KeeneticOS updates — Dev Channel

Restored Fast transition (802.11r) operation for wireless roaming in additional segments such as the Guest segment (protected). [NDM-2774] [Forum topic]

The Ping Check now works correctly when the Operator DNS is disabled and secure DNS over HTTPS (DoH) or DNS over TLS (DoT) is enabled. [NDM-2784] [Forum topic]

Fixed issue with adding the default ISP route when setting up a static IPv6 Internet connection. [NDM-2839]

Wireless connection with WPA3-PSK (SAE-H2E method) security no longer triggers a system reboot. [SYS-932]

The cause of the not found: interface security-level error message in the System log has been fixed when configuring the extender. [NDM-2868]

The issue of unregistered devices originating from the Extender IP address in additional segments has been resolved. [NDM-2869] [Forum topic]

Faster and more reliable operating system updates for Mesh Wi-Fi nodes. The structure of the Mesh Wi-Fi System and the connections between nodes now determine the order in which nodes are updated. [NDM-2816]

Updated the netatalk service used in the AFP file sharing system component to version 3.1.15. [SYS-929] [Forum topic]

The Web interface now supports the Danish language. [SYS-907]

The cause of the port 0 is busy error, which prevented the correct propagation of network segments, has been fixed. [NDM-2852]

Network segmentation has been fixed to prevent Guest segment devices from accessing the settings of Extender nodes. [NDM-2744]

Restored the "alternative speed" mode for the Download Station application. [NDM-2858] [Forum topic]

Fixed support for Microsoft Point-to-Point Encryption (MPPE) on L2TP/IPsec connections. [NDM-2859]

Automatic Wi-Fi channel selection no longer causes Wi-Fi to stop transmitting. [SYS-536]

The name of the segment and other description fields are now protected against the XSS vulnerability in the Web interface. [NWI-2715]

Enabling the DNS transit requests feature correctly disables DNS packet interception. [NDM-2769]

Fixed an error that caused all WireGuard tunnels to disable when one of the tunnels was turned off. [NDM-2800] [Forum topic]

Fixed HTTP server configuration errors after changing the interface security level under certain conditions. [NDM-2832]

Fixed an issue with STP protocol operation that caused the connection status for extenders to appear blank on the Mesh Wi-Fi system page. [SYS-904]

Fixed GigabitEthernet1 is off-board error when deleting Wired connection via port 0 in the Web interface. [NDM-2651]

Implemented a new option to de-announce IPv6 prefixes for backup connections. [NDM-2805]

Added ICMPv6 support to ipv6 static rules, allowing pingv6 to local devices with IPv6 addresses. [NDM-2760]

The WireGuard connections no longer restart after NTP time synchronisation. [NDM-2773] [Forum topic]

Corrected traffic counting when multiple WAN connections are active. [SYS-880] [Forum topic]

Fixed Wi-Fi connection issue when switching channel width from 80 to 20 MHz. [SYS-893]

Implemented a new option to send SIP keep-alive messages to all SIP servers listed in the DNS SRV record. [VOX-278]

It is now possible to add new extenders to the Wi-Fi system without an Internet connection. [NDM-2594]

Speed limits set for multiple registered devices no longer cause the system to spontaneously restart. [NDM-2730]

Corrected the display of the Network SSID tooltip for the Scan for networks results list on the Wi-Fi Monitor page. [NWI-2648] [Forum topic]

Fixed some minor visual issues with the Web interface layouts. [NWI-2675, NWI-2676] [Forum topic]

Fixed positioning of Web UI elements on the System Dashboard page when zooming in Safari iOS 16. [NWI-2626]

The Scan the air feature now accurately displays the list of available mobile operators, even if the operator name contains the special character ')'. [NDM-2788]

Fixed the GRE/IPsec connection issue when using IKEv2 and Cisco iOS/Nx-Os endpoints. [NDM-2789]

There are no changes for Keenetic Hero (KN-1011).

