KeeneticOS updates — Dev Channel

Added the Average speed information to the Traffic Monitor page. [NWI-4212]

Added the date and time to the filenames of downloaded firmware and startup-config configuration files. [NDM-3999]

Added an option to exclude sub-domain names for Object Groups via the command line interface (CLI). [NDM-4001]

The following fixes have been applied to the Web Interface.

Fixed an error causing the ResolveQueue: system failed [0xcffd0046] records to appear in the System log when using the Public DNS resolvers option for content filtering. [NDM-4002]

New USB modems are now supported, including:

Implemented Origin header enforcement for the KeenDNS Web application proxies. [NDM-3988]

Fixed the End User License Agreement title spacing in the Web Interface. [NWI-4344]

Fixed a regression introduced with the new manager user role that prevented seamless access to Wi-Fi System Extenders via HTTPS token. [NDM-3981]

The Internet Safety page now features an Application Filter tab with controls to block traffic from specific applications and categories for individual clients or entire network segments. To use this feature, you must install the Traffic classification engine system component and enable the Application Classification option on the IntelliQoS page. [NWI-4232]

The new WireGuard VPN Server application makes it easier to set up various remote connection scenarios. It enables quick installation on client devices, providing secure access to any part of your network. [NWI-4206]

Implemented UPnP IGDv2 PCP support for the IPv6 protocol. [NDM-3859]

Added a new Manager user role featuring limited administrative rights for ISP deployment scenarios. [NDM-3945]

The following improvements have been applied to the Web Interface.

The following fixes have been applied to the Web Interface.

Fixed configuration issues of the iperf3 system component. [NDM-3972]

The iperf3 system component now includes server mode functionality, enabling users to test the bandwidth between nodes on their home network. However, test speeds may be limited by the performance of certain device models. [NDM-3786]

Implemented a virtual Dummy network interface for ISP-managed routing applications, simulations, testing, and other uses. [NDM-3958]

The new Duny service is now available for the Dynamic DNS (DDNS) client system component. [NDM-3959]

The client part of the iperf3 system component has been extended to support the reverse and streams arguments, enabling download bandwidth testing and the use of parallel network streams. [NDM-3963]

Example command: tools iperf3 ping.online.net reverse port 5202 streams 2 time 5.

Moved the acq, apn, and wwan-force-connected command-line configuration commands from the usb sub-tree to the mobile sub-tree; see details below. [NDM-3950]

Implemented user:password@ authentication credentials support for URLs in the opkg disk CLI command. [NDM-3960]

Fixed an issue where configuration changes to network segments in the Web Interface were not retained and were being reset. [NWI-4353]

Fixed several bugs in the operation of FQDN-based routing rules. [NDM-3956]

Fixed an issue where the OpenConnect client failed to establish a connection with the system failed [0xcffd0085] error caused by IPv6 DNS usage. [NDM-3962]

Introduced a new routing option based on FQDN object-groups, enabling more precise and flexible control over traffic directed to specific domain names. [NDM-3946]

Improved the loading speed of dialogue popups on the Client Lists page when the Knowledge Base article links cannot be obtained or unavailable. [NWI-4326]

The following fixes have been applied to the Web Interface.

Fixed an issue where user-defined static DNS records (ip host) lost priority over dynamically obtained records after the device restarted. [NDM-3947]

The PersistentKeepalive value is now automatically set to 15 seconds when importing a WireGuard configuration file that lacks this parameter, ensuring correct connection establishment. [NDM-3948]

Fixed the address resolution issue that occurred during dynamic reconfiguration in OpenConnect, Proxy, and ZeroTier VPN connections when the server address is specified as an URL. [NDM-3951]

Fixed the incorrect behaviour of the DDNS service when using IPv4 and IPv6 addressing simultaneously or relying solely on the IPv6 protocol. [NDM-3952]

Fixed the MAP-T handling of IPv6 UDP packets with a zero checksum by RFC 6935, improving compatibility with the IPsec protocol. [SYS-1404]

