Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Table of Contents

The device-mode is a feature in ROS that which sets specific limitations to on a device for accessing specific configurations, or limits access to specific configuration options.
There are two available modes: enterprise and home. By default, all devices have a mode: enterpriseuse the mode enterprise, which allows all functionality except container. The home mode disables the following features: scheduler, socks, fetch, bandwidth-test, traffic-gen, sniffer, romon, proxy, hotspot, email, zerotier, container.

Code Block
languageros
[admin@MikroTik] > system/device-mode/print 
  mode: enterprise

enterprise is a mode that allows all functions on the device. Currently, the only additional mode is home, which means limited functionality. The device mode can be changed by the user, but remote access to the device is not enough to change it. After changing the device-mode, using the update command, you need to confirm it, by pressing a button on the device itself, or perform a "cold reboot" - that is, unplug the power:

...

If no power off or button press is performed within the specified time, the update mode change is canceled. If another update command is run in parallel, both will be canceled.

Note

It is possible that in the future there will be a number of devices that will be set to mode = home at the factory, which means that they will reach users with limited functionality, and then if you want advanced features, you will have to change it yourself.

Properties

Following properties  

The following commands are available in thesystem/device-mode/console path. menu: 

PropertyDescription

get

Returns value that you can assign to variable or print on the screen.

printShows the active mode and its properties.
updateUpdates selected properties.

Sub-menu: /device-mode/update

...

Applies changes to the specified properties, see below. 

List of available properties

Property

Description

container, fetch, scheduler, traffic-gen,   
ipsec, pptp, smb, l2tp, proxy, sniffer, zerotier, bandwidth-test, email, hotspot, romon, socks.
(yes | no; Default: yes, for enterprise mode)
The list of available features, which can be disabled controlled with the device-mode option.
activation-timeout (default: 5m);The reset button or power off activation timer timeout can be set in range ( 00:00:10 .. 1d00:00:00. If the reset button is not pressed (or cold reboot is not performed) during this interval, the update will be canceled. 
flagging-enabled (yes | no; Default: yes)Enable or disable the flagging feature flagged status. See Flagged notice below for a detailed description.
flagged (yes | no; Default: no)If RouterOS employs various mechanisms to detect tampering with it's system files. If the system has detected unauthorized access to RouterOS, the status "flagged" is set to yes. If "flagged" is set to yes, for your safety, certain limitations are put in place. See below chapter for more information. 
mode: (home, enterprise; default: enterprise);Allows choosing from available modes that will limit device functionality. In the future, various modes can could be added. 

By default, enterprise mode allows all options except container. So to use the container feature, you will need to turn it on by performing a device-mode update.

By default, home mode disables the following features: scheduler, socks, fetch, bandwidth-test, traffic-gen, sniffer, romon, proxy, hotspot, email, zerotier, container.

...

More specific control over the available features is possible. Each of the features controlled by device-mode can be specifically turned on or off, for example:

...

If the update command specifies any of the modeparameters, this update replaces the entire device-mode configuration. In this case, all "per-feature" settings will be lost, except those specified with this command. For instance:

...

We see that fetch = yes and email = yes is missing, as they were overriden with the mode change. However, specifying only "per-feature" settings will change only those:

Code Block
languageros
[admin@MikroTik] > system/device-mode/update hotspot=no
-- reboot --
[admin@MikroTik] > system/device-mode/print 
     mode: enterprise
  sniffer: no
  hotspot: no

If the feature is disabled, an error message is displayed for interactive commands:

...

However, it is possible to add the configuration to a disabled feature, but there will be a comment showing about the disabled feature in the device-mode:

Code Block
languageros
[admin@MikroTik] > ip hotspot/add interface=ether1 
[admin@MikroTik] > ip hotspot/print 
Flags: X, S - HTTPS
Columns: NAME, INTERFACE, PROFILE, IDLE-TIMEOUT
#   NAME      INTERFACE  PROFILE  IDLE-TIMEOUT
;;; inactivated, not allowed by device-mode
0 X hotspot1  ether1     default  5m          

Flagged

...

status

Along with thedevice-mode feature, ROS has implemented code that analyzes RouterOS now can analyse the whole configuration at system startup, to determine if there are any signs of unauthorized access to your router. If suspicious configurations are configuration is detected, the flagged flag is set at device-mode (and the corresponding configuration is disabled):suspicious configuration will be disabled and the flagged parameter will be set to "yes". The device has now a Flagged state and enforces certain limitations. 

Code Block
languageros
[admin@MikroTik] > system/device-mode/print 
     mode: enterprise
  flagged: yes
  sniffer: no
  hotspot: no

If the system has this flagged noticestatus, then the current configuration works, but it is not possible to perform a series of actions. If the action is restrictedthe following actions: 

bandwidth-test, traffic-generator, sniffer, as well as configuration actions that enable or create new configuration entries (it will still be possible to disable or delete them) for the following programs: system scheduler, SOCKS proxy, pptp, l2tp, ipsec, proxy, smb.

When performing the aforementioned actions while the router has the flagged state, you will receive an error message when doing so:

Code Block
languageros
[admin@MikroTik] > /tool sniffer/quick 
failure: configuration flagged, check all router configuration for unauthorized changes and update device-mode
[admin@MikroTik] > /int l2tp-client/add connect-to=1.1.1.1 user=user
failure: configuration flagged, check all router configuration for unauthorized changes and update device-mode

To remove exit the flagged noticestate, you must perform the command "/system/device-mode/update flagged=noThe following interactive actions will not be possible on the flagged device: bandwidth-test, traffic-generator, sniffer, as well as configuration actions that enable or create new configuration entries (it will still be possible to disable or delete) for the following contacts: scheduler, socks, pptp, l2tp, ipsec, proxy, smb.". The system will ask to either press a button, or issue a hard reboot (cut power physically or do a hard reboot of the virtual machine). 

Important! Although the system has disabled any malicious looking rules, which triggered the flagged state, it is crucial to inspect all of your configuration for other unknown things, before exiting the flagged state. If your system has been flagged, assume that your system has been compromised and do a full audit of all settings before re-enabling the system for use. After completing the audit, change all the system passwords and upgrade to the latest RouterOS version.