[Release] Asuswrt-Merlin 384.17 (and 384.13_8) are now available

[antrabe]

its on asus rt ac5300, yesterday i check i were worried because i couldnt enter but at the end i got enter and back i had a backup settings i think works also with merlin so maybe reseting and installing the backup should works.

I want to mantain all the config that i have now.

 

[jass]

its on asus rt ac5300, yesterday i check i were worried because i couldnt enter but at the end i got enter and back i had a backup settings i think works also with merlin so maybe reseting and installing the backup should works.

I want to mantain all the config that i have now.

If I understand you right, you're planning to read in a backup from a different firmware?
If so I think you're asking for trouble. Asus backup files should only be used if you are going back to the same firmware you had when you did the backup, and not be read in on a different firmware. You might get lucky, but I believe it smells like trouble if you do so...

If you're having trouble, reset with initialize and manually configure your router from scratch. Or go back to your old firmware and read in your backup!

Best of luck!

 

[Alfsu]

@RMerlin: updated AC-86U to .17 from .16... reporting on the OpenVPN.
Server went up as expected after router's update, and mobile clients were able to connect without any problems. No re-boot required, 30 hours up!
Excellent work as usual, Thank you.

 

[maxbraketorque]

the reset is mandatory to do it after update, because the user pass doesnt works after i understood

The situation is that the current Merlin FW does not incorporate any ASUS FWs prior to 384.81792, so if a router that had 384.81792 or newer is flashed with Merlin 384.17, then a full reset is required before flashing.

 

[K-2SO]

The situation is that the current Merlin FW does not incorporate any ASUS FWs prior to 384.81792, so if a router that had 384.81792 or newer is flashed with Merlin 384.17, then a full reset is required before flashing.

I did it just few days back with no reset. From Asus 384_81792 to Merlin 384.17 and back to Asus 384_81792 on RT-AC86U. All settings stay intact. The only new thing I found in 384_81792 is fixed SmartConnect channels. Merlin doesn't have it and I didn't touch it. I wanted to find if new Asus stock encrypts the user pass. It doesn't.

 

[BOFH]

Hi Guys,

On my RT-AX88U (aarch64) FW-384.17, I have these errors when using "dmesg". Is something that I should worry about ?

CFG80211-ERROR) wl_cfg80211_change_station : WLC_SCB_AUTHORIZE sta_flags_mask not set
CFG80211-ERROR) wl_cfg80211_change_station : WLC_SCB_AUTHORIZE sta_flags_mask not set
CFG80211-ERROR) wl_cfg80211_change_station : WLC_SCB_AUTHORIZE sta_flags_mask not set
CFG80211-ERROR) wl_cfg80211_change_station : WLC_SCB_AUTHORIZE sta_flags_mask not set

Best regards,

 

[maxbraketorque]

Check in /jffs/.sys/ , it's often caused by the Traffic Analyzer database.

This is a rather interesting potential issue. Is there something that can be done to limit the database size? I suppose there is no way to control size, but maybe a script could run in the background that automatically deletes the database when it reaches a user defined size? It doesn't sound like a great solution, but I'd prefer it to loosing all my DHCP-based manual IP address and port forwarding assignments.

 

[RMerlin]

I wanted to find if new Asus stock encrypts the user pass. It doesn't.

It depends on the models. As noted in the changelog, the latest RT-AC88U release (and now also RT-AC3100 and RT-AC5300) will encrypt their passwords.

All AX models have already been using encrypted password since day one, so nothing changed for these.

 

[RMerlin]

This is a rather interesting potential issue. Is there something that can be done to limit the database size?

The database already has a 30 MB limit in place, as you can see there - it will periodically get trimmed down to 30 MB. The issue is that sometimes, there will also be a journal generated, and this is separate.

 

[maxbraketorque]

The database already has a 30 MB limit in place, as you can see there - it will periodically get trimmed down to 30 MB. The issue is that sometimes, there will also be a journal generated, and this is separate.

Sorry for asking, but what is a journal in this context?

 

[K-2SO]

It depends on the models.

I figured. I wanted to see if RT-AC86U pass is encrypted.

 

[RMerlin]

Sorry for asking, but what is a journal in this context?

It's a temporary file used by sqlite during database events. I guess it's possible there wasn't enough space for the journal to be created, preventing the database from getting updated.

I figured. I wanted to see if RT-AC86U pass is encrypted.

Not at this time, so I assume it will also eventually go through the same transition (assuming Asus hasn't done it already).

 

[archiel]

Dirty upgrade from 364.16 (AX88 first then AX58) couple of days ago - no issues.

Thanks

 

[hifiwifi]

There seems to be an issue with DNS-over-TLS and VPN Clients. Neither of my two clients would connect unless I turned DOT off. This has not been an issue before, and no other settings were changed. Both clients are set to "exclusive" DNS, FWIW.
EDIT--->The router itself is running two commercial VPN services. Sorry for confusion.

 

[maxbraketorque]

There seems to be an issue with DNS-over-TLS and VPN Clients. Neither of my two clients would connect unless I turned DOT off. This has not been an issue before, and no other settings were changed. Both clients are set to "exclusive" DNS, FWIW.

Do you mean an ASUS router as a VPN client, or do you mean a VPN client on a computer on the ASUS router network?

 

[goRt]

I'm happy to report that for the first time in many releases my USB modem (E3372) now recovers from a reboot without the need for the router (AC86U) to be power cycled.

Thanks

 

[hifiwifi]

Do you mean an ASUS router as a VPN client, or do you mean a VPN client on a computer on the ASUS router network?

Asus router as a client. I have two separate commercial VPN services running on the router. Apologies for the confusion.

 

[pinkgrae]

Dirty upgrade from .16 to .17 on both RT-AC86U and RT-AC68U, both working great after >3 days - thanks RMerlin!

 

[Martineau]

There seems to be an issue with DNS-over-TLS and VPN Clients. Neither of my two clients would connect unless I turned DOT off. This has not been an issue before, and no other settings were changed. Both clients are set to "exclusive" DNS, FWIW.
EDIT--->The router itself is running two commercial VPN services. Sorry for confusion.

Review the VPN ISP's DNS servers, and which VPN Clients are currently designated to use them...

echo;iptables --line -t nat -nvL PREROUTING;echo;echo;iptables --line -t nat -nvL DNSVPN1  2>/dev/null;iptables --line -t nat -nvL DNSVPN2 2>/dev/null;iptables --line -t nat -nvL DNSVPN3  2>/dev/null;iptables --line -t nat -nvL DNSVPN4 2>/dev/null;iptables --line -t nat -nvL DNSVPN5 2>/dev/null;iptables --line -t nat -nvL DNSPPP5 2>/dev/null

Have the DNS server IPs recently changed?......I found that HMA's 'Exclusive=YES' DNS suddenly stopped working and they advised overriding them with OpenDNS servers.

You can obfuscate your VPN Clients' DNS requests from your WAN ISP, VPN ISP and pre-empt MITM snooping if you retain WAN DoT and disable VPN Client 'Exclusive=YES'

 

[maghuro]

Feature suggestion: is it possible to give the possibility to export the actual configuration of each openvpn CLIENT in a .ovpn client?

And also I don't know if that's possible, but if it was possibly to export also on the same file the policy rules it would be perfect.