KeeneticOS updates — Dev Channel

Restored Fast transition (802.11r) operation for wireless roaming in additional segments such as the Guest segment (protected). [NDM-2774] [Reported by dimon27254]

The Ping Check now works correctly when the Operator DNS is disabled and secure DNS over HTTPS (DoH) or DNS over TLS (DoT) is enabled. [NDM-2784] [Reported by Eric750]

Fixed issue with adding the default ISP route when setting up a static IPv6 Internet connection. [NDM-2839]

Wireless connection with WPA3-PSK (SAE-H2E method) security no longer triggers a system reboot. [SYS-932]

The cause of the not found: interface security-level error message in the System log has been fixed when configuring the extender. [NDM-2868]

The issue of unregistered devices originating from the Extender IP address in additional segments has been resolved. [NDM-2869] [Reported by Vision]

Faster and more reliable operating system updates for Mesh Wi-Fi nodes. The structure of the Mesh Wi-Fi System and the connections between nodes now determine the order in which nodes are updated. [NDM-2816]

Updated the netatalk service used in the AFP file sharing system component to version 3.1.15. [SYS-929] [Reported by saffe]

The Web interface now supports the Danish language. [SYS-907]

The cause of the port 0 is busy error, which prevented the correct propagation of network segments, has been fixed. [NDM-2852]

Network segmentation has been fixed to prevent Guest segment devices from accessing the settings of Extender nodes. [NDM-2744]

Restored the "alternative speed" mode for the Download Station application. [NDM-2858] [Reported by Ацкий Падонак]

Fixed support for Microsoft Point-to-Point Encryption (MPPE) on L2TP/IPsec connections. [NDM-2859]

The name of the segment and other description fields are now protected against the XSS vulnerability in the Web interface. [NWI-2715]

Enabling the DNS transit requests feature correctly disables DNS packet interception. [NDM-2769]

Fixed an error that caused all WireGuard tunnels to disable when one of the tunnels was turned off. [NDM-2800] [Reported by stakp]

Fixed HTTP server configuration errors after changing the interface security level under certain conditions. [NDM-2832]

Fixed GigabitEthernet1 is off-board error when deleting Wired connection via port 0 in the Web interface. [NDM-2651]

Implemented a new option to de-announce IPv6 prefixes for backup connections. [NDM-2805]

Added ICMPv6 support to ipv6 static rules, allowing pingv6 to local devices with IPv6 addresses. [NDM-2760]

The WireGuard connections no longer restart after NTP time synchronisation. [NDM-2773] [Reported by divinepredecessor]

Corrected traffic counting when multiple WAN connections are active. [SYS-880] [Reported by dimon27254]

Fixed Wi-Fi connection issue when switching channel width from 80 to 20 MHz. [SYS-893]

Implemented a new option to send SIP keep-alive messages to all SIP servers listed in the DNS SRV record. [VOX-278]

It is now possible to add new extenders to the Wi-Fi system without an Internet connection. [NDM-2594]

Speed limits set for multiple registered devices no longer cause the system to spontaneously restart. [NDM-2730]

Corrected the display of the Network SSID tooltip for the Scan for networks results list on the Wi-Fi Monitor page. [NWI-2648] [Reported by dimon27254]

Fixed some minor visual issues with the Web interface layouts. [NWI-2675, NWI-2676] [Reported by dimon27254]

Fixed positioning of Web UI elements on the System Dashboard page when zooming in Safari iOS 16. [NWI-2626]

The Scan the air feature now accurately displays the list of available mobile operators, even if the operator name contains the special character ')'. [NDM-2788]

Fixed the GRE/IPsec connection issue when using IKEv2 and Cisco iOS/Nx-Os endpoints. [NDM-2789]

There are no changes for Keenetic Giga(KN-1010).

