Asuswrt-Merlin 3.0.0.4.374.38 is out

[RMerlin]

Is there any drawbacks or negatives to this? Security, lower key size, etc? If someone wants to wade through manual configuration is that still better from a security standpoint?

They use a lower bit length to speed of the process, and it means all the keys are stored on the router rather than a secure location outside of your router. In theory, yes, it's not as secure as creating your own keys, signing certs, and they keeping the CA signing key outside of your router. But it depends on what level of security you need. A hacker might spend a lot of time hacking into a business to steal various data. He won't spend more than 2 mins trying to hack into a home router to steal your MP3s.

Asus's default setup is certainly bounds and leap more secure than PPTP already.

 

[beholder0]

Thanks, plugged it back into my pc and partition seemed to be corrupted, have made again and it seems ok. On a slightly related note the partition I have created for the media db is /mnt/mediadb. When i restart the router after setting this up also get a mnt/mediadb(1) that seem to be accessible from gui of router but /mnt/mediadb only seems to be accessible via putty and not gui or network share. Is this normal?

Thanks,
James

Yes, it's normal, if you connect an another storage with same partition name (without router restart) it get "(1)" tag (you recreated the partition, therefore it has become another new partition with same name), but if you restart the router, the name switch back to the real name of the partition, without "(1)" tag.

Edit: Sorry, I missed, that you already restarted your router.

 

[Lost Dog]

They use a lower bit length to speed of the process, and it means all the keys are stored on the router rather than a secure location outside of your router. In theory, yes, it's not as secure as creating your own keys, signing certs, and they keeping the CA signing key outside of your router. But it depends on what level of security you need. A hacker might spend a lot of time hacking into a business to steal various data. He won't spend more than 2 mins trying to hack into a home router to steal your MP3s.

Asus's default setup is certainly bounds and leap more secure than PPTP already.

MP3's? I've got a picture of my dog wearing underwear that would shake the foundation of the world as we know it. Looks like I'm creating my own keys!

Good to know that for now it's "secure enough". I travel a lot for work and spend a lot of time on public wifi. I like to make sure I'm covered...

Thanks!

 

[cornflake]

Good to know that for now it's "secure enough". I travel a lot for work and spend a lot of time on public wifi. I like to make sure I'm covered...

If you use VPN to encrypt your communications on a public WiFi hotspot, make sure that you disable IPv6 on your computer first. Using a packet analyzer on my WiFi adapter, I found all IPv4 traffic going through the VPN tunnel, but all IPv6 traffic was still taking the direct route, unencrypted.

 

[krum]

38.2 parental controls work I am seeing the same performance as .270.26 thanks for all your hard work I am running it on a rt-ac66u

Chris



Sent from my iPhone using Tapatalk

 

[PeterPasm]

Hi, I found something on the n66u with 38_2 here.

192.168.1.1/Advanced_MACFilter_Content.asp doesn't work for me. I have it set on accept (only) but it still allows network access to any machine what I connect to the router (via an utp cable).

Regards,
Peter.

 

[davidml]

Parental control

i Think it was working (parental control) until now.

but i Just had now a look to the panel,
the limitation for one PC is not any more present ..

 

[pitboss]

Please be aware that the openvpn client setup is having some issues on resetting the DNS to the WAN configured DNS upon disconnection from the VPN server push DNS. This should affect all client having option Strict or Exclusive.

It is affecting all versions after 35_4

Should be an easy fix for merlin.

 

[geops]

Hi, I found something on the n66u with 38_2 here.

192.168.1.1/Advanced_MACFilter_Content.asp doesn't work for me. I have it set on accept (only) but it still allows network access to any machine what I connect to the router (via an utp cable).

Regards,
Peter.

This is wireless mac filtering. It is usually used if you have open network and limit connectivity only by mac. However, it is extremely insecure. The point is, this setting has no effect on the lan ports. The lan switch is very basic and has no port security.

