Release ASUS RT-AX86U Pro Firmware version 3.0.0.6_102_34312 - 2024/05/09

[OzarkEdge]

Upgraded my network to ASUSWRT 5.0 and 2.5Mbps backhaul... not using IPv6.

Traded in a burned out RT-AC86U to Best Buy for 15% off a new RT-AX86U Pro (2023 Vietnam) on sale for $209... and then I asked the BB sales rep if I could keep the three antennas and they let me... very much a 'best buy', imo.

Initial new fw observations:

o QIS includes a more in-your-face privacy/policy statement (thanks, EU!):

And in the webGUI:

o QIS\Manual Settings\Upload did not like the fw filespec to my local drive... I completed QIS and used the upload link under the Firmware tab.

o The release notes link on the Firmware tab did not load the notes.

o Auto fw and security upgrade settings got some clarification:

o The Policy tab has a link that does not work... the whole tab content goes blurred and cannot be read (I'm using Edge)... used the browser Back button to back out of it. Repeatable.

Update: Now I get a blank popup dialog over the blurred contents (explains the blurr).

o All Ethernet port status came up yellow (100Mbps) once initially... this cleared up after some webGUI navigation.

o Previous network with AX86U node would not list clients wired to the node (over MoCA2.5 wired backhaul)... the new network is listing clients wired to the node. However, this listing goes blank and appears to recover clients upon browser refresh.

Now to discover 'VLANs w/DHCP' to resurrect my guest network:

[Guest Network Pro] What is Guest Network Pro? | Official Support | ASUS USA

[Wireless Router] What is VLAN and how to setup in ASUS Wireless Router? | Official Support | ASUS USA

Thanks, ASUS!

OE

 

[bbunge]

Only real problem I encountered was the 2.5 GB port quit working when I had VLAN 52 set on LAN port 3 to the Guest - IoT network. The clients on port 3 via an unmanaged switch did get IP addresses and connected to the internet. Connecting a client to the 2.5 GB port lost connection to the network and internet. Have backed off from the VLAN for now.

 

[Justinh]

Only real problem I encountered was the 2.5 GB port quit working when I had VLAN 52 set on LAN port 3 to the Guest - IoT network. The clients on port 3 via an unmanaged switch did get IP addresses and connected to the internet. Connecting a client to the 2.5 GB port lost connection to the network and internet. Have backed off from the VLAN for now.

Did you report to ASUS? Let us know how/if they respond.

 

[OzarkEdge]

Some thoughts on Guest Network Pro (GNP)... Software-Defined Networking (SDN)... (VLAN with DHCP)... profiles:

Is there more to the Define Networks (Guest, Kid's, IoT, etc.) than meets the webUI eye, or can I roll my own using Customized Network without losing some hardwired routing function?

Beware the Guest Network Pro awkward VLAN ID Assign control... it will navigate to the LAN\VLAN tab and lose unapplied settings.

Is there a particular rationale I should consider for changing the default subnet mask, 255.255.255.0 (253 clients)?

So far so good with this release. I had one issue not being able to get an IP at the node for a Guest Network. I recreated that profile and the issue is gone.

Very snappy webUI.

OE

 

[ckristi]

I did do a factory reset via WPS method and through the UI with manual reconfig. Still no luck IPv6 is broken.

Let me try to spare you one lost night (as I did just lose one over this): it seems the IPv6 issue is related to IPv6 Firewall being enabled. I've worked it around by moving the filtering one hop up and disabling the filtering on the AX86U-Pro. I didn't yet understand what change in the firewall broke this.

This is the diff for the ip6tables (ipv6_fw_off vs ipv6_fw_on):

--- asusrt_ipv6_fw_off    2024-05-12 11:40:12.374789529 +0200
+++ asusrt_ipv6_fw_on    2024-05-12 11:40:27.530924471 +0200
@@ -16,20 +16,24 @@
 ACCEPT     udp      ::/0                 ::/0                 udp spt:547 dpt:546
 ICMP_V6_LOCAL  icmpv6    ::/0                 ::/0               
 ICMP_V6    icmpv6    ::/0                 ::/0               
+DROP       all      ::/0                 ::/0               
 
