Release Asuswrt-Merlin 386.4 is now available

[Yota]

AC86U is having very slow web interface over 192.168.1.1.
Even after a full reset.

It may just be me, but I find logging into AC86U, or AX88U via HTTPS is woefully slow.
Navigating around once in is also pretty awful - very slow.
Via HTTP is snappy & no problems.
I would be happy to use HTTPS, but not the way it is.

(This may not be your issue, just sharing what happens here….)

In addition to my local AX88U I did a remote update to 386.4 via OpenVPN on an AX88U, AX86U, AC86U, and 2 AC68U's (as nodes). It went flawlessly on all routers except now I can't log into the remote AC86U interface but everything on that network seems to be working (remote security cameras, VPN, etc)

I get to the router.asus.com login page, but when I enter my credentials the page doesn't load.

Not worried or complaining, just noting it. I bet it'll work when I get a chance to manually reboot it.

If you encounter performance problems when using Firefox + HTTPS, then here is the solution:

Type about:config in the browser address bar
Search for network.trr.builtin-excluded-domains
Add your router IP address and the URL, it looks like this: localhost,local,192.168.50.1,router.asus.com
Close the browser and reopen it, this should solve the problem

The reason for this problem is that Firefox has enabled DNS over HTTPS by default in some countries, and it will cause unknown performance problems on self-signed HTTPS pages. Just add your router to the ignore list to avoid this problem.

 

[octopus]

First thank you for new final software!

Seems that 2,4Gzh wifi dissapear. Aimesh nod 2,4Ghz connected min router dissapear other divice is still connected.
When node reset wifi takes channel 1 and get disassociated and not connect back again. Choosed channel is ch 6-upper to fall back on.
Only option is to reboot aimesh nod to get 2,4Ghz back agian.

BOLD marked is my 2,4Ghz network.

Jan  5 07:39:07 hostapd: eth6: STA 3c:7c:3f:XX:XX:XX WPA: group key handshake completed (RSN) <<<=== BOLD
Jan  5 07:39:07 hostapd: eth7: STA 3c:7c:3XX:XX:XX WPA: group key handshake completed (RSN)
Jan  5 07:39:07 hostapd: wl1.2: STA 14:2d:27:XX:XX:XX WPA: group key handshake completed (RSN)
Jan  5 07:39:07 hostapd: wl1.2: STA 88:3d:24:XX:XX:XX WPA: group key handshake completed (RSN)
Jan  5 07:39:08 hostapd: eth6: STA 38:0b:40:XX:XX:XX WPA: group key handshake completed (RSN)
Jan  5 07:32:33 kernel: CFG80211-ERROR) wl_event_handler : No wdev corresponding to bssidx: 0x0 found! Ignoring event.

Jan  5 08:32:33 wlceventd: wlceventd_proc_event(486): wds1.0.1: Disassoc 3C:7C:3F:XX:XX:XX, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8) <<<=== BOLD
Jan  5 08:32:33 wlceventd: wlceventd_proc_event(486): eth7: Disassoc 3C:7C:3F:XX:XX:XX, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8) <<<=== BOLD
Jan  5 08:32:33 hostapd: eth7: STA 3c:7c:3f:XX:XX:XX IEEE 802.11: disassociated<<<=== BOLD

Jan  5 07:32:33 kernel: wfd_unregisterdevice Successfully unregistered ifidx 1 wfd_idx 1
Jan  5 07:32:33 kernel: br0: port 11(wds1.0.1) entered disabled state
Jan  5 07:32:33 kernel: device wds1.0.1 left promiscuous mode
Jan  5 07:32:33 kernel: br0: port 11(wds1.0.1) entered disabled state
Jan  5 07:32:38 kernel: wl0: random key value: 6FAC6B7552A2392B44F802253313B1B9A5F91E23A07609D8151235B5AAAA5CB3

Jan  5 08:32:38 wlceventd: wlceventd_proc_event(486): wds0.0.1: Disassoc 3C:7C:3F:xx:xx:xx, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)
Jan  5 08:32:38 wlceventd: wlceventd_proc_event(486): eth6: Disassoc 3C:7C:3F:xx:xx:xx, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)

Jan  5 07:32:38 kernel: CFG80211-ERROR) wl_notify_connect_status : Invalid ndev status 4
Jan  5 07:32:38 kernel: wl0: set timeout 5 secs to wait dev reg finish

Jan  5 08:32:38 hostapd: eth6: STA 3c:7c:3f:XX:XX:XX IEEE 802.11: disassociated

Jan  5 07:32:38 kernel: wfd_unregisterdevice Successfully unregistered ifidx 1 wfd_idx 0
Jan  5 07:32:38 kernel: br0: port 10(wds0.0.1) entered disabled state
Jan  5 07:32:38 kernel: device wds0.0.1 left promiscuous mode
Jan  5 07:32:38 kernel: br0: port 10(wds0.0.1) entered disabled state

