Merlin "End of Life" for 386.x firmware implications

[David Cavalli]

Seeing that my RT-AC68U will be able to run "new" Merlin releases only through 2024, I assume that means my router will technically work, but eventually be vulnerable to security issues, or just that there won't be new Merlin features? Not sure exactly what "end of life" means, but it doesn't sound good. I like all the Merlin features I've come to understand and would like to retain them past the current 386.13.xx firmware.

Assuming it's really bad (i.e. new router by 2025), I assume I'll be buying a new Asus which is Merlin ready. From what I glean on the boards here, the RT-AX88U Pro ($267) or GT-AX6000 ($230) were the go-to models to get. Assuming I buy one of those two (or whatever someone senior here says is better for 2024), is it wise to consider using my old AC68U in some sort of mesh configuration? Or should I just toss it? I have a two-story house and if I could repurpose it to "downstairs" wifi usage in "mesh", that would be great. If I understand "mesh" right, it would allow my new router to extend through the current one to double coverage in my house. If this is a bad idea, that's OK too, becuase the AC68U currently covers most areas of the house well, and I assume the replacement would do the same. Any guidance on anything above appreciated.

 

[KrypteX]

When the AC68U will be totally forgotten (i.e. no more security updates), which will probably occur in 2025, hopefully 2026, you will still have the choice of installing DD-WRT on it.
It is not fully supported by OpenWrt.

 

[Dedel66]

Any guidance on anything above appreciated.

If you are happy with the AC68U, you can use it as a mesh node as long as it works with the new main router. If the AC68U can no longer work as a mesh node, it can still be used as an access point.

 

[RMerlin]

Are there any applications that could extend the life of these routers, or are they basically e-waste in a year?

Just lock it down, and it will be fine. Don't expose any service to the Internet, disable unused services such as SSH, use a strong password.... the usual.

No idea what will happen with Trend Micro or ASD signature updates, these may very well stop at some point, which means for instance Adaptive QoS or AiProtection may lose in efficiency at that point. That could happen tomorrow (since device is already EOL), or 5 years from now.

No piece of software is 100% safe, even when it's still actively maintained. Security begins with properly locking down a device. Software updates is just another layer on top of that, and while important, it's not mandatory. People have been using smartphones outside of their support period for a decade, and no apocalypse has happened yet. Same with routers, I would wager the majority of users have a router that hasn't received any security update in over a year. ISP-provided devices are a prime example of that.

 

[Analog-1]

I would wager the majority of users have a router that hasn't received any security update in over a year. ISP-provided devices are a prime example of that.

Yep. my sister has Spectrum internet and has one of there gateway devices it has not been updated with firmware since 2016 yet she has never been hacked or compromised at least to her knowledge.

 

[Tech9]

I assume I'll be buying a new Asus which is Merlin ready.

RT-AX88U Pro ($267) or GT-AX6000 ($230)

The routers on your list are indeed often recommended around, but they are Asuswrt-Merlin compatible at the moment. Perhaps @RMerlin has to clarify what happens to currently supported GT and Pro models when they move to 3.0.0.6 base firmware. If this firmware is not suitable for future Asuswrt-Merlin builds - currently supported GT and Pro models also lose Asuswrt-Merlin support. This may happen by the end of 2024. Asus is not going to continue releases of separate 3.0.0.4 GPL, I guess.

 

[Elmer]

I still have an RT-AC1750b router running as an Aimesh node. The last cursory Asus firmware release was back in November 23 and before that in May of 23. Seems to be working great, but if I was wondering if I was creating a security problem. From your comments, it sounds like it's good to go as long as it will connect. Tell me if I'm being delusional; my feelings will not be hurt - I tell my wife the same thing daily.

 

[Tech9]

I was wondering if I was creating a security problem.

No, you're good.

 

[RMerlin]

Perhaps @RMerlin has to clarify what happens to currently supported GT and Pro models when they move to 3.0.0.6 base firmware.

I can't, since I don't even have access to 3.0.0.6 code code yet to even know what will be involved in working with that code, and whether it will happen or not.