Fixed a reboot issue caused by counting traffic going through the Hardware network accelerator. [SYS-860]

Sorting in the Channels column on the Wi-Fi Monitor page now works correctly. [NWI-2603] [Reported by dimon27254]

Corrected the layout of the dialogue box of the Fail-safe function. [NWI-2635] [Reported by dimon27254]

Fixed incorrect local and remote IKEv2 proposal IDs when using GRE/IPsec tunnels. [NDM-2750]

The WebDAV Server application now supports IPv6 protocol access. [NDM-737]

Implemented a new ip format option for the DCHP server in the command line interface (CLI): [NDM-2755]

Fixed an issue that caused the router to restart when writing a file using the SMB protocol. [NDM-1738]

The Fibocom L830-EB 4G LTE Cat 6 UsbLte-type modem module is now supported. [NDM-2742]

The HEAD method for *.html resources has been restored in the web server response. [NDM-2748] [Reported by merc75]

The misclassification of traffic from registered devices as traffic from unregistered devices in the traffic accounting has been corrected. [SYS-846] [Reported by dimon27254]

Implemented propagation of Network Time Protocol settings to extenders in the Wi-Fi System. [NDM-2508]

The SIP Registration timeout has been increased to 86400 seconds. [VOX-268]

Support for the Samsung GT-B3730 USB modem has been discontinued. [NDM-2746]

The incompatibility of the Ping Check service with DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) name servers has been fixed. [NDM-2739] [Reported by k19olegh68]

Fixed incorrect assignment of VLAN roles to ports in the Web Interface. [NWI-2593]

Using an 4G/LTE modem as your only Internet connection now works correctly with the default Ping Check profile. [NDM-2745] [Reported by Зухель]

The KeeneticOS API is re-enabled for the Keenetic mobile application. [SYS-838] [Reported by ant76]

The cause of the "UsbLte1": lock precedence violation error message in the System log has been fixed when using Fibocom L850/L860 USB modem modules. [NDM-2733] [Reported by k19olegh68]

The cause of the unable to obtain addresses error message in the System log has been fixed when using DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) filtering. [NDM-2735] [Reported by T@rkus]

Fixed cause of resource deadlock avoided error message in System log coming from Cloud agent service. [NDM-2736] [Reported by ラル カ]

The new option to bind DNSv6 addresses is now available via the command line interface (CLI), as follows:

The initial Ping Check state has been changed to a negative state to avoid using a non-working connection to access the Internet. Reduced initial Ping Check time. [NDM-1837]

Disabled the use of name servers (DNS servers) on offline backup connections. [NDM-795]

The static route for the WireGuard® VPN remote peer is no longer removed after changes are made to the underlying connection of the WireGuard VPN tunnel. [NDM-2522]

The bandwidth control of the Connection policy now works as intended for IPsec IKEv2 client connections. [NDM-2537]

Fixed incorrect re-association logic when dealing with a roaming Wi-Fi client with PMKID. [SYS-810]

Asymmetric speed limiting now works correctly for registered devices when IntelliQoS is enabled. [SYS-836]

New SIP transport options - UDP6, TCP6 and TLS6 - are now available on the Telephone Line Settings page of the Web Interface. [NWI-2499]

KeeneticOS can now display and operate on LTE bands above 43 with external USB modems of the UsbQmi and UsbLte types. [NDM-1686]

The Wireless ISP connection now displays the password field correctly when connecting to a mixed WPA1-PSK/WPA2-PSK wireless network. [NWI-1544] [Reported by dimon27254]

The Other Devices category returns to the Traffic monitor page. [NWI-2541]

Fixed the Safari browser's non-editable Clients isolation checkbox. [NWI-2501] [Reported by enterfaza]

Fixed adding a route with /32 IP subnet or address mask on the OpenVPN interface. [NDM-2686]

Fixed a phantom traffic display for unregistered devices. [NDM-2702]

The multipath policies now work correctly and do not use connections with negative Ping Check testing results. [NDM-2706]

The new Panasonic KX-TGA681 handset is now supported. [VOX-267]

The Firewall service now flushes corresponding sessions when firewall rules are enabled or disabled. [NDM-2690]

The maximum MTU size has been increased to 1514 bytes, providing PPPoE MTU = 1500 bytes over VLAN. [SYS-812]

Web API authentication now works correctly with different software versions of the ZTE MF79U USB modem. [NDM-2694] [Reported by yuoras]

New SIP transport options - udp6, tcp6, tls6 - are available with IPv6 protocol support for the nvox sip {id} transport CLI command. [VOX-142]

Additional DECT handsets are now supported, including:

The ip alias configuration no longer affects the NAT translation for the primary PPPoE connection. [SYS-806] [Reported by Christophe Lucas]