Jan  5 08:32:48 wlceventd: wlceventd_proc_event(534): eth7: Assoc 3C:7C:3F:XX:XX:XX, status: Successful (0)
Jan  5 08:32:48 hostapd: eth7: STA 3c:7c:3f:XX:XX:XX IEEE 802.11: associated
Jan  5 08:32:48 hostapd: eth7: STA 3c:7c:3f:XX:XX:XX RADIUS: starting accounting session CA4C86222458B840
Jan  5 08:32:48 hostapd: eth7: STA 3c:7c:3f:XX:XX:XX WPA: pairwise key handshake completed (RSN)
Jan  5 07:32:48 kernel: wfd_registerdevice Successfully registered dev wds1.0.1 ifidx 1 wfd_idx 1
Jan  5 07:32:48 kernel: Register interface [wds1.0.1]  MAC: 24:4b:fe:XX:XX:XX
Jan  5 07:32:48 kernel: device wds1.0.1 entered promiscuous mode
Jan  5 07:32:48 kernel: br0: port 10(wds1.0.1) entered forwarding state
Jan  5 07:32:48 kernel: br0: port 10(wds1.0.1) entered forwarding state

 

[Yota]

As per my post, it's possibly worth a try, for you, in the current IPv6 DDNS situation

You have several choices for DDNS setup on your router, they are all covered / detailed in here: https://github.com/RMerl/asuswrt-merlin.ng/wiki/DDNS-services
It mainly depends on, IF you'll use more than one DDNS provider's services concurrently, or, just one, plus IF you want to add additional inadyn functionality over and above the std GUI options

IMHO You don't need any script that isn't covered in that RMerlin DDNS services link above

No and yes.

You can have 3 host names on their free services plan. Whilst we're all waiting for the forthcoming 386.5 IPv6 DDNS 'fixes' You could for example, have one DDNS hostname with both A and AAAA records and another DDNS hostname with just an A record, but both using the same IPv4 address of your router as the A record, IF, you wanted to experiment / test in fine detail. You could add MX records to your DDNS hostname(s) too, if you wanted to. You have lots of choice with No-IP.

Yep, that's par for the course isn't it? There's lots more IF you want to pay more, just like most service providers, but you can experiment and test, for free, using the free services plan, at first.

Awesome, thank you so much, that's a lot of help!

Because I only need to update my IPv6 address (I am behind CGNAT), so what command should I use to get the router's IPv6 address? By the way, do you have any thoughts on prohibiting the router from assigning public IPv6 addresses to my LAN clients?

 

[FTC]

Hi, just a brief post to confirm my succesful upgrade to 386.4 after a full stable 80 day period on 386.3_2 in my Aimesh installation (AX88U server and AX56U node) and using mainly Diversion / Samba / OVPN / DLNA / AiProtection / IPTV functionality with a PPPoE FFTH 1Gb connection. Thanks again Eric and development team for another great release !.

Now, the only minor issue I am facing is the 'DCD tainted...' Trendmicro abends caused, as reported by pixelsrv. I'll keep an eye to see if a bypass is found not as drastic as disabling pixelsrv.

 

[Matthew Patrick]

Hello again,

Adding adition information I think could be interesting.

Checking with nvram status command, I can see a lot of variables empy, I mean, after equals sign, there isn't any parametter like for example:

wan1_hwaddr=
dhcp_wins_x=
vpn_client_gw=

There are 760 entries like this, without any parametter after equal

I think there is a thread somewhere of a script that can reduce empty spaces. But I forgot exactly where

 

[ColinTaylor]

Awesome, thank you so much, that's a lot of help!

Because I only need to update my IPv6 address (I am behind CGNAT), so what command should I use to get the router's IPv6 address? By the way, do you have any thoughts on prohibiting the router from assigning public IPv6 addresses to my LAN clients?

Can you move your conversation about IPv6 DDNS to another thread as it's not relevant to this thread. Thanks.

Please keep posts in this thread on this specific release. This thread will be locked after a few weeks once the release feedback has died down.

 

[Yota]

Can you move your conversation about IPv6 DDNS to another thread as it's not relevant to this thread. Thanks.

Ok, sorry to interrupt this thread

 

[frequenzy]

Upgraded AC68U to 386.4. So far no issues encountered. I will try to upgrade my primary AX86U this weekend. Thanks.

