KeeneticOS 5.0

KeeneticOS release notes for Keenetic Hopper (KN-3811) in the Preview Channel

KeeneticOS releases in this channel provide the chance to be among the first to try the latest updates, performance improvements and new features, all with minimal risk. It is updated roughly every two weeks, with major updates about every two months. Releases here are typically more than a month in advance of release to the general audience in the Main Channel.

Keenetic Hopper (KN-3811) is currently in the Standard Updates support period and receives regular software updates, including security enhancements, new features, operating system updates, and bug fixes.

KeeneticOS 5.0 Beta 1

11/09/2025

New

Further improvements to the Mesh Wi-Fi System allow an Extender’s built-in 4G/3G modem to be used as the primary or a backup Internet connection. When a compatible Extender is detected, the Controller automatically creates a dedicated MwsMobile interface and manages the connection like any other, including its use in Connection Policies. SMS and USSD modem options are available directly in the Extender’s Web Interface, which can be opened via a link on the Controller’s Wi-Fi System page. [NDM-4027]
The Port Forwarding page now supports IPv6 Pinholing, letting you open TCP and UDP ports to provide external access from the Internet to devices on your home network that use IPv6 addresses. [NWI-4213]
Added support for the Virtual Router Redundancy Protocol (VRRP) v2 and v3, configurable via the command line interface (CLI). This enables redundant routing across multiple routers. To use it, install the VRRP support system component. [SYS-1443]
- interface {name} vrrp group {group} ip {ip} — set virtual IP address for the group;
- interface {name} vrrp group {group} priority {priority} — set priority (integer in the range 0 to 255), the device with the numerically highest priority becomes the master in the group;
- interface {name} vrrp group {group} advertise {advertise} — set advertisement interval in seconds (integer in the range 1 to 255, the default is 1);
- interface {name} vrrp version {version} — set protocol version, supported values:
  - default — use version 2 for IPv4 and version 3 for IPv6;
  - v2 — strict compliance to VRRP version 2:
    zero VIPs are not allowed;
    unicast peers are not allowed;
    IPv6 addresses are not allowed;
    state MASTER can be configured strictly when priority is 255;
  - v3 — compliance to VRRP version 3 for both IPv4 and IPv6;
  - v3-compat — VRRPv3 compatibility mode for interoperability with implementations (such as Cisco and Juniper) that treat RFC 5798 §5.2.8 as applying only to IPv6. When enabled, the router includes the IPv4 pseudo-header but omits it from the IPv4 checksum calculation;
- show interface {name} vrrp — display the VRRP status.

The Internet Safety page now features an Application Filter tab with controls to block traffic from specific applications and categories for individual clients or entire network segments. To use this feature, you must install the Traffic classification engine system component and enable the Application Classification option on the IntelliQoS page. [NWI-4232]
The new WireGuard VPN Server application makes it easier to set up various remote connection scenarios. It enables quick installation on client devices, providing secure access to any part of your network. [NWI-4206]
Implemented UPnP IGDv2 PCP support for the IPv6 protocol. [NDM-3859]
Added a new Manager user role featuring limited administrative rights for ISP deployment scenarios. [NDM-3945]

The iperf3 system component now includes server mode functionality, enabling users to test the bandwidth between nodes on their home network. However, test speeds may be limited by the performance of certain device models. [NDM-3786]
- iperf3 interface {interface} — bind to a specific interface (default: bind to all interfaces according to the security level);
- iperf3 port {port} — set port (default: 5201);
- iperf3 security-level (public | protected | private) — set security level (default: private);
- service iperf3 — run the server.
Implemented a virtual Dummy network interface for ISP-managed routing applications, simulations, testing, and other uses. [NDM-3958]
- interface Dummy0 — create Dummy0 interface.
The new Duny service is now available for the Dynamic DNS (DDNS) client system component. [NDM-3959]

The new iperf3 system component has been implemented, enabling the measurement of bandwidth of a specified network connection via the command line interface (CLI). However, test speeds may be constrained by the performance of specific router models. [NDM-3785]
- tools iperf3 {host} [ipv4 | ipv6] [tcp | udp] [port {port}] [bitrate {bitrate}] [time {time} | bytes {bytes}] [source-interface {source-interface}]
Example command: tools iperf3 ping.online.net port 5202 time 10
Support for the Local Profile Assistant (LPA) and embedded Subscriber Identification Module (eSIM) has been added to the UsbLte and UsbQmi modem interfaces via the command line (CLI). The eSIM chip can be built into the 5G/4G modem or accessed via an external eSIM adapter. [NDM-3850]
- show interface {name} esim — get eSIM status (incl. EID),
- interface {name} esim profile download {qrcode} — download eSIM profiles,
- interface {name} esim profile list — list eSIM profiles,
- interface {name} esim profile activate {iccid} — activate eSIM profile,
- interface {name} esim profile deactivate {iccid} — deactivate eSIM profile,
- interface {name} esim profile delete {iccid} — delete eSIM profile,
- interface {name} esim profile rename {iccid} {newname} — rename eSIM profile.