Fixed a reboot issue caused by counting traffic going through the Hardware network accelerator. [SYS-860]

Sorting in the Channels column on the Wi-Fi Monitor page now works correctly. [NWI-2603] [Forum topic]

Corrected the layout of the dialogue box of the Fail-safe function. [NWI-2635] [Forum topic]

Fixed incorrect local and remote IKEv2 proposal IDs when using GRE/IPsec tunnels. [NDM-2750]

The WebDAV Server application now supports IPv6 protocol access. [NDM-737]

Implemented a new ip format option for the DCHP server in the command line interface (CLI): [NDM-2755]

Fixed an issue that caused the router to restart when writing a file using the SMB protocol. [NDM-1738]

The Fibocom L830-EB 4G LTE Cat 6 UsbLte-type modem module is now supported. [NDM-2742]

The HEAD method for *.html resources has been restored in the web server response. [NDM-2748] [Forum topic]

The misclassification of traffic from registered devices as traffic from unregistered devices in the traffic accounting has been corrected. [SYS-846] [Forum topic]

Implemented propagation of Network Time Protocol settings to extenders in the Wi-Fi System. [NDM-2508]

The SIP Registration timeout has been increased to 86400 seconds. [VOX-268]

Support for the Samsung GT-B3730 USB modem has been discontinued. [NDM-2746]

The incompatibility of the Ping Check service with DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) name servers has been fixed. [NDM-2739] [Forum topic]

Fixed incorrect assignment of VLAN roles to ports in the Web Interface. [NWI-2593]

Using an 4G/LTE modem as your only Internet connection now works correctly with the default Ping Check profile. [NDM-2745] [Forum topic]

The KeeneticOS API is re-enabled for the Keenetic mobile application. [SYS-838] [Forum topic]

The cause of the "UsbLte1": lock precedence violation error message in the System log has been fixed when using Fibocom L850/L860 USB modem modules. [NDM-2733] [Forum topic]

The cause of the unable to obtain addresses error message in the System log has been fixed when using DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) filtering. [NDM-2735] [Forum topic]

Fixed cause of resource deadlock avoided error message in System log coming from Cloud agent service. [NDM-2736] [Forum topic]

The new option to bind DNSv6 addresses is now available via the command line interface (CLI), as follows:

The initial Ping Check state has been changed to a negative state to avoid using a non-working connection to access the Internet. Reduced initial Ping Check time. [NDM-1837]

Disabled the use of name servers (DNS servers) on offline backup connections. [NDM-795]

The static route for the WireGuard® VPN remote peer is no longer removed after changes are made to the underlying connection of the WireGuard VPN tunnel. [NDM-2522]

The bandwidth control of the Connection policy now works as intended for IPsec IKEv2 client connections. [NDM-2537]

Fixed incorrect re-association logic when dealing with a roaming Wi-Fi client with PMKID. [SYS-810]

Asymmetric speed limiting now works correctly for registered devices when IntelliQoS is enabled. [SYS-836]

New SIP transport options - UDP6, TCP6 and TLS6 - are now available on the Telephone Line Settings page of the Web Interface. [NWI-2499]

KeeneticOS can now display and operate on LTE bands above 43 with external USB modems of the UsbQmi and UsbLte types. [NDM-1686]

The Wireless ISP connection now displays the password field correctly when connecting to a mixed WPA1-PSK/WPA2-PSK wireless network. [NWI-1544] [Forum topic]

The Other Devices category returns to the Traffic monitor page. [NWI-2541]

Fixed the Safari browser's non-editable Clients isolation checkbox. [NWI-2501] [Forum topic]

Fixed adding a route with /32 IP subnet or address mask on the OpenVPN interface. [NDM-2686]

Fixed a phantom traffic display for unregistered devices. [NDM-2702]

The multipath policies now work correctly and do not use connections with negative Ping Check testing results. [NDM-2706]

The Firewall service now flushes corresponding sessions when firewall rules are enabled or disabled. [NDM-2690]

The maximum MTU size has been increased to 1514 bytes, providing PPPoE MTU = 1500 bytes over VLAN. [SYS-812]

Web API authentication now works correctly with different software versions of the ZTE MF79U USB modem. [NDM-2694] [Forum topic]

New SIP transport options - udp6, tcp6, tls6 - are available with IPv6 protocol support for the nvox sip {id} transport CLI command. [VOX-142]

The ip alias configuration no longer affects the NAT translation for the primary PPPoE connection. [SYS-806]

The Web Interface's new custom HTTPS server port allows you to free up a standard TCP/443 port and forward it to any device on your local network. [NDM-2670]

Added new optional username and password parameters to the chilli login {mac} command of the Captive portal system component: [NDM-2679]