 

[shabbs]

Wifi code comes directly as 100% binary files from Asus. There is nothing for me to test or investigate there, wifi is what it is. Start reviewing your wifi configuration first. The fact that most client issues are on the 2.4 GHz lead me to believe that most of you are keeping advanced features enabled such as Implicit Beamforming or Airtime Fairness, which has well documented problems with a lot of cheap IoT wifi SoCs. Disable these features on the 2.4 GHz band, none of your clients can make use of them anyway. Sometimes, a complete power cycle (not just a reboot) of the router and the clients has also been known to help, as it ensures both are trying to establish a fresh connection.

Yeah, those have always been disabled for me due to the known issues/limitations. Will re-try again this weekend and do a clean config to see if that kicks it. For the record, I didn't see any issues with my TP-Link IOT devices or Google Home devices. The disconnects/issues on the 2.4GHz band were limited to the Nest HD Cams. Those require a steady constant connection so it's very noticeable when they have issues as they are uploading video 24x7. Will update this thread once I give that a try. But as you noted, the wifi portion is out of your control.

 

[learning_curve]

~~ what command should I use to get the router's IPv6 address?

You can see your router's IPv6 address in your router's GUI page here:
System Log - IPv6 Network Information / WAN IPv6 Address

Which... IF you have a static IPv6 address will remain constant, but in many cases... it's changed periodically (e.g. DHCP) and/or on re-boot etc Hence the need to verify this, for IPv6 DDNS etc

On the same page, you have confirmation of your LAN IPv6 Address but this is also on the IPv6 page within the IPv6 LAN Setting plus, the LAN IPv6 Prefix and the Auto Configuration Setting etc

In my case (courtesy of my ISP) I have a variable /64 WAN IP address, but, a constant /56 LAN IP address, from within that /64 WAN Unicast address. This makes perfect sense, in relation to the actual numbers of LAN IPv6 addresses that I will ever need/use etc even though I use SLAAC i.e.

/64​	1 IPv6 subnet​	18,446,744,073,709,551,616 IPv6 addresses​
/56​	256 LAN segments​	Popular prefix size for one subscriber site​

If we've finished on IPv6 DDNS status on fw 386.4 now (?) we should move any further related posts, to a more specific thread as we're in danger of hijacking this 386.4 specific thread

By the way, do you have any thoughts on prohibiting the router from assigning public IPv6 addresses to my LAN clients?

I have read all of that thread perviously, yes, but to be honest, I do not now (and never will in the foreseeable future) have that desire / requirement, so I've intentionally not posted in that thread.

 

[yuenok]

Hi all, I am a beginner for using merlin and appreciate the performance boost from it. But, I am facing a GUI problem that after upgrading the version to 386.4 in AX3000. As you can watch the attached screencap, the GUI looks very strange and missing menu on the left-hand side. It only appears in "WAN" and Firewall" pages and looks great in other pages. I would be very grateful if someone can save me. Thx~

 

[Yota]

You can see your router's IPv6 address in your router's GUI page here:
System Log - IPv6 Network Information / WAN IPv6 Address

Which... IF you have a static IPv6 address will remain constant, but in many cases... it's changed periodically (e.g. DHCP) and/or on re-boot etc Hence the need to verify this, for IPv6 DDNS etc

On the same page, you have confirmation of your LAN IPv6 Address but this is also on the IPv6 page within the IPv6 LAN Setting plus, the LAN IPv6 Prefix and the Auto Configuration Setting etc

In my case (courtesy of my ISP) I have a variable /64 WAN IP address, but, a constant /56 LAN IP address, from within that /64 WAN Unicast address. This makes perfect sense, in relation to the actual numbers of LAN IPv6 addresses that I will ever need/use etc even though I use SLAAC i.e.

/64​	1 IPv6 subnet​	18,446,744,073,709,551,616 IPv6 addresses​
/56​	256 LAN segments​	Popular prefix size for one subscriber site​

If we've finished on IPv6 DDNS status on fw 386.4 now (?) we should move any further related posts, to a more specific thread as we're in danger of hijacking this 386.4 specific thread

I apologize again and I have to reply to this thread, but this is so awesome, and again, thank you very much for the help!!!!

I have read all of that thread perviously, yes, but to be honest, I do not now (and never will in the foreseeable future) have that desire / requirement, so I've intentionally not posted in that thread.

For the thread of my strange requirement, I think I have found a solution. Disabling router advertisements seems to block all IPv6 traffic. http://www.snbforums.com/threads/ho...om-obtaining-ipv6-addresses.76285/post-734444

 

[SheikhSheikha]

Hi all, I am a beginner for using merlin and appreciate the performance boost from it. But, I am facing a GUI problem that after upgrading the version to 386.4 in AX3000. As you can watch the attached screencap, the GUI looks very strange and missing menu on the left-hand side. It only appears in "WAN" and Firewall" pages and looks great in other pages. I would be very grateful if someone can save me. Thx~

Clear the cache of your browser

 

[RMerlin]

could it be that your hard coded fallback option is still active?

