The device-mode is a feature, which sets specific limitations on a device, or limits access to specific configuration options.
There are two available modes: enterprise and home. By default, all devices use the mode enterprise, which allows all funtionality.
The device mode can be changed by the user, but remote access to the device is not enough to change it. After changing the device-mode, you need to confirm it, by pressing a button on the device itself, or perform a "cold reboot" - that is, unplug the power:
If no power off or button press is performed within the specified time, the mode change is canceled. If another update command is run in parallel, both will be canceled.
It is possible that in the future there will be a number of devices that will be set to mode home at the factory, which means that they will reach users with limited functionality, and then if you want advanced features, you will have to change it to enterprise manually.
The following properties are available in the system/device-mode/ menu.
Returns value that you can assign to variable or print on the screen.
|Shows the active mode and its properties.|
|update||Updates selected properties.|
|container, fetch, scheduler, traffic-gen, |
ipsec, pptp, smb, l2tp, proxy, sniffer, zerotier, bandwidth-test, email, hotspot, romon, socks. (yes | no; Default: yes, for enterprise mode)
|The list of available features, which can be controlled with the device-mode option.|
|activation-timeout (default: 5m);||The reset button or power off activation timer can be set in range 00:00:10 .. 1d00:00:00.|
|flagging-enabled (yes | no; Default: yes)||Enable or disable the flagged status. See below for a detailed description.|
|flagged (yes | no; Default: no)||RouterOS employs various mechanisms to detect tampering with it's system files. If the system has detected unauthorized access to RouterOS, the status "flagged" is set to yes. If "flagged" is set to yes, for your safety, certain limitations are put in place. See below chapter for more information.|
|mode: (home, enterprise; default: enterprise);||Allows choosing from available modes that will limit device functionality. In the future, various modes can be added. |
By default, enterprise mode allows all options except container. So to use the container feature, you will need to turn it on by performing a device-mode update.
By default, home mode disables the following features: scheduler, socks, fetch, bandwidth-test, traffic-gen, sniffer, romon, proxy, hotspot, email, zerotier, container.
More specific control over the available features is possible. Each of the features controlled by device-mode can be specifically turned on or off, for example:
If the update command specifies any of the mode parameters, this update replaces the entire device-mode configuration. In this case, all "per-feature" settings will be lost, except those specified with this command. For instance:
We see that fetch = yes and email = yes is missing. However, specifying only "per-feature" settings will change only those:
If the feature is disabled, an error message is displayed for interactive commands:
However, it is possible to add the configuration to a disabled feature, but there will be a comment showing about the disabled feature in the device-mode:
The Flag is another important "option". Along with the device-mode feature, ROS has implemented code that analyzes the whole configuration at system startup to determine if there are any signs of unauthorized access. If suspicious configurations are detected, the flagged flag is set at device-mode (and the corresponding configuration is disabled):
If the system has this flagged notice, then the current configuration works, but it is not possible to perform a series of actions. If the action is restricted, you will receive an error message when doing so:
To remove the flagged notice, you must perform system/device-mode/update flagged=no
The following interactive actions will not be possible on the flagged device: bandwidth-test, traffic-generator, sniffer, as well as configuration actions that enable or create new configuration entries (it will still be possible to disable or delete) for the following contacts: scheduler, socks, pptp, l2tp, ipsec, proxy, smb.