Beta Asuswrt-Merlin 3006.102.7 Beta is now available

[RMerlin]

Asuswrt-Merlin 3006.102.7 Beta 1 is now available for supported models. The focus of this release is the removal of AiCloud (for security reasons), components upgrade, and a GPL update for the GT-BE19000AI (as its initial release was based on a fairly early GPL version).

Changes since 3006.102.6:

3006.102.7 (xx-xxx-2026)
  - NOTE: AiCloud has been removed from Asuswrt-Merlin due
          to its poor security track record.  This also includes
          cloud syncing features such as Asuswebstorage or
          Dropbox syncing with USB folder.  Use a VPN if you
          need secure remote access to your data.

  - UPDATED: Merged GPL 102_40399 (GT-BE19000AI only)
  - UPDATED: OpenVPN to 2.6.19.
  - UPDATED: Dropbear to 2025.89.
  - UPDATED: nettle to 3.10.2.
  - UPDATED: dnsmasq to 2.93-test2 (includes a couple of DNSSEC
             fixes over 2.92)
  - UPDATED: openssl-3.0 to 3.0.19 (GT-BE19000AI only)
  - UPDATED: tor to 0.4.8.22.
  - CHANGED: Added new 2024 DNSSEC trust anchor, which will
             start being used in October 2026.
  - FIXED: IPv6 blocking of DoT servers (dave14305)
  - FIXED: Multiple minor CVE for OpenSSL 1.1: CVE-2025-68160,
           CVE-2025-69418, CVE-2025-69419, CVE-2025-69420,
           CVE-2025-69421, CVE-2026-22795 and CVE-2026-22796
           (backports by RSDNTWK)
  - FIXED: Missing UPnP settings on models with multiservice
           WAN support.
  - FIXED: ntpd options missing when operating in WISP mode.
  - REMOVED: AiCloud support, due to security reasons.

Please keep discussions on this specific beta release.


Downloads are here.
Changelog is here.

 

[RMerlin]

Reserved post.

 

[Clark Griswald]

Dirty from RMerlin's last final with zero issues experienced, as usual!

 

[John Adler]

Dirty flash over alpha 2
all works fine
thxs Merlin

 

[MDM]

Straight from Alpha 2, no issues to note; DNSSEC working great.

 

[Aarlin303]

From alpha 1, all good on my BE96U

 

[cc666]

From Alpha 2 no problems. GT-BE98PRO

CC

 

[Untried3868]

Dirty upgrade from alpha 2. No issues.

 

[CJ-V300]

WAN bridging fails on boot if Radios are disabled

Hi folks,

Running the latest 3006.102.7_beta1 on both my RT-BE88U (Main Router) and RT-BE92U (AP Mode).

Just to give some context: I bought these two units just 4 days ago, so this is a fresh setup. I jumped straight into Alpha 2 and updated to the new Beta 1 today, so I haven't tested this on stock firmware or previous stable builds.

I've ran into a weird quirk with the BE88U regarding the radios. Since my main router is inside a metal cabinet, I have disabled both radios (2.4GHz and 5GHz set to "Enable Radio: No" in Wireless > Professional). My Wifi is handled entirely by the BE92U (connected via 10G wired backhaul).

The issue:When the BE88U reboots, the LAN comes up, and my wifi clients on the BE92U can access the Router's WebUI perfectly fine (so internal routing is working). However, they have no Internet access.

• Ping from BE88U (Network Tools) to 8.8.8.8 -> OK
• Ping from any LAN client to 8.8.8.8 -> Fails

It looks like the internal bridge or WAN forwarding rules aren't fully initializing during boot if the system detects that the radios are logically "Off".

The Workaround:If I go to Wireless > Professional and just hit "Apply" (or change any dummy setting), the router restarts the wireless service, and internet connectivity flows to the LAN clients instantly.

For now, I’ve "fixed" it by adding a simple script to /jffs/scripts/services-start that sleeps for 90s and runs service restart_wireless. This brings the connection up automatically on every boot.

Just wanted to flag this in case anyone else with a "Wired-only" BE88U is seeing the same behavior on this codebase.

Cheers!

 

[Howard_inGA]

Dirty upgrade from A2. No hitches to report...

 

[KevinGlynn]

Dirty upgrade from alpha 2.
No issues so far on BE86u.

 

[casao94]

Dirty upgrade from alpha2 on RT-BE96U. No issue so far.

 

[joec]

Dirty upgrade on by BE58_go from alpha 2 to beta1. The two options, "Enable local NTP server" and "Intercept NTP client requests" are available in both Router and WISP modes.

I can not update the "Trend Micro's Signature version" in either mode. I see the following two messages during the attempts before it fails.
Signature checking ...
Signature is updating ...

When I use the OEM firmware, it does update from version 1.100 to 1.149.

Thank you Merlin for all your hard work.

 

[Crazy]

Is there any guides to setup vpn to access the router when i'm away from home? Thanks.