KeeneticOS 5.0
KeeneticOS release notes for Keenetic Hero (KN-1012) in the Preview Channel
KeeneticOS releases in this channel provide the chance to be among the first to try the latest updates, performance improvements and new features, all with minimal risk. It is updated roughly every two weeks, with major updates about every two months. Releases here are typically more than a month in advance of release to the general audience in the Main Channel.
Keenetic Hero (KN-1012) is currently in the Standard Updates support period and receives regular software updates, including security enhancements, new features, operating system updates, and bug fixes.
What’s new?
Welcoming the KeeneticOS next major release 5.0! This long-awaited upgrade introduces numerous enhancements to our beautiful and user-friendly web interface, along with a comprehensive list of improvements under the hood. We’ve prepared a range of new features, including a powerful DNS-based routing capability, a simple and effective WireGuard VPN server application, enhanced IPv6 support, and a smart Internet backup solution using a built-in 5G/4G modem on mesh extenders. You also get flexible and trustworthy application filtering for your home devices and VPN users, a web UI for a versatile iPerf3 speed tester, and easy eSIM management. Your router is now faster, more reliable, and more enjoyable to use and set up, whether from a PC or mobile device.
Welcome to the future of Keenetic!
Web Interface & Ease of Use:
New look of the Internet card on the System Dashboard page. The updated design and functionality make it easier to read and monitor traffic stats, providing a cleaner and more intuitive interface.
Keenetic now features the WireGuard VPN Server application — a modern, high-performance VPN solution for secure remote access to the home network using any client. Administrators create and manage peers directly from the web interface, automatically generating configuration files and QR codes for instant connection.
The new Application Filter tab on the Internet Safety page allows you to easily block specific apps or traffic categories (like social media, games, or streaming) for individual devices and home networks — such as your kids’ Wi-Fi.
The Routing page enhancement introduces a convenient DNS-Based Routes tab, an instrument that’s especially useful for tasks such as directing business applications through a corporate connection or ensuring the streaming services utilize a faster link. It works by setting up custom routing rules for traffic destined to specific domains or IP addresses to pass over the connection or gateway of your choice.
The Diagnostics page now features an iPerf3 tool in the Network Connection Test section, allowing you to measure bandwidth and network performance directly from the web interface. To get started, install the iPerf3 system component on your device.
The Mesh Wi-Fi System upgrade to support seamless use of an Extender’s built-in mobile network modem as either your primary or backup Internet connection. The Controller automatically creates a dedicated
MwsMobileinterface and manages it like any other WAN option. Modem’s SMS and USSD tools are accessible as well, via an Extender’s web interface, which you can open directly from the Wi-Fi System page.
Managing your eSIMs just got much easier! The new eSIM web interface page lets you browse, add, and switch eSIM profiles on supported 5G/4G modems. It works equally with external eSIM modules that use a physical eSIM card, so you can activate carriers and update data plans straight from your browser — no third-party apps, no hassle.
Alert pop-ups got a makeover! They are now more readable and visually appealing, contributing to consistency throughout the entire interface.
Automatic light/dark colour scheme — the web interface can now follow the theme of your browser or device.
We’re introducing a new wave of IPv6 enhancements to make your network more flexible and adaptable.
Port Forwarding now supports IPv6 Pinholing, enabling smooth external access for IPv6-based clients.
Each local network segment now has an Enable IPv6 control, along with relevant advanced configuration options.
KeenDNS service now features uniform IPv4/IPv6 support, offering direct IPv6 access over the device’s domain name.
UPnP (IGDv2 PCP protocol) now supports IPv6 as well — games and apps will open the necessary ports automatically.
Network & Advanced Features:
A
Dummyvirtual interface is now available for routing tests and experimental setups.Virtual Router Redundancy Protocol (VRRP v2/v3) support for backup routers. The VRRP enables automatic redundancy between master and backup routers, ensuring the deployment of stable and reliable connections.
A new Limited rights admin (
manager) role with a privilege level that allows restricted permissions is ideal for devices maintained by ISPs.The import/export operation for static routes now preserves your comments, so the file remains readable by humans.
