Release Asuswrt-Merlin 3006.102.4 is now available

[RMerlin]

Asuswrt-Merlin 3006.102.4 is now available. There are a number of significant things to note with this release:

1) BCM4912 models are now migrated to this 3006 code base. This includes the following device list:

• GT-AX6000
• zenWifi Pro XT12
• GT-AX11000 Pro
• GT-AXE16000
• RT-AX86U Pro
• RT-AX88U Pro

2) New addition - the RT-BE92U is now supported.

3) Beside the addition of new models, the focus of this release is the merge of GPL code (I currently need to manage three separate GPL versions for this release.....), updated components, and a number of fixes.

Please make sure you read the Changelog.

3006.102.x (10-May-2025)
  - NOTE: If migrating from a 3004 firmware, only the first Guest
          Network will be migrated - any additionnal GN must be
          manually reconfigured.
  - NOTE: If migrating from a 3004 firmware, the Wireless Scheduler
          will need to be manually reconfigured if you were using
          it.
  - NOTE: As a reminder, the ROG variant of the webui is not
          supported in the 3006 firmware series, as maintaining
          two separate interfaces is too much extra work.
  - NOTE: Due to numerous webui changes, it's recommended to
          force refresh the page after first login, or clear
          your browser cache.

  - NEW: Moved RT-AX86U_PRO, RT-AX88U_PRO, ZenWifi Pro XT12,
         GT-AX6000, GT-AXE16000 and GT-AX11000_PRO to the
         3006 firmware series.
  - NEW: Added RT-BE92U support, based on GPL 102_37526.
  - NEW: Added Control-D servers to DNS-over-TLS
         presets (dave14305)
  - UPDATED: Merged GPL 3006.102_36521 for Wifi 6 models (Wifi 7
             devices other than the RT-BE92U are still on
             102_37346).
  - UPDATED: OpenVPN to 2.6.14.
  - UPDATED: miniupnpd to 2.3.8.
  - UPDATED: amtm to 5.2 (decoderman)
  - UPDATED: dnsmasq to 2.91.
  - UPDATED: dropbear to 2025.87.
  - CHANGED: Setting DNS Director to "Router" will now always
             redirect to the router's own IP.  Previously it
             would redirect to the first DNS server configured
             on the DHCP page (which defaults to the router
             itself).
             If you need DNS Director to redirect to an IP
             configured in your DHCP settings, use a Custom DNS
             entry in DNS Director.  This makes it more consistant
             with what the name implies, and was also necessary
             for improved Guest Network support.
  - CHANGED: Tools category renamed System Info.
  - CHANGED: Tools -> Other Settings were moved to new tabs
             (Administration -> Tweaks, and
             Traffic Analyzer -> Settings).
  - CHANGED: Moved "Redirect to asusrouter.com " to the new
             Tweaks tab, and moved "Enable JFFS Custom Scripts"
             to the Basic Config section on the System page.
  - FIXED: Missing hostname on Wireless Log for MLO-capable Wifi 7
           clients.
  - FIXED: CVE-2024-9143 in OpenSSL (Debian backport by RSDNTWK)
  - FIXED: CVE-2024-13176 in OpenSSL (Ubuntu backport by RSDNTWK)
  - FIXED: Guest Networks on an isolated VLAN with DNS Director set
           to "Router" would fail to do any name resolution (both
           for whole network and for specific clients).
  - FIXED: Wrong tab selected when clicking on "Profile" on the
           VLAN page (dave14305)
  - FIXED: Missing button to remove entries in the Offline Client
           List (dave14305)
  - FIXED: CVE-2025-2492 in AiCloud (backport from upstream)
  - FIXED: DoT access wasn't properly blocked when appropriate
           for Guest Networks.
  - FIXED: DNS-over-TLS presets overwritten by Asus' own (dave14305)
  - FIXED: Networkmap system status frame failing to load when
           accessing the router with some particular hostnames.
  - FIXED: Missing option to disable logging of DHCP/RA queries.

Discussions in this thread should be limited to this specific release. This thread may get locked once the release discussion has quieted down.


Downloads are here.
Changelog is here.

 

[RMerlin]

Reserved post.

 

[alan6854321]

Hi there,
I don't see the SHA256 signature for AX88u_Pro / 3006 under the 'latest releases'
Is this OK?

 

[dave14305]

quiet-ra is already added to dnsmasq.conf when RAs are enabled. If I hide DHCP logging, I end up with quiet-ra twice. No harm since dnsmasq doesn't throw a fit if this option is duplicated, but not sure this change was necessary.

ra-param=br0,10,600
enable-ra
quiet-ra
...
quiet-dhcp
quiet-dhcp6
quiet-ra

 

[RMerlin]

quiet-ra is already added to dnsmasq.conf when RAs are enabled. If I hide DHCP logging, I end up with quiet-ra twice. No harm since dnsmasq doesn't throw a fit if this option is duplicated, but not sure this change was necessary.

ra-param=br0,10,600
enable-ra
quiet-ra
...
quiet-dhcp
quiet-dhcp6
quiet-ra

That was requested by another user, I thought it weird that I hadn't done it initially. That would be why.

Hi there,
I don't see the SHA256 signature for AX88u_Pro / 3006 under the 'latest releases'
Is this OK?

