The device-mode is a feature , which sets specific limitations on a device, or limits access to specific configuration options.
There are two available modes: enterprise and home. By default, all devices use the mode enterprise, which allows all functionality except container. The home mode disables the following features: scheduler, socks, fetch, bandwidth-test, traffic-gen, sniffer, romon, proxy, hotspot, email, zerotier, container.
| Code Block | ||
|---|---|---|
| ||
[admin@MikroTik] > system/device-mode/print mode: enterprise |
...
If no power off or button press is performed within the specified time, the mode change is canceled. If another update command is run in parallel, both will be canceled.
Commands
The following commands are available in the system/device-mode/ menu.:
| Property | Description |
|---|---|
get | Returns value that you can assign to variable or print on the screen. |
| Shows the active mode and its properties. | |
| update | Applies changes to the specified properties, see below. |
...
List of available properties
Property | Description |
|---|---|
| container, fetch, scheduler, traffic-gen, ipsec, pptp, smb, l2tp, proxy, sniffer, zerotier, bandwidth-test, email, hotspot, romon, socks. (yes | no; Default: yes, for enterprise mode) | The list of available features, which can be controlled with the device-mode option. |
| activation-timeout (default: 5m); | The reset button or power off activation timeout can be set in range 00:00:10 .. 1d00:00:00. If the reset button is not pressed (or cold reboot is not performed) during this interval, the update will be canceled. |
| flagging-enabled (yes | no; Default: yes) | Enable or disable the flagged status. See below for a detailed description. |
| flagged (yes | no; Default: no) | RouterOS employs various mechanisms to detect tampering with it's system files. If the system has detected unauthorized access to RouterOS, the status "flagged" is set to yes. If "flagged" is set to yes, for your safety, certain limitations are put in place. See below chapter for more information. |
| mode: (home, enterprise; default: enterprise); | Allows choosing from available modes that will limit device functionality. In the future, various modes could be added. By default, enterprise mode allows all options except container. So to use the container feature, you will need to turn it on by performing a device-mode update. By default, home mode disables the following features: scheduler, socks, fetch, bandwidth-test, traffic-gen, sniffer, romon, proxy, hotspot, email, zerotier, container. |
Configuration
More specific control over the available features is possible. Each of the features controlled by device-mode can be specifically turned on or off, for example:
...
| Code Block | ||
|---|---|---|
| ||
[admin@MikroTik] > /tool sniffer/quick failure: configuration flagged, check all router configuration for unauthorized changes and update device-mode [admin@MikroTik] > /int l2tp-client/add connect-to=1.1.1.1 user=user failure: configuration flagged, check all router configuration for unauthorized changes and update device-mode |
To exit the the flagged state, you must perform the command "/system/device-mode/update flagged=no". The system will ask to either press a button, or issue a hard reboot (cut power physically or do a hard reboot of the virtual machine).
Important! Although the system has disabled any malicious looking rules, which triggered the flagged state, it is crucial to inspect all of your configuration for other unknown things, before exiting the flagged state. If your system has been flagged, assume that your system has been compromised and do a full audit of all settings before re-enabling the system for use. After completing the audit, change all the system passwords and upgrade to the latest RouterOS version.