 

[Tech9]

I understand, but if you find 3.0.0.6 not suitable for your builds this in fact means current GT and Pro models also lose Asuswrt-Merlin support or continue on maintenance only mode with the last available 3.0.0.4 GPL. Folks buying now "Merlin ready" routers have to be aware of this. This uncertainty affects not only new Wi-Fi 7 models launched on 3.0.0.6, but also existing Wi-Fi 6 models waiting for 3.0.0.6. For example RT-AX88U Pro has three 3.0.0.6 releases already and 3.0.0.4 development for it stopped already, no?

 

[L&LD]

Oh my, is the sky falling again?

 

[RMerlin]

I understand, but if you find 3.0.0.6 not suitable for your builds this in fact means current GT and Pro models also lose Asuswrt-Merlin support or continue on maintenance only mode with the last available 3.0.0.4 GPL. Folks buying now "Merlin ready" routers have to be aware of this. This uncertainty affects not only new Wi-Fi 7 models launched on 3.0.0.6, but also existing Wi-Fi 6 models waiting for 3.0.0.6. For example RT-AX88U Pro has three 3.0.0.6 releases already and 3.0.0.4 development for it stopped already, no?

My response is still "I don't know", because this is pure speculation based on things that are completely outside of my control.

 

[bscabl]

Just lock it down, and it will be fine. Don't expose any service to the Internet, disable unused services such as SSH, use a strong password.... the usual.

No idea what will happen with Trend Micro or ASD signature updates, these may very well stop at some point, which means for instance Adaptive QoS or AiProtection may lose in efficiency at that point. That could happen tomorrow (since device is already EOL), or 5 years from now.

No piece of software is 100% safe, even when it's still actively maintained. Security begins with properly locking down a device. Software updates is just another layer on top of that, and while important, it's not mandatory. People have been using smartphones outside of their support period for a decade, and no apocalypse has happened yet. Same with routers, I would wager the majority of users have a router that hasn't received any security update in over a year. ISP-provided devices are a prime example of that.

This is what I suspected as well.. Considering I bought my AC3100 during covid and it was not cheap I'm not ready to change out just because of Asus's product cycles. Now, when I start to acquire more wifi6 devices that will be a different story of course.

 

[Tech9]

Considering I bought my AC3100 during covid and it was not cheap

RT-AC3100 is a 2015 model router. You did a mistake with this one.

 

[bscabl]

RT-AC3100 is a 2015 model router. You did a mistake with this one.

I mean... I bought it from BestBuy - my old router died and everyone was WFH

 

[Tech9]

Unfortunately, even End-of-Life models sometimes are sold by big retailers.

Asus Canada official store still offers Blue Cave, a router End-of-Life for years...

This same router was on clearance on Amazon for CAD50. Asus wants CAD190. The last firmware for it was released in May 2021.

End-of-life product list

 

[bscabl]

Unfortunately, even End-of-Life models sometimes are sold by big retailers.

Asus Canada official store still offers Blue Cave, a router End-of-Life for years...

View attachment 57918

This same router was on clearance on Amazon for CAD50. Asus wants CAD190. The last firmware for it was released in May 2021.

End-of-life product list

I mean, its fair...but I bought it in 2020 and it wasn't on clearance. Was a good mix of what I needed and non mega expensive. Hell.. considering the only wifi6 devices in my house are my Pixel 7 Pro and my Ps5 it's still very much current for my needs. I'm just gonna ride it till the wheels fall off or I get more upgraded devices. [or until some exploit comes out that can get through it with a sneeze]

 

[bscabl]

Also in fairness.. in the height of "everyone will be working from home for a year" it's not like there were 300 models to choose from lol

 

[Tech9]

Not sure what your story is. Like you never had Internet at home before the need to work from home. Many people just used what they already have without purchasing additional routers or upgrading existing ones. Some companies offered subsidy for "whatever is needed", perhaps this is the case. Anyway... just continue using it without exposing any services to Internet as mentioned above.

 

[bscabl]

Not sure what your story is. Like you never had Internet at home before the need to work from home. Many people just used what they already have without purchasing additional routers or upgrading existing ones. Some companies offered subsidy for "whatever is needed", perhaps this is the case. Anyway... just continue using it without exposing any services to Internet as mentioned above.

Old router had died (per above). My company doesn't subsidize personal tech. No matter tho.