Added a robots.txt file to the Web Interface server to prevent indexing by search engines. [NDM-2673]

Custom DNS resolution profiles are now correctly applied to Segments and registered devices. [NWI-1547] [Forum topic]

Prevented IPsec configuration failure using a cryptographic key crypto ike key with an unsupported length greater than 72 characters. [NDM-2562]

Increased the packet queue length of the Captive portal system component to prevent packets from being dropped due to system log congestion errors under heavy load. [NDM-2572]

Reconnection of a wireless client to the access point with WPA3-PSK protection works correctly after accidental disconnection. [SYS-797]

The setting for the new On-demand type of Internet connection is available from the Command Line Interface (CLI). The On-demand type of connection is automatically disconnected if a higher priority Internet connection is running. [NDM-2643]

The new Captive Portal option is available for manual authorization of hotspot hosts in the command line interface (CLI): [NDM-2417]

Corrected Partial data tooltip content display in Safari and Firefox browsers. [NWI-1527] [Forum topic]

Mobile traffic counting now operates correctly on the Data usage & limit page. [NDM-2626]

The OpenVPN connection configuration parser handles the <auth-user-pass> inline password section correctly. [NDM-2640]

The DNS servers toggle now operates as intended for UsbLte interfaces. [NWI-1542] [Forum topic]

The cause of the lock precedence violation error message in the System log that caused slow Web Interface responses has been fixed. [NDM-2663] [Forum topic]

There are no changes for Keenetic Hero (KN-1011).

The Select Your Country or Region pop-up displays correctly in desktop and mobile Safari browsers. [NWI-1541] [Forum topic]

Frequency band selector management now works as intended for UsbQmi and UsbLte modems. [NWI-1543] [Forum topic]

Fixed the BSS ranking algorithm for the WifiStation and Mesh Wi-Fi System backhaul connection. [SYS-782]

The start up of the DHCP client now works correctly on extenders that are connected via wireless backhaul. [NDM-2655] [Forum topic]

OpenVPN interface state detection has been restored; this was causing the VPN connection to fail. [NDM-2661] [Forum topic]

Fixed a bug introduced in 4.0 Alpha 11 that prevented the Keenetic mobile application agent from starting correctly in KeeneticOS. [SYS-793]

Fixed DNS settings incorrectly removed on IKEv1/IPsec and IKEv2/IPsec VPN servers. [NDM-2662]

The Country and Time Zone Confirmation popup will appear when you enter the Web Interface. This confirmation is needed to improve communication with the Keenetic Cloud, time synchronization servers, proper Wi-Fi network announcement, and legal consent. [NWI-1437]

The legal address of Keenetic GmbH has changed with effect from 12 January 2023. This makes it necessary for us to update the Device Privacy Notice. The change of legal address is the only change in the updated document, but you will still see the pop-up asking you to confirm the whole revised document when you log in to the device's Web Interface.

The new 464clat (RFC6877) option has been implemented for the IPv6 transition mechanism. [NDM-2121]

The SNMP server system component now supports IPv6 protocol operation. [NDM-2653]

BSS coloring is enabled by default in Wi-Fi beacons for Wi-Fi 6 models. [SYS-778] [Forum topic]

SNMP response now comes from the correct source IP address when accessing via a VPN connection. [NDM-2082]

The default route is now correctly assigned for HTTP/HTTPS/SOCKS5 proxy interfaces. [NDM-2366]

The Fast Transition (802.11r) option is displayed correctly after changing the network name (SSID) for one of the Wi-Fi bands. [NWI-1508]

The Clients tooltip now displays Wi-Fi device names on the Extender's Wi-Fi monitor page. [NWI-1528] [Forum topic]

The cause of the group address 224.0.1.187 is not equal destination address error message in the System log has been fixed. [SYS-775]

The Hardware Network Accelerator operation is restored for the IPv6 protocol. [SYS-779] [Forum topic]

Implemented web-api authentication for the ZTE MF79U USB modem, which allows proper management in KeeneticOS. [NDM-2592]

The username of the KeeneticOS account now allows the dot '.' character. [NWI-1523]

Recovery of access to the internal /storage partition. [NDM-2629] [Forum topic]

The Phase 1 Rekey time display is corrected in the Web Interface for Site-to-site IPsec VPN connections after changes in system statistics. [NWI-1518]

