KeeneticOS updates — Dev Channel

The Wi-Fi System Controller is now able to manage the KeeneticOS update channel on the Wi-Fi System Extenders. [NDM-3419]

Fixed issue with saving of Wireguard® connect via setting. [NDM-3467]

Fixed an issue where open Wi-Fi network settings were corrupted after restarting the device. [NDM-3485]

The following fixes have been applied to the next-generation Web interface.

Fixed an issue where the Mesh Wi-Fi System would not work correctly with extenders using KeeneticOS version 3.7. [NDM-3491]

Fixed an issue with the community filtering for SNMPv1 protocol. [SYS-1203]

The new public DNS resolver presets from ControlD are now accessible on the Internet Safety page. [NDM-3452] [Forum topic]

A standalone Policy Table mode has been implemented, which disables the automatic addition of static routes to the selected connection policy. [NDM-3445]

WireGuard client connections now select a random listen port each time the tunnel reconnects. [NDM-3469] [Forum topic]

Fixed a memory leak in the VirtualIP IPSec VPN server application. [NDM-3460]

Fixed DNS leakage for custom Connection policies. [NDM-3468] [Forum topic]

Fixed the employment of the SA AEAD mode cypher suite in Phase 2 for Site-to-Site IPsec VPN settings after device reboot. [NDM-3470] [Forum topic]

The following fixes have been applied to the next-generation Web interface.

Added a CLI command to unbind the DDNS service requests from the specified interface. [NDM-3420] 

Implemented a CLI command to enable the sending of the client ID for the WireGuard connection peer. [NDM-3427] [Forum topic]

Added a CLI command to configure the authgroup value for the OpenConnect connection to ensure third-party compatibility. [NDM-3430] [Forum topic]

When accessing the Internet over the tunnel, clients of IKEv1/IPsec and IKEv2/IPsec VPN Server applications now follow the connection policy selected for the bound network segment. [NDM-3431] [Forum topic]

Restored the correct work of access to my.keenetic.net restriction from local network segments configured to prohibit services hosted on the Keenetic device. [NDM-3346]

Fixed the display of the Mesh Wi-Fi System clients shifting between bands in the Transition Log. [NDM-3412] [Forum topic] 

Fixed the application of the routes automatically received by the OpenVPN connection. [NDM-3415]

Fixed the socket leak in nf_queue. [NDM-3428] [Forum topic]

Fixed the underlying connection selection for the OpenConnect connections. [NDM-3434]

The following fixes have been applied to the next-generation Web interface.

Mesh Wi-Fi system controller now propagates segments without Wi-Fi access points to extenders. [NDM-3210]

Disabled DTLS (Datagram Transport Layer Security) support for the OpenConnect VPN server in KeenDNS cloud mode to improve compatibility with the VPN Client Pro application. [NDM-3394] [Forum topic]

Enabled caching of the saved configuration to improve the Web interface response time and reduce CPU load. [NWI-3643]

Fixed an issue where IPv6 static DNS configuration entries were cleared after the device started. [NDM-3390]

Resolved the issue causing unstable connectivity between local and remote networks in a multi-subnet configuration of a site-to-site IPsec VPN tunnel, secured in Phase 1 by IKEv1. [NDM-3381]

Fixed the display of the Transition Log for Mesh Wi-Fi system clients on mobile devices. [NWI-3579]

Added client names for IPv6 connections on the Diagnostics > Active Connections page for the Next-generation web interface (beta). [NDM-3381] [Forum topic]

Fixed incorrect application of a DNS query filtering rule for IPv6 link-local addresses that occurred under certain conditions. [NDM-3379] [Forum topic]

The following fixes have been applied to the Next-generation web interface (beta) component.

We are introducing the next-generation Web interface as the standard UI for configuring and managing your Keenetic device. [NDM-3378]

Implemented dynamic table size adjustment with nf_conntrack_max value for software ppe (Packet Processing Engine) when the user changes maximum NAT sessions via command line interface (CLI). [NDM-3344]

Fixed an issue where the channel number would incorrectly display as zero when connected via Wireless ISP (WISP). [SYS-1171]

Fixed the PPTP VPN connection stalling on the backup connection after the primary connection is restored. [NDM-3376]

The SNTP service compatibility enhancement adds support for Reference Identifier and Reference Timestamp values in SNTP responses based on RFC4330. [NDM-3368]

A problem that caused the OpenVPN: Connection reset, restarting error message to appear in the System log has been fixed. [NDM-3355]

There are no changes for Keenetic Lite (KN-1311).

