Release ASUS RT-AX88U Pro Firmware version 3.0.0.4.388.23110 (2023/04/26)

[xander73]

ASUS RT-AX88U Pro Firmware version 3.0.0.4.388.23110
Version 3.0.0.4.388.23110
62.88 MB
2023/04/26
New features:
-Built-in Surfshark in VPN Fusion allows you to surf the internet anonymously and securely from anywhere by encrypting connections. Please refer to https://asus.click/SurfsharkVPN

-iPhone/Android USB auto backup WAN allows you to connect your phone to the router’s USB port and use it as an internet source. Please refer to https://asus.click/AutobackupWAN

-DDNS transfer allows you to transfer your ASUS DDNS hostname from your original router to the new one. Please refer to https://asus.click/ASUSDDNS

Bug fixes and functionality modifications:
-Resolved the issue with login and password changes.
-Resolved the IPSec VPN connection issues.
-Resolved the Instant Guard connection issues.
-Fixed the AiCloud login issue after unplugging and plugging the HDD into the USB port.
-Fixed the issue where Traffic Analyzer sometimes couldn't record data.
-Fixed the time display issue for the preferred upgrade time in the Auto Firmware Upgrade function.
-Fine-tuned the description for port status.
-Enabled DynDNS and No-IP DDNS to use IPv6.
-Fixed AiMesh preferred AP identification in site survey results.
-Updated timezone list for Greenland, Mexico, and Iran.
-Modified the USB application option text in dual WAN.
-Allowed WireGuard Server clients to access the Samba server.
-Fixed memory leak issue.
-Enabled the failback function when using the iOS/Android USB backup WAN.

Security updates:
-Enabled and supported ECDSA certificates for Let's Encrypt.
-Enhanced protection for credentials.
-Enhanced protection for OTA firmware updates.
-Fixed DoS vulnerabilities in firewall configuration pages. Thanks to Jinghe Gao's contribution.
-Fixed DoS vulerabilities in httpd. Thanks to Howard McGreehan.
-Fixed information disclosure vulnerability. Thanks to Junxu (Hillstone Network Security Research Institute) contribution.
-Fixed CVE-2023-28702 and CVE-2023-28703. Thanks to Xingyu Xu(@tmotfl) contribution.
-Fixed null pointer dereference vulnerabilities. Thanks to Chengfeng Ye, Prism Research Group - cse hkust contribution.

Please unzip the firmware file first then check the MD5 code.
MD5: 423eddf2168e5e18100f7e6fabcde8c6

https://dlcdnets.asus.com/pub/ASUS/wireless/RT-AX88U%20Pro/FW_RT_AX88U_PRO_300438823110.zip?model=RT-AX88U%20Pro

 

[TheLyppardMan]

Just in time! I decided to move back to stock firmware this morning as I was having problems with my wireless Canon network printer. Possibly I deleted some files I shouldn't have done when uninstalling Skynet, or it could have been that I set my network to a somewhat uncommon IP range (10.8.8... with the router set to 10.8.8.7) following some security discussions on another web site. Anyway, it's taken me all day to reconfigure everything back to standard ASUS 192.168.50... (not just the router but all the other things like files and Chrome bookmarks that link to my Synology NAS IP address). At least, everything seems to be back to normal now, so that's a relief. Just my inevitable headache to get rid of now, which hopefully will fade away if I can get a good night's sleep tonight.

 

[Tech9]

If you stop playing with the settings after you read something somewhere your quality of life may improve significantly.

 

[TheLyppardMan]

If you stop playing with the settings after you read something somewhere your quality of life may improve significantly.

Time will tell. Anyway, as I'm now using the stock firmware, there will be less options to "play". I've also set the firmware to auto update mode, so I won't have to keep checking on that either.

 

[Tech9]

so I won't have to keep checking on that either.

You can use the Asus App for notifications if you want to. It sends notifications for new connected devices to your network as well. Via Asus App you have simpler version of DNS Director now to specific devices - not available in router's GUI. There are still things to play with.

 

[TheLyppardMan]

You can use the Asus App for notifications if you want to. It sends notifications for new connected devices to your network as well. Via Asus App you have simpler version of DNS Director now to specific devices - not available in router's GUI. There are still things to play with.

OK, thanks for that. Still some things to play with after all! I'm also considering getting some sort of wireless dongle that I could plug into my router if there were an outrage on the local CityFibre network, as happened a few weeks ago, just before I left BT. The other option could be to buy a bundle for my mobile phone in such an eventuality and use that. Either way, this is a nice feature that we now have on our ASUS routers IMHO.

 

[Tech9]

Still some things to play with after all!

In this current firmware you have everything to play with except Asuswrt-Merlin specific VPN Director and Custom Scripts. All other major features are already ported to Asuswrt or have an equivalent like VPN Fusion. If you decide to play with the new Asuswrt Pro beta firmware you can see features not available in Asuswrt-Merlin and not coming any time soon. This future firmware is the main advantage of your Pro model router.

 

[TheLyppardMan]

In this current firmware you have everything to play with except Asuswrt-Merlin specific VPN Director and Custom Scripts. All other major features are already ported to Asuswrt or have an equivalent like VPN Fusion. If you decide to play with the new Asuswrt Pro beta firmware you can see features not available in Asuswrt-Merlin and not coming any time soon. This future firmware is the main advantage of your Pro model router.

View attachment 49821

Thanks for that; useful to know. I've set up Wireguard VPN on my Android phone and it allows me to access the Plex media server on my Synology Diskstation without having to enable remote access to the server, so that's cool. Tomorrow's experiment is to try out the hotspot tethering feature. I don't normally use data much on my mobile, so I have a PAYG sim from ASDA mobile, but I currently have an active non-recurring 5GB bundle to enable me to test the VPN and other features. I'm going to try disconnecting the Cat 7 cable from my ONT, to simulate an external network outrage and then I'll see if the router can distribute internet access to my network using my mobile phone data. I'll have to wait until the morning so that no-one else is using the network. If it works, my plan in the event of another multi-day outrage would be to pop down to my local ASDA store to obtain another SIM with a non-recurring data bundle and pop that into a dongle, which I could then connect to the router's US port.

Regarding the scripts, I didn't use many of those, so I don't think I'll miss anything there. The one thing I did want to use, mini-snmp didn't work with my Networx app; no idea why, because it worked with my previous ASUS router. Perhaps it's now running a newer version of mini-snmp that is no longer compatible, but who knows? Anyway, I can easily live without it. DNS Director was useful, because I could use Cloudflare as my main DNS resolver (as now), but use AdGuard for my mobile phone, but I can live without that as well. Also, it obviously didn't work with YouTube, so if I want to watch a YouTube video containing lots of adverts, I download the file first, so uBlock Origin can kindly remove the adverts for me. Then I simply have to upload it to my NAS and watch it on my TV via my Amazon Fire TV Stick. It's nice to have some workarounds isn't it?

 

[Tech9]

to simulate an external network outrage

It will work with unplugged cable, but may not work with lost service. Dual WAN in Asuswrt has issues unless Asus fixed something very recently. There is even a custom script addressing the issues. You may find your mobile plan completely drained because the router didn't switch the connections back.

I could use Cloudflare as my main DNS resolver (as now), but use AdGuard for my mobile phone

You can do that in stock Asuswrt as well. Go to LAN section, DHCP Server, Reserve an IP for your phone, use DNS Server (Optional) for it. What you don't have is port 53 redirection, but it doesn't matter. If your phone wants badly access to another DNS server it will use DoT or DoH and still get there.

 

[TheLyppardMan]

It will work with unplugged cable, but may not work with lost service. Dual WAN in Asuswrt has issues unless Asus fixed something very recently. There is even a custom script addressing the issues. You may find your mobile plan completely drained because the router didn't switch the connections back.



You can do that in stock Asuswrt as well. Go to LAN section, DHCP Server, Reserve an IP for your phone, use DNS Server (Optional) for it. What you don't have is port 53 redirection, but it doesn't matter. If your phone wants badly access to another DNS server it will use DoT or DoH and still get there.

I've just tested my phone and the static IP option does enable me to use AdGuard, so that's good.

