KeeneticOS 4.3

What’s new?

Welcome to KeeneticOS version 4.3! We’re delighted to announce this latest release, featuring exciting new updates, improvements, and fixes. Special attention has been given to enhancing the Web Interface, ensuring a smoother experience, improved functionality, and easier navigation.

Web Interface improvements:
- Assign network segments to Ethernet ports for extenders.
  Easily manage your wired network segmentation with the new Port Assignment option on the Extender Settings page, directly from the Mesh Wi-Fi System nodes list. Now you can easily assign a specific network segment to your Extender's Ethernet port or disable it when not in use.
- Enhanced password management.
  The updated Password field on the User Accounts page now includes a built-in password strength indicator, automatic generation of secure passwords, and a handy button to quickly copy passwords to your clipboard.
- Improved dashboard information.
  The redesigned My Networks and Wi-Fi card on the System Dashboard provides clearer visibility and detailed statistics, helping you stay informed about your network status.
Security upgrade with advanced DDoS protection.
- Improved network security with automatic defence against connection table overflow attacks.
IPv6 enhancements (CLI).
- Configure dedicated DNS servers specifically for IPv6 subnets.
- IPv6 support for OpenConnect VPN client, including routing and addressing.
- Ability to bind IPv6 static routes to specific connection policies.
- Automatic NAT66 activation for global interface prefixes (/128).
Enhanced file transfer.
- Software-based FTP acceleration for faster transfers.
- Improved security and performance for SFTP through OpenSSL AES-GCM implementation.
Storage optimisation.
- TRIM support is now enabled by default for compatible external USB drives, ensuring optimal performance and drive longevity.
Expanded 4G modem support.
- Added compatibility for popular USB modem models including Telit FN990, ZTE MF833N, and Sierra MC7304.

We greatly appreciate your continued support and engagement. Your feedback helps us make Keenetic even better. For any questions, discussions, issue reporting, or contacting our development team, please visit our forum. Thank you for choosing Keenetic!

KeeneticOS 4.3.1

29/04/2025

New

Introduced the session-logout CLI command to terminate active VPN sessions across various servers (L2TP/IPsec, IKEv1/IPsec, IKEv2/IPsec, SSTP, PPTP, OpenConnect VPN ). [NDM-3788]
- crypto map l2tp-server session-logout {session} — Terminate {session} for L2TP/IPsec VPN server.
- crypto map virtual-ip session-logout {session} — Terminate {session} for IKEv1/IPsec VPN server and IKEv2/IPsec server.
- sstp-server session-logout {session} — Terminate {session} for SSTP VPN server.
- vpn-server session-logout {session} — Terminate {session} for PPTP VPN server.
- oc-server session-logout {session} — Terminate {session} for OpenConnect VPN server.

Improved

Fixed redundant exposure of device details in the Web Interface server, addressing vulnerabilities CVE-2024-4021 and CVE-2024-4022. [NDM-3783]
The improvements have been applied to the Web interface.
- Users without system accounts are now shown in the File Browser → Permissions for the selected folder popup. [NWI-3951]
- Alphabetically sorted the client list in Connection Policies → Policy Bindings for better navigation. [NWI-4092]
- Automatically adds an https:// prefix when copying URIs if the camouflage option is active in OpenConnect VPN server settings. [NWI-4146]
The SMB file and printer sharing component now supports extended attributes, ensuring accurate copying of files with extended metadata to network resources. [NDM-3645]
Added random padding to TLS packets for enhanced connection stability on OpenConnect and SSTP protocols. [NDM-3791]

Fixed

Resolved incorrect assignment of the Segment default policy (conform) for automatically registered clients in the home network segment. [NDM-3810]
Fixed an issue with incorrect crypto map configuration in the L2TP/IPsec VPN server during upgrades from OS 4.2.x to 4.3.x. [NDM-3811]
Addressed an issue where duplicate static routes were incorrectly assigned across multiple Connection Policies. [NDM-3814]
Corrected CLI saving issue for the dyndns nobind configuration option. [NDM-3816]
Fixed issues for clients accessing the local network over the OpenConnect VPN server. [NDM-3820]
Resolved various bugs and Web Interface layout issues affecting different screen resolutions. [NWI-4168, NWI-4161, NWI-3901, NWI-4108, NWI-3922, NWI-4083, NWI-4085, NWI-4122, NWI-4125, NWI-4136, NWI-4134, NWI-4135, NWI-4139, NWI-4141, NWI-4130, NWI-4169, NWI-4080, NWI-4160, NWI-4151]

