Beta Asuswrt-Merlin 3006.102.4 Beta is now available

[bennor]

Did you notice this button?

Have not checked it in this Asus-Merlin 3006 Beta yet, but under stock Asus firmware on an RT-AX86U Pro that option (Access Intranet), when unchecked, didn't work when one has Use same subnet as main LAN enabled. See my comments in the stock Asus firmware discussions:

Release - ASUS RT-AX86U Pro Firmware version 3.0.0.6_102_34312 - 2024/05/09

thanks - i should've worded my situation better: currently not on either firmware but getting this model soon; sounds like latest stock firmware should work for me as I do not have ipv6; thanks again! You should be able to move forward now with this current stock firmware... install it, Hard...

www.snbforums.com

Release - RT-AX86U_Pro : 3.0.0.6.102_34334 2024/11/06

ASUS RT-AX86U Pro Firmware version 3.0.0.6.102_34334 Version 3.0.0.6.102_34334 58.23 MB 2024/11/06 1. Strengthened input validation and data processing workflows to further protect information security. 2. Enhanced AiCloud password protection mechanisms, safeguarding...

www.snbforums.com

Only way I could get the Guest Network Pro isolated from main LAN was to disable Use same subnet as main LAN.

 

[visortgw]

Have not checked it in this Asus-Merlin 3006 Beta yet, but under stock Asus firmware on an RT-AX86U Pro that option (Access Intranet), when unchecked, didn't work when one has Use same subnet as main LAN enabled. See my comments in the stock Asus firmware discussions:

Release - ASUS RT-AX86U Pro Firmware version 3.0.0.6_102_34312 - 2024/05/09

thanks - i should've worded my situation better: currently not on either firmware but getting this model soon; sounds like latest stock firmware should work for me as I do not have ipv6; thanks again! You should be able to move forward now with this current stock firmware... install it, Hard...

www.snbforums.com

Release - RT-AX86U_Pro : 3.0.0.6.102_34334 2024/11/06

ASUS RT-AX86U Pro Firmware version 3.0.0.6.102_34334 Version 3.0.0.6.102_34334 58.23 MB 2024/11/06 1. Strengthened input validation and data processing workflows to further protect information security. 2. Enhanced AiCloud password protection mechanisms, safeguarding...

www.snbforums.com

Only way I could get the Guest Network Pro isolated from main LAN was to disable Use same subnet as main LAN.

That only makes sense when given the option to configure sublets/VLANs.

 

[rung]

Yes, when DNS Director is set to Router for a guest network, DNS does not resolve.

Is there a way to enable DNS Privacy (e.g. DoT) for these clients another way?

 

[MDM]

Yes, when DNS Director is set to Router for a guest network, DNS does not resolve.

No, its solved (already in Alpha 2)...

- FIXED: Guest Networks on an isolated VLAN with DNSDirector set to "Router" would fail to do any name resolution.

 

[visortgw]

No, its solved (already in Alpha 2)...

I have not been able to get this to work.

 

[MDM]

I have not been able to get this to work.

Works for me, my clients connect just fine now (DNS Server Default in Guest Network).
And I do have DoT, DNSSEC, DNS Rebind protection enabled...
Also not on same subnet if that matters.

 

[bennor]

That only makes sense when given the option to configure sublets/VLANs.

One would think so but that's not apparently what happening (as my posts linked previously indicate with the stock firmware). The entire Guest Network Pro feels like beta that Asus rushed out. I'm also finding, when experimenting with adding and removing Guest Network Pro Profiles, that sometimes certain Guest Network Pro options like Access Intranet no longer appear as an option in a new Guest Network Pro Profile after previously creating a Guest Network Pro Profile and then deleting it and creating a new one. Hopefully Asus will spend some time fixing the entire Guest Network Pro feature since more than a few seem to have issues with it.

 

[alan6854321]

OK, bit the bullet and upgraded to 3006.102.4_beta1.
Everything seems to work including Aimesh with 3004 on the node.
I haven't bothered to remove/re-add the node as it all seems OK.

 

[bennor]

Works for me, my clients connect just fine now (DNS Server Default in Guest Network).

DNS Director is working for Guest Network Pro Profile clients on a RT-AX86U Pro. I've experimented with Redirection for a Guest Network Profile set to; No direction, or Router or User defined 1. Worked with all three settings, The Guest Network Pro Profile clients could access and surf the internet. PS: User defined DNS 1 is set to a Pi-Hole device IP address so I can run my Guest Network Pro Profile clients through Pi-Hole.

Edit to add: Current working DNS Director setting attached. User defined DNS 1 is a Pi-Hole device.

 

[rung]

Works for me, my clients connect just fine now (DNS Server Default in Guest Network).
And I do have DoT, DNSSEC, DNS Rebind protection enabled...
Also not on same subnet if that matters.

My redirection to Router was set for certain clients, not globally. Could be difference.

 

[MDM]

My redirection to Router was set for certain clients, not globally. Could be difference.

That wont work for Guest Network Pro.

 

[visortgw]

Works for me, my clients connect just fine now (DNS Server Default in Guest Network).
And I do have DoT, DNSSEC, DNS Rebind protection enabled...
Also not on same subnet if that matters.

Thanks for confirming. I reconfigured to Router and Default for both guest networks, and I rebooted entire network. As you stated, it does work!

 

[bluepoint]

AX86U-Pro: In Guest Network Pro, if you configure a guest or iot network and select "use same subnet as main network" the guest/iot clients can reach everyhting inside the main network. In the previous 3004 release this was blocked. They used the same ip subnet but could only reach the internet. Is this a bug, or a new "feature"? If it's a feature, it makes gues/iot network useless if you select "same subnet", so be careful. Also, < and > are no longer allowed within a guest networks wifi key. Both are no show stoppers, but to be mentioned.

As long as you disable "access to intranet" in settings, you'll be fine even if you use same subnet as main network. This way the main network can access the GN and not vice versa.

 

[chris.at]

Did you notice this button?
And there is also a Set AP Isolated switch to prevent communications between connected Guest devices...

Thank you, but there is no such button on AX86U-Pro.

 

[MDM]

Thank you, but there is no such button on AX86U-Pro.

Not there, but after it's made...

 

[chris.at]

As long as you disable "access to intranet" in the advanced settings, you'll be fine even if you use same subnet as main network. This way the main network can access the GN and not vice versa.

Makes sense, but there is no such button in the AX86U-Pro (or I'm blind).

 

[chris.at]

Its the same problem, when Use same subnet as main LAN is enabled, that has been repeatedly complained about in the stock Asus 3006 firmware. Made several lengthy posts about it in the past pointing this out in the stock firmware last year when Asus released the 3006 firmware for the RT-AX86U Pro. See here and here. The Guest Network IoT preset default settings simply doesn't work like one would expect, clients isolated from main LAN. I stopped using the IoT preset and use the Customized Network preset in Guest Network Pro, and have Use same subnet as main LAN disabled.

Thank you, so no efforts on Asus' side to fix this obviously. But now I know.

 

[MDM]

Makes sense, but there is no such button in the AX86U-Pro (or I'm blind).

 

[chris.at]

Not there, but after

Not there on my router, only the ap isolation feature. No idea why this button is missing. But as bennor wrote it seems to do nothing at all even if it's there?

Your screenshot is from an AX86?

 

[bluepoint]

Makes sense, but there is no such button in the AX86U-Pro (or I'm blind).

GT-AX6000