Asuswrt-Merlin 380.59 is now available

[RMerlin]

Openvpn server is not working as intended. Starting the vpn server doesn't add the firewall rule to allow inbound connections. pptp works though, but since it's insecure, I would like to avoid it. nmap output as follows:

The firewall rule is definitely properly configured, otherwise the OpenVPN server wouldn't work for anyone. I note that you are scanning from inside your LAN, which won't test anything - the OpenVPN server is configured to listen to connections on the WAN interface. Therefore, firewall configuration is applied to the INPUT chain, not the FORWARD chain.

The ovpn config files generated by the web ui have some syntax issues, at least as far as importing them into ubuntu's network manager gui goes. The html style formatting for certs embedded in the config file probably doesn't work in ubuntu. I have some other ovpn config files which work. They use separate files for the certs and keys in the same directory, and the ovpn file refers to those files.

This formatting is directly supported by the OpenVPN binary. If Ubuntu does its own pre-processing, then there isn't much I can do about it - the config is designed for OpenVPN, not for Network Manager. This is a limitation in Ubuntu in that case, not a bug in the firmware's generated config.

If is use the ddns name (even from inside the lan), it doesn't allow connection to services (for eg. httpd, ssh) that it normally would if i were to use 192.168.1.1 directly from the lan. I know that this used to work earlier. Edit: Tried changing nat loopback from asus to merlin, but didn't help.

Asus tightened security in recent GPL code. httpd no longer listens to every available interface, it will only specifically bind to the LAN interface, or the WAN and LAN interfaces but ONLY if you set it to listen to both WAN and LAN. Using your DDNS hostname means you are trying to access it through the WAN interface, which is most likely not enabled in your case. This is the intended behaviour, and is far more secure than the old one.

 

[wbwwa]

Hi! I'm new here. Already replaced my RT-AC87U with RT-AC88U mostly for 8 LAN switch .

Using same WiFi 5GHz settings my BCM4352 card gets only 400Mbps connection vs. 866Mbps with 87U. Any idea what's wrong? Feel free to ask if more details needed.

 

[bradbort]

Hi! I'm new here. Already replaced my RT-AC87U with RT-AC88U mostly for 8 LAN switch .

Using same WiFi 5GHz settings my BCM4352 card gets only 400Mbps connection vs. 866Mbps with 87U. Any idea what's wrong? Feel free to ask if more details needed.

What do you have the channel bandwidth set to under 5mhz? Try setting it at 80 if it set to less.

 

[wbwwa]

What do you have the channel bandwidth set to under 5mhz? Try setting it at 80 if it set to less.

80 with both routers ofcourse. Tested latest ofw and 380.59 by Merlin - same speed of connection.

 

[bradbort]

80 with both routers ofcourse. Tested latest ofw and 380.59 by Merlin - same speed of connection.

Interesting. I also shifted from the 87 to the 88, but the speeds seemed comparable or superior on 5G. Any chance you have a new source of interference? Could anything have changed with the client?

 

[wbwwa]

Interesting. I also shifted from the 87 to the 88, but the speeds seemed comparable or superior on 5G. Any chance you have a new source of interference? Could anything have changed with the client?

Same place, same ISP, nothing changed. Really no idea what's wrong there.

 

[fink.nottle]

The firewall rule is definitely properly configured, otherwise the OpenVPN server wouldn't work for anyone. I note that you are scanning from inside your LAN, which won't test anything - the OpenVPN server is configured to listen to connections on the WAN interface. Therefore, firewall configuration is applied to the INPUT chain, not the FORWARD chain.

So I checked this again. It looks like can't connect to the openvpn server from the lan if the server is set to ddns. I can connect to it from outside with the ddns, and I can connect to it from the lan if I use 192.168.1.1.

Another issue with ovpn is that even though it connects successfully from outside, I can't access the internet. I think I can access the lan. I was able to ssh to the router, but I wasn't able to open websites in the browser.

 

[bradbort]

Same place, same ISP, nothing changed. Really no idea what's wrong there.

Well, someone smarter than me needs to pitch in here. The only thing I can think of is that something has changed on the client side...driver update or somesuch, but I'm not experiencing the same issue, so am out of ideas. All of my 5G clients are behaving as expected after my update of routers....

