What's new

[Dev] Asuswrt-Merlin 388.1 development

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Status
Not open for further replies.
No it is a kernel space implementation that is why the speed is triple that of OpenVPN. I know WireGuard does not work on Kernel 2.6 but these routers are using Kernel 4.4 so they are also using an upgraded CTF.ko module for Kernel 4.4. maybe that is compatible with WireGuard?
Are you sure you are referring to a Broadcom-based model? AFAIK, the newest BCM kernel DD-WRT has is one of the early 3.x versions, as that was the last time brainslayer had access to the BCM SDK. If it's not a Broadcom model, then this isn't using CTF but something else.
 
Are you sure you are referring to a Broadcom-based model? AFAIK, the newest BCM kernel DD-WRT has is one of the early 3.x versions, as that was the last time brainslayer had access to the BCM SDK. If it's not a Broadcom model, then this isn't using CTF but something else.

He’s likely referring to Atheros, Broadcom is basically stagnant on DDWRT last I used it.
A08905B1-47AF-4C6D-AF30-6F1E733C3528.jpeg
 
Last edited:
Last edited:
Oct 22 02:09:02 kernel: ^[[0;33;41m[ERROR pktrunner] runnerUcast_inet6addr_event,187: Could not rdpa_system_ipv6_host_address_table_find ret=-5^[[0m
Just 1 Error in 5+ Days.
1.png
 
Are you sure you are referring to a Broadcom-based model? AFAIK, the newest BCM kernel DD-WRT has is one of the early 3.x versions, as that was the last time brainslayer had access to the BCM SDK. If it's not a Broadcom model, then this isn't using CTF but something else.
Yes it looks like it:

root@Asus-AC68:~# uname -r
4.4.302-st25
root@Asus-AC68:~#

root@Asus-AC68:~# lsmod | grep -E 'wireguard|ctf'
wireguard 71536 0
ip6_udp_tunnel 1431 1 wireguard
udp_tunnel 1699 1 wireguard
ipv6 302044 56 ip6table_mangle,nf_conntrack_ipv6,nf_defrag_ipv6,wireguard,ipcomp6,xfrm6_tunnel,xfrm6_mode_tunnel,xfrm6_mode_beet,ip6_tunnel,mip6,ah6,esp6,sit,[permanent]
ctf 51118 0
root@Asus-AC68:~#
 
Yes it looks like it:

root@Asus-AC68:~# uname -r
4.4.302-st25
root@Asus-AC68:~#

root@Asus-AC68:~# lsmod | grep -E 'wireguard|ctf'
wireguard 71536 0
ip6_udp_tunnel 1431 1 wireguard
udp_tunnel 1699 1 wireguard
ipv6 302044 56 ip6table_mangle,nf_conntrack_ipv6,nf_defrag_ipv6,wireguard,ipcomp6,xfrm6_tunnel,xfrm6_mode_tunnel,xfrm6_mode_beet,ip6_tunnel,mip6,ah6,esp6,sit,[permanent]
ctf 51118 0
root@Asus-AC68:~#

I just checked and I think they have kernel 5.10 for Asus AC3100? Am I reading that correctly?

That'd mean it could support Cake QOS on these old dinosaurs?

Do you miss Asus Ai Protection? One of the reasons I have not looked at other firmware is the ease of use in malicious sites and IPS..

Another curiosity is whether these newer kernels can be ported to ASUSWRT/ Merlin?
 
No trouble with traffic analyzer on my AX88U.
Let me be more specific. It's the Traffic Analyzer-Statistic page that crashes.
Screenshot 2022-10-23 at 10.48.35.png

Screenshot 2022-10-23 at 10.48.47.png
 
Another curiosity is whether these newer kernels can be ported to ASUSWRT/ Merlin?

Theoretically, maybe. But no. I’d say because RMerlin has a working relationship with ASUS and touching Broadcom’s closed source driver to get it working with a newer kernel or “hacking/porting” it in probably wouldn’t be permitted and would be outside the scope of this project. ASUS would have to be the one to decide to use a newer kernel and drivers from Broadcom. That said idk what RMerlin could do with permission.. but. Eventually ASUS will use newer kernels on newer devices, but older devices will eventually be EOL unless you decide to move to a different custom firmware like DDWRT.

