KeeneticOS updates — Dev Channel

The improved extender discovery method employs both L2 (LLDP) and L3 (multicast WS-Discovery) protocols to support specific configurations of managed Ethernet switches for your Wi-Fi System. [NDM-4220]

The following fixes have been applied to the Web Interface.

Fixed the cause of the response is too big error message appearing in the the Wi-Fi System Controller system log. [NDM-4250]

Resolved an issue where wireless clients were rejected if the IE_SUPP_CHANNELS element in the Wi-Fi association request exceeded 64 bytes. [SYS-1539]

Fixed an issue that prevented proper dual-SIM slot switching when Ping Check was enabled. [NDM-4237]

Restored the Cable Diagnostics functionality for 2.5 Gbit/s Ethernet ports. [SYS-1529]

Eliminated a security vulnerability (CVE-2026-1642) in the Web Interface service. [NDM-4267]

Resolved an issue where the KeenDNS name was inaccessible to clients on the home network after switching the service from Cloud to Direct mode. [NDM-4255]

Added support for the Sierra EM9293 5G NR, LTE Cat 20 USB modem module (UsbQmi-type). [NDM-4235] [Forum topic]

An issue with KeenDNS domain name resolution in direct access operating mode for the IPv6 protocol has been fixed. [NDM-4136]

The following fixes have been applied to the Web Interface.

Fixed clearing cached sessions when restarting the WireGuard connection used to access the Internet. [NDM-4225]

Fixed the UPnP service compatibility issue with Synology ® NAS. [NDM-4247]

Added sorting by list name in the Domain Name Lists summary table on the Routing → DNS-Based Routing tab. [NWI-4595]

Upgraded GnuTLS to v3.8.11, resolving the following CVE security issues. [NDM-4205]

Optimized memory consumption in the Traffic classification engine system component. [NDM-4219]

Fixed compatibility with the macOS Time Machine® backup solution in the SMB file and printer sharing component. [NDM-4112]

Fixed a Web Interface issue where saving the network segment configuration unnecessarily required specifying a VLAN ID. [NWI-4578]

Resolved an issue where static routes added after the default route did not appear in the routing table. [NDM-4209]

Fixed loss of access to the Web Interface caused by network discovery service timeouts under certain conditions. [NDM-4223]

Resolved an issue with the Simple Service Discovery Protocol (SSDP) network discovery routine that could lead to a system restart under certain conditions. [NDM-4224]

Corrected the visibility of the Mobile menu in the Web Interface when no USB modem is connected or no Wi-Fi System Extender with a built-in 4G/5G modem is present. [NWI-4518]

Optimized the performance of FQDN routing list updates. [NDM-4197]

Resolved a system restart loop that occurred when the Fail-Safe Configuration Mode was enabled while a ZeroTier connection was running. [NDM-4187]

Fixed the UDP-to-HTTP proxy (udpxy) service crash when running on a Bridge public interface. [NDM-4200]

Fixed the FQDN-based routing when DNS is operating over the TCP protocol. [NDM-4201]

A new eSIM management page has been added to the Web Interface, allowing you to easily view, add, switch, and manage eSIM profiles on supported 5G/4G modems. The feature currently works with external eSIM modules accessed via a physical eSIM card, so you can activate mobile operators, change data plans, or manage multiple profiles directly from your browser without needing additional apps or manual configuration. [NWI-4526]

Added a new source-address parameter to the tools iperf3 CLI command, providing control over the client source IP address used during performance testing. [NDM-4176]

The following improvements have been applied to the Web Interface.

The following fixes have been applied to the Web Interface.

Fixed the parsing of ipv6 static CLI commands that contain a description field. [NDM-4098]

Fixed an issue that caused the stubby: Could not parse config file error when using DNS over TLS (DoT) for address resolution under certain conditions. [NDM-4125]

Addressed a potential system restart triggered by DNS FQDN event sink threads. [NDM-4162]

Restricted access to sensitive data for users with readonly privileges, enhancing security and ensuring compliance with privilege levels. [NDM-4169]

Fixed the improper missing password warning when navigating to the web interface of a Wi-Fi System extender via Remote Monitoring and Management (RMM). [NDM-4170]

The following improvements have been applied to the Web Interface.

Implemented the configuration of routes over different gateways or interfaces for the same FQDN object group using the command-line interface (dns-proxy route object-group). Routes are prioritized in input order. [NDM-4118]

The following fixes have been applied to the Web Interface.