Fixed IPv6 ULA (Unique local address) prefix announcements with incorrect A bit. [NDM-3350] [Forum topic]

The L2TP/IPsec VPN client now uses a random source port to avoid connection problems when multiple VPN L2TP/IPsec connections are established behind NAT on an upstream router. [NDM-3349]

Fixed selection of the best node for wireless backhaul connection in the Mesh Wi-Fi System. [SYS-1161]

You can now assign Network ports on Extender devices to any configured network segment using the Command Line Interface (CLI). Alternatively, you may wish to disable the Network ports for security reasons. [NDM-3162]

Enhanced software packet processing engine to enable acceleration for traffic with a manually set TTL value. [SYS-1157] [Forum topic]

Fixed remote access over an IKEv2/IPsec VPN connection to a local network host for which a SNAT mapping rule is configured. [NDM-3310]

The new IntelliQoS option allows 802.1p priority code point (PCP) mapping for egress packets in the command line interface (CLI). [NDM-3318] [Forum topic]

interface {name} vlan qos egress map {priority} {pcp}

The implementation of a ZeroTier connection now includes accepting managed routes and DNS servers published on the ZeroTier network controller. [NDM-3319] [Forum topic]

The OpenSSL library has been moved to a different branch with the latest version 3.0.13. [SYS-1152]

Improved robustness of the DNS over TLS and DNS over HTTPS server cache. [NDM-3320] [Forum topic]

Fixed an issue where static DNS settings were cleared when the device was restarted. [NDM-3303]

Fixed the DynDNS domain name validation; now it's possible to use only one domain. [NDM-3309] [Forum topic]

The clients of the VPN Server (PPTP, SSTP and OpenConnect) now access the Internet following the Connection Policy of the local network to which the server is bound. [NDM-3295]

Fixed Connection Policies work with IPv6 protocol under certain conditions. [NDM-3289]

Enabled the SNMP reports by OID ifAdminStatus to monitor the operational state of device ports via third-party software. [NDM-3296]

Fixed a problem where certain settings were disabled due to incorrect inversion of boolean variables. [NDM-3297] [Forum topic]

The problem of returning null for undefined boolean settings in the KeeneticOS core API has been fixed. [NDM-3298] [Forum topic]

Fixed the continued reconnections of OpenVPN with more than one active client or server. [NDM-3301]

Fixed a problem that could cause the password argument to be parsed incorrectly during configuration. [NDM-3293] [Forum topic]

The implementation of IKEv1/IKEv2 IPsec VPN servers now allows to avoid IP address conflicts with other interfaces. [NDM-3250]

Implemented support for direct access mode to KeenDNS domain from browsers with TLS 1.3 hybridized Kyber enabled. [NDM-3284] [Forum topic]

An issue that caused the system failed [0xcffd0042] error message to appear in the System log during client auto-registration has been fixed. [NDM-3275] [Forum topic]

An issue that caused the duplicate key error message to appear in the System log when opening the IntelliQoS page has been fixed. [NDM-3276] [Forum topic]

Improved host detection using EchoReq in the ICMPv6 protocol to ensure correct operation of port forwarding rules for the IPv6 protocol. [NDM-3265] [Forum topic]

The Phase 2 of the site-to-site IPsec tunnel now supports the SHA512 HMAC algorithm. [NDM-3269]

Added MAC address and registration time information to the name of devices registered automatically. This will help you easily identify and keep track of the devices on your network. [NDM-3253]

Fixed the forwarding of the source IP address in the X-Real-IP header when accessing web applications via KeenDNS. [NDM-2214]

Fixed random disconnection of IKEv2 tunnels to the Keenetic IKEv2/IPsec VPN server. [NDM-3059]