Caching issue. It was missing in the original file, I reuploaded it afterward. It will eventually show up.

 

[bennor]

Hi there,
I don't see the SHA256 signature for AX88u_Pro / 3006 under the 'latest releases'
Is this OK?

See the download page...

Download | Asuswrt-Merlin

www.asuswrt-merlin.net

b6367400a2e86136ae27a0dd3deb0b138d6ff2fd040615677a29486c7654cd55 RT-AX88U_PRO_3006_102.4_0_nand_squashfs.pkgtb

And check the zip firmware file for the sha256sum.sha256 file.

 

[dave14305]

That was requested by another user, I thought it weird that I hadn't done it initially. That would be why.

Using my Monday morning quarterback's 20/20 hindsight, the red flag was, "Not using IPv6/RA, so can't try myself."

Beta - Asuswrt-Merlin 3006.102.4 Beta is now available

I can't - only Asus can implement that. Thank you for the prompt answer @RMerlin !!! Really a shame that Asus gave up fixing VLAN for those expensive XT12...

www.snbforums.com

 

[Ev0]

Upgrade from beta3 to release all good on my BE92U

 

[Analog-1]

Impressive change log. Thanks !!

 

[MDM]

No problem spotted while upgrading from Beta, all seems fine and fixed!
Thanks RMerlin!!

 

[jerry6]

all working well on my GT1100pro Thanks for the quick updates . At this rate I'll never get 600 days uptime with no interuptions

 

[dave14305]

That was requested by another user

This might only be needed in sdn.c since Asus doesn't insert quiet-ra when enable-ra is set there.

 

[sl4fko]

Going to upgrade my GT-AX6000 from 388.8_4 to 3006.102.4.

Is it necessary or at least recommended to hard reset a router after upgrading?

 

[bennor]

Going to upgrade my GT-AX6000 from 388.8_4 to 3006.102.4.

Is it necessary or at least recommended to hard reset a router after upgrading?

Everyone will have their own opinions. I did a hard factory reset when upgrading from 3004.388.4 to 3006.102.4 Beta firmware on a RT-AX86U Pro. Then did a manual configuration (did not import a saved router.cfg file). Did it this way primarily due to the differences between the two firmware tracks. YMMV

 

[heysoundude]

Updated 10m ago.
Might be that I'm the only one home at the moment, but things seem particularly snappy.

 

[RMerlin]

This might only be needed in sdn.c since Asus doesn't insert quiet-ra when enable-ra is set there.

Shouldn't be necessary for now tho, Asus hasn't implemented IPv6 support yet to SDN (AFAIK).

 

[ColDen]

Going to upgrade my GT-AX6000 from 388.8_4 to 3006.102.4.

Is it necessary or at least recommended to hard reset a router after upgrading?

I have performed a dirty upgrat (also from 388.8_4 to 3006.102.4) almost 4 hours ago and the only issues were with 2 addons (was already aware about connmon and unbound with 3006), fixed connmon with version 3.0.3 from develop but still have to figured out about updating unbound with the develop version (unbound Manager: Functional on 3006 (with the develop branch for the WebUI only!)).

 

[FernandoF]

@dave14305, thank you for adding the free Control-D servers to the DoT drop-down list! I may have a contribution here, though. Unlike the committed "Control D (Network Security)" settings, according to these instructions from Control-D, the IP Addresses for their DoT servers should be:

Primary endpoints for Secure DNS protocols (DoH, DOT, Doq) are:

freedns.controld.com
76.76.2.11
76.76.10.11
2606:1a40::11
2606:1a40:1::11

On the other hand, somewhat contrasting to what is seen above, the following screenshot from this page indicates that your original p1.freedns.controld.com TLS Hostname seems to be correct:

I could not find any alternative references to the "Control D (Privacy Protection)" servers, so I presume we are good with your original settings.

I hope this helps!

 

[ExtremeFiretop]

but still have figured out about updating unbound with the develop version (unbound Manager: Functional on 3006 (with the develop branch for the WebUI only!)).

curl --retry 3 "https://raw.githubusercontent.com/juched78/Unbound-Asuswrt-Merlin/refs/heads/develop/unboundstats_www.asp" -o "/jffs/addons/unbound/unboundstats_www.asp" && chmod 755 "/jffs/addons/unbound/unboundstats_www.asp"

To mention, that replaces the file, but you will still need to reboot the router to mount the new Webpage
(Since it's not being done by the scripts update process it won't unmount and replace automatically)

But replacing that file and then rebooting should do the trick.

 

[ColDen]

curl --retry 3 "https://raw.githubusercontent.com/juched78/Unbound-Asuswrt-Merlin/refs/heads/develop/unboundstats_www.asp" -o "/jffs/addons/unbound/unboundstats_www.asp" && chmod 755 "/jffs/addons/unbound/unboundstats_www.asp"

To mention, that replaces the file, but you will still need to reboot the router to mount the new Webpage
(Since it's not being done by the scripts update process it won't unmount and replace automatically)

But replacing that file and then rebooting should do the trick.

Thanks @ExtremeFiretop for the provided code. I have run it but will reboot the router later tonight (the boss will not very happy since everything is on the router's wifi here).