Fixed the IPv4 default route setup for IPv6 DS-Lite over PPPoE connections. [NDM-4109]

Fixed the command execution restriction for users with read-only privileges. [NDM-4113]

Fixed the issue with user authentication for logging into the Web Interface using IPv6. [NDM-4115]

Added support for base-station binding on the FM350-GL USB modem module, enabling it to lock to a specific cell tower for improved connection stability. [NDM-3201]

The following improvements have been applied to the Web Interface.

Changed the NXDOMAIN DNS response to NOERROR when querying AAAA records for A-only entries, in accordance with RFC 6147. [NDM-3857]

The OpenSSL library has been updated to version 3.0.18. [NDM-4083]

Changed the packet dump file extension from .pcapng to .pcap in the Packet Capture system component. [NDM-4091]

Implemented safeguards to prevent routing loops when a remote peer sends an invalid IPCP configuration. [NDM-4093]

Devices with weak administrator passwords no longer allow public access to the Web Interface. [NDM-4097]

Implemented eSIM and dualSIM support for the FM350-GL USB modem module. [NDM-4100]

The following fixes have been applied to the Web Interface.

Fixed the Wi-Fi button so it correctly turns Guest network access points off and back on in certain scenarios. [NDM-4054]

Resolved an issue where KeenDNS names failed to resolve for VPN clients. [NDM-4095]

Resolved an issue where the auto argument was parsed incorrectly in DNS-Based Routes configuration. [NDM-4096]

Fixed an issue where adding FQDN object group exclusions generated an IPset kernel error in the System Log. [NDM-4101]

Implemented a CLI option to override the DNS server for clients of the built-in VPN servers. [NDM-4032]

Added support for including IP subnets in the Domain Name Lists, using the object-group fqdn include command in the CLI or via the DNS-Based Routes tab on the Routing page. [NDM-4078]

Command example: object-group fqdn TEST include 10.0.0.1/24

Adjusted the intensity of recurring name resolutions for the currently unclaimed names in the FQDN Object group (object-group fqdn). [NDM-4082]

Enabled external access to the IPv6 addresses of backup WAN connections. [NDM-4067]

Fixed an issue that caused multiple Dns::Route::ResolveQueue messages to appear in the System Log when using FQDN object groups with many entries. [NDM-4086]

The following fixes have been applied to the Web Interface.

Resolved an issue with L2TP traffic handling when the L2TP/IPsec VPN Server application is enabled. [NDM-4068]

Resolved an issue with forwarding servfail.invalid DNS queries to upstream DNS servers. [NDM-4069]

Fixed an issue that could cause the system to crash when connecting clients using Wi-Fi OWE (Opportunistic Wireless Encryption) authentication. [SYS-1461]

Fixed an issue on the Routing page that prevented disabling individual static route entries without affecting others. [NDM-4076]

Implemented a new Enable IPv6 checkbox and an IPv6 configuration section for Home and additional local network segments, providing advanced control over IPv6 parameters and allowing IPv6 to be disabled per segment. [NWI-4373]

Introduced a new design for the Internet card on the System Dashboard page, featuring an updated layout and buttons to manage the display of connection statistics and traffic chart blocks. [NWI-4377]

The following improvements have been applied to the Web Interface.

Added Basic authentication support for the OpenConnect VPN client via the command line interface (CLI). [NDM-4037]

The following fixes have been applied to the Web Interface.

Resolved an issue where the DNS proxy service could enter a busy loop when processing malformed DNS responses, improving stability and performance. [NDM-4034]

Fixed an issue with the Exclusive Route option in DNS-based Routes. [NDM-4046]

Fixed inbound Web Interface access via IPv6 on interfaces configured with the private or protected security level. [NDM-4061]

Fixed the display of remote IP addresses and ports for clients in the WireGuard VPN Server Statistics popup window. [NDM-4064]

Further improvements to the Mesh Wi-Fi System allow an Extender’s built-in 4G/3G modem to be used as the primary or a backup Internet connection. When a compatible Extender is detected, the Controller automatically creates a dedicated MwsMobile interface and manages the connection like any other, including its use in Connection Policies. SMS and USSD modem options are available directly in the Extender’s Web Interface, which can be opened via a link on the Controller’s Wi-Fi System page. [NDM-4027]

The Port Forwarding page now supports IPv6 Pinholing, letting you open TCP and UDP ports to provide external access from the Internet to devices on your home network that use IPv6 addresses. [NWI-4213]

Added support for the Virtual Router Redundancy Protocol (VRRP) v2 and v3, configurable via the command line interface (CLI). This enables redundant routing across multiple routers. To use it, install the VRRP support system component. [SYS-1443]

The following fixes have been applied to the Web Interface.

Fixed an issue where the identity-local parameter was reset when reconfiguring the IPsec VPN Server. [NDM-4036]