The new Huawei ME906E 4G LTE Cat 3 modem module is now supported. [NDM-2582]

The Media Server no longer requires activation - Access the applications running on your Keenetic in Guest or other protected segments. [NDM-2514] [Forum topic]

Added an action to unmount USB drives when the USB port is powered off. [NDM-2589]

The CLI command for sending init AT commands has a new syntax for the UsbModem, UsbLte, and UsbQmi interfaces: [NDM-2564] [Forum topic]

The RADIUS settings propagate correctly from the Controller to all Extenders of the Wi-Fi System. [NDM-2243]

IPv4 connectivity restored via an IPv6 MAP-T Internet connection. [NDM-2613]

Fixed connected state for HTTP/HTTPS/SOCKSv5 proxy interfaces. [NDM-2627]

The Meiglink SLM820 4G LTE Cat 12 modem module is now supported. [NDM-2602]

The Application traffic analyser now supports traffic classification for the ICMP protocol. [SYS-760]

The AFP file sharing system component is updated to version 3.1.14. [NDM-2600]

The OpenSSL library is updated to the latest version, 3.0.8, which fixes the following list of vulnerabilities: [SYS-759]

The web UI of the Download station application is updated to version 1.6.1 . [SYS-757]

The maximum length of a PIN code for the SIM card in the UsbLte and UsbQmi modems is now eight characters. [NWI-1509]

The Ping Check > Automatic profile operation has been fixed. [NDM-2608]

The check box to Enable the SNTP service for local devices is available with a custom configuration of NTP servers. [NWI-1505]

The DHCP renewal process no longer restarts L2TP/PPTP/IPoE Internet connections. [NDM-2590] [Forum topic]

Status detection of the interface with a static IPv6 address works as intended. [NDM-2591]

Disconnecting the underlying interface for WireGuard® VPN no longer causes traffic flooding. [NDM-2593] [Forum topic]

New USB port power management is now available via CLI commands. You can power on/off USB ports or assign a schedule profile. [NDM-2550]

Use the following CLI commands:

The ipv6 firewall CLI command has been deprecated and removed. [NDM-1731]

Fixed unnecessary SMB file and printer sharing service restarting when the status of irrelevant network interfaces changes. [NDM-1840] [Forum topic]

The network interface status tracking mechanism in KeeneticOS has been redesigned to provide better IPv6 protocol support and faster Web Interface response. [NDM-2415]

Improved compatibility of SMB file and printer sharing system component with Total commander application. [NDM-2574]

The remote access to the Download station via KeenDNS no longer produces limiting requests: excess by zone errors in the System log. [SYS-752]

Corrected the Spectrum analyzer legend on the Wi-Fi monitor page. [NWI-1507]

The PPPoE connection now works as intended with IPv6-only connections. [NDM-2585]

Disabled PAT (Port Address Translation) for locally generated traffic. This was particularly disruptive to MAP-T and DS-Lite Internet connections. [NDM-2587] [Forum topic]

System halt has been fixed when connecting to the cloud service under certain conditions. [NDM-2516]

The new WAN IPv6 address assignment option has been implemented in accordance with the RFC6204 (WAA-8) standard. [NDM-2549]

The cause of the ndnproxy:out of socket file descriptors error message in the System log was fixed. It occurs under heavy loading of the DNS proxy service. [SYS-727]

The enabled DNS request transit option now operates as expected for unregistered hosts. [NDM-2547]

Fixed watchdog timer interrupt on CPU0 system reboot when using the Traffic shaper system component. [SYS-397]

The default route via the IPoE interface is now automatically restored after the PPP (PPPoE, L2TP, PPTP) interface is deleted. [NDM-2575]

KeeneticOS now allows you to assign 512 hosts with Static IP settings on the Device lists page for registered devices. [NDM-2501]

Increased KeenDNS service web application records from 160 to 256. [NDM-2519]

For the Fibocom L850-GL/L860-GL modem modules, SMS storage has been moved from the modem's internal memory to the SIM card memory to avoid problems with receiving and reading incoming SMS messages. [SYS-723] [Forum topic]

The DNS proxy service now handles TCP chunks correctly, resulting in better service stability. [SYS-726]

Fixed connected state for interfaces with a statically configured IP address. [NDM-2551]

