Asuswrt-Merlin 384.5 beta is now available for all supported models. In addition to new GPL merges, this release focuses on various things that had been waiting on the Todo list for a while. With this release, a lot of work has been done around the OpenVPN implementation in an attempt to simplify it a bit, removing rarely used or flat out broken settings.
Updated May 7th: Beta 2 is now available. Changes since beta 1:
The highlight of this release:
This is a summary of the changes made to OpenVPN:
Server changes:
Client changes:
Things that will require particular testing/feedback:
Please keep discussions to this specific beta release. Off-topic posts may be moved or deleted, depending on my mood at the time.
Downloads are here.
Changelog is here.
Updated May 7th: Beta 2 is now available. Changes since beta 1:
Code:
4833b80 Updated documentation
cffe78d webui: autofill DST start/end time on timezone select; update a few outdated DST times
d4b23de miniupnpd: updated to 20180503 snapshot
d645ee8 iptables: add missing ip6tables-save applet (closes #142)
020df8d Updated documentation
5598770 kernel: tweak input class modules, removing mouse/joystick support
fc5eb7d build: include HID modules in firmware images
caaa83a kernel41: Add USB HID support
84b68d0 webui: look up for firmware_path nvram rather than the checkbox that's no longer on that page
7d05e84 webui: display remaining time left on UPNP leases, now stored as remaining time instead of a timestamp
91f505b httpd: signal miniupnpd to dump an up-to-date lease list
9ac7d0f miniupnpd: updated to 20180502 (includes monotonic clock fixes)
1e54594 strongswan: patch for CVE-2017-9022, CVE-2017-9023, CVE-2017-11185
3fdd7ff build: copy-prebuilt: added libletsencrypt
71141ea libletsencrypt: updated with builds from 384_20648
60538a9 webui: explicitely set textarea_ssh_table font size to 13px
72210f1 webui: firmware_path can be either "0" or "" when set to the stable channel - check both
785c216 Bumped revision to beta 2
e126557 Merge branch 'master' of github.com:RMerl/asuswrt-merlin.ng
b1d3858 rc: keep persistent dlna uuid & serial format, follow e9219373af4c688532f66de9a6c6d887d50b948a
e921937 rc: make upnp uuid persistent
f487476 miniupnpd: fix SSDP socket binding to wrong interfaces
058a835 shared: fix empty wan/lan/2g hwaddr on gmac3-enabled modelsThe highlight of this release:
- Merged with GPL 384_20648.
- Merged binary blobs from 384_20648 for RT-AC86U, RT-AC68U and RT-AC5300.
- Updated components: OpenVPN (2.4.6), Dropbear (2018.76), OpenSSL (1.0.2o), miniupnpd (20180412), nano (2.9.5).
- Upgraded the RT-AC86U to the same Busybox release (1.25.1) as used by all other models.
- Revised Traditional QoS implementation. Will require extensive testing to validate that it does fix previous issues, and that it doesn't introduce any new one.
- Added a new service-event script, executed before any service call (for example, restart_wireless). Note that this script will block the execution of the event until it returns, so be careful with it.
- Revised OpenVPN server and client options. Please see below for more details on these changes.
- Revised the System Log -> Connections page due to changes made by Asus to httpd. The new implementation removes the ability to resolve hostnames, and info is shown in a sortabled table (click on a header to sort by that field).
- Added ability to resolve hostnames to the Network Tools -> Netstat page.
- Changed Samba behaviour. From now on, enabling master browser and WINS support requires explicitely enabling SMB sharing.
- Changes to the Firmware Upgrade page layout. Beta Firmware channel selector moved to Tools -> Other Settings, where it will now behave more predictably like a standard setting that can be saved to nvram.
- DHCP server no longer broadcast an empty option 252 value (for WPAD).
- Blocking custom scripts (like pre-mount) will now wait a maximum of 120 seconds before returning control, to prevent permanent lockouts.
- Security fixes for dnsmasq (like CVE-2017-15107) were backported from upstream
This is a summary of the changes made to OpenVPN:
Server changes:
- Removed "TLS Reneg time" (rarely used, can manually be set as a custom option)
- Removed "Server Poll" (which didn't work properly), and reimplemented watchdog service as a cron job, hardcoded to 2 mins frequency.
- Removed "Push LAN" and "Redirect Gateway", replaced with new Client Access setting
- Removed Firewall setting (firewall rules are now always created, and the broken External mode was fixed and integrated into the new Client Access setting). You can now use the postconf script to override it.
- Removed option to respond to DNS queries - enabling the option to Push DNS will also handle it
- Added new Client Access setting to select between three types of access: LAN only, WAN only (will block access to the LAN, including the router itself) and LAN + WAN.
Keys and certificates can now be up to 7999 characters long.
Client changes:
- Reorganized settings into groups
- Removed "Poll Interval" (which didn't work properly), and reimplemented watchdog service as a cron job, with a hardcoded frequency of 2 mins.
- Removed Firewall setting (firewall rules are now always created). You can now use the postconf script to override it.
- Modified behaviour of Connection Retry. Instead of taking a value in seconds that only affected resolution failure, it now takes a number of attempts, and affects connection failures. Resolution failures will now retry for an infinite period of time (the default OpenVPN value).
- Added "refresh" link which can be clicked to re-query the public IP endpoint of the tunnel
- Keys and certificates can now be up to 7999 characters long.
Things that will require particular testing/feedback:
- Traditional QoS. Please confirm whether Cédric's fixes resolved the non-working Traditional QoS.
- OpenVPN: Make sure nothing was broken by the changes, and provide feedback on those changes.
- miniupnpd: confirm that the new version doesn't break things (one thing is known broken at this time - the ability to report the remaining forward time. Issue logged upstream, the remaining time is temporarily hardcoded to always report N/A for now.
Please keep discussions to this specific beta release. Off-topic posts may be moved or deleted, depending on my mood at the time.
Downloads are here.
Changelog is here.
Last edited:
