[Release] Asuswrt-Merlin 384.12 is now available

[Martineau]

On my ac86u I run both OVPN server and client.

However since 384.11 when the OVPN client is active it does not permits traffic from the VPN Server's clients even in local network.

If the LAN resource your inbound OpenVPN Server clients are trying to reach is explicitly routed via the VPN, then you may need to create a split tunnel for the VPN Server subnet/interface tun2+

However, you should check the following rule tables when the issue occurs.

e.g. Selective routing for VPN Client 3

ip route show table ovpnc3

and the RPDB/firewall rules

ip rule

iptables  --line -t filter -nvL OVPN

iptables  --line -t filter -nvL FORWARD

 

[themiron]

If I do ' git merge master ' after 'git checkout mainline' , it doesn't add Master commits which are not yet merged to Mainline on github? because I do get 384.13_alpha1 FW file after compilation and not 384_12 (which gets compiled if I don't use 'git merge master') .

Thanks.

yep, git merge master while you on mainline will do the trick. but only merge part. reconfiguring way should be visible from the changes, if not, well... I'd suggest not to try to use it at this highly experimental stage

 

[elgreco29]

Since 384.12 (dirty flashed from 384.11.2) i cannot see my fire tv stick as a renderer. No probs with all previous versions.

 

[dave14305]

Do you want the ping count box visible or hidden for Ping Continuous? It will still be there with the fix.

Leaving the ping count field exposed slows the speed of the graphs if a count greater than 1 is entered, since you're waiting for more than 1 ping reply before netool gets the current result. So I guess it really should be hidden for Continuous.

 

[L&LD]

Since 384.12 (dirty flashed from 384.11.2) i cannot see my fire tv stick as a renderer. No probs with all previous versions.

What process have you tried to fix this issue? What router are you using? Does a reboot (of the whole network) help?

 

[Ditch]

If the LAN resource your inbound OpenVPN Server clients are trying to reach is explicitly routed via the VPN, then you may need to create a split tunnel for the VPN Server subnet/interface tun2+

However, you should check the following rule tables when the issue occurs.

e.g. Selective routing for VPN Client 3

ip route show table ovpnc3

and the RPDB/firewall rules

ip rule

iptables  --line -t filter -nvL OVPN

iptables  --line -t filter -nvL FORWARD

10102:    from 10.8.0.2 lookup ovpnc1

Chain OVPN (2 references)

num   pkts bytes target     prot opt in     out     source               destination         

1       27  1754 ACCEPT     all  --  tun21  *       0.0.0.0/0            0.0.0.0/0           

2        0     0 DROP       all  --  tun11  *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)

num   pkts bytes target     prot opt in     out     source               destination         

1        0     0 ACCEPT     udp  --  br0    ppp0    0.0.0.0/0            0.0.0.0/0            match-set Skynet-IOT src udp dpt:123

2        0     0 LOG        all  --  br0    !tun2+  0.0.0.0/0            0.0.0.0/0            match-set Skynet-IOT src LOG flags 7 level 4 prefix "[BLOCKED - 

3        0     0 DROP       all  --  br0    !tun2+  0.0.0.0/0            0.0.0.0/0            match-set Skynet-IOT src

4        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.0/4         

5      655 39652 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x06/0x02 TCPMSS clamp to PMTU

6    20735   10M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

7        0     0 other2wan  all  --  !br0   ppp0    0.0.0.0/0            0.0.0.0/0           

8        0     0 logdrop    all  --  !br0   eth0    0.0.0.0/0            0.0.0.0/0           

9       29  1856 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0           

10     150  7010 logdrop    all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID

11     489 41621 NSFW       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

12     456 39491 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           

13       6   376 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT

14      27  1754 OVPN       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW

15       0     0 logdrop    all  --  *      *       0.0.0.0/0            0.0.0.0/0

 

[RAH-66]

Some people recommended the very extreme way, such as pulling out the power cord, with the intention to 100% ensure that the old firmware and its configs are totally wiped out with no remains, and the new firmware you flash in will be like virgin to the router.

In this way, there is a high probability of getting bad blocks in flash and throwing router into garbage.

 

[elgreco29]

What process have you tried to fix this issue? What router are you using? Does a reboot (of the whole network) help?

Router is a AC88U, reboot helped not.