Implemented the DD-WRT-compatible obfuscation key usage for WireGuard connections via the command line interface (CLI). [NDM-3883]
- interface {name} wireguard obfs-key {obfs-key} — Set an obfuscation key {obfs-key} for WireGuard connection {name}.
Implemented support for specifying a domain name (FQDN) in the IKEv2/IPsec VPN Server certificate via the command-line interface (CLI). [NDM-3884]
- crypto ipsec profile VirtualIPServerIKE2 identity-local fqdn {fqdn} — Set {fqdn} certificate for use in the IKEv2/IPsec VPN Server.
- crypto ipsec profile VirtualIPServerIKE2 identity-local fqdn ndns — Set the default KeenDNS certificate in the IKEv2/IPsec VPN Server.

We are broadening our endorsement programme for Internet Operators by introducing support for the TR‑098 data model under the CPE WAN Management Protocol (CWMP). The feature is available on request. Contact our support (destek@keenetic.com.tr) for further details. [NDM-3870]
Implemented CLI commands to configure static IPv6 address and port translation rules, enhancing IPv6 NAT management via the command line. See the Command Reference Guide for full syntax. [NDM-3819]
- ipv6 static [protocol] ({interface} {mac} | {mac}) [{port} [through {end-port}] ] — defines a translation rule;
- ipv6 static rule {index} (disable | schedule {schedule}) — disables a rule or limits its operation by schedule.
Implemented detection and integration of OpkgTun and OpkgTap interfaces created within the OPKG environment, enabling their use in Connection Policies and static routes. [NDM-3846]

Improved

The client part of the iperf3 system component has been extended to support the reverse and streams arguments, enabling download bandwidth testing and the use of parallel network streams. [NDM-3963]
- tools iperf3 {host} [ipv4 | ipv6] [tcp | udp] [reverse] [port {port}] [bitrate {bitrate}] [streams {streams}] [time {time} | bytes {bytes}] [source-interface {source-interface}];
Example command: tools iperf3 ping.online.net reverse port 5202 streams 2 time 5.
Moved the acq, apn, and wwan-force-connected command-line configuration commands from the usb sub-tree to the mobile sub-tree; see details below. [NDM-3950]
- Deprecated interface {name} usb acq → current interface {name} mobile acq;
- Deprecated interface {name} usb apn → current interface {name} mobile apn;
- Deprecated interface {name} usb wwan-force-connected → current interface {name} mobile force-connected.
Implemented user:password@ authentication credentials support for URLs in the opkg disk CLI command. [NDM-3960]
- Example command: opkg disk storage:/ https://user:password@router.keenetic.pro/webdav/mipsel-installer.tar.gz.

Implemented batch removal of User-Defined Routes per interface through the command line (CLI), allowing the destination arguments {network} {mask} | {host} to be optional. [NDM-3911]
- no ip route [{network} {mask} | {host} | default] [{gateway} | {interface}] [metric] — Deletes IPv4 routes.
- no ipv6 route [{prefix} | default] ({interface} [{gateway}] | {gateway}) — Deletes IPv6 routes.
- no ip policy {name} route [{network} {mask} | {host}] [{interface} | {gateway}] [ {metric}] — Deletes IPv4 routes in policy {name}.
- no ip policy {name} ipv6 route [{prefix} | default] ({interface} [{gateway}] | {gateway}) — Deletes IPv6 routes in policy {name}.
Example command: no ip route ISP — Deletes all IPv4 static routes from the ISP interface.
The following improvements have been applied to the Web Interface.
- Enabled the use of VLAN 0 for Ethernet cable connections, improving compatibility with certain Internet service providers. [NWI-4315]
- Added a new Automatic theme option that adapts to the system’s light or dark colour scheme preferences for a seamless user experience. [NWI-4242]
Implemented support for configuring the WireGuard Peer obfuscation key in WireGuard connections via the command line interface (CLI). [NDM-3917]
- interface {name} wireguard peer obfs-key {obfs-key} — Set an obfuscation key {obfs-key} for WireGuard Peer connection {name}.
Enabled mDNS announcements for the Web Interface (HTTP) service, making it discoverable in the Home segment. [NDM-3919]

Fixed

The following fixes have been applied to the Web Interface.
- Fixed the display of the drop-down list on the Internet Safety page. [NWI-4306]
- Fixed an issue where the Save button for a Modify TTL value on the Mobile connection settings page did not appear correctly. [NWI-4322]
Fixed an issue where user-defined static DNS records (ip host) lost priority over dynamically obtained records after the device restarted. [NDM-3947]
Fixed the address resolution issue that occurred during dynamic reconfiguration in OpenConnect, Proxy, and ZeroTier VPN connections when the server address is specified as an URL. [NDM-3951]
Fixed the incorrect behaviour of the DDNS service when using IPv4 and IPv6 addressing simultaneously or relying solely on the IPv6 protocol. [NDM-3952]
Fixed the incorrect saving of the no system log reduction CLI command to the running configuration. [NDM-3953]
Resolved an issue where clients of IKEv1/IPsec VPN and IKEv2/IPsec VPN servers did not receive static routes correctly. [NDM-3954]

In this section:

KeeneticOS updates — Preview Channel

KeeneticOS 5.0

KeeneticOS release notes for Keenetic Hopper (KN-3811) in the Preview Channel

KeeneticOS 5.0 Beta 1

New

Improved

Fixed

Search results