WAN Ethernet ports now accept VLAN tagging with ID 0 — a setting required by some ISPs, and it finally works.
Security Improvements:
Update of the kernel and internal OS services closes freshly discovered CVE vulnerabilities.
Public web access is blocked if the device administrator password is weak.
The system prevents users with read-only access from viewing sensitive data.
Expanded 4G modem support.
Added compatibility for popular USB modem models, including Fibocom FM101-GL, Olax F90, SMD12, and SMW12.
We greatly appreciate your continued support and engagement. Your feedback helps us make Keenetic even better. For any questions, discussions, issue reporting, or contacting our development team, please visit our forum. Thank you for choosing Keenetic!
KeeneticOS 5.0.4
16/01/2026
Improved
Fixed
KeeneticOS 5.0.3
18/12/2025
Improved
Fixed
KeeneticOS 5.0.2
05/12/2025
New
A new eSIM management page has been added to the Web Interface, allowing you to easily view, add, switch, and manage eSIM profiles on supported 5G/4G modems. The feature currently works with external eSIM modules accessed via a physical eSIM card, so you can activate mobile operators, change data plans, or manage multiple profiles directly from your browser without needing additional apps or manual configuration. [NWI-4526]
Added a new
source-addressparameter to thetools iperf3CLI command, providing control over the client source IP address used during performance testing. [NDM-4176]tools iperf3 {host} [(ipv4 | ipv6)] [(tcp | udp)] [reverse] [port {port}] [bitrate {bitrate}] [streams {streams}] [(time {time}) | (bytes {bytes})] [(source-interface {source-interface}) | (source-address {source-address})]
Improved
Fixed
KeeneticOS 5.0.1
14/11/2025
Improved
The following improvements have been applied to the Web Interface.
Redesigned alert pop-ups in the Web Interface for clearer interaction, better readability and a more consistent visual style. [NWI-4469]
Improved detection and error messaging for outdated browsers when opening the Web Interface. [NWI-4273]
Implemented the configuration of routes over different gateways or interfaces for the same FQDN object group using the command-line interface (
dns-proxy route object-group). Routes are prioritized in input order. [NDM-4118]
Fixed
KeeneticOS 5.0.0
29/10/2025
Improved
Fixed
KeeneticOS 5.0 Beta 3
10/10/2025
New
Improved
Fixed
KeeneticOS 5.0 Beta 2
26/09/2025
New
Implemented a new Enable IPv6 checkbox and an IPv6 configuration section for Home and additional local network segments, providing advanced control over IPv6 parameters and allowing IPv6 to be disabled per segment. [NWI-4373]
Introduced a new design for the Internet card on the System Dashboard page, featuring an updated layout and buttons to manage the display of connection statistics and traffic chart blocks. [NWI-4377]
Improved
Fixed
KeeneticOS 5.0 Beta 1
11/09/2025
New
Further improvements to the Mesh Wi-Fi System allow an Extender’s built-in 4G/3G modem to be used as the primary or a backup Internet connection. When a compatible Extender is detected, the Controller automatically creates a dedicated
MwsMobileinterface and manages the connection like any other, including its use in Connection Policies. SMS and USSD modem options are available directly in the Extender’s Web Interface, which can be opened via a link on the Controller’s Wi-Fi System page. [NDM-4027]The Port Forwarding page now supports IPv6 Pinholing, letting you open TCP and UDP ports to provide external access from the Internet to devices on your home network that use IPv6 addresses. [NWI-4213]
Added support for the Virtual Router Redundancy Protocol (VRRP) v2 and v3, configurable via the command line interface (CLI). This enables redundant routing across multiple routers. To use it, install the VRRP support system component. [SYS-1443]
interface {name} vrrp group {group} ip {ip}— set virtual IP address for the group;interface {name} vrrp group {group} priority {priority}— set priority (integer in the range 0 to 255), the device with the numerically highest priority becomes the master in the group;interface {name} vrrp group {group} advertise {advertise}— set advertisement interval in seconds (integer in the range 1 to 255, the default is 1);interface {name} vrrp version {version}— set protocol version, supported values:default— use version 2 for IPv4 and version 3 for IPv6;v2— strict compliance to VRRP version 2:zero VIPs are not allowed;
unicast peers are not allowed;
IPv6 addresses are not allowed;
state MASTER can be configured strictly when priority is 255;
v3— compliance to VRRP version 3 for both IPv4 and IPv6;v3-compat— VRRPv3 compatibility mode for interoperability with implementations (such as Cisco and Juniper) that treat RFC 5798 §5.2.8 as applying only to IPv6. When enabled, the router includes the IPv4 pseudo-header but omits it from the IPv4 checksum calculation;
show interface {name} vrrp— display the VRRP status.
