6.41rc16 changelog:

*) ipsec - added DH groups 19, 20 and 21 support for phase1 and phase2 (CLI only);
*) lcd - fixed unresponsive LCD (introduced in 6.41rc15);
*) lte - added passthrough support (CLI only);
*) traffic-flow - fixed reboots when IPv6 address has been set as target address without active IPv6 package;

Other changes since 6.40.1:

!) bridge - implemented software based vlan-aware bridges;
https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Bridge_VLAN_Filtering
!) switch - "master-port" conversion into a bridge with hardware offload "hw" option (CLI only);
https://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Bridge_Hardware_Offloading
!) bridge - general development of hw-offload bridge implementation (introduced in v6.40rc36);
*) arp - fixed invalid static ARP entries after reboot on interfaces without IP address;
*) bridge - added initial support for hardware "igmp-snooping" on CRS1xx/2xx (CLI only);
*) bridge - automatically turn off "fast-forward" feature if both bridge ports have "H" flag;
*) bridge - fixed ARP setting (introduced in v6.40rc36);
*) bridge - fixed multicast forwarding (introduced in v6.40rc36);
*) bridge - implemented dynamic entries for active MST port overrides;
*) bridge - implemented software based "igmp-snooping" (CLI only);
*) bridge - implemented software based MSTP (CLI only);
*) bridge - removed "frame-types" and "ingress-filtering" for bridge interfaces (introduced in v6.40rc36);
*) bridge - removed "master-port" parameter (CLI only);
*) bridge - show "admin-mac" only if "auto-mac=no";
*) btest - improved reliability on Bandwidth Test when device`s RAM is almost full;
*) capsman - added "vlan-mode=no-tag" option (CLI only);
*) capsman - return complete CA chain when issuing new certificate;
*) certificate - fixed import of certificates with empty SKID;
*) certificate - fixed SCEP "get" request URL encoding;
*) certificate - show "Expired" flag when initial CRL fetch fails;
*) CRS3xx - switch VLAN configuration integrated within bridge VLAN configuration with hw-offload;
*) dhcp - require DHCP option name to be unique;
*) dhcpv6-client - fixed IA evaluation order;
*) dhcpv6-client - ignore unknown IA;
*) e-mail - do not show errors when sending e-mail from script;
*) export - fixed "/system routerboard" export (introduced in 6.40.1);
*) export - fixed interface list export;
*) hotspot - fixed missing "/ip hotspost server profile" if invalid "dns-name" was specified;
*) hotspot - improved user statistics collection process;
*) ike1 - fixed initiator ID comparison to NAT-OA;
*) ike1 - release mismatched PH2 peer IDs;
*) ike2 - check identities on "initial-contact";
*) ike2 - use peer configuration address when available on empty TSi;
*) interface - added option to join and exclude "/interface list" from one and another;
*) interface - fixed corrupted "/interface list" configuration after upgrade;
*) ippool6 - try to assign desired prefix for client if prefix is not being already used;
*) ipsec - allow to specify remote peer address as DNS name (CLI only);
*) ipsec - renamed "firewall" argument to "notrack-chain" in peer configuration;
*) ipv6 - fixed IPv6 address request from pool (introduced in 6.41rc1);
*) l2tp-server - fixed PPP services becoming unresponsive after changes on L2TP server with IPSec configuration;
*) led - fixed "modem-signal" LEDs (introduced in 6.40);
*) led - fixed "on" and "off" triggers when multiple LEDs are selected;
*) lte - do not show USB LTE modem under "/port" menu (introduced in 6.41rc);
*) lte - improved reliability of USB LTE modems;
*) lte - properly recognize USB devices under "/system resource usb" (introduced in 6.41rc12);
*) modem - added initial support for Alcatel IK40 and Olicard 500;
*) ospf - fixed OSPF v2 and v3 neighbor election;
*) ppp - added support for Sierra MC7750, Verizon USB730L;
*) pppoe-client - fixed wrong auto MRU detection over VLAN interfaces;
*) pppoe-server - fixed situation when PPPoE servers become invalid on reboot;
*) rb1100ahx4 - fixed HW acceleration fragmented packet decryption when fragment is smaller than 64 bytes;
*) rb2011 - fixed possible LCD blinking along with ethernet LED (introduced in 6.40);
*) rb750gr3 - show warning and do not allow to use "protected-bootloader" feature if "factory-firmware" older than 3.34.4 version;
*) routerboard - added "mode-button" support for RB750Gr3 (CLI only);
*) sfp - fixed invalid temperature readings when ambient temperature is below 0C;
*) sfp - fixed SFP interface power monitor when bad SFP DDMI information is received;
*) sftp - added functionality which imports ".auto.rsc" file or reboots router on ".auto.npk" upload;
*) ssh - do not execute command if it starts with "-" symbol;
*) ups - fixed duplicate "failed" UPS logs;
*) winbox - added certificate settings;
*) winbox - added support fro certificate CRL list;
*) winbox - do not show duplicate "Template" parameters for filter in IPSec policy list;
*) winbox - do not show duplicate filter parameters "Published" in ARP list;
*) winbox - fixed bridge port sorting order by interface name;
*) winbox - hide "level" and "tunnel" parameters for IPSec policy templates;
*) winbox - hide FAN speed if it is 0RPM;
*) winbox - show warnings under "/system routerboard settings" menu;
*) wireless - added "russia3" country settings;
*) wireless - added New Zealand regulatory domain information for P2P links;
*) wireless - updated China and New Zealand regulatory domain information;

Download the new 'RouterOS 6.41rc16' version here: https://www.mikrotik.com/download