Beta Asuswrt-Merlin 388.1 Beta is available for select models

[snah001]

I wrote this some time ago for Wireguard Manager but its mostly about the how and why. It may contribute to the discussion:
https://github.com/ZebMcKayhan/WireguardManager#disable-flowcache

Thanks everyone for the explanation.
I was indeed mixing up NAT and NAT acceleration and that is why flow cache is off.
With this in mind and WG active and my max download speed is 350 Mbps {by provider} i achieve exactly the 350 Mbps and that is really not bad.

 

[skeal]

Hi @RMerlin thanks for the new build. I have a AX86S, AX56U and a AX68U.
The AX86S is my main accespoint and the AX56U and AX68U are my mesh nodes.
Everything is working as before the 388.1 but the AX68U does not come online after the upgrade.
I can see that an ip-adres is given to AX68U but it's not online in the AI-mesh menu.
When i reset the AX68U and set it up in router mode everythings works as it should.
Flashed the 386.7 firmware again and set the AX68U as an ai-mesh node and it works again.
Then tried the official firmware from the AX68U in mesh node mode and the same problem again.
Are there more poaple that are using the AX68U as an mesh node that experience the same problem?

Yes, there is. Read a few posts back for a few examples.

 

[blackfireball5]

1) Try enabling Bandwidth Monitor only (not AiProtection), see if it still crashes

1. Bandwidth Monitor enabled and is working just fine. Enabled smoothly, no crashes for about 5 minutes of testing and a speedtest run on my computer which showed the bandwidth changes on the GUI.

3) Try enabling Bandwidth Monitor first, followed by enabling AiProtection. Does it still crash?

PROGRESS!

3. Having Bandwidth Monitor enabled and then enabling AIProtection (all three services) NO LONGER causes my router to bootloop. In fact, it doesn't even reboot once. It just enables the features and all my connections stay online and happy.

Providing a pastebin of my full log containing the enabling of both Bandwidth Monitor and AIProtection:

Bandwidth Monitor being enabled stops AIProtection from crashing - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

After doing test 1 and 3 (and before the crash if you are able to), please post the output of this command:

cat /proc/net/biqos

It should return a value of "0" or "1".

This command returns "1".
(Bandwidth Monitor and AIProtection enabled, no crashing)


@RMerlin Please advise if you still want me to test number 4.

THANK YOU!

 

[RMerlin]

@RMerlin Please advise if you still want me to test number 4.

No, that should be all the info Asus needs for now. From the looks of it, the crash occurs when the Trend Micro engine is trying to use flow cache acceleration, which is necessary for WAN ports running > 1 Gbps, which was their engineer's hypothesis.

The only workaround until the issue gets resolved upstream is to enable Bandwidth Monitoring before enabling AiProtection, which will however disable the Trend Micro engine's ability to leverage flow acceleration, and may limit the WAN speed. closer to 1 Gbps. Or, to keep AiProtection disabled for now.

I'll let you know if they need additional testing done.

 

[RMerlin]

I wrote this some time ago for Wireguard Manager but its mostly about the how and why. It may contribute to the discussion:
https://github.com/ZebMcKayhan/WireguardManager#disable-flowcache

If you wrote that article, you should replace "package" with "packet" however.

 

[blackfireball5]

No, that should be all the info Asus needs for now. From the looks of it, the crash occurs when the Trend Micro engine is trying to use flow cache acceleration, which is necessary for WAN ports running > 1 Gbps, which was their engineer's hypothesis.

The only workaround until the issue gets resolved upstream is to enable Bandwidth Monitoring before enabling AiProtection, which will however disable the Trend Micro engine's ability to leverage flow acceleration, and may limit the WAN speed. closer to 1 Gbps. Or, to keep AiProtection disabled for now.

I'll let you know if they need additional testing done.

Wooo! So exciting to be able to help fix issues. haha

One question though.

You said having Bandwidth Monitor and AIProtection enabled will disable Flow Cache, but when I go to Tools > Sysinfo I see Flow Cache is Enabled.

Also, when I do a speedtest on my computer via ethernet, I still seem to be getting my full DL/UL speeds:

Is this what you expect to see?

 

[RMerlin]

You said having Bandwidth Monitor and AIProtection enabled will disable Flow Cache, but when I go to Tools > Sysinfo I see Flow Cache is Enabled.

Enabling Bandwidth Monitor does not disable flow cache itself. What it does is tell the bwdpi engine to not directly use it (that's what the /proc/biqos value reports, whether it's bypassed (1) or not (0)).

They tell me it's required for 2.5 Gbps / 10 Gbps ports to run at full speed (that's why I couldn't reproduce it, my WAN is only linked at 1 Gbps), but they didn't give me any actual numbers to tell how badly it may impact performance, or in which specific scenarios. Maybe it will only matter if a lot of concurrent connections have to be analyzed by the engine. Or maybe the performance cap is higher than 2 Gbps.