Phase 1 Rekey time is now displayed correctly for site-to-site IPsec VPN connections. [NDM-2554]

Fixed the reason for spontaneous disconnection of remote connections to L2TP/IPsec VPN server. [NDM-2555]

The Traffic monitor page now displays the correct average speed for 3 minutes. [NDM-2556]

Corrected the "transmitted bytes" statistic in the host traffic monitor legend. [NDM-2560]

The new deSEC (desec.io) service is available for the Dynamic DNS (DDNS) client system component. [NDM-2540]

A new CLI command allows the deactivation of an internal storm-control feature for a specific interface:

Ethernet ports are now operating correctly after re-enabling of the previously disabled ports. [NDM-2529] [Forum topic]

The 4G NDIS-type USB modems from Huawei are now correctly configured with the APN setting. [NDM-2524] [Forum topic]

Connection priority change no longer modifies the interface state. [NDM-2526] [Forum topic]

The ip6 prefix auto setting no longer disappears from the running configuration. [NDM-2528] [Forum topic]

Fixed early expiration of the Days until count resets timer in the Data usage & limit feature for Mobile Broadband connections. [SYS-720]

The ICMP and GRE protocols are now available for the new IPsec traffic selectors with multiple subnets. [NDM-2534] [Forum topic]

The use of WireGuard® tunnels as the default route with the IPv6 protocol is now fixed. [NDM-2535]

Restored the working of IPv6 in IPv4 tunnels after switching to new routing table logic. [NDM-2544] [Forum topic]

The interface ipv6 force-default CLI command has been brought back into support for backward compatibility. [NDM-2545] [Forum topic]

The Fail-safe configuration mode no longer causes an unnecessary reboot. The timeout is set to three minutes. [NWI-1496]

The Provider name description now displays correctly on the Dashboard and Connection priorities pages. [NWI-1495] [Forum topic]

The cause of the not found: show/ip6/routes error messages in the System log was fixed. [NWI-1497] [Forum topic]

Restored PPPoE interface management when it changes up or down state. [NDM-2523] [Forum topic]

The SSTP VPN server now supports legacy TLSv1/SHA1 algorithms for correct SSTP connection with particular Windows 7 clients. [NDM-2525] [Forum topic]

The new IPv6 Prefix Delegation option has been implemented for subnetting. [NDM-1976]

Use the following CLI commands to set:

A typical configuration Prefix Delegation for a Home segment looks like follows:

ipv6 subnet Default
    bind Home
    mode dhcp
    prefix length 63
    prefix delegate 64
    number 0

The new multiple subnets option is available for Site-to-site IPsec VPN connections in Phase 2, providing network connectivity between several subnets over a VPN tunnel. [NDM-313]

Use the following CLI commands to set:

The new Add local subnet and Add remote subnet options are available for Site-to-site IPsec VPN connections on the Internet > Other connections page.

Implemented frequency band selection option for Huawei modems with NDIS-type. [NDM-2151] [Forum topic]

Implemented host traffic accounting for IPv6 protocol, providing correct calculation for the incoming/outgoing data of your home devices. [SYS-648]

The Application traffic analyser now supports traffic classification for the IPv6 protocol. [SYS-652]

The Traffic shaper system component now supports operation with the IPv6 protocol, providing correct traffic limitation for data flows of IPv4/IPv6 together. [SYS-658]

New USB modem modules are now supported, including:

The Web Interface receives core support for IPv6 connections. [NDM-2448]

The OpenVPN client and server system component now supports the IPv6 protocol for VPN connection. [NDM-2451]

The Wireguard VPN component now internally supports the IPv6 protocol for VPN connection. [NDM-2452]

Implemented support for 802.1Q tagged VLAN traffic over AccessPoint and WifiStation (Wireless ISP) interfaces. [SYS-682]

The new HTTP/HTTPS URI mode of the Ping Check allows you to specify the host address to check using a URI (Uniform Resource Identifier). [NDM-2490] [Forum topic]

Use the following CLI commands to set:

Connection policy now operates with the IPv6 protocol. [NDM-2515]

Implemented copying of static routes to all Connection policies. [NDM-2335]

Traffic Classification now supports PPP and GRE protocol recognition for the IntelliQoS and Application Traffic Analyser functions [NDM-2486]

DNS IPv6 responses now sent from the correct and expected port 53. [NDM-2439]