The Application traffic analyser engine now operates more efficiently with the IPv6 protocol under high network load. [NDM-3235]

Fixed hostname resolution for Ping Check in TCP/TLS port check mode when using secure DNS for domain name resolution. [NDM-3273] [Forum topic]

Fixed access to the KeenDNS Web Applications configured with prohibited remote access (security-level private) from the home network. [NDM-3264] [Forum topic]

The camouflage mode option has been added to both SSTP VPN and OpenConnect VPN servers and clients, providing greater security against remote service scanning. [NDM-3257] [Forum topic]

Fixed spurious EoIP/IPsec connection attempts after device restart. [NDM-2518]

Incomplete application of static IPv6 routes when re-establishing an associated VPN connection after a reboot fixed. [NDM-3248] [Forum topic]

Fixed issue with absent route to remote Wireguard endpoint after device restart. [NDM-3223]

The problem that causes the error message PingCheck::Resolve: "default": system failed [0xcffd003c], upstream is very slow to respond in the System log has been fixed. [NDM-3244]

UPnP service rules are now correctly applied to clients accessing the Internet using the Connection policy with active multipath mode. [NDM-3251]

Implemented an aggressive mode option for the IKEv1 client in the command line interface (CLI) for compatibility with VPN (IPsec) servers running on Fritz!Box routers. [NDM-3227]

Fixed DNS query interception in the additional network segments. [NDM-3228] [Forum topic]

The new OpenConnect VPN client system component is now available, allowing you to establish a secure connection to a remote server via the command line interface (CLI). [NDM-3207]

Implemented a workaround to prevent certain Realtek Wi-Fi drivers from crashing on Windows OS when passing non-PMF authentication on a PMF-enabled access point. [SYS-1131]

Fixed priority of user-defined ip static rules over automatic UPnP port forwarding rules to a host. [NDM-3078]

Fixed home network access for L2TP/IPsec VPN server clients when ip static rules are configured on WAN IP aliases. [NDM-3110]

Fixed binding to the WAN address and inbound access to the service port for the ZeroTier client connection. [NDM-3216] [Forum topic]

A new CLI grep extension is now available to filter the output of the show command. [NDM-3075]

For example:

(config)> show interface | grep address

Interface, name = "Home"
          address: 192.168.2.1
             ipv6:

Interface, name = "Guest"
          address: 10.1.30.1
             ipv6:

(config)> show system | grep cpuload

          cpuload: 5

A new read/send timeout option allows the session lifetime for Web applications of the KeenDNS proxy service to be set via the command line interface (CLI). [NDM-3157]

The WireGuard advanced security configuration (ASC) parameters are now available in the command line interface (CLI). [NDM-3202]

Fixed iOS L2TP/IPsec client disconnecting under heavy load. [NDM-3180]

A new segment default policy for hosts has been implemented and is now enabled by default. Registered devices with this connection policy assigned will follow the default connection policy of the network segment they are connecting to. [NDM-2237]

The new application filtering option is now available in the Application traffic analyser service via command line interface (CLI). This option allows to create a filtering profile, add required applications, assign a host or segment to the filtering profile and enable the operation schedule. [NDM-3069]

The new option to automatically register hosts in the Home segment is now available (enabled by default). You can disable this behaviour using the command line interface (CLI). [NDM-3101]

The new OpenConnect VPN server system component is now available, providing a remote SSL VPN connection to your Keenetic. [NDM-3141]

Disabling Port Forwarding (ip static) rules now forces matching active sessions to be dropped. [NDM-3067]

Implemented new options to preserve Referer and Origin headers for Web applications of the KeenDNS proxy service in the command line interface (CLI). [NDM-3089] [Forum topic]

A NetFlow monitor system component can now collect IPv6 traffic information and monitor network flows. [NDM-3109]

The MOBIKE extension (RFC 4555) has been enabled for both the IKEv2/IPsec VPN Server and the IKEv2 client. [NDM-3164]

The CloudFlare content filter has been corrected to work properly on networks that do not support IPv6. [NDM-3163]

Fixed port forwarding issues after Hotspot (ip hostspot) code refactoring. [NDM-3127, NDM-3171] [Forum topic]