What's new
By:

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

[Beta] Asuswrt-Merlin 384.14 Beta is now available

Status
Not open for further replies.
We'll probably have to forget about the new RT-AX88U SDK in 384.14. Adaptive QoS does look broken with the new SDK. First reply from Asus was that it seemed to be fine on their end, so I sent them more test results. Hopefully they can eventually track it down.

I might publish a separate test build on Onedrive (with the fixed System page among other things) for those who don't care about Adaptive QoS but want the OFDMA/WPA3 support, but an official release will have to wait until a fix is available.
 
RMerlin said:
We'll probably have to forget about the new RT-AX88U SDK in 384.14. Adaptive QoS does look broken with the new SDK. First reply from Asus was that it seemed to be fine on their end, so I sent them more test results. Hopefully they can eventually track it down.

I might publish a separate test build on Onedrive (with the fixed System page among other things) for those who don't care about Adaptive QoS but want the OFDMA/WPA3 support, but an official release will have to wait until a fix is available.
Click to expand...

Great news, really appreciated. (I for one, don’t use Qos).
 
Last edited:
Frankflash said:
sloppy from Asus they are a bit like micosoft fix things and brake things along the way
Click to expand...

In this case, it's not something that's easy to catch. The bug was most likely introduced with the new Broadcom SDK, not in Asus's own code. Could be an incompatibility issue, or could be that Trend Micro might need to recompile their engine against the new SDK... Hard to tell.

The only reason why we picked it up is because my firmware exposes some low-level stats through the Classification page, making it more visible.
 
RMerlin said:
In this case, it's not something that's easy to catch. The bug was most likely introduced with the new Broadcom SDK, not in Asus's own code. Could be an incompatibility issue, or could be that Trend Micro might need to recompile their engine against the new SDK... Hard to tell.

The only reason why we picked it up is because my firmware exposes some low-level stats through the Classification page, making it more visible.
Click to expand...
I have pin pointed a flaw in stubby as i was using the stubby dnssec with the stubby.yml.add, but with the new firmware update to beta2 for RT-AC5300, it breaks the IPV6, so i switched to just using dnsmasq dnssec and the IPV6 connection issue goes away, Has anything changed recently with directories related to stubby?
 
RMerlin said:
I might publish a separate test build on Onedrive (with the fixed System page among other things) for those who don't care about Adaptive QoS but want the OFDMA/WPA3 support, but an official release will have to wait until a fix is available.
Click to expand...

Thanks a lot Eric for all your efforts to keep this firmware as in sync as possible with the latest official code. Count on my feedback for that separate build also, since I am in that boat also (not using QoS).
 
Eric, it would be great if you could post separate build as you mentioned. I have symmetrical gigabit and really don't need QOS.

I was just loud thinking since router security assessment is powered by Trend Micro and it is broken when wpa3 and wpa2 is used together. It may be possible that section is also affecting adaptive QOS, requiring Trend Micro to recompile for new SDK.
 
I noticed some new... interesting IPTables entries.

Code: 
Chain OUTPUT (policy ACCEPT 7180 packets, 6572K bytes)
 pkts bytes target     prot opt in     out     source               destination
 4169  326K OUTPUT_DNS  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 u32 "0x0>>0x16&0x3c@0x8>>0xf&0x1=0x0"
   14  1611 OUTPUT_DNS  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x8>>0xf&0x1=0x0"
43393   20M OUTPUT_IP  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT_DNS (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|10706f697579747975696f706b6a666e6603636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0d72666a656a6e666a6e65666a6503636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|1131306166646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f376d667364666173646d6b676d726b03636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0d386d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f3966646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|1265666274686d6f6975796b6d6b6a6b6a677403636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|086861636b7563647403636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|076c696e77756469056633333232036e657400|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f6c6b6a68676664736174727975696f03636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0b6d6e627663787a7a7a313203636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|077131313133333303746f7000|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|057371353230056633333232036e657400|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|077563746b6f6e6503636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0e7a786376626d6e6e666a6a66777103636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0a65756d6d6167766e627003636f6d00|" ALGO name bm TO 65535 ICASE