-Chain FORWARD (policy ACCEPT)
+Chain FORWARD (policy DROP)
 target     prot opt source               destination         
 NWFF       all      ::/0                 ::/0               
 URLFF      all      ::/0                 ::/0               
+ACCEPT     all      ::/0                 ::/0                 state RELATED,ESTABLISHED
 WGSF       all      ::/0                 ::/0               
 OVPNSF     all      ::/0                 ::/0               
 ACCEPT     all      ::/0                 ::/0               
 DROP       all      ::/0                 ::/0                 state INVALID
 ACCEPT     59       ::/0                 ::/0                 length 40
 ICMP_V6    icmpv6    ::/0                 ::/0               
+ACCEPT     udp      ::/0                 [REDACTED_INTERNAL_LAN_DNS_IP]/128  state NEW udp dpt:53
 WGCF       all      ::/0                 ::/0               
 OVPNCF     all      ::/0                 ::/0               
 SDN_FF     all      ::/0                 ::/0               
+DROP       all      ::/0                 ::/0

 

[OzarkEdge]

I notice that the node 2.5G port used for my MoCA backhaul is labeled port 5... LAN 5:

This labeling doesn't quite fit my interpretation of my previous AX86U node ports...

Primary WAN set to 1G WAN: 2.5G port defaults to LAN5 after QIS, or to WAN on a wired node.

Primary WAN set to 2.5G port: default WAN becomes LAN5 after reboot.

Perhaps they chose not to complicate the port status display too much despite the various usage.

OE

 

[ckristi]

Let me try to spare you one lost night (as I did just lose one over this): it seems the IPv6 issue is related to IPv6 Firewall being enabled. I've worked it around by moving the filtering one hop up and disabling the filtering on the AX86U-Pro. I didn't yet understand what change in the firewall broke this.

This is the diff for the ip6tables (ipv6_fw_off vs ipv6_fw_on):

--- asusrt_ipv6_fw_off    2024-05-12 11:40:12.374789529 +0200
+++ asusrt_ipv6_fw_on    2024-05-12 11:40:27.530924471 +0200
@@ -16,20 +16,24 @@
 ACCEPT     udp      ::/0                 ::/0                 udp spt:547 dpt:546
 ICMP_V6_LOCAL  icmpv6    ::/0                 ::/0              
 ICMP_V6    icmpv6    ::/0                 ::/0              
+DROP       all      ::/0                 ::/0              
 
-Chain FORWARD (policy ACCEPT)
+Chain FORWARD (policy DROP)
 target     prot opt source               destination        
 NWFF       all      ::/0                 ::/0              
 URLFF      all      ::/0                 ::/0              
+ACCEPT     all      ::/0                 ::/0                 state RELATED,ESTABLISHED
 WGSF       all      ::/0                 ::/0              
 OVPNSF     all      ::/0                 ::/0              
 ACCEPT     all      ::/0                 ::/0              
 DROP       all      ::/0                 ::/0                 state INVALID
 ACCEPT     59       ::/0                 ::/0                 length 40
 ICMP_V6    icmpv6    ::/0                 ::/0              
+ACCEPT     udp      ::/0                 [REDACTED_INTERNAL_LAN_DNS_IP]/128  state NEW udp dpt:53
 WGCF       all      ::/0                 ::/0              
 OVPNCF     all      ::/0                 ::/0              
 SDN_FF     all      ::/0                 ::/0              
+DROP       all      ::/0                 ::/0

Finally a reset to factory defaults (from WebUI) + manual reconfig of everything solved the IPv6 issue.

 

[ckristi]

Finally a reset to factory defaults (from WebUI) + manual reconfig of everything solved the IPv6 issue.

Actually, no, ICMP seems to be working correctly now (as compared to before), maybe due to this slight change in the ip6tables as compared to before the factory reset:

Chain ICMP_V6 (2 references)
target     prot opt source               destination         
-RETURN     icmpv6    ::/0                 ::/0                 ipv6-icmptype 128 limit: avg 1/sec burst 5
+ACCEPT     icmpv6    ::/0                 ::/0                 ipv6-icmptype 128

but TCP connections are still failing.

 

[Analog-1]

Actually, no, ICMP seems to be working correctly now (as compared to before), maybe due to this slight change in the ip6tables as compared to before the factory reset:

Chain ICMP_V6 (2 references)
target     prot opt source               destination       
-RETURN     icmpv6    ::/0                 ::/0                 ipv6-icmptype 128 limit: avg 1/sec burst 5
+ACCEPT     icmpv6    ::/0                 ::/0                 ipv6-icmptype 128

but TCP connections are still failing.

Broke here even factory reset does nothing to fix it. I disabled IPv6 for now. Other than IPv6 being broken this firmware seems to be working fine. Can't believe Asus did not check something as simple as IPv6 before they released this update.