But there are risks consider every update to be a perpetual beta, and you’re the guinea pig if you’re the first to install or don’t read the forums, because you can brick your router. I’ve done it 3 times using ddwrt on older non-ASUS routers, and needed a serial JTAG to fix.

07879D62-2C68-47BB-8C1C-CF4A7218A9AF.jpeg

Sometimes your lucky other times… not.
 
Last edited:
One of the exceptions being a pure fiber connection, but i am not even sure if that would make a difference. Also, show of hands, how many of us can say our area provides us with a "pure" fiber connections?

Where I am in Northeastern Ontario, Canada, 80/40 connection is the best we get, and only because a single entrepreneur setup his own microwave link between us and the city. We are way too small for the big ISPs to even look at.
 
Have made a Hard Reset on my 3 RT-AX88U.

Have added 2 AiMesh Nodes to the Main one, then I noticed after switching from WPA2 -> WPA3 that 1 AiMesh Node was missing.
Switched back to WPA2 and the missing AiMesh Node showed up again (dont know if its a bug).

EDIT:
getting some wired Kernel log now.
Code:
Oct 23 11:40:35 kernel: TCP: request_sock_TCP: Possible SYN flooding on port 7788. Sending cookies.  Check SNMP counters.
 
Last edited:
@RMerlin thanks for the AX58U alpha, out of curiosity I've been waiting for it to try wireguard.

Just putting up a few comparison speed tests up.

I have a 500Gb symmetrical fibre connection over PPPoE to my ISP.

I use Astrill VPN as a client to the outside world and all tests are to the same host server.

Win11 PC no VPN
win11novpn.jpg


Win11 PC Astrill WG client
astrillwin11pcclient.jpg


AX58U OpenVPN
ax58uovpn.jpg


AX58U WireGuard
ax58urwg.jpg


So even on this relatively low powered AX58U WireGuard is over 3 times faster than OpenVPN.
 
Upgraded my GT-AX6000 to 388.1_alpha1 yesterday and haven't noticed any issues so far. :)

I don't currently use its VPN functions so I can't speak on that.
 
I attempted to upgrade my GT-AX6000 to 388.1_alpha1 from 386.7_2, but I was forced to revert — I also tried the same unsuccessfully a couple of days back. The router was virtually crippled. When I waited long enough for the GUI to launch, all four (4) cores were pegged at 100% CPU usage — none of my four (4) AiMesh nodes would connect. Not sure what the issue is as others appear to have upgraded without issue. As part of reverting, I reset to factory and reconfigured from scratch, including re-adding the AiMesh nodes.
 
I'm trying to login to my AiMesh-node, when I login it asks for user ID and password, after entering that on the AiMesh-node's login, it instantly redirects me to my main router's network map page. Is this the intended outcome? I used to be able to login to the mesh node and see a limited GUI, now that seems impossible to achieve. Am I missing something? Is this new with this firmware?
 
After initial success when first installed on my AX58U connecting to my VPN provider Astrill is now having problems with OVPN.

No rules are set.

ovpnbad.jpg


If I do set a wan rule in VPN Director it seems to be ignored.

This all I see in the log.