Chain OUTPUT_IP (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            193.201.224.0/24

Chain default_block (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain logdrop_dns (16 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 7 level 4 prefix "DROP_DNS "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop_ip (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 7 level 4 prefix "DROP_IP "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

I wonder what Asus is planning (an improvement with built-in DNS/IP blocking?), also strange why only one random IP range from Ukraine is blocked by default linked to some "DDoSMan" malware.

https://otx.alienvault.com/indicator/ip/193.201.224.0
 
Swistheater said:
I have pin pointed a flaw in stubby as i was using the stubby dnssec with the stubby.yml.add, but with the new firmware update to beta2 for RT-AC5300, it breaks the IPV6, so i switched to just using dnsmasq dnssec and the IPV6 connection issue goes away, Has anything changed recently with directories related to stubby?
Click to expand...
Using a .add file for DNSSEC might be unreliable since you aren’t able to validate ntp sync before turning on DNSSEC like the firmware does. Has your time been syncing reliably in the new beta?
 
Adamm said:
I noticed some new... interesting IPTables entries.

Code: 
Chain OUTPUT (policy ACCEPT 7180 packets, 6572K bytes)
 pkts bytes target     prot opt in     out     source               destination
 4169  326K OUTPUT_DNS  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 u32 "0x0>>0x16&0x3c@0x8>>0xf&0x1=0x0"
   14  1611 OUTPUT_DNS  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x8>>0xf&0x1=0x0"
43393   20M OUTPUT_IP  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT_DNS (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|10706f697579747975696f706b6a666e6603636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0d72666a656a6e666a6e65666a6503636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|1131306166646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f376d667364666173646d6b676d726b03636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0d386d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f3966646d617361787373736171726b03636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|1265666274686d6f6975796b6d6b6a6b6a677403636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|086861636b7563647403636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|076c696e77756469056633333232036e657400|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0f6c6b6a68676664736174727975696f03636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0b6d6e627663787a7a7a313203636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|077131313133333303746f7000|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|057371353230056633333232036e657400|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|077563746b6f6e6503636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0e7a786376626d6e6e666a6a66777103636f6d00|" ALGO name bm TO 65535 ICASE
    0     0 logdrop_dns  all  --  *      *       0.0.0.0/0            0.0.0.0/0            STRING match  "|0a65756d6d6167766e627003636f6d00|" ALGO name bm TO 65535 ICASE


Chain OUTPUT_IP (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            193.201.224.0/24

Chain default_block (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain logdrop_dns (16 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 7 level 4 prefix "DROP_DNS "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop_ip (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 7 level 4 prefix "DROP_IP "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

I wonder what Asus is planning (an improvement with built-in DNS/IP blocking?), also strange why only one random IP range from Ukraine is blocked by default linked to some "DDoSMan" malware.

https://otx.alienvault.com/indicator/ip/193.201.224.0
Click to expand...
Merlin’s statement on the topic:
Iptables, routes and ip a
 
dave14305 said:
Using a .add file for DNSSEC might be unreliable since you aren’t able to validate ntp sync before turning on DNSSEC like the firmware does. Has your time been syncing reliably in the new beta?
Click to expand...
yes the time has been syncing reliably.
I might go ahead and append it with an if statement inside stubby.postconf that checks for time sync then to test your theory.
 
RMerlin said:
Asus confirmed that Adaptive QoS was working correctly, so I'll have to check to see if something failed to be properly merged on my end.
Click to expand...

FreshJR adaptive QOS working perfectly on my RT--AC86U with 384.14_beta2

QOS.JPG
 
Last edited:
kernol said:
FreshJR adaptive QOS working perfectly on my RT--AC86U with 384.14_beta2

View attachment 20061
Click to expand...
As it should. The build you have doesn't have the adaptive QOS issue. The two Test versions of the Beta2 are the ones that have the problem. So far Test builds are only available for the AX88U and the AC5300. Eric has said that further development of 384.14 isn't likely to include the QOS changes. He will have to deal with them in future builds IE: 384.15.
 
dave14305 said:
Using a .add file for DNSSEC might be unreliable since you aren’t able to validate ntp sync before turning on DNSSEC like the firmware does. Has your time been syncing reliably in the new beta?
Click to expand...