 

[RMerlin]

Please be aware that the openvpn client setup is having some issues on resetting the DNS to the WAN configured DNS upon disconnection from the VPN server push DNS. This should affect all client having option Strict or Exclusive.

It is affecting all versions after 35_4

Should be an easy fix for merlin.

Strict mode was actually broken prior to 38_2, it wasn't properly restarting dnsmasq after adding "strict-order" to its configuration. I can take another look, but it was working fine for me after I fixed that particular issue issue.

 

[PeterPasm]

This is wireless mac filtering. It is usually used if you have open network and limit connectivity only by mac. However, it is extremely insecure. The point is, this setting has no effect on the lan ports. The lan switch is very basic and has no port security.

Hey

Isn't this the wireless MAC filter page?: http://192.168.1.1/Advanced_ACL_Content.asp

Peter

 

[RMerlin]

Those having IPv6 connectivity issues, try either of these two settings:

nvram set ipv6_ra_conf=noneset
nvram commit

or

nvram set ipv6_ra_conf=mset
nvram commit

This is a new setting added by Asus, and I can't find any place where it sets it to any specific value (the default value is "noneset"). Reboot after setting it to a specific value, see if it makes any difference.

So far it seems that only Comcast users are having issues. This wouldn't be the first time...

 

[DonCatoli]

I updated the fw and wasted 2 hours with the stupid "Settings have been updated. Web page will now refresh." bug but I read up and solved that with the workaround... can that not be fixed? The issue I have now is that Internet Explorer 10 and 11 do not like the cert HTTPS is using and refuses to let me log in (the option to continue anyways is now gone), did Microsoft revoke the cert outright? is there a fix?

thx

 

[saintdev]

This is a new setting added by Asus, and I can't find any place where it sets it to any specific value (the default value is "noneset").

So far it seems that only Comcast users are having issues. This wouldn't be the first time...

It's set in rdnssd (ndisc6/rdnssd/icmp.c:106). And that isn't the issue, although there may be other issues with ipv6_ra_conf (see below). At least it has nothing to do with the "Cannot set address" issue I was experiencing. I can't say what is causing that issue (it shouldn't be happening in the first place), but I can say it isn't ipv6_ra_conf.

I do think Asus messed up setting ipv6_ra_conf. rdnssd only ever sets ipv6_ra_conf to "oset" or "noneset". In start_dhcp6c, they only ever check against the values "mset" and "noneset". A couple of the checks are if the value is not "noneset", so one of the places it's set to "oset" may be intentional. Based on the flags they're testing against in rdnssd (ND_RA_FLAG_MANAGED and ND_RA_FLAG_OTHER) and the config file generation in start_dhcp6c, I strongly suspect the first condition is supposed to set it to "mset" instead of "oset". That would make the following values for ipv6_ra_conf:

• noneset = None. Address and DNS provided by RA. dhcp6c is only used to request a prefix delegation.
• mset = Managed. Address and DNS provided by DHCPv6. dhcp6c is used to request an address, DNS servers and a prefix delegation.
• oset = Other. Address provided by RA, DNS provided by DHCPv6. dhcp6c is only used to request DNS servers and a prefix delegation.

Comcast users fall under the case that probably should be "mset" and explains why we never get a WAN IPv6 address. It's never requested! I just haven't had a chance to test changing this yet. This should be the only issue caused by this bug, though.

Those having IPv6 connectivity issues, try either of these two settings:

nvram set ipv6_ra_conf=noneset
nvram commit

or

nvram set ipv6_ra_conf=mset
nvram commit

Reboot after setting it to a specific value, see if it makes any difference.

This actually won't have any effect if you reboot, it's set every time in rdnssd just before start_dhcp6c is called (the only place it's read). You would have to set it, then restart dhcp6c.

nvram set ipv6_ra_conf=mset
nvram commit
service restart_dhcp6c

 

[pitboss]

Strict mode was actually broken prior to 38_2, it wasn't properly restarting dnsmasq after adding "strict-order" to its configuration. I can take another look, but it was working fine for me after I fixed that particular issue issue.