 

[oric1]

Of all the updates on my AC87U, this is the BEST for me so far! Both the 2.4 & 5GHz band were very stable now with BeamForming ON.

Thanks Merlin!

 

[john9527]

Hi! I'm new here. Already replaced my RT-AC87U with RT-AC88U mostly for 8 LAN switch .

Using same WiFi 5GHz settings my BCM4352 card gets only 400Mbps connection vs. 866Mbps with 87U. Any idea what's wrong? Feel free to ask if more details needed.

Try to forget/delete and recreate your connection profiles on the clients, or set up a new SSID on the router to connect to.

 

[RMerlin]

Hi! I'm new here. Already replaced my RT-AC87U with RT-AC88U mostly for 8 LAN switch .

Using same WiFi 5GHz settings my BCM4352 card gets only 400Mbps connection vs. 866Mbps with 87U. Any idea what's wrong? Feel free to ask if more details needed.

Disable MU-MIMO.

 

[Alfsu]

First and foremost, thanks to @RMerlin for such a wonderful firmware.
This is my update:
380.59 running as a champ for more than 7 days straight without any hiccups on my RT-AC68P.
Latency has been considerably reduced (in my case), CTF enabled on a 40Mbps FTTH connection.
VPN Client, Selective Routing and DNS Filtering are all performing as expected.
No issues with Samba shares, all locally (WIFI & Wired) accessible (incl: Win-10, iOS-9, Kody 16 and Android M devices), and remotely through AiCloud as well.
Transmission and Custom DDNS (inadyn) operational under Entware-NG.
Also Tor and Selected countries IPsec Blocking plus Smart DNS IP update with a croned script.

 

[dfran1]

So I checked this again. It looks like can't connect to the openvpn server from the lan if the server is set to ddns. I can connect to it from outside with the ddns, and I can connect to it from the lan if I use 192.168.1.1.

Another issue with ovpn is that even though it connects successfully from outside, I can't access the internet. I think I can access the lan. I was able to ssh to the router, but I wasn't able to open websites in the browser.

A maybe similar issue I had with my NVR, this fixed it for me
-Firewall
--General
----NAT Loopback set it to "Asus"
and or try my settings on 2 pages before this, just a suggestion.

 

[princi]

Disable MU-MIMO.

Good advice!

Seems to have fixed my 5 GHz dropout / no password issues.

(I only had MU-MIMO enabled on 5 GHz)

 

[Piter]

Hi RMerlin
Please merged your repo with new GPL ASUS 3341 and maybe is any chance to build new image for our routers with new GPL ?

http://dlcdnet.asus.com/pub/ASUS/wi...3341.zip?_ga=1.123772738.971854980.1456140035

 

[CiscoX]

Hi RMerlin
Please merged your repo with new GPL ASUS 3341 and maybe is any chance to build new image for our routers with new GPL ?

http://dlcdnet.asus.com/pub/ASUS/wi...3341.zip?_ga=1.123772738.971854980.1456140035

Hi I think he already have a newer one
https://github.com/RMerl/asuswrt-merlin/commit/25dd0d57720630795700918a0c8f53e65ceada4a

Merged with GPL 3459. This includes the new file format required for certification purposes.

 

[Savell Martin]

Hey guys, Whats the status with QoS?
Without reading through all the pages.

 

[RMerlin]

Hey guys, Whats the status with QoS?
Without reading through all the pages.

Traditional only works on N66, AC66, AC56, AC68, AC87.

 

[Savell Martin]

Traditional only works on N66, AC66, AC56, AC68, AC87.

What does this mean for 88U?
In the QoS page, I never see the download/upload indicators moving, and having random issues (see the thread I opened)

 

[HTKatzmarek]

I haven't had a chance to read all of the discussion on QoS, however, from my experience so far, 'fq_codel' seems to work the best for me. I use QoS primarily for VoIP, I have VoIP telephone service that I added a custom rule for MAC address, and I also use TeamSpeak 3 where I added the upload port to a rule. I have much better results now with fq_codel versus sfq, particularly when my FTP server is getting hit hard.
I'd love to see the 3 options stay in any upcoming releases so we have the choice for QoS to use fq_codel.