Regarding the backup WAN feature, I'll test that later this morning. If there were an outrage that looked like it might last for more than a day, I'd probably buy an unlimited ASDA bundle, as my daughter uses quite a lot of data. Something like this should do I would think:

 

[TheLyppardMan]

I can confirm that on reconnecting the ONT to the router, the connection to the internet continues to use the mobile phone's data, rather than switching back to my ISP.

 

[Tech9]

Report your finding to Asus in the Feedback form. Mention in Comments routers for $60 do multi-WAN properly. Suggest getting one to take a look.

 

[TheLyppardMan]

Report your finding to Asus in the Feedback form. Mention in Comments routers for $60 do multi-WAN properly. Suggest getting one to take a look.

I've raised a support ticket and sent them a copy of my system log.

 

[TheLyppardMan]

I'm disappointed so far with the response from ASUS. They've asked me to provide all sort of stuff, such as my router name, serial number, firmware version, etc and yet I already provided that in my initial enquiry. Even the subject line of their e-mail response states this: "Re: <Web>Wireless RT-AX88U Pro; ASUS Service No=E23050006962-0001" [my emphasis added].

Here is part of my response to the message I have received from ASUS:

"I'm disappointed by your response to my enquiry. I'm not very well at the moment and I feel I have provided you with enough information for you to be able to investigate this matter. For example, you can see that I have already provided you with the firmware version, serial number and system log, so why are you asking for this information again?

My ISP is Zen Internet and they could advise you of the make/model of the ONT, although I don't think that's relevant.

Did you view the forum thread using the link I provided? If not, here is a copy of the relevant part of the discussion..."

On a related subject, I now have an idea how to use mobile hotspot tethering, but if I were to buy a dongle and SIM card to use instead, can anyone tell me what steps I would need to follow to start and stop the router from using the dongle if my normal WAN connection became unavailable for some reason? I might buy one soon anyway to try it out.

 

[bennor]

On a related subject, I now have an idea how to use mobile hotspot tethering, but if I were to buy a dongle and SIM card to use instead, can anyone tell me what steps I would need to follow to start and stop the router from using the dongle if my normal WAN connection became unavailable for some reason? I might buy one soon anyway to try it out.

Look at the WAN > Dual WAN page in the GUI for the options/settings for using Dual WAN. If you search through the various dual WAN posts here you'll see some have issues getting things like the failover feature to work properly. One can select which WAN connection to use on the Dual WAN page.

[Wireless Router] Dual WAN introduction and setup - Failover and Load Balance

 

[Tech9]

I'm disappointed so far with the response from ASUS.

At least you got a response. They know very well there is an issue. It's there for years. The person who replied to you perhaps doesn't know about it.

 

[TheLyppardMan]

I received this reply yesterday (10th May):
"Could you please try loading this BETA firmware and reset - and see if the issue has been resolved?"

I don't fancy having to "reset" everything, just to see if this works, especially since no confirmation of whether ASUS has actually made any attempt to rectify this particular issue has been given. I shouldn't be expected to waste my time testing whether their products are functioning correctly IMHO. What do others think?

 

[L&LD]

Download, verify, and save a copy of the firmware you currently have installed. Create a backup config file from your current configuration. Save this with the firmware (they are a matched pair).

Flash the firmware they offered. Do a full reset. Test.

If the testing isn't successful, simply flash the firmware you saved, reset to factory defaults, then load the saved backup config file you created.

This isn't a burden. They are trying to fix your issues (and yes, they have made an attempt to fix things, but you still need to test it for yourself, in your environment. They can't be expected to recreate everyone's environment for every firmware they issue).

 

[Tech9]

I shouldn't be expected to waste my time testing whether their products are functioning correctly IMHO.

I did that for fun. I told you it's not working properly. Now you have some fun with reboot and reset. Part of the experience.

 

[TheLyppardMan]

I've replied to the message I received from ASUS as follows:

"I'm a bit confused with the numbering of the beta firmware. On the ASUS website it lists the following beta firmware for my RT-AX88U Pro router as "ASUS RT-AX88U Pro Firmware version 9.0.0.6.102.4856" and yet the numbering of the beta firmware on your link is "RT-AX88U_9.0.0.4_22713-g259835d_ubi.w" Can you confirm that both these firmware versions are for my router model and also whether the beta version has specifically tried to address the issue raised by the advanced users on the forum thread, as per my previous message?"