KeeneticOS 4.3.0

10/04/2025

New

Improved

Fixed

The following fixes have been applied to the Web interface.
- Adjusted row heights in the Client Lists table to remove excess spacing. [NWI-4133]
- Corrected the appearance of the Read more button in knowledge base article lists. [NWI-4137]
- Fixed the colour of the separator line on the Network Ports card. [NWI-4145]
- Restored missing buttons in the confirmation popup dialogue within Fail Safe Configuration Mode. [NWI-4143]
- Improved text annotation spacing for better readability on mobile screens. [NWI-3872]
- Resolved selection issues with segments in the Traffic Monitor pie chart on mobile devices. [NWI-4079]
- Fixed a loading issue affecting the Applications page under certain conditions. [NWI-4104]
- Addressed several display issues on the Connection Policies page for mobile users. [NWI-4114]
- Corrected behaviour to retain the hidden state of the left-side navigation menu after closing and reopening the browser. [NWI-4120]
- Resolved visual and functional issues introduced by updated styling of control elements. [NWI-4140]
Resolved a client isolation issue that previously allowed multicast and broadcast traffic between isolated devices. [SYS-1329]

KeeneticOS 4.3 Beta 4

27/03/2025

Improved

Fixed

The following fixes have been applied to the Web interface.
- Resolved an issue where it was previously possible to create a user account for OPKG and Applications without setting a password. [NWI-3700]
- Fixed tooltip display issues affecting longer lists within the Mesh Wi-Fi System interface card. [NWI-4062]
Resolved connectivity issues affecting devices using Intel® AC9260 and AC9560 Wi-Fi adapters when connected via WPA3-PSK security mode. [SYS-1325]
Corrected multicast forwarding to IPTV ports when Internet and IPTV services have different VLAN configurations. [NDM-3767]
Resolved an issue affecting the application of static custom routes to remote VPN client networks on the L2TP/IPsec VPN server. [NDM-3758]
Fixed an issue with applying Wi-Fi Channel width settings under specific conditions in the Wi-Fi settings interface. [NDM-3764]
Resolved an error causing the message system failed [0xcffd00bd] to appear in the System log when saving IntelliQoS filtering profiles using the command line interface (CLI). [NDM-3770]
Prevented the error message Json::Object: AppendMember: duplicate key: 'fqdn' from appearing in the System log when using FQDN object groups. [NDM-3762]

KeeneticOS 4.3 Beta 3

13/03/2024

New

Improved

Fixed

Resolved an issue causing Wi-Fi connection instability and incorrect Connected status displayed for certain wireless devices when the Target Wake Time feature was enabled. [SYS-1266]
The following fixes have been applied to the Web interface.
- Fixed access to the Mesh Wi-Fi System page after adding a new extender. [NDM-3757]
- Corrected the displayed connection mode for the combined Ethernet/SFP port. [NWI-3319]
- Fixed an issue where PPPoE authentication settings were unnecessarily reset after choosing Automatic (DHCP) as the Internet connection type. [NWI-4065]
- Fixed the problem preventing reactivation of the Ethernet port once it had been disabled from the System Settings page. [NWI-4066]
Addressed a port conflict issue between WireGuard and OpenVPN connections when creating VPN tunnels. [NDM-3732]
Corrected the User-Agent header content when using the "anyconnect" protocol with OpenConnect VPN connections. [NDM-3733]
- interface {name} openconnect protocol anyconnect — enable anyconnect support for OpenConnect interface {name}
Fixed an issue causing WireGuard VPN connections to lose Advanced Security Configuration (ASC) settings after reconfiguration or reconnection. [SYS-1320]
Resolved remote connection problems with SSTP VPN Server when Web Interface access from the Internet was disabled. [NDM-3747]
Eliminated the duplicate key: group error logged in the System log when using FQDN object groups. [NDM-3755]
Fixed the erroneous log entry detected 5 attributes, only 4 supported when using the Application Classification feature on the IntelliQoS page. [NDM-3756]

KeeneticOS 4.3 Beta 2

27/02/2025

New

Improved

The improvements have been applied to the Web interface.
- The Password field on the User Accounts page now includes additional security features: password strength assessment, automatic secure password generation, and a button to copy the password to the clipboard. [NWI-4030]
- The left-side navigation menu (hamburger button) has been redesigned for a more compact and organised submenu structure. [NWI-3839]
- The Show signal levels button is now disabled when no mobile connection is detected. [NWI-4015]
Proxy Connections now reset their traffic counters after a manual restart. [NDM-3724]
Updated the OpenSSL library to version 3.3.3, addressing the CVE-2024-12797 and CVE-2024-13176 vulnerabilities. [SYS-1306]