 

[RMerlin]

I ONLY see that icon file failure while trying to join the AX68U to the mesh, and did NOT see similar entries joining an AX88U. I've done this wired and wireless, from factory reset. It shows the same log entries every time.

BTW I finally tracked down which specific models were affected (RT-AX88U and GT-AX11000), which allowed me to track down the root cause. Fixed.

 

[skeal]

Re-applying VPN Director rules or restarting the firewall wasn't reapplying the DNS redirection rules for WGC clients. Fixed.

@RMerlin My Wireguard client has two Torguard DNS servers configured. When I reboot and test for a DNS leak, I get a leak. The DNS is Cloudflare which is my DoT server on the WAN page. If I disable and re-enable the Wireguard client the proper DNS is restored, and no leak. Does this indicate a bigger problem? It happens with or without DNS Director enabled and with or without "Router" as global mode.

 

[blackfireball5]

Enabling Bandwidth Monitor does not disable flow cache itself. What it does is tell the bwdpi engine to not directly use it (that's what the /proc/biqos value reports, whether it's bypassed (1) or not (0)).

They tell me it's required for 2.5 Gbps / 10 Gbps ports to run at full speed (that's why I couldn't reproduce it, my WAN is only linked at 1 Gbps), but they didn't give me any actual numbers to tell how badly it may impact performance, or in which specific scenarios. Maybe it will only matter if a lot of concurrent connections have to be analyzed by the engine. Or maybe the performance cap is higher than 2 Gbps.

Hm. Interesting. Well at least for my setup and brief testing it doesn't appear to be negatively impacting me in any meaningful way yet.

So for now I'll keep BW Monitor and AIProtection enabled and wait for a fix to come down the pipeline as having that layer of security is important to me.

 

[Damit1]

A bug, I think.
Some devices that are disconnected show as connected with their leased IP.

AX88U
Happened to me earlier already with the first device I disconnected on the same switch.
Shows as well in the APP itself
View attachment 45277

@RMerlin

Any chance you know about it maybe?
Thank you

 

[Slapdaddy]

Wooo! So exciting to be able to help fix issues. haha

One question though.

You said having Bandwidth Monitor and AIProtection enabled will disable Flow Cache, but when I go to Tools > Sysinfo I see Flow Cache is Enabled.
View attachment 45317

Also, when I do a speedtest on my computer via ethernet, I still seem to be getting my full DL/UL speeds:
View attachment 45318

Is this what you expect to see?

Did you have the same issue on 386.8? Or was it specific to 388.1 beta? Tried to replicate the problem on my AXE16000 but could not - I'm still running 386.8 though. Like you I'm on AT&T's 2Gbps fiber tier, but I'm using one of the 10G ports as my WAN and the 2.5G port for LAN. Speeds are identical to yours, no reduction.

 

[blackfireball5]

@RMerlin A completely unrelated question/issue that has been persistant for me through different firmware versions and clean flashes.

WifiRadar pages don't appear to be updated to handle displaying the 6ghz band correctly. Is this a known issue?

Attached is a screenshot showing the issue.

OptimusPrime is my 6ghz band.

 

[blackfireball5]

Did you have the same issue on 386.8? Or was it specific to 388.1 beta? Tried to replicate the problem on my AXE16000 but could not - I'm still running 386.8 though. Like you I'm on AT&T's 2Gbps fiber tier, but I'm using one of the 10G ports as my WAN and the 2.5G port for LAN. Speeds are identical to yours, no reduction.

This issue was introduced for me in 388.1_beta1. (I did not try the Alpha)

I had AIProtection turned on with Bandwidth Monitor disabled in 386.8 just fine.

 

[TheOldMan]

LOL! Ahhh... you should add "-snapshot" then to the build reference.

Here's the screenshots for you alls... 388.1_Beta2 on RT-AX68U.

 

[Lax]

I was able to update my AXE16000 388.1 and everything seems to be working fine except the AI protection got disabled. When I turned on the AI protection.
The router reset itself and rebooted with QIS page Confirmed the behavior few times. Waiting for Beta2

 

[skeal]

I was able to update my AXE16000 388.1 and everything seems to be working fine except the AI protection got disabled. When I turned on the AI protection.
The router reset itself and rebooted with QIS page Confirmed the behavior few times. Waiting for Beta2

@RMerlin wrote this to someone else. See this post

 

[Rhialto]

They tell me it's required for 2.5 Gbps / 10 Gbps ports to run at full speed

If someone don't need any of the TM stuff the best is never accept the licence and keep it disabled, right?

 

[skeal]

If someone don't need any of the TM stuff the best is never accept the licence and keep it disabled, right?

Absolutely, don't enable things you don't need.

 

[SpasilliumNexus]

I was hesitant for a few days with upgrading my AX88U, but I took the plunge and everything seems good so far. I can finally put away my Pi devices and use WireGuard from the router. Thank you RMerlin!

Here's the screenshots for you alls... 388.1_Beta2 on RT-AX68U.

Your client list is setting off my OCD lol