The Web Interface's new custom HTTPS server port allows you to free up a standard TCP/443 port and forward it to any device on your local network. [NDM-2670]

Added new optional username and password parameters to the chilli login {mac} command of the Captive portal system component: [NDM-2679]

Added a robots.txt file to the Web Interface server to prevent indexing by search engines. [NDM-2673]

Custom DNS resolution profiles are now correctly applied to Segments and registered devices. [NWI-1547] [Reported by Серов Николай]

Prevented IPsec configuration failure using a cryptographic key crypto ike key with an unsupported length greater than 72 characters. [NDM-2562]

Increased the packet queue length of the Captive portal system component to prevent packets from being dropped due to system log congestion errors under heavy load. [NDM-2572]

Reconnection of a wireless client to the access point with WPA3-PSK protection works correctly after accidental disconnection. [SYS-797]

The setting for the new On-demand type of Internet connection is available from the Command Line Interface (CLI). The On-demand type of connection is automatically disconnected if a higher priority Internet connection is running. [NDM-2643]

The new Captive Portal option is available for manual authorization of hotspot hosts in the command line interface (CLI): [NDM-2417]

Corrected Partial data tooltip content display in Safari and Firefox browsers. [NWI-1527] [Reported by enterfaza]

Mobile traffic counting now operates correctly on the Data usage & limit page. [NDM-2626]

The OpenVPN connection configuration parser handles the <auth-user-pass> inline password section correctly. [NDM-2640]

The DNS servers toggle now operates as intended for UsbLte interfaces. [NWI-1542] [Reported by mogvai]

The cause of the lock precedence violation error message in the System log that caused slow Web Interface responses has been fixed. [NDM-2663] [Reported by dimon27254]

There are no changes for Keenetic Giga(KN-1010).

The Select Your Country or Region pop-up displays correctly in desktop and mobile Safari browsers. [NWI-1541] [Reported by n1ck222]

Frequency band selector management now works as intended for UsbQmi and UsbLte modems. [NWI-1543] [Reported by roman_sh]

Fixed the BSS ranking algorithm for the WifiStation and Mesh Wi-Fi System backhaul connection. [SYS-782]

The start up of the DHCP client now works correctly on extenders that are connected via wireless backhaul. [NDM-2655] [Reported by PriSonerS61]

OpenVPN interface state detection has been restored; this was causing the VPN connection to fail. [NDM-2661] [Reported by i81]

Fixed a bug introduced in 4.0 Alpha 11 that prevented the Keenetic mobile application agent from starting correctly in KeeneticOS. [SYS-793]

Fixed DNS settings incorrectly removed on IKEv1/IPsec and IKEv2/IPsec VPN servers. [NDM-2662]

The new 464clat (RFC6877) option has been implemented for the IPv6 transition mechanism. [NDM-2121]

The SNMP server system component now supports IPv6 protocol operation. [NDM-2653]

SNMP response now comes from the correct source IP address when accessing via a VPN connection. [NDM-2082] [Reported by Christophe Lucas]

The default route is now correctly assigned for HTTP/HTTPS/SOCKS5 proxy interfaces. [NDM-2366]

The Fast Transition (802.11r) option is displayed correctly after changing the network name (SSID) for one of the Wi-Fi bands. [NWI-1508]

The Clients tooltip now displays Wi-Fi device names on the Extender's Wi-Fi monitor page. [NWI-1528] [Reported by enterfaza]

The cause of the group address 224.0.1.187 is not equal destination address error message in the System log has been fixed. [SYS-775]

The Hardware Network Accelerator operation is restored for the IPv6 protocol. [SYS-779] [Reported by Simone]

Implemented web-api authentication for the ZTE MF79U USB modem, which allows proper management in KeeneticOS. [NDM-2592]

The username of the KeeneticOS account now allows the dot '.' character. [NWI-1523]

Recovery of access to the internal /storage partition. [NDM-2629] [Reported by Serghey]

The Phase 1 Rekey time display is corrected in the Web Interface for Site-to-site IPsec VPN connections after changes in system statistics. [NWI-1518]

The new Huawei ME906E 4G LTE Cat 3 modem module is now supported. [NDM-2582]