The new DNS-Based Routes tab on the Static Routes page allows creating custom routing rules via a specified connection or gateway for user-defined lists of domain names and IP addresses. [NWI-4186]
The Diagnostics page now includes an iPerf utility in the Network Connection Test section, enabling bandwidth and performance testing directly from the web interface. To use it, install the iPerf3 system component on your device. [NWI-4371]
The Internet Safety page now features an Application Filter tab with controls to block traffic from specific applications and categories for individual clients or entire network segments. To use this feature, you must install the Traffic classification engine system component and enable the Application Classification option on the IntelliQoS page. [NWI-4232]
The new WireGuard VPN Server application makes it easier to set up various remote connection scenarios. It enables quick installation on client devices, providing secure access to any part of your network. [NWI-4206]
Implemented UPnP IGDv2 PCP support for the IPv6 protocol. [NDM-3859]
Added a new Manager user role featuring limited administrative rights for ISP deployment scenarios. [NDM-3945]
The new iperf3 system component has been implemented, enabling the measurement of bandwidth of a specified network connection via the command line interface (CLI). However, test speeds may be constrained by the performance of specific router models. [NDM-3785]
tools iperf3 {host} [ipv4 | ipv6] [tcp | udp] [port {port}] [bitrate {bitrate}] [time {time} | bytes {bytes}] [source-interface {source-interface}]
Example command:
tools iperf3 ping.online.net port 5202 time 10
Support for the Local Profile Assistant (LPA) and embedded Subscriber Identification Module (eSIM) has been added to the
UsbLteandUsbQmimodem interfaces via the command line (CLI). The eSIM chip can be built into the 5G/4G modem or accessed via an external eSIM adapter. [NDM-3850]show interface {name} esim— get eSIM status (incl. EID),interface {name} esim profile download {qrcode}— download eSIM profiles,interface {name} esim profile list— list eSIM profiles,interface {name} esim profile activate {iccid}— activate eSIM profile,interface {name} esim profile deactivate {iccid}— deactivate eSIM profile,interface {name} esim profile delete {iccid}— delete eSIM profile,interface {name} esim profile rename {iccid} {newname}— rename eSIM profile.
Improved
The client part of the iperf3 system component has been extended to support the
reverseandstreamsarguments, enabling download bandwidth testing and the use of parallel network streams. [NDM-3963]tools iperf3 {host} [ipv4 | ipv6] [tcp | udp] [reverse] [port {port}] [bitrate {bitrate}] [streams {streams}] [time {time} | bytes {bytes}] [source-interface {source-interface}];
Example command:
tools iperf3 ping.online.net reverse port 5202 streams 2 time 5.
Moved the
acq,apn, andwwan-force-connectedcommand-line configuration commands from theusbsub-tree to themobilesub-tree; see details below. [NDM-3950]Deprecated
interface {name} usb acq→ currentinterface {name} mobile acq;Deprecated
interface {name} usb apn→ currentinterface {name} mobile apn;Deprecated
interface {name} usb wwan-force-connected→ currentinterface {name} mobile force-connected.
Implemented
user:password@authentication credentials support for URLs in theopkg diskCLI command. [NDM-3960]Example command:
opkg disk storage:/ https://user:password@router.keenetic.pro/webdav/mipsel-installer.tar.gz.