Code:
Oct 23 13:27:29 rc_service: httpd 1606:notify_rc restart_logger
Oct 23 13:27:29 custom_script: Running /jffs/scripts/service-event (args: restart logger)
Oct 23 13:27:30 custom_script: Running /jffs/scripts/service-event-end (args: restart logger)
Oct 23 13:28:06 rc_service: httpd 1606:notify_rc stop_vpnclient1
Oct 23 13:28:06 custom_script: Running /jffs/scripts/service-event (args: stop vpnclient1)
Oct 23 13:28:06 ovpn-client1[22594]: event_wait : Interrupted system call (code=4)
Oct 23 13:28:06 openvpn-event[24197]: No scripts found to run for openvpn-event: vpnclient1-route-pre-down
Oct 23 13:28:06 custom_script: Running openvpn-event
Oct 23 13:28:07 openvpn-routing: Clearing routing table for VPN client 1
Oct 23 13:28:07 custom_script: Running /jffs/scripts/service-event-end (args: stop vpnclient1)
Oct 23 13:29:14 rc_service: httpd 1606:notify_rc start_vpnclient1
Oct 23 13:29:14 custom_script: Running /jffs/scripts/service-event (args: start vpnclient1)
Oct 23 13:29:15 ovpn-client1[24690]: WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
Oct 23 13:29:15 ovpn-client1[24690]: DEPRECATED OPTION: --max-routes option ignored.The number of routes is unlimited as of OpenVPN 2.4. This option will be removed in a future version, please remove it from your configuration.
Oct 23 13:29:15 ovpn-client1[24690]: Unrecognized option or missing or extra parameter(s) in config.ovpn:39: block-outside-dns (2.5.7)
Oct 23 13:29:15 custom_script: Running /jffs/scripts/service-event-end (args: start vpnclient1)
Oct 23 13:29:15 ovpn-client1[24691]: WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.
Oct 23 13:29:15 ovpn-client1[24691]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Oct 23 13:29:16 openvpn-routing: Routing all traffic through ovpnc1
Oct 23 13:29:18 openvpn-event[24765]: No scripts found to run for openvpn-event: vpnclient1-route-up
Oct 23 13:29:18 custom_script: Running openvpn-event
Oct 23 13:29:18 ovpn-client1[24691]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
 
Hello everybody,

this is the first time I write in the forum, but first of all I would like to thank @RMerlin for the fantastic work he does on his custom firmware, without your firmware I could not start up my personal homelab with proxmoxVE, which can be reached safely in a very long time short.

I could just say a word THANK YOU.

I just updated my rt-ax58U to 388.1_alpha1-g89b92e5ff6 but I encountered a problem, from the DDNS page I can't use the "Method to retrieve WAN IP", unfortunately, in spite of myself, I have to use the router provided by my ISP (Vodafone IT ) as ONT, so the good Asus is set up with a static but private wan IP address.

I must revert to 386.7_2 and all ok.

Thanks
Commodoro


Schermata 2022-10-23 alle 14.59.20.jpg
 
Hello everybody,

this is the first time I write in the forum, but first of all I would like to thank @RMerlin for the fantastic work he does on his custom firmware, without your firmware I could not start up my personal homelab with proxmoxVE, which can be reached safely in a very long time short.

I could just say a word THANK YOU.

I just updated my rt-ax58U to 388.1_alpha1-g89b92e5ff6 but I encountered a problem, from the DDNS page I can't use the "Method to retrieve WAN IP", unfortunately, in spite of myself, I have to use the router provided by my ISP (Vodafone IT ) as ONT, so the good Asus is set up with a static but private wan IP address.

I must revert to 386.7_2 and all ok.

Thanks
Commodoro


View attachment 44997
Is your ISP modem/router bridged? The ONT probably can't do anything but hand your AX58U a private IP. If the ISP modem/router is bridged it passes the public IP to your AX58U, in effect becoming just a modem.
 
Hi @skeal,

thanks for the feedback, unfortunately the Vodafone custom firmware does not allow me to set the bridge mode, but only the DMZ or a static NAT, and this forces me to stay in an environment with double NAT, with the version 386.7_2 and the check of the wan ip external la DDNS resolution works smoothly.

Thanks
Commodoro
 
If I do set a wan rule in VPN Director it seems to be ignored.
This all I see in the log.

Code:
Oct 23 13:29:15 ovpn-client1[24690]: WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.Oct 23 13:29:15 ovpn-client1[24690]: DEPRECATED OPTION: --max-routes option ignored.The number of routes is unlimited as of OpenVPN 2.4. This option will be removed in a future version, please remove it from your configuration.
Oct 23 13:29:15 ovpn-client1[24690]: Unrecognized option or missing or extra parameter(s) in config.ovpn:39: block-outside-dns (2.5.7)
Oct 23 13:29:15 ovpn-client1[24691]: WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.
Try to fix this and test again.
 
Status
Not open for further replies.

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Staff online

Top