 

[RMerlin]

Do you want the ping count box visible or hidden for Ping Continuous? It will still be there with the fix.

It probably should be hidden as well.

 

[dosborne]

In official firmware, we expect the engineer to know inside-out of the differences between the old version and new version, and have every measures to make sure the new version works properly after the update

Care to share whatever it is you are smoking?

Just kidding, but I think your ideal world is unrealistic. Sometimes there are literally hundreds of people with their fingers in the code. Companies are rushing out updates and calling them release quality when they are, at best, beta versions. I'm not saying *all* companies, but certainly many, and unfortunately, many of the ones I deal with. As my router is a critical piece in my network, I tend to keep it up to date. However for internal facing devices, I certainly wait a while for a compelling reason to update to a new firmware version.

 

[eclp]

After a complete reset and reconfiguration, the router name is displayed three times in System/ Installed Server Certificate.

 

[Jack Yaz]

After a complete reset and reconfiguration, the router name is displayed three times in System/ Installed Server Certificate.

View attachment 18389

The second entry is your router's name followed by a . and then the name again. What have you set for your router's domain?

 

[eclp]

The second entry is your router's name followed by a . and then the name again. What have you set for your router's domain?

That already cleared it up. Thank you

 

[JohnSmith]

Upgrade RT-X88U from V384.11_2 Final to V384.12_0 Final, via firmware upgrade (first GUI rebooted the router as it had been up for 30+ days, working great with 40+ devices). All appears to be working, except for the following:

• Under "Adaptive QOS" | "QOS", QOS Configuration was reverted to defaults and did not keep my customization settings
• Under "Adaptive QOS" | "Bandwidth Monitor", any of my "Network Map" List clients that I normally had set from "Highest" to "Lowest" were all back to "Default" color

As per Merlin below, this is a known ASUS issue, has been fixed, and waiting on a firmware release for this.

https://www.snbforums.com/threads/r...-12-is-now-available.57220/page-8#post-500065

 

[DarkKnight75]

Running solid so far on my ASUS RT AC86U

 

[Val D.]

I'm rebooting the router every few minutes today in an attempt to find what is causing the no boot condition after soft reboot (more details here https://www.snbforums.com/threads/ac86u-sometimes-powers-completely-off-during-reboot.48296/) and in the process I noticed the following:

OpenVPN, Inbound Firewall - Block -> VPN speed is very low, 20/2 Mbps s in most cases, both down/up speeds are affected
OpenVPN, Inbound Firewall - Allow -> everything goes back to normal, I usually get around 150/10 Mbps through VPN

NordVPN, server is local and the same in all tests. Configuration is as per NordVPN, nothing much have been changed.
Anyone else seeing this?

 

[Swistheater]

what is a fix for being flooded by this?

kernel: icmpv6_send: no reply to icmp error

Edit: I figured it out.

 

[L&LD]

I'm rebooting the router every few minutes today in an attempt to find what is causing the no boot condition after soft reboot (more details here https://www.snbforums.com/threads/ac86u-sometimes-powers-completely-off-during-reboot.48296/) and in the process I noticed the following:

OpenVPN, Inbound Firewall - Block -> VPN speed is very low, 20/2 Mbps s in most cases, both down/up speeds are affected
OpenVPN, Inbound Firewall - Allow -> everything goes back to normal, I usually get around 150/10 Mbps through VPN

NordVPN, server is local and the same in all tests. Configuration is as per NordVPN, nothing much have been changed.
Anyone else seeing this?

Just tested between my RT-AC86U router (client) and my customers RT-AC68U (server) and no such differences using OpenVPN (no paid VPN client here).

Are you sure they are connecting to the same server each time?

Do I have to make an atomic suggestion?

 

[Val D.]

Are you sure they are connecting to the same server each time?

Do I have to make an atomic suggestion?

Same server for sure, same configuration, the Inbond Firewall state is the only difference. Could be something NordVPN specific, not sure yet. Will investigate this later after I finish playing with reboots. No atomic suggestions needed at this point, please. I'm going to take a little more scientific approach.

 

[Val D.]

Anyone else seeing this?

The problem disappeared before I start checking what is happening. VPN is working properly now with Inbond Firewall Block. Temporary VPN server overload perhaps between my reboots, who knows.