Fixed

The following fixes have been applied to the Web interface.
- Removed unnecessary browser warnings about unsaved changes during a device OS update. [NWI-3944]
- Fixed an issue where the Wi-Fi toggle behaved incorrectly in the My Networks and Wi-Fi section of the System Dashboard. [NWI-4010]
- Restored the missing SIM card not inserted status on the System Dashboard page. [NWI-4016]
- Improved tooltip readability in the Application Traffic Analyser table. [NWI-4020]
- Resolved a bug where an unnecessary unset password warning was displayed. [NWI-4033]
- Fixed an issue causing a scroll bar to appear while dragging connections to adjust priority in the Policy Configuration list. [NWI-4044]
- Addressed an issue where the Web Interface page would unexpectedly reload after a system update. [NWI-4047]
Resolved compatibility issues with GPON SFP modules using the RTL9601D chipset. [SYS-1313]
Fixed an issue with web cookie handling that caused the Core::Scgi::Tools: bad request: no session error during authentication in the Web Interface. [NDM-3713]
Restored missing static DNS records for KeenDNS subdomains when the ip http proxy dns-override setting is enabled. [NDM-3718]

KeeneticOS 4.3 Beta 1

12/02/2025

New

Added a Port assignment option to the Wi-Fi System page to assign a network segment to the Extender's Ethernet port or to turn the port off. [NWI-3571]
Added support for Object Groups with automatic Fully Qualified Domain Name (FQDN) name resolution. [NDM-3692]
- object-group fqdn {name} — Creates an FQDN object group.
- object-group fqdn {name} include {address} — Adds an address to the group.
A new CLI command to view the internal system name of the network interface is now available with the OPKG component. [NDM-3694]
- show interface {name} system-name — Displays the system name for the specified interface.

The new settings for SFP+ and combo port operation modes are now available. [NDM-3181]
- interface {name} media-type {type} — set the combo port media type:
  - auto — prefer SFP with auto-failover to RJ45 (default)
  - mdi — enforce media type to RJ45
  - sfp — enforce media type to SFP
- interface {name} sfp pcs {mode} — set the SFP media Physical Coding Sublayer (PCS) mode:
  - auto — autodetect from Digital Diagnostic Monitoring Interface (DDMI) (default)
  - fallback — sequentially try SGMII and fixed baseband modes until one works
  - sgmii/an — SGMII-supported speeds of 10/100/1000 Mbps with auto-negotiation enabled
  - 1000base-x/an — fixed 1 Gbps baseband with IEEE802.3 Clause 37 auto-negotiation enabled
  - 1000base-x — fixed 1 Gbps baseband
  - 2500base-x/an — fixed 2.5 Gbps baseband with IEEE802.3 Clause 37 auto-negotiation enabled
  - 2500base-x — fixed 2.5 Gbps baseband
- interface {name} sfp rx-los {mode} — set SFP RX_LOS reception mode:
  - auto — autodetect from Digital Diagnostic Monitoring Interface (DDMI) (default)
  - accept — accept RX_LOS signal
  - ignore — ignore RX_LOS signal
- interface {name} sfp init-timeout (auto | {timeout}) — set the SFP module initialization timeout in seconds.
  - auto — use the system-defined default timeout of ... seconds
Added support for USB Attached SCSI Protocol (UASP) to improve the performance of compatible external USB drives. [SYS-1290]
To use UASP, enable it in the command line interface with the following commands:
```
system set dev.usb.allow_uas 1
system configuration save
```
Added support for the Sierra MC7304 LTE Cat 3 USB modem (UsbQmi type). [NDM-3684]

The new accept-routes option allows the OpenConnect VPN client to obtain route and IPv6 address configuration from the remote OpenConnect VPN server. [NDM-3539]
- interface {name} openconnect accept-routes — enable obtaining IP routes for OpenConnect interface {name}
The new OpenConnect VPN server option enables static route forwarding to be sent to the connected VPN clients. [NDM-3540]
- oc-server route {address} {mask} — set a static route with {address} {mask} for OpenConnect VPN server
The new OpenConnect VPN client option allows turning off the DTLS (Datagram Transport Layer Security) feature via the command line interface. [NDM-3541]
- interface {name} openconnect no dtls — disable DTLS for OpenConnect interface {name}

