KeeneticOS 3.8
KeeneticOS release notes for Keenetic City (KN-1510) in the Main Channel
KeeneticOS releases in this channel have passed our full rigorous testing and are recommended to all users, to avoid issues and maximize capabilities. This channel is updated roughly every two-three weeks with minor releases, and every two months with major releases.
Keenetic City (KN-1510) is past its End of Support date and no longer receives any updates. We recommend purchasing the latest version or a newer, more advanced, Keenetic product.
Highlights at a glance
Welcome to KeeneticOS release 3.8! This release introduces completely reworked Internet safety provisions, improved traffic classification and prioritization, and multiple other performance improvements and fixes:
Block annoying ads and trackers, protect your privacy, defend against security threats and enforce clean Internet access for children with the new Cloud-based content filtering and ad blocking component — the new filter combines seven popular public DNS resolvers into one configuration, allowing you to mix filtering profiles from different service providers to your devices in one setup. Supported public DNS resolvers include AdGuard DNS, CleanBrowsing, Cloudflare DNS, Neustar UltraDNS Public, OpenDNS, Quad9, and Yandex.DNS.
Add custom DNS profiles for even greater flexibility when public DNS presets are not enough.
Assign default filtering profiles to network segments.
Get complete peace of mind with the new NextDNS integration. NextDNS protects you from all kinds of security threats, blocks ads and trackers on websites and inside apps and provides a safe and supervised Internet for kids.
The traffic classification engine now detects and prioritizes various types of traffic inside a single app independently — for example, a video call and a file transfer via the same messenger app will have different traffic priorities according to your IntelliQoS rules.
New inbound and outbound bandwidth control options are now available for Internet connection policies to further improve traffic prioritization and minimize "buffer bloat."
The Mesh Wi-Fi system initialization on startup now happens considerably faster.
The Mesh Wi-Fi system’s new Conditional Wi-Fi broadcast option prevents the connection of wireless clients to the non-operatable extender, which loses connection to the controller.
Behind the scenes, not visible in the generic version, we have also developed a feature set for regional ISPs, covering initial device provisioning and centralized monitoring and management. Drop us a mail at help@keenetic.ru if you are interested.
As always, if you have any feedback (or want to say hi 
), drop us a line in the forum. To learn more about Keenetic, visit the Help Center.
KeeneticOS 3.8.7
31/10/2022
Improved
Fixed
KeeneticOS 3.8.5
07/09/2022
Improved
Fixed
KeeneticOS 3.8.4
15/08/2022
Improved
Fixed
KeeneticOS 3.8.3
18/07/2022
Fixed
KeeneticOS 3.8.2
27/06/2022
New
The new Channel number option for Wireless ISP connections allows setting of a specific channel number instead of automatic channel selection based on an SSID. This setting significantly reduces the air scanning time, leaving more slots for Wi-Fi distribution and Mesh Wi-Fi backhaul operation. Use this setting for scenarios when the uplink ISP or Hotspot has a fixed Wi-Fi channel number. [NWI-938]
The new MAP-T option is available for tunnelling IPv4 protocol packets over an ISP's internal IPv6-only network according to the RFC7599. Please check whether your ISP supports this feature. [NDM-1824, NWI-906]
The new Conditional Wi-Fi broadcast option is available for the Mesh Wi-Fi System. When enabled, Wi-Fi System Extenders stop wireless network broadcasting when the Wi-Fi System Controller is inaccessible. [NWI-895]
The Internet connection policy now has the Adaptive Outbound Speed Limit option, currently available through the CLI only, as follows: [NDM-2109]
ip policy rate-limit output ({rate} | auto)
New content filtering option: NextDNS service is available now as the KeeneticOS system component. Install the NextDNS component and register an account with the service before use. [NDM-1870]
The following CLI commands are available to configure the NextDNS component:
nextdns check-availability;nextdns authenticate {login} {password} [{pin}]— please register with NextDNS before authentication;show nextdns profiles— look for the token associated with the filtering profile and apply it with the following command;nextdns assign ( ({host} {token}) | (interface {iface} {token}) | {token} );dns-proxy filter engine nextdns— to enable NextDNS.
New configuration option for Traffic classification engine: Use the
no ntce memory-watcherCLI command to disable the memory "pressure watcher" mechanism enabled by default. [NDM-1995]More content filtering and ad blocking choices with outstanding flexibility: AdGuard DNS, CleanBrowsing, Cloudflare DNS, Neustar UltraDNS Public, OpenDNS, Quad9, Yandex.DNS are now available at once with the redesigned Public DNS resolvers & custom DNS profiles option. Mix and match content filtering services with registered devices for complete control. Install the all-new Cloud-based Content Filtering and Ad Blocking system component of KeenetiсOS and give it a try. [NDM-1820, SYS-361, NWI-784]
Warning
We suggest making a configuration backup before trying the new version of KeeneticOS 3.8. The new Cloud-based Content Filtering and Ad Blocking component settings are incompatible with previous versions of KeeneticOS.
When installing version 3.8, the existing settings of Yandex.DNS, AdGuard DNS, and Cloudflare DNS components automatically migrate to the new Cloud-based Content Filtering and Ad Blocking component.
New control option for Mesh Wi‑Fi system: Reboot Wi-Fi system extenders from the controller using the new CLI command
mws member {member} reboot. [NDM-1946]
Improved
Using the Web Interface to assign an Ethernet port to the Guest segment enables its operation if wireless networks are disabled. [NWI-1029]
The new Bandwidth control mode selector (Auto / Manual / Disabled) for inbound and outbound traffic is now available for configuring connections in the Internet Connections policies. [NWI-1070]
The OpenSSL library is updated to the latest version,
1.1.1o, fixing the CVE-2022-1292 and CVE-2022-1473 vulnerabilities. [SYS-551]
Added
MTUcontrol to IKEv2 VPN client configuration in the advanced settings section, providing better interoperability with certain VPN providers, for example, Surfshark VPN. [NWI-974]
Added a warning message while setting up a Port forwarding rule for the HTTPS or 443/TCP protocol. [NWI-977]
Increased the maximum PSK key size up to
196characters for IPsec VPN and IPsec/L2TP connections, providing proper connection to corporate networks with firm security policies. [NDM-2128]Added the display of the
regional codenext to the Model name field on the About the system tile. [NWI-1027]Improved IPv4 availability criteria for
MAP-T-enabled connections for the proper display on the Dashboard page. [NWI-1025]Added links to the NextDNS account configurations on the Internet safety page, providing easy access to the NextDNS management portal. [NWI-1020]
Added support for two-factor authentication (2FA) for the NextDNS service on the Internet safety page. [NWI-1021]
The user properties menu is now directly accessible from the Applications settings with user credentials. [NWI-893]
Updated the metadata file of the Web Interface to comply with the Progressive Web App (PWA) specification. [NWI-904]
Improved traffic classification through additional attribute parsing. [NDM-2021]
Changed the RTP (Real-time Transport Protocol) classification category to Voice over IP for the Cloud-based content filtering and ad blocking system component. [NDM-2110]
We replaced Service Class with a Traffic Priority setting for registered devices and IntelliQoS. [NWI-939]
Improved Network ports tile of the System dashboard now links to System settings > Network ports for all operating modes of the Keenetic. [NWI-822]
System dashboard improvement: Use the Change link to modify the schedule of Wi‑Fi network availability when Wi-Fi is disabled. [NWI-840]