 

[bennor]

I notice that the node 2.5G port used for my MoCA backhaul is labeled port 5... LAN 5:
<snip>

Been like that for some time, on the Merlin firmware. Haven't used the stock Asus firmware in some time but assumed it was the same there too. Commented about the 2.5GB port showing as a LAN port to someone else last month:
https://www.snbforums.com/threads/ax86u-pro-testing-with-2-5gb-wan.89682/#post-902754

Examples from a RT-AX86U Pro running Asus-Merlin 3004.388.6_2. WAN set to 1GB:

WAN set to 2.5GB:

 

[bbunge]

Did you report to ASUS? Let us know how/if they respond.

Glad to report that my issue with the 2.5G port was likely operator error of some sort. I redid the Guest-IoT VLAN to router port #3 and all appears to be working as intended. Originally I was trying to get my NAS LAN port 2 on VLAN 52 to allow my TV's and etc to access the DLNA server on the NAS. I solved my "video issue" for now by putting the most used video files on a M.2 SSD in a USB enclosure and made my Pi3 into a DLNA server. It is only USB2 but streams the videos with no problems.
Also added the AX86U as an AiMesh node and that is working well.
Now the sun is out and the Rail Trail is calling!

 

[Tech9]

Also added the AX86U as an AiMesh node and that is working well.

What's the behavior of Guest Network Pro on the main Pro router when the node is a non-Pro router?

Is there anything in Pro firmware explaining what to expect and how Guest Network propagation to nodes is going to work after 3.0.0.6 upgrade?

 

[bbunge]

What's the behavior of Guest Network Pro on the main Pro router when the node is a non-Pro router?

Is there anything in Pro firmware explaining what to expect and how Guest Network propagation to nodes is going to work after 3.0.0.6 upgrade?

The node functions the same as it did with the non-pro firmware. I only have one guest network with both 2.4 and 5 GHz enabled and the node has both of those guest WIFI. Have not tried a VLAN wired out of the node although I am sure a tagged connection of 52 would allow the client to join the Guest-IoT.
As a test I added my AC66U_B1 as a node and it restricted the channels the router could use, no DFS. As I am running 80 MHz on 5 GHz I did not observe any bandwidth reduction. The AC66U_B1 worked OK but it is now back in storage.

Edit: You can individually select which nodes get the guest WIFI. In the old firmware it was all or none.

 

[taedan]

Installed this last night works ok but IPv6 is broken don't work at all. Using native with comcast no issues on any other firmware except the new one here. Was this even tested before release ?

Same here on EPB Fiber (native). Hard reset/power cycle didn't solve the problem. Reverted back to 24199 and all is well.

 

[Tech9]

The node functions the same as it did with the non-pro firmware.

Are there any options for Guest Network Pro propagation to nodes or they work on the main router only in your Pro + non-Pro AiMesh?

@OzarkEdge perhaps has more configuration options with Pro node on the same VLAN capable firmware? My question is in relation of eventual AiMesh evolution using new available features in 3.0.0.6 firmware. Nothing is documented yet on Asus side. I expect old Guest Network only available to non-Pro nodes and eventually Guest Network Pro available to Pro nodes. At least ExpertWiFi series are expected to work like this with ExpertWiFi routers and access points as nodes, all on 3.0.0.6 firmware.

 

[grzewo]

I have a similar question regarding VLAN Switch Control Settings considering non-pro node. @OzarkEdge posted a sample, where both the router and the node are running pro firmware. I’m curious how that’s look like for a non-pro node.
Actually, it would be enough for me to be able to detach Ethernet ports from intranet on a specific node, which is located outside of my house.
And like others, I hope Asus will share pro firmware with RTAX86U, which is pretty much the same from hardware perspective as RTAX86PRO.

 

[Darkje]

I have a ax86u pro with a GT 2900 as node. What doe you want to know

 

[grzewo]

I have a ax86u pro with a GT 2900 as node. What doe you want to know

Hi, as above. How VLAN Switch Control Settings looks like comparing to what @OzarkEdge presented when a node is running pro firmware. Is there any option to manage Ethernet ports on a node running non-pro version?

 

[Darkje]

Hi, as above. How VLAN Switch Control Settings looks like comparing to what @OzarkEdge presented when a node is running pro firmware. Is there any option to manage Ethernet ports on a node running non-pro version?

No sir. It is not

 

[grzewo]

No sir. It is not

Thanks. Still have hope to get pro features to RTAX86U then or maybe even 86S