The new option for interface-specific DHCP relay agents is now accessible from the command line interface (CLI). [NDM-3401]
- interface {name} ip dhcp relay enable — enable DHCP relay on an interface.
- interface {name} ip dhcp relay upstream server {address} — specify an upstream DHCP server.
- interface {name} ip dhcp relay upstream interface {interface} — bind DHCP upstream to a specific interface (optional).
Implemented a new connect method of the KeenDNS proxy service for web applications, allowing remote access to the OpenVPN server using a KeenDNS name. [NDM-3497]
- ip http proxy {name} upstream (http | https | connect) {upstream} [port] — set connect method for KeenDNS proxy {name}
The new IPv4 and IPv6 static route settings for binding to specified connection policies have been implemented. [NDM-3435]
- ip policy {name} route ( {network} {mask} | {host} ) ( {gateway} [interface] | {interface}) [auto] [metric] [reject]
- ip policy {name} ipv6 route {prefix} ( {interface} [gateway] | {gateway} ) [auto] [metric] [reject]
Enhanced security: Implementation of DDoS protection against connection table overflow. [NDM-3362]
- ip conntrack max-entries {max-entries} — set conntrack table size.
- ip conntrack lockout disable — disable conntrack table protection (enabled by default).
- ip conntrack lockout threshold public {public} — set maximum number of connections from public interfaces (percentage of the conntrack table size, from 50 to 99, default value: 80).
- ip conntrack lockout duration {duration} — set lockout duration in seconds (from 60 to 3600, default value: 600).
- ip conntrack sweep threshold {threshold} — set threshold to start cleaning up waiting sessions (percentage of the conntrack table size, from 50 to 99, default value: 70).
- show ip conntrack lockout — view lockout status.
The Download Station component now supports the setting of background priority for disk I/O operations via the command line interface (CLI). [NDM-3436]
- torrent io-priority low — enable low priority for disk I/O operations.

Improved

Fixed

Fixed an issue with mounting HFS+ formatted USB drives larger than 6TB. [SYS-1143]
The following fixes have been applied to the Web interface.
- Fixed an issue where changing the SSID sets the Fast Transition (802.11r) to Disabled. [NWI-3900]
- Corrected the description for the OpkgLedControlX handler on devices with two Function (FN) LEDs. [NWI-3997]
- Fixed incorrect display of manually configured HTTPS ports in KeenDNS links. [NWI-4027]
- Fixed background color issues in the Web CLI when using the show threads command. [NWI-4052]
- Corrected behaviour after disabling the Fail-Safe Configuration Mode under specific conditions. [NWI-4035]

The following fixes have been applied to the Web interface.
- The Mobile settings page now accurately notifies users when there are unsaved changes. [NWI-3999]
- Improved command auto-completion in the Web CLI for commands starting with ‘no’. [NWI-4022]
Resolved an issue with the OpenVPN connection inability to locate an endpoint using IPv4 DNS queries while IPv6 is on. [NDM-3640]
Fixed an issue where allowed transit DNS queries in the System profile were not being forwarded correctly. [NDM-3651]
Fixed an issue where the Extender’s wireless backhaul link would fail to reconnect to the Wi-Fi system node with the best signal (RSSI) while using WPA3 security. [SYS-1281]
Fixed the initialization of DNS-over-TLS and DNS-over-HTTPS server configurations when using static DNS servers for inactive connections. [NDM-3681]

KeeneticOS 4.3

KeeneticOS release notes for Keenetic Hero (KN-1012) in the Preview Channel

What’s new?

KeeneticOS 4.3.1

New

Improved

Fixed

KeeneticOS 4.3.0

New

Improved

Fixed

KeeneticOS 4.3 Beta 4

Improved

Fixed

KeeneticOS 4.3 Beta 3

New

Tip

Improved

Fixed

KeeneticOS 4.3 Beta 2

New

Improved

Fixed

KeeneticOS 4.3 Beta 1

New

Improved

Fixed

Search results

KeeneticOS updates — Preview Channel

KeeneticOS 4.3

KeeneticOS release notes for Keenetic Hero (KN-1012) in the Preview Channel

What’s new?

KeeneticOS 4.3.1

New

Improved

Fixed

KeeneticOS 4.3.0

New

Improved

Fixed

KeeneticOS 4.3 Beta 4

Improved

Fixed

KeeneticOS 4.3 Beta 3

New

Tip

Improved

Fixed

KeeneticOS 4.3 Beta 2

New

Improved

Fixed

KeeneticOS 4.3 Beta 1

New

Improved

Fixed

Search results