Fixed the incorrect saving of the no system log reduction CLI command to the running configuration. [NDM-3953]

Resolved an issue where clients of IKEv1/IPsec VPN and IKEv2/IPsec VPN servers did not receive static routes correctly. [NDM-3954]

The new iperf3 system component has been implemented, enabling the measurement of bandwidth of a specified network connection via the command line interface (CLI). However, test speeds may be constrained by the performance of specific router models. [NDM-3785]

Example command: tools iperf3 ping.online.net port 5202 time 10

Support for the Local Profile Assistant (LPA) and embedded Subscriber Identification Module (eSIM) has been added to the UsbLte and UsbQmi modem interfaces via the command line (CLI). The eSIM chip can be built into the 5G/4G modem or accessed via an external eSIM adapter. [NDM-3850]

An interface selection option has been added when exporting user-defined routes to a .bat file, enabling customised route export per interface. [NWI-4288]

The IPv6 system component was removed, as IPv6 functionality has been integrated into the base OS. [NDM-3935]

Fixed an issue that caused the error message socks5 client read auth to appear when using a Proxy connection with socks5 protocol under certain conditions. [NDM-3942]

Fixed various issues related to importing WireGuard configurations from a file, improving reliability and compatibility. [NDM-3943]

Added support for the Signalinks M806B LTE Cat 4 USB modem and the Signalinks D525C LTE Cat 4 USB mobile router. [NDM-3933]

Added SNMP metrics support for wireless broadband connections on 4G/3G modem connections. [NDM-3934]

The following improvements have been applied to the Web Interface.

Resolved multiple translation issues in the Web Interface related to Extender Mode. [NWI-4281]

Added tooltips to blocked fields when Fail-Safe Configuration Mode is enabled, providing users with clearer guidance on disabled settings. [NWI-4252]

Fixed the tooltip display on the Wi-Fi Monitor tile of the System Dashboard page. [NWI-4298]

Fixed an issue where rekeying during an IKEv2 VPN connection initiated from a client to a server could cause the client to disconnect. [NDM-3922]

Resolved the binding of an IKEv2/IPsec VPN Server policy to a home network segment. [NDM-3925]

Addressed an issue that caused the ban remote host 127.0.0.1 message to appear in the System log when using the mobile application. [NDM-3926]

Fixed an issue with the DDNS service incorrectly reporting IPv6 update disabled despite the router having an IPv6 address. [NDM-3927]

Fixed an issue where importing WireGuard connection settings from a file with rearranged [Peer] and [Interface] blocks caused the system failed [0xcffd009e] error message to appear in the System log. [NDM-3930]

Added an option to support the nc (Juniper®) protocol in the OpenConnect VPN client, which is selectable via the command line interface (CLI). [NDM-3908]

Implemented batch removal of User-Defined Routes per interface through the command line (CLI), allowing the destination arguments {network} {mask} | {host} to be optional. [NDM-3911]

Example command: no ip route ISP — Deletes all IPv4 static routes from the ISP interface.

The following improvements have been applied to the Web Interface.

Reduced the "ZeroTier0": install accepted route log message flow. [NDM-3903]

Removed excess debug messages from the log. [SYS-1384]

Improved handling of routes without a specified outgoing interface. [NDM-3907]

Implemented support for configuring the WireGuard Peer obfuscation key in WireGuard connections via the command line interface (CLI). [NDM-3917]

Enabled mDNS announcements for the Web Interface (HTTP) service, making it discoverable in the Home segment. [NDM-3919]

The following fixes have been applied to the Web Interface.

Fixed an issue that caused the error message Io::Serial: terminal options verification failed to appear when using a UsbLte-type modem. [NDM-3905]

Fixed an issue that caused WifiStationX interfaces to incorrectly reset their MAC address to the default state. [NDM-3906]

Fixed the usage of the authgroup parameter with the anyconnect protocol in OpenConnect VPN connections. [NDM-3918]

Enabled the display of customised page title prefix on System Dashboard and WebCLI pages. [NWI-4240]

The following fixes have been applied to the Web Interface.