The Media Server no longer requires activation - Access the applications running on your Keenetic in Guest or other protected segments. [NDM-2514] [Reported by Yevgen16]

Added an action to unmount USB drives when the USB port is powered off. [NDM-2589]

The CLI command for sending init AT commands has a new syntax for the UsbModem, UsbLte, and UsbQmi interfaces: [NDM-2564] [Requested by 1qqq]

The RADIUS settings propagate correctly from the Controller to all Extenders of the Wi-Fi System. [NDM-2243]

IPv4 connectivity restored via an IPv6 MAP-T Internet connection. [NDM-2613]

Fixed connected state for HTTP/HTTPS/SOCKSv5 proxy interfaces. [NDM-2627]

The Meiglink SLM820 4G LTE Cat 12 modem module is now supported. [NDM-2602]

The Application traffic analyser now supports traffic classification for the ICMP protocol. [SYS-760]

The AFP file sharing system component is updated to version 3.1.14. [NDM-2600]

The OpenSSL library is updated to the latest version, 3.0.8, which fixes the following list of vulnerabilities: [SYS-759]

The web UI of the Download station application is updated to version 1.6.1 . [SYS-757]

The maximum length of a PIN code for the SIM card in the UsbLte and UsbQmi modems is now eight characters. [NWI-1509]

The Ping Check > Automatic profile operation has been fixed. [NDM-2608]

The check box to Enable the SNTP service for local devices is available with a custom configuration of NTP servers. [NWI-1505]

The DHCP renewal process no longer restarts L2TP/PPTP/IPoE Internet connections. [NDM-2590] [Reported by 3-50]

Status detection of the interface with a static IPv6 address works as intended. [NDM-2591]

Disconnecting the underlying interface for WireGuard® VPN no longer causes traffic flooding. [NDM-2593] [Reported by vasek00]

New USB port power management is now available via CLI commands. You can power on/off USB ports or assign a schedule profile. [NDM-2550]

Use the following CLI commands:

The ipv6 firewall CLI command has been deprecated and removed. [NDM-1731]

Fixed unnecessary SMB file and printer sharing service restarting when the status of irrelevant network interfaces changes. [NDM-1840] [Reported by vasek00]

The network interface status tracking mechanism in KeeneticOS has been redesigned to provide better IPv6 protocol support and faster Web Interface response. [NDM-2415]

Improved compatibility of SMB file and printer sharing system component with Total commander application. [NDM-2574]

The remote access to the Download station via KeenDNS no longer produces limiting requests: excess by zone errors in the System log. [SYS-752]

The PPPoE connection now works as intended with IPv6-only connections. [NDM-2585]

Disabled PAT (Port Address Translation) for locally generated traffic. This was particularly disruptive to MAP-T and DS-Lite Internet connections. [NDM-2587] [Reported by Stef]

System halt has been fixed when connecting to the cloud service under certain conditions. [NDM-2516]

The new WAN IPv6 address assignment option has been implemented in accordance with the RFC6204 (WAA-8) standard. [NDM-2549]

The cause of the ndnproxy:out of socket file descriptors error message in the System log was fixed. It occurs under heavy loading of the DNS proxy service. [SYS-727]

The enabled DNS request transit option now operates as expected for unregistered hosts. [NDM-2547]

Fixed watchdog timer interrupt on CPU0 system reboot when using the Traffic shaper system component. [SYS-397]

The default route via the IPoE interface is now automatically restored after the PPP (PPPoE, L2TP, PPTP) interface is deleted. [NDM-2575]

KeeneticOS now allows you to assign 512 hosts with Static IP settings on the Device lists page for registered devices. [NDM-2501]

Increased KeenDNS service web application records from 160 to 256. [NDM-2519]

For the Fibocom L850-GL/L860-GL modem modules, SMS storage has been moved from the modem's internal memory to the SIM card memory to avoid problems with receiving and reading incoming SMS messages. [SYS-723] [Reported by r13]

The DNS proxy service now handles TCP chunks correctly, resulting in better service stability. [SYS-726]

Fixed connected state for interfaces with a statically configured IP address. [NDM-2551]

Phase 1 Rekey time is now displayed correctly for site-to-site IPsec VPN connections. [NDM-2554]

Fixed the reason for spontaneous disconnection of remote connections to L2TP/IPsec VPN server. [NDM-2555]

