[Release] Asuswrt-Merlin 384.11 is available

[Gar]

I have. Some pages very slow to load, if they load at all.

Quad1 & Quad8 no problem.

I just use Quad1 & job’s done....

I like the filtering or I'd do the same.

 

[Paliv]

I have. Some pages very slow to load, if they load at all.

Quad1 & Quad8 no problem.

I just use Quad1 & job’s done....

Yeah, I went back to Quad1 for now. May look into the timeout change, but Cloudflare works fine.

 

[Treadler]

Yeah, I went back to Quad1 for now. May look into the timeout change, but Cloudflare works fine.

As per my edit above, I tried selecting the Quad9 primary server only, & now works well. Go figure.....

 

[Paliv]

As per my edit above, I tried selecting the Quad9 primary server only, & now works well. Go figure.....

Interesting....wonder what’s happening there. Thanks for the tip. May give that a shot to see what happens. Though, I wasn’t having the issue very often. But I don’t want to cause issues with people in my house not being able to load a page. That gets me in hot water for tinkering with what was working...

 

[RMerlin]

Is it worth me calling asus? I have talked to one of the VPs before, but that was awhile ago.

No need to. I have direct lines of communications with managers on their dev team back at Taiwan HQ. I'm waiting to see the source code first to determine if there is an issue, and if there is I will contact them.

 

[Comoman]

I just registered to report that I upgraded my AC86U to 45717. I then read the post from RMerlin about the changes. I then tried to install 384.11 and it won't install - it just hangs.

A reboot doesn't solve it and 45717 is still hanging on......

 

[bbunge]

Has anybody else tried Quad9 with DoT and DNSSEC? It randomly won’t resolve pages on occasion requiring several refreshes. I saw people in the stubby thread mention this months ago, guess it’s still a problem.

Yes, I have that same issue even with DNSSEC disabled. You may discover, as I have, that the Quad9 data center you use with normal DNS port 53 are not used with DoT. Without DoT I connect to Quad9 resolvers in Miami, Fl. With DoT enabled the querys go to Berkley, Ca! Cloudflare and CleanBrowsing use resolvers just over 100 miles away. I suspect my ISP is fooling with anycast. Or Quad9 is not fully implemented with DoT.
On another note, I had fewer issues with Stubby/Entware configuration than with Merlin. Yes, I too jumped at the chance to dump my USB drive and dive into 384.11 alpha, beta and final. I was critical of the Stubby configuration as it was different from Entware. I have not been comfortable with 384.11 Stubby as I can not replace the stubby.yml, the stubby.postconf does not do what I want and am tired of the family saying they can't connect.
So, for the time being I am not using DoT or DNSSEC. Just using plain Quad9 resolvers which do a good job of blocking malicious add sites (fewer hits in AiProtection). Have considered going back to 384.10 or stock Asus with Entware. But...

Sent from my SM-T380 using Tapatalk

 

[RMerlin]

I just registered to report that I upgraded my AC86U to 45717. I then read the post from RMerlin about the changes. I then tried to install 384.11 and it won't install - it just hangs.

A reboot doesn't solve it and 45717 is still hanging on......

You shouldn't have any problem flashing back to my firmware, I have done it (on an RT-AC88U) without any issue.

 

[rk8531]

BTW, Asus's 45717 contains a "security" enhancement that means bad news for me if they did it the way I heard they did. I need to wait for access to GPL code to determine how bad it is. I knew ahead of time of the change, and I could confirm that the change made it into that release when I tested it on an RT-AC88U, however the big question is to see how it was implemented, so I can devise a workaround. For this I will need to wait until I get GPL drops for that release.

For now, be advised that if you install 45717 and then decide to switch back to my firmware, any script you had installed in /jffs/ will no longer work, and will require "fixing". I can't go into any further detail for now, sorry.

I had installed 45717 and then again migrated back to 384.11 with no issues. I am using Asus 86au and all the scripts are working the same way they were working before the installation of 45717.

 

[rk8531]

I just registered to report that I upgraded my AC86U to 45717. I then read the post from RMerlin about the changes. I then tried to install 384.11 and it won't install - it just hangs.

A reboot doesn't solve it and 45717 is still hanging on......

Use wipe jffs at next reboot and then flash 384.11. it worked for me and all the scripts are running without any issue.

 

[skeal]

@RMerlin I just noticed that when enabling LAN aggregation on my AX88U, I lose over half of my connected devices listed in Network Map. The count on the Network Map page says 9, yet if I click the view clients button, the count inflates back to the accurate count of devices. Close the list, and the count drops back to 9. I know you don't mess with Network Map but I thought others would gain from knowing about this. Keep up the great work!

 

[Paliv]

Yes, I have that same issue even with DNSSEC disabled. You may discover, as I have, that the Quad9 data center you use with normal DNS port 53 are not used with DoT. Without DoT I connect to Quad9 resolvers in Miami, Fl. With DoT enabled the querys go to Berkley, Ca! Cloudflare and CleanBrowsing use resolvers just over 100 miles away. I suspect my ISP is fooling with anycast. Or Quad9 is not fully implemented with DoT.
On another note, I had fewer issues with Stubby/Entware configuration than with Merlin. Yes, I too jumped at the chance to dump my USB drive and dive into 384.11 alpha, beta and final. I was critical of the Stubby configuration as it was different from Entware. I have not been comfortable with 384.11 Stubby as I can not replace the stubby.yml, the stubby.postconf does not do what I want and am tired of the family saying they can't connect.
So, for the time being I am not using DoT or DNSSEC. Just using plain Quad9 resolvers which do a good job of blocking malicious add sites (fewer hits in AiProtection). Have considered going back to 384.10 or stock Asus with Entware. But...

Sent from my SM-T380 using Tapatalk

Interesting, good to know. I was using OpenDNS, but they didn’t support DoT.

 

[Gar]

Interesting, good to know. I was using OpenDNS, but they didn’t support DoT.

OpenDNS has speedy servers, wish they had DoT, as you say. I used to use them and they were great.

 

[RMerlin]

I had installed 45717 and then again migrated back to 384.11 with no issues. I am using Asus 86au and all the scripts are working the same way they were working before the installation of 45717.

Are they still marked as executable?

Note that this is only for scripts in /jffs, it shouldn't affect what's on the USB disk.

 

[nakti]

FCC Regulations on Routers? Banning WiFi Router Firmware Modification.

Im scared of FCC

 

[mbze430]

I found this while searching for the SPKI fingerprint

https://gist.github.com/alanbuxey/8713073e232adfd56198e8cd8ee1258b

anyone used these for cloudflare??

 

[Ro berto]

I for more than I look for it I do not see it, xDDD.

on mobile (at least for me) I cannot see signatures, I have to switch to desktop version in chrome to be able to see signatures

 

[MDM]

on mobile (at least for me) I cannot see signatures, I have to switch to desktop version in chrome to be able to see signatures

Rotate your phone horizontally, an you will see them...

 

[Ro berto]

Rotate your phone horizontally, an you will see them...

indeed

 

[snixel]

Has anybody else tried Quad9 with DoT and DNSSEC? It randomly won’t resolve pages on occasion requiring several refreshes. I saw people in the stubby thread mention this months ago, guess it’s still a problem.

I use Quad9 primary and quad1 as DoT servers together with DNSSEC and it has been running fine for 3 days now. I do however use ipv4 aswell as the ipv6 servers.

got me wondering, how exactly does stubby select which DNS server to use? Does it use the first entry as primary or does it randomly select configured servers?