Yes it is. Asus hardcoded it in recent releases, in addition to the WAN settings which I believe are tied to Dual WAN monitoring.

you still start to get a feel of the code layout

Yes, and all the WAN-related code is all over the place, and quite complicated. Disabling WAN monitoring means the WAN state that is used throughout the rest of the firmware would be invalid, causing other issues, such as the router most likely would fail to reconnect if the WAN went down.

Is this somethin I must to worry about?

That should be enough for the router to work normally.

 

[RMerlin]

So for DNSSec, do I need to set the GUI option for it to NO (I have YES at the moment)?

Do you want to use DNSSEC? If yes, enable, otherwise disable it.

 

[tsanga]

Hello guys,

First of all, @RMerlin thanks for your job on this firmware. It's amazing, and also, thank to the people help on this forum.

I have a question about last update. Today I updated from version 386.3 to 386.4 and then I reveived the yellow esclamation icon saying "Your router is running low on free NVRAM, which might affect its stability..."

Checking filesystems I see following:

ASUSWRT-Merlin RT-AC68U 386.4_0 Sat Jan 1 18:42:21 UTC 2022
admin@RT-AC68U:/tmp/home/root# df -h
Filesystem Size Used Available Use% Mounted on
/dev/root 32.0M 32.0M 0 100% /
devtmpfs 124.8M 0 124.8M 0% /dev
tmpfs 124.9M 1.9M 123.0M 1% /tmp
/dev/mtdblock4 62.8M 5.1M 57.6M 8% /jffs

As you can see my jffs partition is almos empty so, why I can see this warning message on my router?

Thank you in advance.
Regards.

This was from a few pages back in the thread:
http://www.snbforums.com/threads/asuswrt-merlin-386-4-is-now-available.76498/post-733954

 

[dave14305]

For some odd reason DNSSEC only gets enabled in Stubby if it's set to "2", while it should looking for "1" rather. Not sure why, I'd have to investigate in past commits if this could be old leftover.

I think this was how @themiron disabled Stubby dnssec in favor of dnsmasq dnssec. Just set it to check for an unlikely value.

rc: use dnsmasq for dnssec validation · RMerl/asuswrt-merlin.ng@0bdf749

Third party firmware for Asus routers (newer codebase) - rc: use dnsmasq for dnssec validation · RMerl/asuswrt-merlin.ng@0bdf749

github.com

[Preview] Asuswrt-Merlin 384.11 with DNS over TLS

it must be there, othercase authenticated status of reply from stubby will be lost in dnsmasq and will never reach lan clients. because this file is the only valid path with upstream (isp) nameservers that stubby can use. right, not a really great idea to have it configured, taking into...

www.snbforums.com

 

[Elmer]

So, AX88/386.4_0 with three AImesh units (connecting is a nightmare). Working great, have 96 clients attached, with wireless set to specific channels (not auto), airtime fairness and universal beam forming disabled. Opted out of all privacy agreements, and have offloaded dns queries to two piholes (not using Asus instructions which are wrong). Minimal usage of amtm (swap file) and scripts (chkwan). Only thing missing is ipv6 which is not a big deal at this point and I understand that it's an Asus problem. I think Asus is well aware of the problems and things will only get better in future releases. Thanks for the firmware.

 

[lbtboy]

"The Internet Service Provider's DHCP service is not working properly" a constant error when updating to 386.4, restarting the device does not help. When returning to 386.3.2, everything works like an atomic clock, there are no errors. Authorization of the IPoE provider's e at the MAC address. Maybe someone has encountered help.

 

[ElmerFudd]

If your 2.4 devices are mostly all G, change the Wireless Mode to Legacy. I had issues even before 386.3 with my thermostat and weather station randomly dropping and this cured it.

Thank AlbumMan,

That might fix it but I'm reluctant to do so as I have been using "Auto mode" for a long time with no issues. Reverted back to 386.3.2 and have had no issues using Auto for almost 2 days now... everything is rock solid as it was before 386.4. Many including myself have notices Asus changed something with the WIFI in the latest GPL which is causing the disconnects for 2.4ghz clients.
My 2.4ghz radio services more than just the smart bulbs so using legacy mode would be an adverse degradation of performance for some clients. Basically all my smart bulbs have been in their own guest network / vlan (use yazi) which is isolated from other devices in the household. Also, I uses 2 other guest networks on the 2.4ghz band to support legacy clients not able to connect with WPA3 as well as household visitors.