The Traffic monitor page now displays the correct average speed for 3 minutes. [NDM-2556]

Corrected the "transmitted bytes" statistic in the host traffic monitor legend. [NDM-2560]

The new deSEC (desec.io) service is available for the Dynamic DNS (DDNS) client system component. [NDM-2540]

A new CLI command allows the deactivation of an internal storm-control feature for a specific interface:

Ethernet ports are now operating correctly after re-enabling of the previously disabled ports. [NDM-2529] [Reported by T@rkus]

The 4G NDIS-type USB modems from Huawei are now correctly configured with the APN setting. [NDM-2524] [Reported by Migel]

Connection priority change no longer modifies the interface state. [NDM-2526] [Reported by T@rkus]

The ip6 prefix auto setting no longer disappears from the running configuration. [NDM-2528] [Reported by avn]

Fixed early expiration of the Days until count resets timer in the Data usage & limit feature for Mobile Broadband connections. [SYS-720]

The ICMP and GRE protocols are now available for the new IPsec traffic selectors with multiple subnets. [NDM-2534] [Reported by gaaronk]

The use of WireGuard® tunnels as the default route with the IPv6 protocol is now fixed. [NDM-2535]

Restored the working of IPv6 in IPv4 tunnels after switching to new routing table logic. [NDM-2544] [Reported by stakp]

The interface ipv6 force-default CLI command has been brought back into support for backward compatibility. [NDM-2545] [Reported by stakp]

The Fail-safe configuration mode no longer causes an unnecessary reboot. The timeout is set to three minutes. [NWI-1496]

The Provider name description now displays correctly on the Dashboard and Connection priorities pages. [NWI-1495] [Reported by r777ay]

The cause of the not found: show/ip6/routes error messages in the System log was fixed. [NWI-1497] [Reported by fl4co]

Restored PPPoE interface management when it changes up or down state. [NDM-2523] [Reported by dimon27254]

The SSTP VPN server now supports legacy TLSv1/SHA1 algorithms for correct SSTP connection with particular Windows 7 clients. [NDM-2525] [Reported by Winterborn]

The new IPv6 Prefix Delegation option has been implemented for subnetting. [NDM-1976]

Use the following CLI commands to set:

A typical configuration Prefix Delegation for a Home segment looks like follows:

ipv6 subnet Default
    bind Home
    mode dhcp
    prefix length 63
    prefix delegate 64
    number 0

The new multiple subnets option is available for Site-to-site IPsec VPN connections in Phase 2, providing network connectivity between several subnets over a VPN tunnel. [NDM-313]

Use the following CLI commands to set:

The new Add local subnet and Add remote subnet options are available for Site-to-site IPsec VPN connections on the Internet > Other connections page.

Implemented frequency band selection option for Huawei modems with NDIS-type. [NDM-2151] [Requested by XEGARE]

Implemented host traffic accounting for IPv6 protocol, providing correct calculation for the incoming/outgoing data of your home devices. [SYS-648]

The Application traffic analyser now supports traffic classification for the IPv6 protocol. [SYS-652]

The Traffic shaper system component now supports operation with the IPv6 protocol, providing correct traffic limitation for data flows of IPv4/IPv6 together. [SYS-658]

New USB modem modules are now supported, including:

The Web Interface receives core support for IPv6 connections. [NDM-2448]

The OpenVPN client and server system component now supports the IPv6 protocol for VPN connection. [NDM-2451]

The Wireguard VPN component now internally supports the IPv6 protocol for VPN connection. [NDM-2452]

Implemented support for 802.1Q tagged VLAN traffic over AccessPoint and WifiStation (Wireless ISP) interfaces. [SYS-682]

The new HTTP/HTTPS URI mode of the Ping Check allows you to specify the host address to check using a URI (Uniform Resource Identifier). [NDM-2490] [Requested by Oleksii87]

Use the following CLI commands to set:

Connection policy now operates with the IPv6 protocol. [NDM-2515]

Implemented copying of static routes to all Connection policies. [NDM-2335]

Traffic Classification now supports PPP and GRE protocol recognition for the IntelliQoS and Application Traffic Analyser functions [NDM-2486]

DNS IPv6 responses now sent from the correct and expected port 53. [NDM-2439]