I've compiled the latest git and confirmed that this issue is fixed for the 39_alpha2 version, tho I'm not sure this alpha2 has been release to the public by rmerlin.

 

[RMerlin]

I've compiled the latest git and confirmed that this issue is fixed for the 39_alpha2 version, tho I'm not sure this alpha2 has been release to the public by rmerlin.

It's not released. I merely bump the version tag at various stages during development to make it easier for me to distinguish between various development builds.

 

[RMerlin]

I updated the fw and wasted 2 hours with the stupid "Settings have been updated. Web page will now refresh." bug but I read up and solved that with the workaround... can that not be fixed?

That message doesn't say anything about what is happening, merely that you just clicked on "Apply", so I have no idea what issue you are referring to.

The issue I have now is that Internet Explorer 10 and 11 do not like the cert HTTPS is using and refuses to let me log in (the option to continue anyways is now gone), did Microsoft revoke the cert outright? is there a fix?

The certificate is self-signed. Internet Explorer is sometime stupid and will suddenly refuse to let you manually accept any certificate it does not recognize. Check on the web, there are various tips on how to fix this. One method that I recall was to put the site in the Trusted Site list.

 

[jay50n]

It's set in rdnssd (ndisc6/rdnssd/icmp.c:106). And that isn't the issue, although there may be other issues with ipv6_ra_conf (see below). At least it has nothing to do with the "Cannot set address" issue I was experiencing. I can't say what is causing that issue (it shouldn't be happening in the first place), but I can say it isn't ipv6_ra_conf.

I do think Asus messed up setting ipv6_ra_conf. rdnssd only ever sets ipv6_ra_conf to "oset" or "noneset". In start_dhcp6c, they only ever check against the values "mset" and "noneset". A couple of the checks are if the value is not "noneset", so one of the places it's set to "oset" may be intentional. Based on the flags they're testing against in rdnssd (ND_RA_FLAG_MANAGED and ND_RA_FLAG_OTHER) and the config file generation in start_dhcp6c, I strongly suspect the first condition is supposed to set it to "mset" instead of "oset". That would make the following values for ipv6_ra_conf:

• noneset = None. Address and DNS provided by RA. dhcp6c is only used to request a prefix delegation.
• mset = Managed. Address and DNS provided by DHCPv6. dhcp6c is used to request an address, DNS servers and a prefix delegation.
• oset = Other. Address provided by RA, DNS provided by DHCPv6. dhcp6c is only used to request DNS servers and a prefix delegation.

Comcast users fall under the case that probably should be "mset" and explains why we never get a WAN IPv6 address. It's never requested! I just haven't had a chance to test changing this yet. This should be the only issue caused by this bug, though.



This actually won't have any effect if you reboot, it's set every time in rdnssd just before start_dhcp6c is called (the only place it's read). You would have to set it, then restart dhcp6c.

nvram set ipv6_ra_conf=mset
nvram commit
service restart_dhcp6c

This does solve the ipv6 issue on singapore isp M1. It works well

 

[MarkyPancake]

I've gone back to 374.38_2-em and browsing and using the admin pages is slow. It takes several seconds for pages to load, even after caching, and sometimes it just hangs on a white page, such as going from 2.4 GHz to 5 GHz wireless settings via the drop-down menu.

I had this problem when I tried it before, but thought other factors were at play at the time.

 

[Muchoaliento]

Greetings,

Was using version 3.0.0.4.374.34_2 on my RT-N66u and wanted to jump to bleeding edge 38_2, upgrade went with no problem and forced a factory reset from config menu (just in case).

The thing is, upon initial device configuration, my router refused to automatically detect connection type no matter what option I selected (my ISP provides cable service). Even resetted modem and called and asked for DNS which I entered but same result, kept returning to "check connection" page.

As this connection is what I use for work and cannot keep idle, I reverted back to 34_2, which is what I am using right now.

Sorry, but 38_2 is a no no for me...