Fixed the forwarding of negative DNS responses from the DNS proxy bound to 127.0.0.1, ensuring that local clients now receive these responses correctly. [SYS-1382]

Added ability to specify the 802.1p Priority Code Point (PCP) mapping to ISP VLANs on the Ethernet Cable Connections to Internet page for compatibility with certain ISPs. [NWI-3726]

The strict prevention of overlapping network configurations in the Allowed IPs field of the WireGuard peer settings has been replaced with a log notification. [NDM-3888]

Improved static route import/export by adding support for comments or remarks in Windows® batch files; lines ending with :: rem and & rem are now correctly identified as comments and preserved during import/export. [NDM-3889]

Routes example:

route add 5.5.5.0 mask 255.255.255.0 0.0.0.0 :: rem route-to-5-network

route add 4.4.4.4 mask 255.255.255.255 0.0.0.0 & rem route-to-4-net

The following fixes have been applied to the Web Interface.

Fixed the issue with accessing VPN servers when connecting via the IPv6 protocol. [NDM-3886]

Fixed inbound IPv6 connections to the built-in SSH server. [NDM-3891]

Fixed the WGOBFS netfilter chains for correct handling of WireGuard connections configured with the obfs-key setting. [NDM-3890]

Implemented the DD-WRT-compatible obfuscation key usage for WireGuard connections via the command line interface (CLI). [NDM-3883]

Implemented support for specifying a domain name (FQDN) in the IKEv2/IPsec VPN Server certificate via the command-line interface (CLI). [NDM-3884]

Removed unnecessary debug messages Proxy0: 0x7f9ba28be0 socks5 client res.rep from the System log when using Proxy Connections to improve log clarity. [NDM-3875]

Fixed the issue for Windows clients connecting to WPA/WPA2/WPA3 Enterprise-secured networks with Allow WPS option enabled. [SYS-1361]

Corrected traffic accounting issues causing unintended disconnections for remote clients of the IKEv2/IPsec VPN Server. [NDM-3876]

Resolved issues during the simultaneous operation of IKEv1/IPsec VPN Server and Site-to-Site IPsec VPN connections under specific conditions. [NDM-3878]

Fixed an issue potentially causing system restarts under particular conditions when using the IKEv2/IPsec VPN Server. [NDM-3880]

The following fixes have been applied to the Web Interface.

We are broadening our endorsement programme for Internet Operators by introducing support for the TR‑098 data model under the CPE WAN Management Protocol (CWMP). The feature is available on request. Contact our support (support@keenetic.de) for further details. [NDM-3870]

Added support for seamless integration with ZeroTier virtual networks on the Other Connections page. Create a Permit firewall rule to allow incoming traffic. [NWI-4164]

Implemented CLI commands to configure static IPv6 address and port translation rules, enhancing IPv6 NAT management via the command line. See the Command Reference Guide for full syntax. [NDM-3819]

Implemented detection and integration of OpkgTun and OpkgTap interfaces created within the OPKG environment, enabling their use in Connection Policies and static routes. [NDM-3846]

Enabled automatic mounting of the /lib/system-modules directory within the OPKG environment, so additional kernel modules become accessible immediately. [NDM-3693]

Implemented the capability to include a UsbQmi connection in BridgeX configurations, allowing cellular links to join network bridges. [NDM-3707]

Removed the obsolete cifs master command from the system’s SMB file and printer sharing component. [NDM-3827]

Enhanced the allow‑ips validator to prevent overlapping networks across multiple WireGuard peers, ensuring proper routing and peer isolation. [NDM-3868]

Fixed an issue in which a UsbLte modem connection failed to restart when Ping Check was enabled in certain scenarios. [NDM-3848]