So after testing with a stubby.postconf that checks on NTP sync, still the same issue is back, No ipv6 connectivity.

*EDIT*

new find has led me to determine that it is actually the use of
Code: 
tls_min_version: GETDNS_TLS1_2
tls_cipher_list: "EECDH+AESGCM:EECDH+CHACHA20"
tls_max_version: GETDNS_TLS1_3
tls_ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
style settings
I had mine set to
tls_min_version: GETDNS_TLS1_3
also tested with other settings as well
specifying both tls_1_2 as min and
tls_1_3 as max
All possible combinations cause IPV6 connectivity to fail. You will still get your DHCP handouts for IPV6 but no internet connectivity.
 
Last edited:
Swistheater said:
So after testing with a stubby.postconf that checks on NTP sync, still the same issue is back, No ipv6 connectivity.

*EDIT*

new find has led me to determine that it is actually the use of
Code: 
tls_min_version: GETDNS_TLS1_2
tls_cipher_list: "EECDH+AESGCM:EECDH+CHACHA20"
tls_max_version: GETDNS_TLS1_3
tls_ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
style settings
I had mine set to
tls_min_version: GETDNS_TLS1_3
also tested with other settings as well
specifying both tls_1_2 as min and
tls_1_3 as max
All possible combinations cause IPV6 connectivity to fail. You will still get your DHCP handouts for IPV6 but no internet connectivity.
Click to expand...
Cloudflare in particular has given many people issues lately if they had min TLS set for 1.3. This included John’s fork users and straggling users of the original Stubby installer script.
 
Status
Not open for further replies.

Similar threads

RMerlin
  • Locked
Beta Asuswrt-Merlin 3006.102.5 Beta is now available
15 16 17
Replies
326
Views
50K
RMerlin
RMerlin
RMerlin
  • Locked
Beta Asuswrt-Merlin 3004.388.10 Beta is now available
2 3 4
Replies
67
Views
12K
RMerlin
RMerlin
RMerlin
  • Locked
Beta Asuswrt-Merlin 3006.102.4 Beta is now available
34 35 36
Replies
702
Views
80K
RMerlin
RMerlin
RMerlin
  • Locked
Beta Asuswrt-Merlin 3004.388.9 Beta is now available
4 5 6
Replies
112
Views
14K
RMerlin
RMerlin
RMerlin
Release Asuswrt-Merlin 3004.388.10 is now available
11 12 13
Replies
256
Views
25K
jksmurf
J
Similar threads
Thread starter Title Forum Replies Date
RMerlin Beta Asuswrt-Merlin 3004.388.10 Beta is now available Asuswrt-Merlin 67
RMerlin Beta Asuswrt-Merlin 3006.102.5 Beta is now available Asuswrt-Merlin 326
delikid ASUS releasing early-stage beta for VLAN - asuswrt-merlin to follow? Asuswrt-Merlin 5
A Homekit help request on Asuswrt-Merlin 3006.102.4 Beta 2 Asuswrt-Merlin 2
RMerlin Beta Asuswrt-Merlin 3006.102.4 Beta is now available Asuswrt-Merlin 702
RMerlin Beta Asuswrt-Merlin 3004.388.9 Beta is now available Asuswrt-Merlin 112
RMerlin Beta Asuswrt-Merlin 3006.102.3 beta is now available for Wifi 7 devices Asuswrt-Merlin 53
N Incorrect behavior of Asuswrt-Merlin and inability to restore stock firmware on Asus RT-AC66U B1 Asuswrt-Merlin 3
C Does minidlna get installed by default (asuswrt-merlin 3006.102.5) Asuswrt-Merlin 2
RMerlin Release Asuswrt-Merlin 3004.388.10 is now available Asuswrt-Merlin 256

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 979 (members: 18, guests: 961)
Back
Top
✖