KeeneticOS 5.1
KeeneticOS release notes for Keenetic Hero (KN-1011) in the Main Channel
KeeneticOS releases in this channel have passed our full rigorous testing and are recommended to all users, to avoid issues and maximize capabilities. This channel is updated roughly every two-three weeks with minor releases, and every two months with major releases.
Keenetic Hero (KN-1011) is currently in the Standard Updates support period and receives regular software updates, including security enhancements, new features, operating system updates, and bug fixes.
What’s new?
The next KeeneticOS version 5.1 release is out, bringing substantial improvements to usability along with modern networking features. The web interface now provides convenient dedicated Access Points and Storages & Devices pages, a redesigned Firewall with IPv6 support, and usability improvements to Client Lists and Traffic Monitor pages. Mesh Wi-Fi System capabilities have been expanded for extenders that support mobile network connectivity. Networking and connectivity receive numerous updates, including an upgrade to ZeroTier implementation that now supports custom server configurations. A comprehensive update has been applied across a wide set of key security components, and guest Wi-Fi networks now receive stronger protection against malicious AirSnitch attacks.
Web Interface and Usability:
A dedicated Access Points page now lets you manage all your Wi-Fi networks from a single location, centralizing Wi-Fi settings and consolidating common radio interface options under the System Settings menu. All local networks are now logically grouped on the Segments page, reducing the need to navigate multiple menus.
The Client Lists page now includes convenient filters, allowing you to quickly hide offline devices and instantly see the total number of clients currently online or disconnected. The page also shows more detailed information, including traffic statistics, connection policy, and IPv6 addresses.
The new Storages & Devices page provides a clear overview of connected drives, allowing you to browse their status, manage files, safely eject storage devices, or format them directly from the web interface.
The Traffic Monitor is now even more convenient for everyday use. Devices are automatically sorted alphabetically when creating custom views, longer chart labels are displayed in full, and the page delivers a smoother experience on mobile devices. Together, these improvements make monitoring and analysing network activity faster and more comfortable.
Greater flexibility has been introduced for the custom Ping Check profiles. You can now turn off automatic modem reboots when using custom Internet connectivity checks. This provides greater control over mobile Internet behaviour and greater flexibility when configuring advanced or non-standard network scenarios.
IPv6 enhancements:
The Firewall page received one of the biggest updates in KeeneticOS 5.1. The redesigned page makes firewall management much more intuitive by separating IPv4 and IPv6 suites into dedicated tabs, giving you a clearer view of the security rules applied to each protocol and interface. That said, the web interface now allows you to create and manage IPv6 firewall rules directly, making it just as easy to adjust security for modern IPv6 networks as for traditional IPv4 networks.
Secure DNS configuration has become more flexible. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) now support IPv6 server addresses, allowing you to use encrypted DNS services regardless of whether they are available over IPv4 or IPv6. This improves compatibility with modern network deployments.
Mesh Wi-Fi System
The Wi-Fi System extenders equipped with embedded 5G/4G modems can now fully contribute to the use of mobile network. They support network scanning, eSIM management, SMS messaging, and USSD requests directly via the controller's web interface.
Detailed connection information is now available for wired clients connected via Wi-Fi system extenders, making it easier to devise the position of each device on your network and its use of network capacity.
Network & Advanced Features:
Support for the legacy Apple Filing Protocol (AFP) was removed in favor of SMB, providing better compatibility with current operating systems and making file sharing across your network simpler and more reliable.
ZeroTier connectivity has become even more versatile. KeeneticOS now supports connecting to private ZeroTier networks that use custom root servers (moons). This expands compatibility with self-hosted and enterprise ZeroTier deployments, providing advanced users with greater flexibility when deploying secure virtual networks.
IntelliQoS has been further optimized to improve traffic management and application performance, especially on devices with limited system memory.
DNS-based routing received significant enhancements, including more reliable rule processing, support for route prioritization, and improved handling of situations where the primary Internet connection is unavailable.
Improved support for importing WireGuard configuration files, including advanced ASC parameters.
Security Improvements:
Updated key system components, including OpenSSL, curl and libevent, providing protection against multiple newly discovered vulnerabilities.
Improved security for guest and isolated Wi-Fi networks. KeeneticOS now provides enhanced protection against the AirSnitch attack by strengthening the Wi-Fi Client Isolation mechanism, helping prevent isolated wireless devices from communicating with the rest of your network.
KeeneticOS 5.1.1
16/07/2026
New
Implemented CLI commands to manage IPv6 access lists. [NDM-4130]
ipv6 access-list {acl}— create an IPv6 access list with name{acl};ipv6 access-list {acl} (permit | deny) ((tcp | udp) ({source} | (host {source}) | any) [port (((lt | gt | eq) {source-port}) | (range {source-port} {source-end-port}))] ({destination} | (host {destination}) | any) [port (((lt | gt | eq) {destination-port}) | (range {destination-port} {destination-end-port}))]) | ((((ipv6 | esp | ahp | pcp | sctp)) | {protocol}) ({source} | (host {source}) | any) ({destination} | (host {destination}) | any)) | (icmp ({source} | (host {source}) | any) ({destination} | (host {destination}) | any) [(icmp-message | ({icmp-type} [{icmp-code}]))])— specify details for IPv6 access rule;ipv6 access-list {acl} rule {index} (disable | (schedule {schedule}) | (order {new-index}) | (description {description}))— set description, schedule, priority, or turn off selected IPv6 access list rule;ipv6 access-list {acl} auto-delete— enable automatic deletion along with all bound network interfaces.
Implemented command line interface (CLI) tools to check and format the file system. To use it, install corresponding filesystem utilities via system components options selector on the System Settings page. [NDM-4239]
media {name} partition {partition} check— check the file system on a partition; ability to check depends on the installed filesystem utilities;media {name} partition {partition} format {type}— format a partition, supported file system types depend on the installed filesystem utilities.
Added an IPv6 rules management tab to the Firewall page of the Web Interface. [NWI-4614]
Introduced the Storages & Devices page to manage connected USB devices and storage units, including format, check, disconnect, and safe eject options. [NWI-4583]
Improved
Optimized memory allocation settings for the Traffic classification engine system component to avoid unnecessary limitations when using IntelliQoS features. [NDM-4482]
The following improvements have been applied to the Web Interface.
Enhanced the usability of the Client Lists page by adding an option to hide offline clients and a tooltip that displays the client count by status. [NWI-4857]
Updated the appearance of the frequency band selector on the Access Points page. [NWI-4867]
Arranged the lists of domain names alphabetically in the selector on the DNS-Based Route Parameters pop-up. [NWI-4895]
Added a link to the General Wi-Fi Settings section from the Access Points page. [NWI-4894]
The following improvements have been applied to the Web Interface.
Added support for eSIM, SMS, and USSD operations on embedded 5G/4G modems for Wi-Fi System extenders. [NWI-4738]
Enhanced the Client Lists page to display information on the client device's currently used connection policy, traffic sent and received, and IPv6 addresses. [NWI-4707]
Implemented a CLI command to enable the collection of application traffic statistics. On devices with less than 256 MB of RAM, application traffic statistics are not processed by default to optimize memory usage. [NDM-4367]
ntce stats no disable— restore application statistics recording.
Updated protection against attacks targeting the Wi-Fi client isolation feature, such as AirSnitch. [SYS-1725]