datapath/remove [find]
/caps-man/configuration/remove [find]
/caps-man/provisioning/remove [find]

In the square brackets you can write something like [find disabled=yes] to remove all disabled entries, but if you just leave it empty it will select all.

@mikrotik@mikrotik.social @mikrotik@lemmy.world nice typo to avoid the copyreich olimpifascists ringing at your door :'D

@non_burglar Thank you for your support! :) The Fediverse is too good to ignore, we're still exploring all the options, but so far - loving it! 😎

I just realized you post on Lemmy?!?

Thanks for your products. I'm a huge fan!

@Albirew @mikrotik@lemmy.world @mikrotik@mikrotik.social OK, looks like we're suspended on mikrotik.social (maybe due to their ISP allowing me to contact them but not the other way around, they suspended this instance in order not to flood their logs with timeouts...)

I have the rb5009, love it and routerOS. WireGuard and DDNS was so simple to setup, I found the software much better than unifi.

@mikrotik@mikrotik.social @mikrotik@lemmy.world sure when they get in your home, they get a tour, but I promise when I find a way into your home I’m making off with the RB6009 prototype

Oh hey, I kinda listened to this video earlier, thanks for reminding me to go back and watch it. I gotta say I like what I heard though. I really need to try some of your products one of these days, I am slowly upgrading to 2.5GB on my home network so maybe when the time comes to replace the switches that are on either side of the Cat 6 cable that connects the 2 halves of my house I will give one of yours a try, maybe the CRS304-4XG-IN. I only have 3 devices on either side but it would be nice to have them all chatting away at 2.5GB with a speedy 10GB trunk between the two networks.

@mikrotik@mikrotik.social @mikrotik@lemmy.world shouldn't your server room be more like intelligent design than evolution by natural selection? 🤔

@mikrotik how much better yer network runnin with all them perty cable ties? 😆I kinda like the security my floor-spaghetti provides 😉